334 files changed, 2198 insertions, 1242 deletions
diff --git a/Documentation/bpf/bpf_devel_QA.txt b/Documentation/bpf/bpf_devel_QA.txt
index 1a0b704e1a38..da57601153a0 100644
--- a/Documentation/bpf/bpf_devel_QA.txt
+++ b/Documentation/bpf/bpf_devel_QA.txt
@@ -557,6 +557,14 @@ A: Although LLVM IR generation and optimization try to stay architecture
       pulls in some header files containing file scope host assembly codes.
     - You can add "-fno-jump-tables" to work around the switch table issue.
-   Otherwise, you can use bpf target.
+   Otherwise, you can use bpf target. Additionally, you _must_ use bpf target
+   when:
+     - Your program uses data structures with pointer or long / unsigned long
+       types that interface with BPF helpers or context data structures. Access
+       into these structures is verified by the BPF verifier and may result
+       in verification failures if the native architecture is not aligned with
+       the BPF architecture, e.g. 64-bit. An example of this is
+       BPF_PROG_TYPE_SK_MSG require '-target bpf'
 Happy BPF hacking!
diff --git a/Documentation/devicetree/bindings/input/atmel,maxtouch.txt b/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
index 23e3abc3fdef..c88919480d37 100644
--- a/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
+++ b/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
@@ -4,6 +4,13 @@ Required properties:
 - compatible:
    atmel,maxtouch
+    The following compatibles have been used in various products but are
+    deprecated:
+        atmel,qt602240_ts
+        atmel,atmel_mxt_ts
+        atmel,atmel_mxt_tp
+        atmel,mXT224
 - reg: The I2C address of the device
 - interrupts: The sink for the touchpad's IRQ output
diff --git a/Documentation/doc-guide/parse-headers.rst b/Documentation/doc-guide/parse-headers.rst
index 96a0423d5dba..82a3e43b6864 100644
--- a/Documentation/doc-guide/parse-headers.rst
+++ b/Documentation/doc-guide/parse-headers.rst
@@ -177,14 +177,14 @@ BUGS
 ****
-Report bugs to Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Report bugs to Mauro Carvalho Chehab <mchehab@kernel.org>
 COPYRIGHT
 *********
-Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab@s-opensource.com>.
+Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab+samsung@kernel.org>.
 License GPLv2: GNU GPL version 2 <http://gnu.org/licenses/gpl.html>.
diff --git a/Documentation/media/uapi/rc/keytable.c.rst b/Documentation/media/uapi/rc/keytable.c.rst
index e6ce1e3f5a78..217237f93b37 100644
--- a/Documentation/media/uapi/rc/keytable.c.rst
+++ b/Documentation/media/uapi/rc/keytable.c.rst
@@ -7,7 +7,7 @@ file: uapi/v4l/keytable.c
    /* keytable.c - This program allows checking/replacing keys at IR
-       Copyright (C) 2006-2009 Mauro Carvalho Chehab <mchehab@infradead.org>
+       Copyright (C) 2006-2009 Mauro Carvalho Chehab <mchehab@kernel.org>
       This program is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published by
diff --git a/Documentation/media/uapi/v4l/v4l2grab.c.rst b/Documentation/media/uapi/v4l/v4l2grab.c.rst
index 5aabd0b7b089..f0d0ab6abd41 100644
--- a/Documentation/media/uapi/v4l/v4l2grab.c.rst
+++ b/Documentation/media/uapi/v4l/v4l2grab.c.rst
@@ -6,7 +6,7 @@ file: media/v4l/v4l2grab.c
 .. code-block:: c
    /* V4L2 video picture grabber
-       Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@infradead.org>
+       Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@kernel.org>
       This program is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published by
diff --git a/Documentation/sphinx/parse-headers.pl b/Documentation/sphinx/parse-headers.pl
index a958d8b5e99d..d410f47567e9 100755
--- a/Documentation/sphinx/parse-headers.pl
+++ b/Documentation/sphinx/parse-headers.pl
@@ -387,11 +387,11 @@ tree for more details.
 =head1 BUGS
-Report bugs to Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Report bugs to Mauro Carvalho Chehab <mchehab@kernel.org>
 =head1 COPYRIGHT
-Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab@s-opensource.com>.
+Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab+samsung@kernel.org>.
 License GPLv2: GNU GPL version 2 <http://gnu.org/licenses/gpl.html>.
diff --git a/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt b/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt
index 698660b7f21f..c77c0f060864 100644
--- a/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt
+++ b/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt
@@ -6,7 +6,7 @@ communicating in English you can also ask the Chinese maintainer for
 help.  Contact the Chinese maintainer if this translation is outdated
 or if there is a problem with the translation.
-Maintainer: Mauro Carvalho Chehab <mchehab@infradead.org>
+Maintainer: Mauro Carvalho Chehab <mchehab@kernel.org>
 Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
 ---------------------------------------------------------------------
 Documentation/video4linux/v4l2-framework.txt 的中文翻译
@@ -14,7 +14,7 @@ Documentation/video4linux/v4l2-framework.txt 的中文翻译
 如果想评论或更新本文的内容，请直接联系原文档的维护者。如果你使用英文
 交流有困难的话，也可以向中文版维护者求助。如果本翻译更新不及时或者翻
 译存在问题，请联系中文版维护者。
-英文版维护者： Mauro Carvalho Chehab <mchehab@infradead.org>
+英文版维护者： Mauro Carvalho Chehab <mchehab@kernel.org>
 中文版维护者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
 中文版翻译者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
 中文版校译者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index 79bb02ff812f..df6e9bb2559a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2554,7 +2554,6 @@ F:	Documentation/devicetree/bindings/sound/axentia,*
 F:      sound/soc/atmel/tse850-pcm5142.c
 AZ6007 DVB DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -3083,7 +3082,6 @@ F:	include/linux/btrfs*
 F:      include/uapi/linux/btrfs*
 BTTV VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -3812,7 +3810,6 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/cx24120*
 CX88 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -5053,7 +5050,6 @@ F:	drivers/edac/thunderx_edac*
 EDAC-CORE
 M:      Borislav Petkov <bp@alien8.de>
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git for-next
@@ -5082,7 +5078,6 @@ S:	Maintained
 F:      drivers/edac/fsl_ddr_edac.*
 EDAC-GHES
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
@@ -5099,21 +5094,18 @@ S:	Maintained
 F:      drivers/edac/i5000_edac.c
 EDAC-I5400
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i5400_edac.c
 EDAC-I7300
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i7300_edac.c
 EDAC-I7CORE
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
@@ -5163,7 +5155,6 @@ S:	Maintained
 F:      drivers/edac/r82600_edac.c
 EDAC-SBRIDGE
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
@@ -5222,7 +5213,6 @@ S:	Maintained
 F:      drivers/net/ethernet/ibm/ehea/
 EM28XX VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -7677,9 +7667,11 @@ L:	linux-kbuild@vger.kernel.org
 S:      Maintained
 F:      Documentation/kbuild/
 F:      Makefile
-F:      scripts/Makefile.*
+F:      scripts/Kbuild*
+F:      scripts/Makefile*
 F:      scripts/basic/
 F:      scripts/mk*
+F:      scripts/mod/
 F:      scripts/package/
 KERNEL JANITORS
@@ -8871,7 +8863,6 @@ F:	Documentation/devicetree/bindings/media/nvidia,tegra-vde.txt
 F:      drivers/staging/media/tegra-vde/
 MEDIA INPUT INFRASTRUCTURE (V4L/DVB)
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 P:      LinuxTV.org Project
 L:      linux-media@vger.kernel.org
@@ -9725,6 +9716,7 @@ W:	https://fedorahosted.org/dropwatch/
 F:      net/core/drop_monitor.c
 NETWORKING DRIVERS
+M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
@@ -12259,7 +12251,6 @@ S:	Odd Fixes
 F:      drivers/media/i2c/saa6588*
 SAA7134 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -12498,6 +12489,7 @@ F:	drivers/scsi/st_*.h
 SCTP PROTOCOL
 M:      Vlad Yasevich <vyasevich@gmail.com>
 M:      Neil Horman <nhorman@tuxdriver.com>
+M:      Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
 S:      Maintained
@@ -12763,7 +12755,6 @@ S:	Maintained
 F:      drivers/media/radio/si4713/radio-usb-si4713.c
 SIANO DVB DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -13754,7 +13745,6 @@ S:	Maintained
 F:      drivers/media/i2c/tda9840*
 TEA5761 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -13763,7 +13753,6 @@ S:	Odd fixes
 F:      drivers/media/tuners/tea5761.*
 TEA5767 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -13853,7 +13842,6 @@ S:	Supported
 F:      drivers/iommu/tegra*
 TEGRA KBC DRIVER
-M:      Rakesh Iyer <riyer@nvidia.com>
 M:      Laxman Dewangan <ldewangan@nvidia.com>
 S:      Supported
 F:      drivers/input/keyboard/tegra-kbc.c
@@ -14180,7 +14168,6 @@ F:	Documentation/networking/tlan.txt
 F:      drivers/net/ethernet/ti/tlan.*
 TM6000 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -15407,7 +15394,6 @@ S:	Maintained
 F:      arch/x86/entry/vdso/
 XC2028/3028 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
diff --git a/Makefile b/Makefile
index 619a85ad716b..d0d2652db174 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,8 @@
 VERSION = 4
 PATCHLEVEL = 17
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
-NAME = Fearless Coyote
+NAME = Merciless Moray
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 23b33e8ea03a..1dab3a984608 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -333,7 +333,7 @@ static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu)
        } else {
                u64 sctlr = vcpu_read_sys_reg(vcpu, SCTLR_EL1);
                sctlr |= (1 << 25);
-                vcpu_write_sys_reg(vcpu, SCTLR_EL1, sctlr);
+                vcpu_write_sys_reg(vcpu, sctlr, SCTLR_EL1);
        }
 }
diff --git a/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c b/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c
index 86801b6055d6..39be799d0417 100644
--- a/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c
+++ b/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c
@@ -18,11 +18,20 @@
 #include <linux/compiler.h>
 #include <linux/irqchip/arm-gic.h>
 #include <linux/kvm_host.h>
+#include <linux/swab.h>
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_hyp.h>
 #include <asm/kvm_mmu.h>
+static bool __hyp_text __is_be(struct kvm_vcpu *vcpu)
+{
+        if (vcpu_mode_is_32bit(vcpu))
+                return !!(read_sysreg_el2(spsr) & COMPAT_PSR_E_BIT);
+        return !!(read_sysreg(SCTLR_EL1) & SCTLR_ELx_EE);
+}
 /*
 * __vgic_v2_perform_cpuif_access -- perform a GICV access on behalf of the
 *                                   guest.
@@ -64,14 +73,19 @@ int __hyp_text __vgic_v2_perform_cpuif_access(struct kvm_vcpu *vcpu)
        addr += fault_ipa - vgic->vgic_cpu_base;
        if (kvm_vcpu_dabt_iswrite(vcpu)) {
-                u32 data = vcpu_data_guest_to_host(vcpu,
+                u32 data = vcpu_get_reg(vcpu, rd);
-                                                   vcpu_get_reg(vcpu, rd),
+                if (__is_be(vcpu)) {
-                                                   sizeof(u32));
+                        /* guest pre-swabbed data, undo this for writel() */
+                        data = swab32(data);
+                }
                writel_relaxed(data, addr);
        } else {
                u32 data = readl_relaxed(addr);
-                vcpu_set_reg(vcpu, rd, vcpu_data_host_to_guest(vcpu, data,
+                if (__is_be(vcpu)) {
-                                                               sizeof(u32)));
+                        /* guest expects swabbed data */
+                        data = swab32(data);
+                }
+                vcpu_set_reg(vcpu, rd, data);
        }
        return 1;
diff --git a/arch/hexagon/include/asm/io.h b/arch/hexagon/include/asm/io.h
index 9e8621d94ee9..e17262ad125e 100644
--- a/arch/hexagon/include/asm/io.h
+++ b/arch/hexagon/include/asm/io.h
@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
        memcpy((void *) dst, src, count);
 }
+static inline void memset_io(volatile void __iomem *addr, int value,
+                             size_t size)
+{
+        memset((void __force *)addr, value, size);
+}
 #define PCI_IO_ADDR     (volatile void __iomem *)
 /*
diff --git a/arch/hexagon/lib/checksum.c b/arch/hexagon/lib/checksum.c
index 617506d1a559..7cd0a2259269 100644
--- a/arch/hexagon/lib/checksum.c
+++ b/arch/hexagon/lib/checksum.c
@@ -199,3 +199,4 @@ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum)
        memcpy(dst, src, len);
        return csum_partial(dst, len, sum);
 }
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index e2364ff59180..34ac503e28ad 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -123,6 +123,9 @@ INSTALL_TARGETS = zinstall install
 PHONY += bzImage $(BOOT_TARGETS) $(INSTALL_TARGETS)
+# Default kernel to build
+all: bzImage
 zImage: vmlinuz
 Image: vmlinux
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index 3b8507f71050..ee5a78a151a6 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -448,7 +448,8 @@ static int match_by_id(struct device * dev, void * data)
 * Checks all the children of @parent for a matching @id.  If none
 * found, it allocates a new device and returns it.
 */
-static struct parisc_device * alloc_tree_node(struct device *parent, char id)
+static struct parisc_device * __init alloc_tree_node(
+                        struct device *parent, char id)
 {
        struct match_id_data d = {
                .id = id,
@@ -825,8 +826,8 @@ static void walk_lower_bus(struct parisc_device *dev)
 * devices which are not physically connected (such as extra serial &
 * keyboard ports).  This problem is not yet solved.
 */
-static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high,
+static void __init walk_native_bus(unsigned long io_io_low,
-                            struct device *parent)
+        unsigned long io_io_high, struct device *parent)
 {
        int i, devices_found = 0;
        unsigned long hpa = io_io_low;
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index 13ee3569959a..ae684ac6efb6 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -174,7 +174,7 @@ void pcibios_set_master(struct pci_dev *dev)
 * pcibios_init_bridge() initializes cache line and default latency
 * for pci controllers and pci-pci bridges
 */
-void __init pcibios_init_bridge(struct pci_dev *dev)
+void __ref pcibios_init_bridge(struct pci_dev *dev)
 {
        unsigned short bridge_ctl, bridge_ctl_new;
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index c3830400ca28..a1e772f909cb 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -205,7 +205,7 @@ static int __init rtc_init(void)
 device_initcall(rtc_init);
 #endif
-void read_persistent_clock(struct timespec *ts)
+void read_persistent_clock64(struct timespec64 *ts)
 {
        static struct pdc_tod tod_data;
        if (pdc_tod_read(&tod_data) == 0) {
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 68e671a11987..71d31274d782 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -837,6 +837,17 @@ void __init initialize_ivt(const void *iva)
        if (pdc_instr(&instr) == PDC_OK)
                ivap[0] = instr;
+        /*
+         * Rules for the checksum of the HPMC handler:
+         * 1. The IVA does not point to PDC/PDH space (ie: the OS has installed
+         *    its own IVA).
+         * 2. The word at IVA + 32 is nonzero.
+         * 3. If Length (IVA + 60) is not zero, then Length (IVA + 60) and
+         *    Address (IVA + 56) are word-aligned.
+         * 4. The checksum of the 8 words starting at IVA + 32 plus the sum of
+         *    the Length/4 words starting at Address is zero.
+         */
        /* Compute Checksum for HPMC handler */
        length = os_hpmc_size;
        ivap[7] = length;
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index cab32ee824d2..2607d2d33405 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -516,7 +516,7 @@ static void __init map_pages(unsigned long start_vaddr,
        }
 }
-void free_initmem(void)
+void __ref free_initmem(void)
 {
        unsigned long init_begin = (unsigned long)__init_begin;
        unsigned long init_end = (unsigned long)__init_end;
diff --git a/arch/sparc/include/uapi/asm/oradax.h b/arch/sparc/include/uapi/asm/oradax.h
index 722951908b0a..4f6676fe4bcc 100644
--- a/arch/sparc/include/uapi/asm/oradax.h
+++ b/arch/sparc/include/uapi/asm/oradax.h
@@ -3,7 +3,7 @@
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
+ * the Free Software Foundation, either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index 1a0fa10cb6b7..32bae68e34c1 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -403,7 +403,7 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
        if (err) {
                printk(KERN_ERR "VIO: Could not register device %s, err=%d\n",
                       dev_name(&vdev->dev), err);
-                kfree(vdev);
+                put_device(&vdev->dev);
                return NULL;
        }
        if (vdev->dp)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 8a5b185735e1..ce243f7d2d4e 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -848,6 +848,11 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                c->x86_power = edx;
        }
+        if (c->extended_cpuid_level >= 0x80000008) {
+                cpuid(0x80000008, &eax, &ebx, &ecx, &edx);
+                c->x86_capability[CPUID_8000_0008_EBX] = ebx;
+        }
        if (c->extended_cpuid_level >= 0x8000000a)
                c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a);
@@ -871,7 +876,6 @@ static void get_cpu_address_sizes(struct cpuinfo_x86 *c)
                c->x86_virt_bits = (eax >> 8) & 0xff;
                c->x86_phys_bits = eax & 0xff;
-                c->x86_capability[CPUID_8000_0008_EBX] = ebx;
        }
 #ifdef CONFIG_X86_32
        else if (cpu_has(c, X86_FEATURE_PAE) || cpu_has(c, X86_FEATURE_PSE36))
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 91e6da48cbb6..74392d9d51e0 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1067,6 +1067,7 @@ static struct clocksource clocksource_tsc_early = {
        .resume                 = tsc_resume,
        .mark_unstable          = tsc_cs_mark_unstable,
        .tick_stable            = tsc_cs_tick_stable,
+        .list                   = LIST_HEAD_INIT(clocksource_tsc_early.list),
 };
 /*
@@ -1086,6 +1087,7 @@ static struct clocksource clocksource_tsc = {
        .resume                 = tsc_resume,
        .mark_unstable          = tsc_cs_mark_unstable,
        .tick_stable            = tsc_cs_tick_stable,
+        .list                   = LIST_HEAD_INIT(clocksource_tsc.list),
 };
 void mark_tsc_unstable(char *reason)
@@ -1098,13 +1100,9 @@ void mark_tsc_unstable(char *reason)
                clear_sched_clock_stable();
        disable_sched_clock_irqtime();
        pr_info("Marking TSC unstable due to %s\n", reason);
-        /* Change only the rating, when not registered */
-        if (clocksource_tsc.mult) {
+        clocksource_mark_unstable(&clocksource_tsc_early);
-                clocksource_mark_unstable(&clocksource_tsc);
+        clocksource_mark_unstable(&clocksource_tsc);
-        } else {
-                clocksource_tsc.flags |= CLOCK_SOURCE_UNSTABLE;
-                clocksource_tsc.rating = 0;
-        }
 }
 EXPORT_SYMBOL_GPL(mark_tsc_unstable);
@@ -1244,7 +1242,7 @@ static void tsc_refine_calibration_work(struct work_struct *work)
        /* Don't bother refining TSC on unstable systems */
        if (tsc_unstable)
-                return;
+                goto unreg;
        /*
         * Since the work is started early in boot, we may be
@@ -1297,11 +1295,12 @@ static void tsc_refine_calibration_work(struct work_struct *work)
 out:
        if (tsc_unstable)
-                return;
+                goto unreg;
        if (boot_cpu_has(X86_FEATURE_ART))
                art_related_clocksource = &clocksource_tsc;
        clocksource_register_khz(&clocksource_tsc, tsc_khz);
+unreg:
        clocksource_unregister(&clocksource_tsc_early);
 }
@@ -1311,8 +1310,8 @@ static int __init init_tsc_clocksource(void)
        if (!boot_cpu_has(X86_FEATURE_TSC) || tsc_disabled > 0 || !tsc_khz)
                return 0;
-        if (check_tsc_unstable())
+        if (tsc_unstable)
-                return 0;
+                goto unreg;
        if (tsc_clocksource_reliable)
                clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY;
@@ -1328,6 +1327,7 @@ static int __init init_tsc_clocksource(void)
                if (boot_cpu_has(X86_FEATURE_ART))
                        art_related_clocksource = &clocksource_tsc;
                clocksource_register_khz(&clocksource_tsc, tsc_khz);
+unreg:
                clocksource_unregister(&clocksource_tsc_early);
                return 0;
        }
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 70dcb5548022..b74c9c1405b9 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1463,23 +1463,6 @@ static void start_sw_tscdeadline(struct kvm_lapic *apic)
        local_irq_restore(flags);
 }
-static void start_sw_period(struct kvm_lapic *apic)
-{
-        if (!apic->lapic_timer.period)
-                return;
-        if (apic_lvtt_oneshot(apic) &&
-            ktime_after(ktime_get(),
-                        apic->lapic_timer.target_expiration)) {
-                apic_timer_expired(apic);
-                return;
-        }
-        hrtimer_start(&apic->lapic_timer.timer,
-                apic->lapic_timer.target_expiration,
-                HRTIMER_MODE_ABS_PINNED);
-}
 static void update_target_expiration(struct kvm_lapic *apic, uint32_t old_divisor)
 {
        ktime_t now, remaining;
@@ -1546,6 +1529,26 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic)
                                apic->lapic_timer.period);
 }
+static void start_sw_period(struct kvm_lapic *apic)
+{
+        if (!apic->lapic_timer.period)
+                return;
+        if (ktime_after(ktime_get(),
+                        apic->lapic_timer.target_expiration)) {
+                apic_timer_expired(apic);
+                if (apic_lvtt_oneshot(apic))
+                        return;
+                advance_periodic_target_expiration(apic);
+        }
+        hrtimer_start(&apic->lapic_timer.timer,
+                apic->lapic_timer.target_expiration,
+                HRTIMER_MODE_ABS_PINNED);
+}
 bool kvm_lapic_hv_timer_in_use(struct kvm_vcpu *vcpu)
 {
        if (!lapic_in_kernel(vcpu))
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index b725154182cc..263c8453815e 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1027,7 +1027,17 @@ emit_cond_jmp:		/* convert BPF opcode to x86 */
                        break;
                case BPF_JMP | BPF_JA:
-                        jmp_offset = addrs[i + insn->off] - addrs[i];
+                        if (insn->off == -1)
+                                /* -1 jmp instructions will always jump
+                                 * backwards two bytes. Explicitly handling
+                                 * this case avoids wasting too many passes
+                                 * when there are long sequences of replaced
+                                 * dead code.
+                                 */
+                                jmp_offset = -2;
+                        else
+                                jmp_offset = addrs[i + insn->off] - addrs[i];
                        if (!jmp_offset)
                                /* optimize out nop jumps */
                                break;
@@ -1226,6 +1236,7 @@ skip_init_addrs:
        for (pass = 0; pass < 20 || image; pass++) {
                proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
                if (proglen <= 0) {
+out_image:
                        image = NULL;
                        if (header)
                                bpf_jit_binary_free(header);
@@ -1236,8 +1247,7 @@ skip_init_addrs:
                        if (proglen != oldproglen) {
                                pr_err("bpf_jit: proglen=%d != oldproglen=%d\n",
                                       proglen, oldproglen);
-                                prog = orig_prog;
+                                goto out_image;
-                                goto out_addrs;
                        }
                        break;
                }
@@ -1273,7 +1283,7 @@ skip_init_addrs:
                prog = orig_prog;
        }
-        if (!prog->is_func || extra_pass) {
+        if (!image || !prog->is_func || extra_pass) {
 out_addrs:
                kfree(addrs);
                kfree(jit_data);
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index c36d23aa6c35..357969a3697c 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -421,45 +421,33 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
 {
        unsigned long va = dtr->address;
        unsigned int size = dtr->size + 1;
-        unsigned pages = DIV_ROUND_UP(size, PAGE_SIZE);
+        unsigned long pfn, mfn;
-        unsigned long frames[pages];
+        int level;
-        int f;
+        pte_t *ptep;
+        void *virt;
-        /*
-         * A GDT can be up to 64k in size, which corresponds to 8192
-         * 8-byte entries, or 16 4k pages..
-         */
-        BUG_ON(size > 65536);
+        /* @size should be at most GDT_SIZE which is smaller than PAGE_SIZE. */
+        BUG_ON(size > PAGE_SIZE);
        BUG_ON(va & ~PAGE_MASK);
-        for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
+        /*
-                int level;
+         * The GDT is per-cpu and is in the percpu data area.
-                pte_t *ptep;
+         * That can be virtually mapped, so we need to do a
-                unsigned long pfn, mfn;
+         * page-walk to get the underlying MFN for the
-                void *virt;
+         * hypercall.  The page can also be in the kernel's
+         * linear range, so we need to RO that mapping too.
-                /*
+         */
-                 * The GDT is per-cpu and is in the percpu data area.
+        ptep = lookup_address(va, &level);
-                 * That can be virtually mapped, so we need to do a
+        BUG_ON(ptep == NULL);
-                 * page-walk to get the underlying MFN for the
-                 * hypercall.  The page can also be in the kernel's
-                 * linear range, so we need to RO that mapping too.
-                 */
-                ptep = lookup_address(va, &level);
-                BUG_ON(ptep == NULL);
-                pfn = pte_pfn(*ptep);
-                mfn = pfn_to_mfn(pfn);
-                virt = __va(PFN_PHYS(pfn));
-                frames[f] = mfn;
+        pfn = pte_pfn(*ptep);
+        mfn = pfn_to_mfn(pfn);
+        virt = __va(PFN_PHYS(pfn));
-                make_lowmem_page_readonly((void *)va);
+        make_lowmem_page_readonly((void *)va);
-                make_lowmem_page_readonly(virt);
+        make_lowmem_page_readonly(virt);
-        }
-        if (HYPERVISOR_set_gdt(frames, size / sizeof(struct desc_struct)))
+        if (HYPERVISOR_set_gdt(&mfn, size / sizeof(struct desc_struct)))
                BUG();
 }
@@ -470,34 +458,22 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
 {
        unsigned long va = dtr->address;
        unsigned int size = dtr->size + 1;
-        unsigned pages = DIV_ROUND_UP(size, PAGE_SIZE);
+        unsigned long pfn, mfn;
-        unsigned long frames[pages];
+        pte_t pte;
-        int f;
-        /*
-         * A GDT can be up to 64k in size, which corresponds to 8192
-         * 8-byte entries, or 16 4k pages..
-         */
-        BUG_ON(size > 65536);
+        /* @size should be at most GDT_SIZE which is smaller than PAGE_SIZE. */
+        BUG_ON(size > PAGE_SIZE);
        BUG_ON(va & ~PAGE_MASK);
-        for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
+        pfn = virt_to_pfn(va);
-                pte_t pte;
+        mfn = pfn_to_mfn(pfn);
-                unsigned long pfn, mfn;
-                pfn = virt_to_pfn(va);
+        pte = pfn_pte(pfn, PAGE_KERNEL_RO);
-                mfn = pfn_to_mfn(pfn);
-                pte = pfn_pte(pfn, PAGE_KERNEL_RO);
+        if (HYPERVISOR_update_va_mapping((unsigned long)va, pte, 0))
+                BUG();
-                if (HYPERVISOR_update_va_mapping((unsigned long)va, pte, 0))
-                        BUG();
-                frames[f] = mfn;
-        }
-        if (HYPERVISOR_set_gdt(frames, size / sizeof(struct desc_struct)))
+        if (HYPERVISOR_set_gdt(&mfn, size / sizeof(struct desc_struct)))
                BUG();
 }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index c3621453ad87..9ce9cac16c3f 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -95,18 +95,15 @@ static void blk_mq_check_inflight(struct blk_mq_hw_ctx *hctx,
 {
        struct mq_inflight *mi = priv;
-        if (blk_mq_rq_state(rq) == MQ_RQ_IN_FLIGHT) {
+        /*
-                /*
+         * index[0] counts the specific partition that was asked for. index[1]
-                 * index[0] counts the specific partition that was asked
+         * counts the ones that are active on the whole device, so increment
-                 * for. index[1] counts the ones that are active on the
+         * that if mi->part is indeed a partition, and not a whole device.
-                 * whole device, so increment that if mi->part is indeed
+         */
-                 * a partition, and not a whole device.
+        if (rq->part == mi->part)
-                 */
+                mi->inflight[0]++;
-                if (rq->part == mi->part)
+        if (mi->part->partno)
-                        mi->inflight[0]++;
+                mi->inflight[1]++;
-                if (mi->part->partno)
-                        mi->inflight[1]++;
-        }
 }
 void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part,
@@ -118,6 +115,25 @@ void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part,
        blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight, &mi);
 }
+static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx,
+                                     struct request *rq, void *priv,
+                                     bool reserved)
+{
+        struct mq_inflight *mi = priv;
+        if (rq->part == mi->part)
+                mi->inflight[rq_data_dir(rq)]++;
+}
+void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                         unsigned int inflight[2])
+{
+        struct mq_inflight mi = { .part = part, .inflight = inflight, };
+        inflight[0] = inflight[1] = 0;
+        blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight_rw, &mi);
+}
 void blk_freeze_queue_start(struct request_queue *q)
 {
        int freeze_depth;
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 89b5cd3a6c70..e1bb420dc5d6 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -188,7 +188,9 @@ static inline bool blk_mq_hw_queue_mapped(struct blk_mq_hw_ctx *hctx)
 }
 void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part,
-                        unsigned int inflight[2]);
+                      unsigned int inflight[2]);
+void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                         unsigned int inflight[2]);
 static inline void blk_mq_put_dispatch_budget(struct blk_mq_hw_ctx *hctx)
 {
diff --git a/block/genhd.c b/block/genhd.c
index dc7e089373b9..c4513fe1adda 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -82,6 +82,18 @@ void part_in_flight(struct request_queue *q, struct hd_struct *part,
        }
 }
+void part_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                       unsigned int inflight[2])
+{
+        if (q->mq_ops) {
+                blk_mq_in_flight_rw(q, part, inflight);
+                return;
+        }
+        inflight[0] = atomic_read(&part->in_flight[0]);
+        inflight[1] = atomic_read(&part->in_flight[1]);
+}
 struct hd_struct *__disk_get_part(struct gendisk *disk, int partno)
 {
        struct disk_part_tbl *ptbl = rcu_dereference(disk->part_tbl);
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 08dabcd8b6ae..db57cced9b98 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -145,13 +145,15 @@ ssize_t part_stat_show(struct device *dev,
                jiffies_to_msecs(part_stat_read(p, time_in_queue)));
 }
-ssize_t part_inflight_show(struct device *dev,
+ssize_t part_inflight_show(struct device *dev, struct device_attribute *attr,
-                        struct device_attribute *attr, char *buf)
+                           char *buf)
 {
        struct hd_struct *p = dev_to_part(dev);
+        struct request_queue *q = part_to_disk(p)->queue;
+        unsigned int inflight[2];
-        return sprintf(buf, "%8u %8u\n", atomic_read(&p->in_flight[0]),
+        part_in_flight_rw(q, p, inflight);
-                atomic_read(&p->in_flight[1]));
+        return sprintf(buf, "%8u %8u\n", inflight[0], inflight[1]);
 }
 #ifdef CONFIG_FAIL_MAKE_REQUEST
diff --git a/drivers/clk/clk-cs2000-cp.c b/drivers/clk/clk-cs2000-cp.c
index c58019750b7e..a2f8c42e527a 100644
--- a/drivers/clk/clk-cs2000-cp.c
+++ b/drivers/clk/clk-cs2000-cp.c
@@ -541,7 +541,7 @@ probe_err:
        return ret;
 }
-static int cs2000_resume(struct device *dev)
+static int __maybe_unused cs2000_resume(struct device *dev)
 {
        struct cs2000_priv *priv = dev_get_drvdata(dev);
diff --git a/drivers/clk/clk-mux.c b/drivers/clk/clk-mux.c
index ac4a042f8658..1628b93655ed 100644
--- a/drivers/clk/clk-mux.c
+++ b/drivers/clk/clk-mux.c
@@ -112,10 +112,18 @@ static int clk_mux_set_parent(struct clk_hw *hw, u8 index)
        return 0;
 }
+static int clk_mux_determine_rate(struct clk_hw *hw,
+                                  struct clk_rate_request *req)
+{
+        struct clk_mux *mux = to_clk_mux(hw);
+        return clk_mux_determine_rate_flags(hw, req, mux->flags);
+}
 const struct clk_ops clk_mux_ops = {
        .get_parent = clk_mux_get_parent,
        .set_parent = clk_mux_set_parent,
-        .determine_rate = __clk_mux_determine_rate,
+        .determine_rate = clk_mux_determine_rate,
 };
 EXPORT_SYMBOL_GPL(clk_mux_ops);
diff --git a/drivers/clk/clk-stm32mp1.c b/drivers/clk/clk-stm32mp1.c
index f1d5967b4b39..edd3cf451401 100644
--- a/drivers/clk/clk-stm32mp1.c
+++ b/drivers/clk/clk-stm32mp1.c
@@ -216,7 +216,7 @@ static const char * const usart1_src[] = {
        "pclk5", "pll3_q", "ck_hsi", "ck_csi", "pll4_q", "ck_hse"
 };
-const char * const usart234578_src[] = {
+static const char * const usart234578_src[] = {
        "pclk1", "pll4_q", "ck_hsi", "ck_csi", "ck_hse"
 };
@@ -224,10 +224,6 @@ static const char * const usart6_src[] = {
        "pclk2", "pll4_q", "ck_hsi", "ck_csi", "ck_hse"
 };
-static const char * const dfsdm_src[] = {
-        "pclk2", "ck_mcu"
-};
 static const char * const fdcan_src[] = {
        "ck_hse", "pll3_q", "pll4_q"
 };
@@ -316,10 +312,8 @@ struct stm32_clk_mgate {
 struct clock_config {
        u32 id;
        const char *name;
-        union {
+        const char *parent_name;
-                const char *parent_name;
+        const char * const *parent_names;
-                const char * const *parent_names;
-        };
        int num_parents;
        unsigned long flags;
        void *cfg;
@@ -469,7 +463,7 @@ static void mp1_gate_clk_disable(struct clk_hw *hw)
        }
 }
-const struct clk_ops mp1_gate_clk_ops = {
+static const struct clk_ops mp1_gate_clk_ops = {
        .enable         = mp1_gate_clk_enable,
        .disable        = mp1_gate_clk_disable,
        .is_enabled     = clk_gate_is_enabled,
@@ -698,7 +692,7 @@ static void mp1_mgate_clk_disable(struct clk_hw *hw)
                mp1_gate_clk_disable(hw);
 }
-const struct clk_ops mp1_mgate_clk_ops = {
+static const struct clk_ops mp1_mgate_clk_ops = {
        .enable         = mp1_mgate_clk_enable,
        .disable        = mp1_mgate_clk_disable,
        .is_enabled     = clk_gate_is_enabled,
@@ -732,7 +726,7 @@ static int clk_mmux_set_parent(struct clk_hw *hw, u8 index)
        return 0;
 }
-const struct clk_ops clk_mmux_ops = {
+static const struct clk_ops clk_mmux_ops = {
        .get_parent     = clk_mmux_get_parent,
        .set_parent     = clk_mmux_set_parent,
        .determine_rate = __clk_mux_determine_rate,
@@ -1048,10 +1042,10 @@ struct stm32_pll_cfg {
        u32 offset;
 };
-struct clk_hw *_clk_register_pll(struct device *dev,
+static struct clk_hw *_clk_register_pll(struct device *dev,
-                                 struct clk_hw_onecell_data *clk_data,
+                                        struct clk_hw_onecell_data *clk_data,
-                                 void __iomem *base, spinlock_t *lock,
+                                        void __iomem *base, spinlock_t *lock,
-                                 const struct clock_config *cfg)
+                                        const struct clock_config *cfg)
 {
        struct stm32_pll_cfg *stm_pll_cfg = cfg->cfg;
@@ -1405,7 +1399,8 @@ enum {
        G_USBH,
        G_ETHSTP,
        G_RTCAPB,
-        G_TZC,
+        G_TZC1,
+        G_TZC2,
        G_TZPC,
        G_IWDG1,
        G_BSEC,
@@ -1417,7 +1412,7 @@ enum {
        G_LAST
 };
-struct stm32_mgate mp1_mgate[G_LAST];
+static struct stm32_mgate mp1_mgate[G_LAST];
 #define _K_GATE(_id, _gate_offset, _gate_bit_idx, _gate_flags,\
               _mgate, _ops)\
@@ -1440,7 +1435,7 @@ struct stm32_mgate mp1_mgate[G_LAST];
               &mp1_mgate[_id], &mp1_mgate_clk_ops)
 /* Peripheral gates */
-struct stm32_gate_cfg per_gate_cfg[G_LAST] = {
+static struct stm32_gate_cfg per_gate_cfg[G_LAST] = {
        /* Multi gates */
        K_GATE(G_MDIO,          RCC_APB1ENSETR, 31, 0),
        K_MGATE(G_DAC12,        RCC_APB1ENSETR, 29, 0),
@@ -1506,7 +1501,8 @@ struct stm32_gate_cfg per_gate_cfg[G_LAST] = {
        K_GATE(G_BSEC,          RCC_APB5ENSETR, 16, 0),
        K_GATE(G_IWDG1,         RCC_APB5ENSETR, 15, 0),
        K_GATE(G_TZPC,          RCC_APB5ENSETR, 13, 0),
-        K_GATE(G_TZC,           RCC_APB5ENSETR, 12, 0),
+        K_GATE(G_TZC2,          RCC_APB5ENSETR, 12, 0),
+        K_GATE(G_TZC1,          RCC_APB5ENSETR, 11, 0),
        K_GATE(G_RTCAPB,        RCC_APB5ENSETR, 8, 0),
        K_MGATE(G_USART1,       RCC_APB5ENSETR, 4, 0),
        K_MGATE(G_I2C6,         RCC_APB5ENSETR, 3, 0),
@@ -1600,7 +1596,7 @@ enum {
        M_LAST
 };
-struct stm32_mmux ker_mux[M_LAST];
+static struct stm32_mmux ker_mux[M_LAST];
 #define _K_MUX(_id, _offset, _shift, _width, _mux_flags, _mmux, _ops)\
        [_id] = {\
@@ -1623,7 +1619,7 @@ struct stm32_mmux ker_mux[M_LAST];
        _K_MUX(_id, _offset, _shift, _width, _mux_flags,\
                        &ker_mux[_id], &clk_mmux_ops)
-const struct stm32_mux_cfg ker_mux_cfg[M_LAST] = {
+static const struct stm32_mux_cfg ker_mux_cfg[M_LAST] = {
        /* Kernel multi mux */
        K_MMUX(M_SDMMC12, RCC_SDMMC12CKSELR, 0, 3, 0),
        K_MMUX(M_SPI23, RCC_SPI2S23CKSELR, 0, 3, 0),
@@ -1860,7 +1856,8 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
        PCLK(USART1, "usart1", "pclk5", 0, G_USART1),
        PCLK(RTCAPB, "rtcapb", "pclk5", CLK_IGNORE_UNUSED |
             CLK_IS_CRITICAL, G_RTCAPB),
-        PCLK(TZC, "tzc", "pclk5", CLK_IGNORE_UNUSED, G_TZC),
+        PCLK(TZC1, "tzc1", "ck_axi", CLK_IGNORE_UNUSED, G_TZC1),
+        PCLK(TZC2, "tzc2", "ck_axi", CLK_IGNORE_UNUSED, G_TZC2),
        PCLK(TZPC, "tzpc", "pclk5", CLK_IGNORE_UNUSED, G_TZPC),
        PCLK(IWDG1, "iwdg1", "pclk5", 0, G_IWDG1),
        PCLK(BSEC, "bsec", "pclk5", CLK_IGNORE_UNUSED, G_BSEC),
@@ -1916,8 +1913,7 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
        KCLK(RNG1_K, "rng1_k", rng_src, 0, G_RNG1, M_RNG1),
        KCLK(RNG2_K, "rng2_k", rng_src, 0, G_RNG2, M_RNG2),
        KCLK(USBPHY_K, "usbphy_k", usbphy_src, 0, G_USBPHY, M_USBPHY),
-        KCLK(STGEN_K, "stgen_k",  stgen_src, CLK_IGNORE_UNUSED,
+        KCLK(STGEN_K, "stgen_k", stgen_src, CLK_IS_CRITICAL, G_STGEN, M_STGEN),
-             G_STGEN, M_STGEN),
        KCLK(SPDIF_K, "spdif_k", spdif_src, 0, G_SPDIF, M_SPDIF),
        KCLK(SPI1_K, "spi1_k", spi123_src, 0, G_SPI1, M_SPI1),
        KCLK(SPI2_K, "spi2_k", spi123_src, 0, G_SPI2, M_SPI23),
@@ -1948,8 +1944,8 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
        KCLK(FDCAN_K, "fdcan_k", fdcan_src, 0, G_FDCAN, M_FDCAN),
        KCLK(SAI1_K, "sai1_k", sai_src, 0, G_SAI1, M_SAI1),
        KCLK(SAI2_K, "sai2_k", sai2_src, 0, G_SAI2, M_SAI2),
-        KCLK(SAI3_K, "sai3_k", sai_src, 0, G_SAI2, M_SAI3),
+        KCLK(SAI3_K, "sai3_k", sai_src, 0, G_SAI3, M_SAI3),
-        KCLK(SAI4_K, "sai4_k", sai_src, 0, G_SAI2, M_SAI4),
+        KCLK(SAI4_K, "sai4_k", sai_src, 0, G_SAI4, M_SAI4),
        KCLK(ADC12_K, "adc12_k", adc12_src, 0, G_ADC12, M_ADC12),
        KCLK(DSI_K, "dsi_k", dsi_src, 0, G_DSI, M_DSI),
        KCLK(ADFSDM_K, "adfsdm_k", sai_src, 0, G_ADFSDM, M_SAI1),
@@ -1992,10 +1988,6 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
                  _DIV(RCC_MCO2CFGR, 4, 4, 0, NULL)),
        /* Debug clocks */
-        FIXED_FACTOR(NO_ID, "ck_axi_div2", "ck_axi", 0, 1, 2),
-        GATE(DBG, "ck_apb_dbg", "ck_axi_div2", 0, RCC_DBGCFGR, 8, 0),
        GATE(CK_DBG, "ck_sys_dbg", "ck_axi", 0, RCC_DBGCFGR, 8, 0),
        COMPOSITE(CK_TRACE, "ck_trace", ck_trace_src, CLK_OPS_PARENT_ENABLE,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index ea67ac81c6f9..7af555f0e60c 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -426,9 +426,9 @@ static bool mux_is_better_rate(unsigned long rate, unsigned long now,
        return now <= rate && now > best;
 }
-static int
+int clk_mux_determine_rate_flags(struct clk_hw *hw,
-clk_mux_determine_rate_flags(struct clk_hw *hw, struct clk_rate_request *req,
+                                 struct clk_rate_request *req,
-                             unsigned long flags)
+                                 unsigned long flags)
 {
        struct clk_core *core = hw->core, *parent, *best_parent = NULL;
        int i, num_parents, ret;
@@ -488,6 +488,7 @@ out:
        return 0;
 }
+EXPORT_SYMBOL_GPL(clk_mux_determine_rate_flags);
 struct clk *__clk_lookup(const char *name)
 {
diff --git a/drivers/clk/meson/clk-regmap.c b/drivers/clk/meson/clk-regmap.c
index 3645fdb62343..ab7a3556f5b2 100644
--- a/drivers/clk/meson/clk-regmap.c
+++ b/drivers/clk/meson/clk-regmap.c
@@ -153,10 +153,19 @@ static int clk_regmap_mux_set_parent(struct clk_hw *hw, u8 index)
                                  val << mux->shift);
 }
+static int clk_regmap_mux_determine_rate(struct clk_hw *hw,
+                                         struct clk_rate_request *req)
+{
+        struct clk_regmap *clk = to_clk_regmap(hw);
+        struct clk_regmap_mux_data *mux = clk_get_regmap_mux_data(clk);
+        return clk_mux_determine_rate_flags(hw, req, mux->flags);
+}
 const struct clk_ops clk_regmap_mux_ops = {
        .get_parent = clk_regmap_mux_get_parent,
        .set_parent = clk_regmap_mux_set_parent,
-        .determine_rate = __clk_mux_determine_rate,
+        .determine_rate = clk_regmap_mux_determine_rate,
 };
 EXPORT_SYMBOL_GPL(clk_regmap_mux_ops);
diff --git a/drivers/clk/meson/gxbb-aoclk.h b/drivers/clk/meson/gxbb-aoclk.h
index 0be78383f257..badc4c22b4ee 100644
--- a/drivers/clk/meson/gxbb-aoclk.h
+++ b/drivers/clk/meson/gxbb-aoclk.h
@@ -17,8 +17,6 @@
 #define AO_RTC_ALT_CLK_CNTL0    0x94
 #define AO_RTC_ALT_CLK_CNTL1    0x98
-extern const struct clk_ops meson_aoclk_gate_regmap_ops;
 struct aoclk_cec_32k {
        struct clk_hw hw;
        struct regmap *regmap;
diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index cc2992493e0b..d0524ec71aad 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -253,7 +253,7 @@ static struct clk_fixed_factor meson8b_fclk_div3_div = {
        .mult = 1,
        .div = 3,
        .hw.init = &(struct clk_init_data){
-                .name = "fclk_div_div3",
+                .name = "fclk_div3_div",
                .ops = &clk_fixed_factor_ops,
                .parent_names = (const char *[]){ "fixed_pll" },
                .num_parents = 1,
@@ -632,7 +632,8 @@ static struct clk_regmap meson8b_cpu_clk = {
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk",
                .ops = &clk_regmap_mux_ro_ops,
-                .parent_names = (const char *[]){ "xtal", "cpu_out_sel" },
+                .parent_names = (const char *[]){ "xtal",
+                                                  "cpu_scale_out_sel" },
                .num_parents = 2,
                .flags = (CLK_SET_RATE_PARENT |
                          CLK_SET_RATE_NO_REPARENT),
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index bc5fc1630876..b15115a48775 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -126,6 +126,49 @@ static void cppc_cpufreq_stop_cpu(struct cpufreq_policy *policy)
                                cpu->perf_caps.lowest_perf, cpu_num, ret);
 }
+/*
+ * The PCC subspace describes the rate at which platform can accept commands
+ * on the shared PCC channel (including READs which do not count towards freq
+ * trasition requests), so ideally we need to use the PCC values as a fallback
+ * if we don't have a platform specific transition_delay_us
+ */
+#ifdef CONFIG_ARM64
+#include <asm/cputype.h>
+static unsigned int cppc_cpufreq_get_transition_delay_us(int cpu)
+{
+        unsigned long implementor = read_cpuid_implementor();
+        unsigned long part_num = read_cpuid_part_number();
+        unsigned int delay_us = 0;
+        switch (implementor) {
+        case ARM_CPU_IMP_QCOM:
+                switch (part_num) {
+                case QCOM_CPU_PART_FALKOR_V1:
+                case QCOM_CPU_PART_FALKOR:
+                        delay_us = 10000;
+                        break;
+                default:
+                        delay_us = cppc_get_transition_latency(cpu) / NSEC_PER_USEC;
+                        break;
+                }
+                break;
+        default:
+                delay_us = cppc_get_transition_latency(cpu) / NSEC_PER_USEC;
+                break;
+        }
+        return delay_us;
+}
+#else
+static unsigned int cppc_cpufreq_get_transition_delay_us(int cpu)
+{
+        return cppc_get_transition_latency(cpu) / NSEC_PER_USEC;
+}
+#endif
 static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
        struct cppc_cpudata *cpu;
@@ -162,8 +205,7 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
                cpu->perf_caps.highest_perf;
        policy->cpuinfo.max_freq = cppc_dmi_max_khz;
-        policy->transition_delay_us = cppc_get_transition_latency(cpu_num) /
+        policy->transition_delay_us = cppc_cpufreq_get_transition_delay_us(cpu_num);
-                NSEC_PER_USEC;
        policy->shared_type = cpu->shared_type;
        if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
diff --git a/drivers/gpu/drm/bridge/dumb-vga-dac.c b/drivers/gpu/drm/bridge/dumb-vga-dac.c
index 498d5948d1a8..9837c8d69e69 100644
--- a/drivers/gpu/drm/bridge/dumb-vga-dac.c
+++ b/drivers/gpu/drm/bridge/dumb-vga-dac.c
@@ -56,7 +56,9 @@ static int dumb_vga_get_modes(struct drm_connector *connector)
        }
        drm_mode_connector_update_edid_property(connector, edid);
-        return drm_add_edid_modes(connector, edid);
+        ret = drm_add_edid_modes(connector, edid);
+        kfree(edid);
+        return ret;
 fallback:
        /*
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 41e6c75a7f3c..f9550ea46c26 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -35,6 +35,7 @@
 */
 #define I915_CSR_GLK "i915/glk_dmc_ver1_04.bin"
+MODULE_FIRMWARE(I915_CSR_GLK);
 #define GLK_CSR_VERSION_REQUIRED        CSR_VERSION(1, 4)
 #define I915_CSR_CNL "i915/cnl_dmc_ver1_07.bin"
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index bf4667481935..c61dff594195 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -760,6 +760,7 @@ static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 struct vc4_async_flip_state {
        struct drm_crtc *crtc;
        struct drm_framebuffer *fb;
+        struct drm_framebuffer *old_fb;
        struct drm_pending_vblank_event *event;
        struct vc4_seqno_cb cb;
@@ -789,6 +790,23 @@ vc4_async_page_flip_complete(struct vc4_seqno_cb *cb)
        drm_crtc_vblank_put(crtc);
        drm_framebuffer_put(flip_state->fb);
+        /* Decrement the BO usecnt in order to keep the inc/dec calls balanced
+         * when the planes are updated through the async update path.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made cleanup_fb()
+         * logic.
+         */
+        if (flip_state->old_fb) {
+                struct drm_gem_cma_object *cma_bo;
+                struct vc4_bo *bo;
+                cma_bo = drm_fb_cma_get_gem_obj(flip_state->old_fb, 0);
+                bo = to_vc4_bo(&cma_bo->base);
+                vc4_bo_dec_usecnt(bo);
+                drm_framebuffer_put(flip_state->old_fb);
+        }
        kfree(flip_state);
        up(&vc4->async_modeset);
@@ -813,9 +831,22 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
        struct drm_gem_cma_object *cma_bo = drm_fb_cma_get_gem_obj(fb, 0);
        struct vc4_bo *bo = to_vc4_bo(&cma_bo->base);
+        /* Increment the BO usecnt here, so that we never end up with an
+         * unbalanced number of vc4_bo_{dec,inc}_usecnt() calls when the
+         * plane is later updated through the non-async path.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made prepare_fb()
+         * logic.
+         */
+        ret = vc4_bo_inc_usecnt(bo);
+        if (ret)
+                return ret;
        flip_state = kzalloc(sizeof(*flip_state), GFP_KERNEL);
-        if (!flip_state)
+        if (!flip_state) {
+                vc4_bo_dec_usecnt(bo);
                return -ENOMEM;
+        }
        drm_framebuffer_get(fb);
        flip_state->fb = fb;
@@ -826,10 +857,23 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
        ret = down_interruptible(&vc4->async_modeset);
        if (ret) {
                drm_framebuffer_put(fb);
+                vc4_bo_dec_usecnt(bo);
                kfree(flip_state);
                return ret;
        }
+        /* Save the current FB before it's replaced by the new one in
+         * drm_atomic_set_fb_for_plane(). We'll need the old FB in
+         * vc4_async_page_flip_complete() to decrement the BO usecnt and keep
+         * it consistent.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made cleanup_fb()
+         * logic.
+         */
+        flip_state->old_fb = plane->state->fb;
+        if (flip_state->old_fb)
+                drm_framebuffer_get(flip_state->old_fb);
        WARN_ON(drm_crtc_vblank_get(crtc) != 0);
        /* Immediately update the plane's legacy fb pointer, so that later
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 2582ffd36bb5..ba0cdb743c3e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -441,11 +441,11 @@ static int vmwgfx_set_config_internal(struct drm_mode_set *set)
        struct drm_crtc *crtc = set->crtc;
        struct drm_framebuffer *fb;
        struct drm_crtc *tmp;
-        struct drm_modeset_acquire_ctx *ctx;
        struct drm_device *dev = set->crtc->dev;
+        struct drm_modeset_acquire_ctx ctx;
        int ret;
-        ctx = dev->mode_config.acquire_ctx;
+        drm_modeset_acquire_init(&ctx, 0);
 restart:
        /*
@@ -458,7 +458,7 @@ restart:
        fb = set->fb;
-        ret = crtc->funcs->set_config(set, ctx);
+        ret = crtc->funcs->set_config(set, &ctx);
        if (ret == 0) {
                crtc->primary->crtc = crtc;
                crtc->primary->fb = fb;
@@ -473,20 +473,13 @@ restart:
        }
        if (ret == -EDEADLK) {
-                dev->mode_config.acquire_ctx = NULL;
+                drm_modeset_backoff(&ctx);
-retry_locking:
-                drm_modeset_backoff(ctx);
-                ret = drm_modeset_lock_all_ctx(dev, ctx);
-                if (ret)
-                        goto retry_locking;
-                dev->mode_config.acquire_ctx = ctx;
                goto restart;
        }
+        drm_modeset_drop_locks(&ctx);
+        drm_modeset_acquire_fini(&ctx);
        return ret;
 }
@@ -624,7 +617,6 @@ static int vmw_fb_set_par(struct fb_info *info)
        }
        mutex_lock(&par->bo_mutex);
-        drm_modeset_lock_all(vmw_priv->dev);
        ret = vmw_fb_kms_framebuffer(info);
        if (ret)
                goto out_unlock;
@@ -657,7 +649,6 @@ out_unlock:
                drm_mode_destroy(vmw_priv->dev, old_mode);
        par->set_mode = mode;
-        drm_modeset_unlock_all(vmw_priv->dev);
        mutex_unlock(&par->bo_mutex);
        return ret;
@@ -713,18 +704,14 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
        par->max_width = fb_width;
        par->max_height = fb_height;
-        drm_modeset_lock_all(vmw_priv->dev);
        ret = vmw_kms_fbdev_init_data(vmw_priv, 0, par->max_width,
                                      par->max_height, &par->con,
                                      &par->crtc, &init_mode);
-        if (ret) {
+        if (ret)
-                drm_modeset_unlock_all(vmw_priv->dev);
                goto err_kms;
-        }
        info->var.xres = init_mode->hdisplay;
        info->var.yres = init_mode->vdisplay;
-        drm_modeset_unlock_all(vmw_priv->dev);
        /*
         * Create buffers and alloc memory
@@ -832,7 +819,9 @@ int vmw_fb_close(struct vmw_private *vmw_priv)
        cancel_delayed_work_sync(&par->local_work);
        unregister_framebuffer(info);
+        mutex_lock(&par->bo_mutex);
        (void) vmw_fb_kms_detach(par, true, true);
+        mutex_unlock(&par->bo_mutex);
        vfree(par->vmalloc);
        framebuffer_release(info);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index f11601b6fd74..96fd7a03d2f8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2595,6 +2595,7 @@ void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
                vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf,
                                             out_fence, NULL);
+        vmw_dmabuf_unreference(&ctx->buf);
        vmw_resource_unreserve(res, false, NULL, 0);
        mutex_unlock(&res->dev_priv->cmdbuf_mutex);
 }
@@ -2680,7 +2681,9 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
        struct vmw_display_unit *du;
        struct drm_display_mode *mode;
        int i = 0;
+        int ret = 0;
+        mutex_lock(&dev_priv->dev->mode_config.mutex);
        list_for_each_entry(con, &dev_priv->dev->mode_config.connector_list,
                            head) {
                if (i == unit)
@@ -2691,7 +2694,8 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
        if (i != unit) {
                DRM_ERROR("Could not find initial display unit.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
        }
        if (list_empty(&con->modes))
@@ -2699,7 +2703,8 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
        if (list_empty(&con->modes)) {
                DRM_ERROR("Could not find initial display mode.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
        }
        du = vmw_connector_to_du(con);
@@ -2720,7 +2725,10 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
                                           head);
        }
-        return 0;
+ out_unlock:
+        mutex_unlock(&dev_priv->dev->mode_config.mutex);
+        return ret;
 }
 /**
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index ee270e065ba9..2a972ed6851b 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -61,9 +61,12 @@ config INFINIBAND_ON_DEMAND_PAGING
          pages on demand instead.
 config INFINIBAND_ADDR_TRANS
-        bool
+        bool "RDMA/CM"
        depends on INFINIBAND
        default y
+        ---help---
+          Support for RDMA communication manager (CM).
+          This allows for a generic connection abstraction over RDMA.
 config INFINIBAND_ADDR_TRANS_CONFIGFS
        bool
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index e337b08de2ff..fb2d347f760f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -291,14 +291,18 @@ static int find_gid(struct ib_gid_table *table, const union ib_gid *gid,
                 * so lookup free slot only if requested.
                 */
                if (pempty && empty < 0) {
-                        if (data->props & GID_TABLE_ENTRY_INVALID) {
+                        if (data->props & GID_TABLE_ENTRY_INVALID &&
-                                /* Found an invalid (free) entry; allocate it */
+                            (default_gid ==
-                                if (data->props & GID_TABLE_ENTRY_DEFAULT) {
+                             !!(data->props & GID_TABLE_ENTRY_DEFAULT))) {
-                                        if (default_gid)
+                                /*
-                                                empty = curr_index;
+                                 * Found an invalid (free) entry; allocate it.
-                                } else {
+                                 * If default GID is requested, then our
-                                        empty = curr_index;
+                                 * found slot must be one of the DEFAULT
-                                }
+                                 * reserved slots or we fail.
+                                 * This ensures that only DEFAULT reserved
+                                 * slots are used for default property GIDs.
+                                 */
+                                empty = curr_index;
                        }
                }
@@ -420,8 +424,10 @@ int ib_cache_gid_add(struct ib_device *ib_dev, u8 port,
        return ret;
 }
-int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+static int
-                     union ib_gid *gid, struct ib_gid_attr *attr)
+_ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+                  union ib_gid *gid, struct ib_gid_attr *attr,
+                  unsigned long mask, bool default_gid)
 {
        struct ib_gid_table *table;
        int ret = 0;
@@ -431,11 +437,7 @@ int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
        mutex_lock(&table->lock);
-        ix = find_gid(table, gid, attr, false,
+        ix = find_gid(table, gid, attr, default_gid, mask, NULL);
-                      GID_ATTR_FIND_MASK_GID      |
-                      GID_ATTR_FIND_MASK_GID_TYPE |
-                      GID_ATTR_FIND_MASK_NETDEV,
-                      NULL);
        if (ix < 0) {
                ret = -EINVAL;
                goto out_unlock;
@@ -452,6 +454,17 @@ out_unlock:
        return ret;
 }
+int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+                     union ib_gid *gid, struct ib_gid_attr *attr)
+{
+        unsigned long mask = GID_ATTR_FIND_MASK_GID       |
+                             GID_ATTR_FIND_MASK_GID_TYPE |
+                             GID_ATTR_FIND_MASK_DEFAULT  |
+                             GID_ATTR_FIND_MASK_NETDEV;
+        return _ib_cache_gid_del(ib_dev, port, gid, attr, mask, false);
+}
 int ib_cache_gid_del_all_netdev_gids(struct ib_device *ib_dev, u8 port,
                                     struct net_device *ndev)
 {
@@ -728,7 +741,7 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
                                  unsigned long gid_type_mask,
                                  enum ib_cache_gid_default_mode mode)
 {
-        union ib_gid gid;
+        union ib_gid gid = { };
        struct ib_gid_attr gid_attr;
        struct ib_gid_table *table;
        unsigned int gid_type;
@@ -736,7 +749,9 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
        table = ib_dev->cache.ports[port - rdma_start_port(ib_dev)].gid;
-        make_default_gid(ndev, &gid);
+        mask = GID_ATTR_FIND_MASK_GID_TYPE |
+               GID_ATTR_FIND_MASK_DEFAULT |
+               GID_ATTR_FIND_MASK_NETDEV;
        memset(&gid_attr, 0, sizeof(gid_attr));
        gid_attr.ndev = ndev;
@@ -747,12 +762,12 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
                gid_attr.gid_type = gid_type;
                if (mode == IB_CACHE_GID_DEFAULT_MODE_SET) {
-                        mask = GID_ATTR_FIND_MASK_GID_TYPE |
+                        make_default_gid(ndev, &gid);
-                               GID_ATTR_FIND_MASK_DEFAULT;
                        __ib_cache_gid_add(ib_dev, port, &gid,
                                           &gid_attr, mask, true);
                } else if (mode == IB_CACHE_GID_DEFAULT_MODE_DELETE) {
-                        ib_cache_gid_del(ib_dev, port, &gid, &gid_attr);
+                        _ib_cache_gid_del(ib_dev, port, &gid,
+                                          &gid_attr, mask, true);
                }
        }
 }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 51a641002e10..a693fcd4c513 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -382,6 +382,8 @@ struct cma_hdr {
 #define CMA_VERSION 0x00
 struct cma_req_info {
+        struct sockaddr_storage listen_addr_storage;
+        struct sockaddr_storage src_addr_storage;
        struct ib_device *device;
        int port;
        union ib_gid local_gid;
@@ -866,7 +868,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv,
 {
        struct ib_qp_attr qp_attr;
        int qp_attr_mask, ret;
-        union ib_gid sgid;
        mutex_lock(&id_priv->qp_mutex);
        if (!id_priv->id.qp) {
@@ -889,12 +890,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv,
        if (ret)
                goto out;
-        ret = ib_query_gid(id_priv->id.device, id_priv->id.port_num,
-                           rdma_ah_read_grh(&qp_attr.ah_attr)->sgid_index,
-                           &sgid, NULL);
-        if (ret)
-                goto out;
        BUG_ON(id_priv->cma_dev->device != id_priv->id.device);
        if (conn_param)
@@ -1340,11 +1335,11 @@ static bool validate_net_dev(struct net_device *net_dev,
 }
 static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event,
-                                          const struct cma_req_info *req)
+                                          struct cma_req_info *req)
 {
-        struct sockaddr_storage listen_addr_storage, src_addr_storage;
+        struct sockaddr *listen_addr =
-        struct sockaddr *listen_addr = (struct sockaddr *)&listen_addr_storage,
+                        (struct sockaddr *)&req->listen_addr_storage;
-                        *src_addr = (struct sockaddr *)&src_addr_storage;
+        struct sockaddr *src_addr = (struct sockaddr *)&req->src_addr_storage;
        struct net_device *net_dev;
        const union ib_gid *gid = req->has_gid ? &req->local_gid : NULL;
        int err;
@@ -1359,11 +1354,6 @@ static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event,
        if (!net_dev)
                return ERR_PTR(-ENODEV);
-        if (!validate_net_dev(net_dev, listen_addr, src_addr)) {
-                dev_put(net_dev);
-                return ERR_PTR(-EHOSTUNREACH);
-        }
        return net_dev;
 }
@@ -1490,15 +1480,51 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id,
                }
        }
+        /*
+         * Net namespace might be getting deleted while route lookup,
+         * cm_id lookup is in progress. Therefore, perform netdevice
+         * validation, cm_id lookup under rcu lock.
+         * RCU lock along with netdevice state check, synchronizes with
+         * netdevice migrating to different net namespace and also avoids
+         * case where net namespace doesn't get deleted while lookup is in
+         * progress.
+         * If the device state is not IFF_UP, its properties such as ifindex
+         * and nd_net cannot be trusted to remain valid without rcu lock.
+         * net/core/dev.c change_net_namespace() ensures to synchronize with
+         * ongoing operations on net device after device is closed using
+         * synchronize_net().
+         */
+        rcu_read_lock();
+        if (*net_dev) {
+                /*
+                 * If netdevice is down, it is likely that it is administratively
+                 * down or it might be migrating to different namespace.
+                 * In that case avoid further processing, as the net namespace
+                 * or ifindex may change.
+                 */
+                if (((*net_dev)->flags & IFF_UP) == 0) {
+                        id_priv = ERR_PTR(-EHOSTUNREACH);
+                        goto err;
+                }
+                if (!validate_net_dev(*net_dev,
+                                 (struct sockaddr *)&req.listen_addr_storage,
+                                 (struct sockaddr *)&req.src_addr_storage)) {
+                        id_priv = ERR_PTR(-EHOSTUNREACH);
+                        goto err;
+                }
+        }
        bind_list = cma_ps_find(*net_dev ? dev_net(*net_dev) : &init_net,
                                rdma_ps_from_service_id(req.service_id),
                                cma_port_from_service_id(req.service_id));
        id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev);
+err:
+        rcu_read_unlock();
        if (IS_ERR(id_priv) && *net_dev) {
                dev_put(*net_dev);
                *net_dev = NULL;
        }
        return id_priv;
 }
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index 9821ae900f6d..da12da1c36f6 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -114,7 +114,7 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr,
                        struct sockaddr_storage *mapped_sockaddr,
                        u8 nl_client)
 {
-        struct hlist_head *hash_bucket_head;
+        struct hlist_head *hash_bucket_head = NULL;
        struct iwpm_mapping_info *map_info;
        unsigned long flags;
        int ret = -EINVAL;
@@ -142,6 +142,9 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr,
                }
        }
        spin_unlock_irqrestore(&iwpm_mapinfo_lock, flags);
+        if (!hash_bucket_head)
+                kfree(map_info);
        return ret;
 }
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index c50596f7f98a..b28452a55a08 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -59,7 +59,7 @@ module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
 MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
 static struct list_head ib_mad_port_list;
-static u32 ib_mad_client_id = 0;
+static atomic_t ib_mad_client_id = ATOMIC_INIT(0);
 /* Port list lock */
 static DEFINE_SPINLOCK(ib_mad_port_list_lock);
@@ -377,7 +377,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
        }
        spin_lock_irqsave(&port_priv->reg_lock, flags);
-        mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
+        mad_agent_priv->agent.hi_tid = atomic_inc_return(&ib_mad_client_id);
        /*
         * Make sure MAD registration (if supplied)
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index cc2966380c0c..c0e4fd55e2cc 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -255,6 +255,7 @@ static void bond_delete_netdev_default_gids(struct ib_device *ib_dev,
                                            struct net_device *rdma_ndev)
 {
        struct net_device *real_dev = rdma_vlan_dev_real_dev(event_ndev);
+        unsigned long gid_type_mask;
        if (!rdma_ndev)
                return;
@@ -264,21 +265,22 @@ static void bond_delete_netdev_default_gids(struct ib_device *ib_dev,
        rcu_read_lock();
-        if (rdma_is_upper_dev_rcu(rdma_ndev, event_ndev) &&
+        if (((rdma_ndev != event_ndev &&
-            is_eth_active_slave_of_bonding_rcu(rdma_ndev, real_dev) ==
+              !rdma_is_upper_dev_rcu(rdma_ndev, event_ndev)) ||
-            BONDING_SLAVE_STATE_INACTIVE) {
+             is_eth_active_slave_of_bonding_rcu(rdma_ndev, real_dev)
-                unsigned long gid_type_mask;
+                                                 ==
+             BONDING_SLAVE_STATE_INACTIVE)) {
                rcu_read_unlock();
+                return;
+        }
-                gid_type_mask = roce_gid_type_mask_support(ib_dev, port);
+        rcu_read_unlock();
-                ib_cache_gid_set_default_gid(ib_dev, port, rdma_ndev,
+        gid_type_mask = roce_gid_type_mask_support(ib_dev, port);
-                                             gid_type_mask,
-                                             IB_CACHE_GID_DEFAULT_MODE_DELETE);
+        ib_cache_gid_set_default_gid(ib_dev, port, rdma_ndev,
-        } else {
+                                     gid_type_mask,
-                rcu_read_unlock();
+                                     IB_CACHE_GID_DEFAULT_MODE_DELETE);
-        }
 }
 static void enum_netdev_ipv4_ips(struct ib_device *ib_dev,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 74329483af6d..eab43b17e9cf 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -159,6 +159,23 @@ static void ucma_put_ctx(struct ucma_context *ctx)
                complete(&ctx->comp);
 }
+/*
+ * Same as ucm_get_ctx but requires that ->cm_id->device is valid, eg that the
+ * CM_ID is bound.
+ */
+static struct ucma_context *ucma_get_ctx_dev(struct ucma_file *file, int id)
+{
+        struct ucma_context *ctx = ucma_get_ctx(file, id);
+        if (IS_ERR(ctx))
+                return ctx;
+        if (!ctx->cm_id->device) {
+                ucma_put_ctx(ctx);
+                return ERR_PTR(-EINVAL);
+        }
+        return ctx;
+}
 static void ucma_close_event_id(struct work_struct *work)
 {
        struct ucma_event *uevent_close =  container_of(work, struct ucma_event, close_work);
@@ -683,7 +700,7 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        if (!rdma_addr_size_in6(&cmd.src_addr) ||
+        if ((cmd.src_addr.sin6_family && !rdma_addr_size_in6(&cmd.src_addr)) ||
            !rdma_addr_size_in6(&cmd.dst_addr))
                return -EINVAL;
@@ -734,7 +751,7 @@ static ssize_t ucma_resolve_route(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1050,7 +1067,7 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
        if (!cmd.conn_param.valid)
                return -EINVAL;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1092,7 +1109,7 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1120,7 +1137,7 @@ static ssize_t ucma_reject(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1139,7 +1156,7 @@ static ssize_t ucma_disconnect(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1167,15 +1184,10 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
        if (cmd.qp_state > IB_QPS_ERR)
                return -EINVAL;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
-        if (!ctx->cm_id->device) {
-                ret = -EINVAL;
-                goto out;
-        }
        resp.qp_attr_mask = 0;
        memset(&qp_attr, 0, sizeof qp_attr);
        qp_attr.qp_state = cmd.qp_state;
@@ -1316,13 +1328,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
+        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
+                return -EINVAL;
        ctx = ucma_get_ctx(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
-        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
-                return -EINVAL;
        optval = memdup_user(u64_to_user_ptr(cmd.optval),
                             cmd.optlen);
        if (IS_ERR(optval)) {
@@ -1384,7 +1396,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
        else
                return -EINVAL;
-        ctx = ucma_get_ctx(file, cmd->id);
+        ctx = ucma_get_ctx_dev(file, cmd->id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 13cb5e4deb86..21a887c9523b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -691,6 +691,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
        mr->device  = pd->device;
        mr->pd      = pd;
+        mr->dm      = NULL;
        mr->uobject = uobj;
        atomic_inc(&pd->usecnt);
        mr->res.type = RDMA_RESTRACK_MR;
@@ -765,6 +766,11 @@ ssize_t ib_uverbs_rereg_mr(struct ib_uverbs_file *file,
        mr = uobj->object;
+        if (mr->dm) {
+                ret = -EINVAL;
+                goto put_uobjs;
+        }
        if (cmd.flags & IB_MR_REREG_ACCESS) {
                ret = ib_check_mr_access(cmd.access_flags);
                if (ret)
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c93970dc8f1..8d32c4ae368c 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -234,6 +234,15 @@ static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *met
                        return -EINVAL;
        }
+        for (; i < method_spec->num_buckets; i++) {
+                struct uverbs_attr_spec_hash *attr_spec_bucket =
+                        method_spec->attr_buckets[i];
+                if (!bitmap_empty(attr_spec_bucket->mandatory_attrs_bitmask,
+                                  attr_spec_bucket->num_attrs))
+                        return -EINVAL;
+        }
        return 0;
 }
diff --git a/drivers/infiniband/core/uverbs_std_types_flow_action.c b/drivers/infiniband/core/uverbs_std_types_flow_action.c
index cbcec3da12f6..b4f016dfa23d 100644
--- a/drivers/infiniband/core/uverbs_std_types_flow_action.c
+++ b/drivers/infiniband/core/uverbs_std_types_flow_action.c
@@ -363,28 +363,28 @@ static int UVERBS_HANDLER(UVERBS_METHOD_FLOW_ACTION_ESP_MODIFY)(struct ib_device
 static const struct uverbs_attr_spec uverbs_flow_action_esp_keymat[] = {
        [IB_UVERBS_FLOW_ACTION_ESP_KEYMAT_AES_GCM] = {
-                .ptr = {
+                { .ptr = {
                        .type = UVERBS_ATTR_TYPE_PTR_IN,
                        UVERBS_ATTR_TYPE(struct ib_uverbs_flow_action_esp_keymat_aes_gcm),
                        .flags = UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO,
-                },
+                } },
        },
 };
 static const struct uverbs_attr_spec uverbs_flow_action_esp_replay[] = {
        [IB_UVERBS_FLOW_ACTION_ESP_REPLAY_NONE] = {
-                .ptr = {
+                { .ptr = {
                        .type = UVERBS_ATTR_TYPE_PTR_IN,
                        /* No need to specify any data */
                        .len = 0,
-                }
+                } }
        },
        [IB_UVERBS_FLOW_ACTION_ESP_REPLAY_BMP] = {
-                .ptr = {
+                { .ptr = {
                        .type = UVERBS_ATTR_TYPE_PTR_IN,
                        UVERBS_ATTR_STRUCT(struct ib_uverbs_flow_action_esp_replay_bmp, size),
                        .flags = UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO,
-                }
+                } }
        },
 };
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 7eff3aeffe01..6ddfb1fade79 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1656,6 +1656,7 @@ struct ib_mr *ib_alloc_mr(struct ib_pd *pd,
        if (!IS_ERR(mr)) {
                mr->device  = pd->device;
                mr->pd      = pd;
+                mr->dm      = NULL;
                mr->uobject = NULL;
                atomic_inc(&pd->usecnt);
                mr->need_inval = false;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 6f2b26126c64..2be2e1ac1b5f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -315,7 +315,7 @@ static void advance_oldest_read(struct t4_wq *wq)
 * Deal with out-of-order and/or completions that complete
 * prior unsignalled WRs.
 */
-void c4iw_flush_hw_cq(struct c4iw_cq *chp)
+void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp)
 {
        struct t4_cqe *hw_cqe, *swcqe, read_cqe;
        struct c4iw_qp *qhp;
@@ -339,6 +339,13 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp)
                if (qhp == NULL)
                        goto next_cqe;
+                if (flush_qhp != qhp) {
+                        spin_lock(&qhp->lock);
+                        if (qhp->wq.flushed == 1)
+                                goto next_cqe;
+                }
                if (CQE_OPCODE(hw_cqe) == FW_RI_TERMINATE)
                        goto next_cqe;
@@ -390,6 +397,8 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp)
 next_cqe:
                t4_hwcq_consume(&chp->cq);
                ret = t4_next_hw_cqe(&chp->cq, &hw_cqe);
+                if (qhp && flush_qhp != qhp)
+                        spin_unlock(&qhp->lock);
        }
 }
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index feeb8ee6f4a2..44161ca4d2a8 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -875,6 +875,11 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
        rdev->status_page->db_off = 0;
+        init_completion(&rdev->rqt_compl);
+        init_completion(&rdev->pbl_compl);
+        kref_init(&rdev->rqt_kref);
+        kref_init(&rdev->pbl_kref);
        return 0;
 err_free_status_page_and_wr_log:
        if (c4iw_wr_log && rdev->wr_log)
@@ -893,13 +898,15 @@ destroy_resource:
 static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
-        destroy_workqueue(rdev->free_workq);
        kfree(rdev->wr_log);
        c4iw_release_dev_ucontext(rdev, &rdev->uctx);
        free_page((unsigned long)rdev->status_page);
        c4iw_pblpool_destroy(rdev);
        c4iw_rqtpool_destroy(rdev);
+        wait_for_completion(&rdev->pbl_compl);
+        wait_for_completion(&rdev->rqt_compl);
        c4iw_ocqp_pool_destroy(rdev);
+        destroy_workqueue(rdev->free_workq);
        c4iw_destroy_resource(&rdev->resource);
 }
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index cc929002c05e..831027717121 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -185,6 +185,10 @@ struct c4iw_rdev {
        struct wr_log_entry *wr_log;
        int wr_log_size;
        struct workqueue_struct *free_workq;
+        struct completion rqt_compl;
+        struct completion pbl_compl;
+        struct kref rqt_kref;
+        struct kref pbl_kref;
 };
 static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
@@ -1049,7 +1053,7 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
 u32 c4iw_ocqp_pool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_ocqp_pool_free(struct c4iw_rdev *rdev, u32 addr, int size);
-void c4iw_flush_hw_cq(struct c4iw_cq *chp);
+void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp);
 void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
 int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp);
 int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count);
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index de77b6027d69..ae167b686608 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1343,12 +1343,12 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
        qhp->wq.flushed = 1;
        t4_set_wq_in_error(&qhp->wq);
-        c4iw_flush_hw_cq(rchp);
+        c4iw_flush_hw_cq(rchp, qhp);
        c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count);
        rq_flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
        if (schp != rchp)
-                c4iw_flush_hw_cq(schp);
+                c4iw_flush_hw_cq(schp, qhp);
        sq_flushed = c4iw_flush_sq(qhp);
        spin_unlock(&qhp->lock);
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index 3cf25997ed2b..0ef25ae05e6f 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -260,12 +260,22 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size)
                rdev->stats.pbl.cur += roundup(size, 1 << MIN_PBL_SHIFT);
                if (rdev->stats.pbl.cur > rdev->stats.pbl.max)
                        rdev->stats.pbl.max = rdev->stats.pbl.cur;
+                kref_get(&rdev->pbl_kref);
        } else
                rdev->stats.pbl.fail++;
        mutex_unlock(&rdev->stats.lock);
        return (u32)addr;
 }
+static void destroy_pblpool(struct kref *kref)
+{
+        struct c4iw_rdev *rdev;
+        rdev = container_of(kref, struct c4iw_rdev, pbl_kref);
+        gen_pool_destroy(rdev->pbl_pool);
+        complete(&rdev->pbl_compl);
+}
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
 {
        pr_debug("addr 0x%x size %d\n", addr, size);
@@ -273,6 +283,7 @@ void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
        rdev->stats.pbl.cur -= roundup(size, 1 << MIN_PBL_SHIFT);
        mutex_unlock(&rdev->stats.lock);
        gen_pool_free(rdev->pbl_pool, (unsigned long)addr, size);
+        kref_put(&rdev->pbl_kref, destroy_pblpool);
 }
 int c4iw_pblpool_create(struct c4iw_rdev *rdev)
@@ -310,7 +321,7 @@ int c4iw_pblpool_create(struct c4iw_rdev *rdev)
 void c4iw_pblpool_destroy(struct c4iw_rdev *rdev)
 {
-        gen_pool_destroy(rdev->pbl_pool);
+        kref_put(&rdev->pbl_kref, destroy_pblpool);
 }
 /*
@@ -331,12 +342,22 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
                rdev->stats.rqt.cur += roundup(size << 6, 1 << MIN_RQT_SHIFT);
                if (rdev->stats.rqt.cur > rdev->stats.rqt.max)
                        rdev->stats.rqt.max = rdev->stats.rqt.cur;
+                kref_get(&rdev->rqt_kref);
        } else
                rdev->stats.rqt.fail++;
        mutex_unlock(&rdev->stats.lock);
        return (u32)addr;
 }
+static void destroy_rqtpool(struct kref *kref)
+{
+        struct c4iw_rdev *rdev;
+        rdev = container_of(kref, struct c4iw_rdev, rqt_kref);
+        gen_pool_destroy(rdev->rqt_pool);
+        complete(&rdev->rqt_compl);
+}
 void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
 {
        pr_debug("addr 0x%x size %d\n", addr, size << 6);
@@ -344,6 +365,7 @@ void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
        rdev->stats.rqt.cur -= roundup(size << 6, 1 << MIN_RQT_SHIFT);
        mutex_unlock(&rdev->stats.lock);
        gen_pool_free(rdev->rqt_pool, (unsigned long)addr, size << 6);
+        kref_put(&rdev->rqt_kref, destroy_rqtpool);
 }
 int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
@@ -380,7 +402,7 @@ int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
 void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev)
 {
-        gen_pool_destroy(rdev->rqt_pool);
+        kref_put(&rdev->rqt_kref, destroy_rqtpool);
 }
 /*
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index a97055dd4fbd..b5fab55cc275 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -412,7 +412,6 @@ static void hfi1_cleanup_sdma_notifier(struct hfi1_msix_entry *msix)
 static int get_irq_affinity(struct hfi1_devdata *dd,
                            struct hfi1_msix_entry *msix)
 {
-        int ret;
        cpumask_var_t diff;
        struct hfi1_affinity_node *entry;
        struct cpu_mask_set *set = NULL;
@@ -424,10 +423,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
        extra[0] = '\0';
        cpumask_clear(&msix->mask);
-        ret = zalloc_cpumask_var(&diff, GFP_KERNEL);
-        if (!ret)
-                return -ENOMEM;
        entry = node_affinity_lookup(dd->node);
        switch (msix->type) {
@@ -458,6 +453,9 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
         * finds its CPU here.
         */
        if (cpu == -1 && set) {
+                if (!zalloc_cpumask_var(&diff, GFP_KERNEL))
+                        return -ENOMEM;
                if (cpumask_equal(&set->mask, &set->used)) {
                        /*
                         * We've used up all the CPUs, bump up the generation
@@ -469,6 +467,8 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
                cpumask_andnot(diff, &set->mask, &set->used);
                cpu = cpumask_first(diff);
                cpumask_set_cpu(cpu, &set->used);
+                free_cpumask_var(diff);
        }
        cpumask_set_cpu(cpu, &msix->mask);
@@ -482,7 +482,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
                hfi1_setup_sdma_notifier(msix);
        }
-        free_cpumask_var(diff);
        return 0;
 }
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 46d1475b2154..bd837a048bf4 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -433,31 +433,43 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
                               bool do_cnp)
 {
        struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
+        struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
        struct ib_other_headers *ohdr = pkt->ohdr;
        struct ib_grh *grh = pkt->grh;
        u32 rqpn = 0, bth1;
-        u16 pkey, rlid, dlid = ib_get_dlid(pkt->hdr);
+        u16 pkey;
+        u32 rlid, slid, dlid = 0;
        u8 hdr_type, sc, svc_type;
        bool is_mcast = false;
+        /* can be called from prescan */
        if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
                is_mcast = hfi1_is_16B_mcast(dlid);
                pkey = hfi1_16B_get_pkey(pkt->hdr);
                sc = hfi1_16B_get_sc(pkt->hdr);
+                dlid = hfi1_16B_get_dlid(pkt->hdr);
+                slid = hfi1_16B_get_slid(pkt->hdr);
                hdr_type = HFI1_PKT_TYPE_16B;
        } else {
                is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
                           (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
                pkey = ib_bth_get_pkey(ohdr);
                sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
+                dlid = ib_get_dlid(pkt->hdr);
+                slid = ib_get_slid(pkt->hdr);
                hdr_type = HFI1_PKT_TYPE_9B;
        }
        switch (qp->ibqp.qp_type) {
+        case IB_QPT_UD:
+                dlid = ppd->lid;
+                rlid = slid;
+                rqpn = ib_get_sqpn(pkt->ohdr);
+                svc_type = IB_CC_SVCTYPE_UD;
+                break;
        case IB_QPT_SMI:
        case IB_QPT_GSI:
-        case IB_QPT_UD:
+                rlid = slid;
-                rlid = ib_get_slid(pkt->hdr);
                rqpn = ib_get_sqpn(pkt->ohdr);
                svc_type = IB_CC_SVCTYPE_UD;
                break;
@@ -482,7 +494,6 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
                                              dlid, rlid, sc, grh);
        if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
-                struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
                u32 lqpn = bth1 & RVT_QPN_MASK;
                u8 sl = ibp->sc_to_sl[sc];
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 32c48265405e..cac2c62bc42d 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1537,13 +1537,13 @@ void set_link_ipg(struct hfi1_pportdata *ppd);
 void process_becn(struct hfi1_pportdata *ppd, u8 sl, u32 rlid, u32 lqpn,
                  u32 rqpn, u8 svc_type);
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-                u32 pkey, u32 slid, u32 dlid, u8 sc5,
+                u16 pkey, u32 slid, u32 dlid, u8 sc5,
                const struct ib_grh *old_grh);
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                    u8 sc5, const struct ib_grh *old_grh);
 typedef void (*hfi1_handle_cnp)(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                                u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                                u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                                u8 sc5, const struct ib_grh *old_grh);
 #define PKEY_CHECK_INVALID -1
@@ -2437,7 +2437,7 @@ static inline void hfi1_make_16b_hdr(struct hfi1_16b_header *hdr,
                ((slid >> OPA_16B_SLID_SHIFT) << OPA_16B_SLID_HIGH_SHIFT);
        lrh2 = (lrh2 & ~OPA_16B_DLID_MASK) |
                ((dlid >> OPA_16B_DLID_SHIFT) << OPA_16B_DLID_HIGH_SHIFT);
-        lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | (pkey << OPA_16B_PKEY_SHIFT);
+        lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | ((u32)pkey << OPA_16B_PKEY_SHIFT);
        lrh2 = (lrh2 & ~OPA_16B_L4_MASK) | l4;
        hdr->lrh[0] = lrh0;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 33eba2356742..6309edf811df 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -88,9 +88,9 @@
 * pio buffers per ctxt, etc.)  Zero means use one user context per CPU.
 */
 int num_user_contexts = -1;
-module_param_named(num_user_contexts, num_user_contexts, uint, S_IRUGO);
+module_param_named(num_user_contexts, num_user_contexts, int, 0444);
 MODULE_PARM_DESC(
-        num_user_contexts, "Set max number of user contexts to use");
+        num_user_contexts, "Set max number of user contexts to use (default: -1 will use the real (non-HT) CPU count)");
 uint krcvqs[RXE_NUM_DATA_VL];
 int krcvqsset;
@@ -1209,30 +1209,49 @@ static void finalize_asic_data(struct hfi1_devdata *dd,
        kfree(ad);
 }
-static void __hfi1_free_devdata(struct kobject *kobj)
+/**
+ * hfi1_clean_devdata - cleans up per-unit data structure
+ * @dd: pointer to a valid devdata structure
+ *
+ * It cleans up all data structures set up by
+ * by hfi1_alloc_devdata().
+ */
+static void hfi1_clean_devdata(struct hfi1_devdata *dd)
 {
-        struct hfi1_devdata *dd =
-                container_of(kobj, struct hfi1_devdata, kobj);
        struct hfi1_asic_data *ad;
        unsigned long flags;
        spin_lock_irqsave(&hfi1_devs_lock, flags);
-        idr_remove(&hfi1_unit_table, dd->unit);
+        if (!list_empty(&dd->list)) {
-        list_del(&dd->list);
+                idr_remove(&hfi1_unit_table, dd->unit);
+                list_del_init(&dd->list);
+        }
        ad = release_asic_data(dd);
        spin_unlock_irqrestore(&hfi1_devs_lock, flags);
-        if (ad)
-                finalize_asic_data(dd, ad);
+        finalize_asic_data(dd, ad);
        free_platform_config(dd);
        rcu_barrier(); /* wait for rcu callbacks to complete */
        free_percpu(dd->int_counter);
        free_percpu(dd->rcv_limit);
        free_percpu(dd->send_schedule);
        free_percpu(dd->tx_opstats);
+        dd->int_counter   = NULL;
+        dd->rcv_limit     = NULL;
+        dd->send_schedule = NULL;
+        dd->tx_opstats    = NULL;
        sdma_clean(dd, dd->num_sdma);
        rvt_dealloc_device(&dd->verbs_dev.rdi);
 }
+static void __hfi1_free_devdata(struct kobject *kobj)
+{
+        struct hfi1_devdata *dd =
+                container_of(kobj, struct hfi1_devdata, kobj);
+        hfi1_clean_devdata(dd);
+}
 static struct kobj_type hfi1_devdata_type = {
        .release = __hfi1_free_devdata,
 };
@@ -1265,6 +1284,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
                return ERR_PTR(-ENOMEM);
        dd->num_pports = nports;
        dd->pport = (struct hfi1_pportdata *)(dd + 1);
+        dd->pcidev = pdev;
+        pci_set_drvdata(pdev, dd);
        INIT_LIST_HEAD(&dd->list);
        idr_preload(GFP_KERNEL);
@@ -1331,9 +1352,7 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
        return dd;
 bail:
-        if (!list_empty(&dd->list))
+        hfi1_clean_devdata(dd);
-                list_del_init(&dd->list);
-        rvt_dealloc_device(&dd->verbs_dev.rdi);
        return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 83d66e862207..c1c982908b4b 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -163,9 +163,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
        resource_size_t addr;
        int ret = 0;
-        dd->pcidev = pdev;
-        pci_set_drvdata(pdev, dd);
        addr = pci_resource_start(pdev, 0);
        len = pci_resource_len(pdev, 0);
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index d486355880cb..cbf7faa5038c 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -199,6 +199,7 @@ void free_platform_config(struct hfi1_devdata *dd)
 {
        /* Release memory allocated for eprom or fallback file read. */
        kfree(dd->platform_config.data);
+        dd->platform_config.data = NULL;
 }
 void get_port_type(struct hfi1_pportdata *ppd)
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index 1869f639c3ae..b5966991d647 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -204,6 +204,8 @@ static void clean_i2c_bus(struct hfi1_i2c_bus *bus)
 void clean_up_i2c(struct hfi1_devdata *dd, struct hfi1_asic_data *ad)
 {
+        if (!ad)
+                return;
        clean_i2c_bus(ad->i2c_bus0);
        ad->i2c_bus0 = NULL;
        clean_i2c_bus(ad->i2c_bus1);
diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c
index 3daa94bdae3a..c0071ca4147a 100644
--- a/drivers/infiniband/hw/hfi1/ruc.c
+++ b/drivers/infiniband/hw/hfi1/ruc.c
@@ -733,6 +733,20 @@ static inline void hfi1_make_ruc_bth(struct rvt_qp *qp,
        ohdr->bth[2] = cpu_to_be32(bth2);
 }
+/**
+ * hfi1_make_ruc_header_16B - build a 16B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
                                            struct ib_other_headers *ohdr,
                                            u32 bth0, u32 bth2, int middle,
@@ -777,6 +791,12 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
        else
                middle = 0;
+        if (qp->s_flags & RVT_S_ECN) {
+                qp->s_flags &= ~RVT_S_ECN;
+                /* we recently received a FECN, so return a BECN */
+                becn = true;
+                middle = 0;
+        }
        if (middle)
                build_ahg(qp, bth2);
        else
@@ -784,11 +804,6 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
        bth0 |= pkey;
        bth0 |= extra_bytes << 20;
-        if (qp->s_flags & RVT_S_ECN) {
-                qp->s_flags &= ~RVT_S_ECN;
-                /* we recently received a FECN, so return a BECN */
-                becn = true;
-        }
        hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
        if (!ppd->lid)
@@ -806,6 +821,20 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
                          pkey, becn, 0, l4, priv->s_sc);
 }
+/**
+ * hfi1_make_ruc_header_9B - build a 9B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
                                           struct ib_other_headers *ohdr,
                                           u32 bth0, u32 bth2, int middle,
@@ -839,6 +868,12 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
        else
                middle = 0;
+        if (qp->s_flags & RVT_S_ECN) {
+                qp->s_flags &= ~RVT_S_ECN;
+                /* we recently received a FECN, so return a BECN */
+                bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
+                middle = 0;
+        }
        if (middle)
                build_ahg(qp, bth2);
        else
@@ -846,11 +881,6 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
        bth0 |= pkey;
        bth0 |= extra_bytes << 20;
-        if (qp->s_flags & RVT_S_ECN) {
-                qp->s_flags &= ~RVT_S_ECN;
-                /* we recently received a FECN, so return a BECN */
-                bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
-        }
        hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
        hfi1_make_ib_hdr(&ps->s_txreq->phdr.hdr.ibh,
                         lrh0,
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index bcf3b0bebac8..69c17a5ef038 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -628,7 +628,7 @@ int hfi1_lookup_pkey_idx(struct hfi1_ibport *ibp, u16 pkey)
 }
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                    u8 sc5, const struct ib_grh *old_grh)
 {
        u64 pbc, pbc_flags = 0;
@@ -687,7 +687,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 }
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-                u32 pkey, u32 slid, u32 dlid, u8 sc5,
+                u16 pkey, u32 slid, u32 dlid, u8 sc5,
                const struct ib_grh *old_grh)
 {
        u64 pbc, pbc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index 0eeabfbee192..63b5b3edabcb 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -912,7 +912,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                obj_per_chunk = buf_chunk_size / obj_size;
                num_hem = (nobj + obj_per_chunk - 1) / obj_per_chunk;
                bt_chunk_num = bt_chunk_size / 8;
-                if (table->type >= HEM_TYPE_MTT)
+                if (type >= HEM_TYPE_MTT)
                        num_bt_l0 = bt_chunk_num;
                table->hem = kcalloc(num_hem, sizeof(*table->hem),
@@ -920,7 +920,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                if (!table->hem)
                        goto err_kcalloc_hem_buf;
-                if (check_whether_bt_num_3(table->type, hop_num)) {
+                if (check_whether_bt_num_3(type, hop_num)) {
                        unsigned long num_bt_l1;
                        num_bt_l1 = (num_hem + bt_chunk_num - 1) /
@@ -939,8 +939,8 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                                goto err_kcalloc_l1_dma;
                }
-                if (check_whether_bt_num_2(table->type, hop_num) ||
+                if (check_whether_bt_num_2(type, hop_num) ||
-                        check_whether_bt_num_3(table->type, hop_num)) {
+                        check_whether_bt_num_3(type, hop_num)) {
                        table->bt_l0 = kcalloc(num_bt_l0, sizeof(*table->bt_l0),
                                               GFP_KERNEL);
                        if (!table->bt_l0)
@@ -1039,14 +1039,14 @@ void hns_roce_cleanup_hem_table(struct hns_roce_dev *hr_dev,
 void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
 {
        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->cq_table.table);
-        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.irrl_table);
        if (hr_dev->caps.trrl_entry_sz)
                hns_roce_cleanup_hem_table(hr_dev,
                                           &hr_dev->qp_table.trrl_table);
+        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.irrl_table);
        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.qp_table);
        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtpt_table);
-        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtt_table);
        if (hns_roce_check_whether_mhop(hr_dev, HEM_TYPE_CQE))
                hns_roce_cleanup_hem_table(hr_dev,
                                           &hr_dev->mr_table.mtt_cqe_table);
+        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtt_table);
 }
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 8b84ab7800d8..25916e8522ed 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -71,6 +71,11 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        return -EINVAL;
                }
+                if (wr->opcode == IB_WR_RDMA_READ) {
+                        dev_err(hr_dev->dev, "Not support inline data!\n");
+                        return -EINVAL;
+                }
                for (i = 0; i < wr->num_sge; i++) {
                        memcpy(wqe, ((void *)wr->sg_list[i].addr),
                               wr->sg_list[i].length);
@@ -148,7 +153,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                     ibqp->qp_type != IB_QPT_GSI &&
                     ibqp->qp_type != IB_QPT_UD)) {
                dev_err(dev, "Not supported QP(0x%x)type!\n", ibqp->qp_type);
-                *bad_wr = NULL;
+                *bad_wr = wr;
                return -EOPNOTSUPP;
        }
@@ -182,7 +187,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                qp->sq.wrid[(qp->sq.head + nreq) & (qp->sq.wqe_cnt - 1)] =
                                                                      wr->wr_id;
-                owner_bit = ~(qp->sq.head >> ilog2(qp->sq.wqe_cnt)) & 0x1;
+                owner_bit =
+                       ~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1);
                /* Corresponding to the QP type, wqe process separately */
                if (ibqp->qp_type == IB_QPT_GSI) {
@@ -456,6 +462,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                } else {
                        dev_err(dev, "Illegal qp_type(0x%x)\n", ibqp->qp_type);
                        spin_unlock_irqrestore(&qp->sq.lock, flags);
+                        *bad_wr = wr;
                        return -EOPNOTSUPP;
                }
        }
@@ -2592,10 +2599,12 @@ static void modify_qp_init_to_init(struct ib_qp *ibqp,
        roce_set_field(qpc_mask->byte_4_sqpn_tst, V2_QPC_BYTE_4_SQPN_M,
                       V2_QPC_BYTE_4_SQPN_S, 0);
-        roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+        if (attr_mask & IB_QP_DEST_QPN) {
-                       V2_QPC_BYTE_56_DQPN_S, hr_qp->qpn);
+                roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-        roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+                               V2_QPC_BYTE_56_DQPN_S, hr_qp->qpn);
-                       V2_QPC_BYTE_56_DQPN_S, 0);
+                roce_set_field(qpc_mask->byte_56_dqpn_err,
+                               V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+        }
        roce_set_field(context->byte_168_irrl_idx,
                       V2_QPC_BYTE_168_SQ_SHIFT_BAK_M,
                       V2_QPC_BYTE_168_SQ_SHIFT_BAK_S,
@@ -2650,8 +2659,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
                return -EINVAL;
        }
-        if ((attr_mask & IB_QP_ALT_PATH) || (attr_mask & IB_QP_ACCESS_FLAGS) ||
+        if (attr_mask & IB_QP_ALT_PATH) {
-            (attr_mask & IB_QP_PKEY_INDEX) || (attr_mask & IB_QP_QKEY)) {
                dev_err(dev, "INIT2RTR attr_mask (0x%x) error\n", attr_mask);
                return -EINVAL;
        }
@@ -2800,10 +2808,12 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
                               V2_QPC_BYTE_140_RR_MAX_S, 0);
        }
-        roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+        if (attr_mask & IB_QP_DEST_QPN) {
-                       V2_QPC_BYTE_56_DQPN_S, attr->dest_qp_num);
+                roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-        roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+                               V2_QPC_BYTE_56_DQPN_S, attr->dest_qp_num);
-                       V2_QPC_BYTE_56_DQPN_S, 0);
+                roce_set_field(qpc_mask->byte_56_dqpn_err,
+                               V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+        }
        /* Configure GID index */
        port_num = rdma_ah_get_port_num(&attr->ah_attr);
@@ -2845,7 +2855,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
        if (ibqp->qp_type == IB_QPT_GSI || ibqp->qp_type == IB_QPT_UD)
                roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
                               V2_QPC_BYTE_24_MTU_S, IB_MTU_4096);
-        else
+        else if (attr_mask & IB_QP_PATH_MTU)
                roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
                               V2_QPC_BYTE_24_MTU_S, attr->path_mtu);
@@ -2922,11 +2932,9 @@ static int modify_qp_rtr_to_rts(struct ib_qp *ibqp,
                return -EINVAL;
        }
-        /* If exist optional param, return error */
+        /* Not support alternate path and path migration */
-        if ((attr_mask & IB_QP_ALT_PATH) || (attr_mask & IB_QP_ACCESS_FLAGS) ||
+        if ((attr_mask & IB_QP_ALT_PATH) ||
-            (attr_mask & IB_QP_QKEY) || (attr_mask & IB_QP_PATH_MIG_STATE) ||
+            (attr_mask & IB_QP_PATH_MIG_STATE)) {
-            (attr_mask & IB_QP_CUR_STATE) ||
-            (attr_mask & IB_QP_MIN_RNR_TIMER)) {
                dev_err(dev, "RTR2RTS attr_mask (0x%x)error\n", attr_mask);
                return -EINVAL;
        }
@@ -3161,7 +3169,8 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
                   (cur_state == IB_QPS_RTR && new_state == IB_QPS_ERR) ||
                   (cur_state == IB_QPS_RTS && new_state == IB_QPS_ERR) ||
                   (cur_state == IB_QPS_SQD && new_state == IB_QPS_ERR) ||
-                   (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR)) {
+                   (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR) ||
+                   (cur_state == IB_QPS_ERR && new_state == IB_QPS_ERR)) {
                /* Nothing */
                ;
        } else {
@@ -4478,7 +4487,7 @@ static int hns_roce_v2_create_eq(struct hns_roce_dev *hr_dev,
        ret = hns_roce_cmd_mbox(hr_dev, mailbox->dma, 0, eq->eqn, 0,
                                eq_cmd, HNS_ROCE_CMD_TIMEOUT_MSECS);
        if (ret) {
-                dev_err(dev, "[mailbox cmd] creat eqc failed.\n");
+                dev_err(dev, "[mailbox cmd] create eqc failed.\n");
                goto err_cmd_mbox;
        }
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index e289a924e789..d4aad34c21e2 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -620,7 +620,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
                                        to_hr_ucontext(ib_pd->uobject->context),
                                        ucmd.db_addr, &hr_qp->rdb);
                        if (ret) {
-                                dev_err(dev, "rp record doorbell map failed!\n");
+                                dev_err(dev, "rq record doorbell map failed!\n");
                                goto err_mtt;
                        }
                }
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 17f4f151a97f..61d8b06375bb 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -346,7 +346,7 @@ int mlx4_ib_umem_calc_optimal_mtt_size(struct ib_umem *umem, u64 start_va,
        /* Add to the first block the misalignment that it suffers from. */
        total_len += (first_block_start & ((1ULL << block_shift) - 1ULL));
        last_block_end = current_block_start + current_block_len;
-        last_block_aligned_end = round_up(last_block_end, 1 << block_shift);
+        last_block_aligned_end = round_up(last_block_end, 1ULL << block_shift);
        total_len += (last_block_aligned_end - last_block_end);
        if (total_len & ((1ULL << block_shift) - 1ULL))
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 50af8915e7ec..199648adac74 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -673,7 +673,8 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                                          MLX4_IB_RX_HASH_SRC_PORT_TCP  |
                                          MLX4_IB_RX_HASH_DST_PORT_TCP  |
                                          MLX4_IB_RX_HASH_SRC_PORT_UDP  |
-                                          MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+                                          MLX4_IB_RX_HASH_DST_PORT_UDP  |
+                                          MLX4_IB_RX_HASH_INNER)) {
                pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
                         ucmd->rx_hash_fields_mask);
                return (-EOPNOTSUPP);
diff --git a/drivers/infiniband/hw/mlx5/Kconfig b/drivers/infiniband/hw/mlx5/Kconfig
index bce263b92821..fb4d77be019b 100644
--- a/drivers/infiniband/hw/mlx5/Kconfig
+++ b/drivers/infiniband/hw/mlx5/Kconfig
@@ -1,6 +1,7 @@
 config MLX5_INFINIBAND
        tristate "Mellanox Connect-IB HCA support"
        depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on INFINIBAND_USER_ACCESS || INFINIBAND_USER_ACCESS=n
        ---help---
          This driver provides low-level InfiniBand support for
          Mellanox Connect-IB PCI Express host channel adapters (HCAs).
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index daa919e5a442..b4d8ff8ab807 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -52,7 +52,6 @@
 #include <linux/mlx5/port.h>
 #include <linux/mlx5/vport.h>
 #include <linux/mlx5/fs.h>
-#include <linux/mlx5/fs_helpers.h>
 #include <linux/list.h>
 #include <rdma/ib_smi.h>
 #include <rdma/ib_umem.h>
@@ -180,7 +179,7 @@ static int mlx5_netdev_event(struct notifier_block *this,
                        if (rep_ndev == ndev)
                                roce->netdev = (event == NETDEV_UNREGISTER) ?
                                        NULL : ndev;
-                } else if (ndev->dev.parent == &ibdev->mdev->pdev->dev) {
+                } else if (ndev->dev.parent == &mdev->pdev->dev) {
                        roce->netdev = (event == NETDEV_UNREGISTER) ?
                                NULL : ndev;
                }
@@ -4757,7 +4756,7 @@ mlx5_ib_get_vector_affinity(struct ib_device *ibdev, int comp_vector)
 {
        struct mlx5_ib_dev *dev = to_mdev(ibdev);
-        return mlx5_get_vector_affinity(dev->mdev, comp_vector);
+        return mlx5_get_vector_affinity_hint(dev->mdev, comp_vector);
 }
 /* The mlx5_ib_multiport_mutex should be held when calling this function */
@@ -5427,9 +5426,7 @@ static void mlx5_ib_stage_cong_debugfs_cleanup(struct mlx5_ib_dev *dev)
 static int mlx5_ib_stage_uar_init(struct mlx5_ib_dev *dev)
 {
        dev->mdev->priv.uar = mlx5_get_uars_page(dev->mdev);
-        if (!dev->mdev->priv.uar)
+        return PTR_ERR_OR_ZERO(dev->mdev->priv.uar);
-                return -ENOMEM;
-        return 0;
 }
 static void mlx5_ib_stage_uar_cleanup(struct mlx5_ib_dev *dev)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 1520a2f20f98..90a9c461cedc 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -866,25 +866,28 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
                       int *order)
 {
        struct mlx5_ib_dev *dev = to_mdev(pd->device);
+        struct ib_umem *u;
        int err;
-        *umem = ib_umem_get(pd->uobject->context, start, length,
+        *umem = NULL;
-                            access_flags, 0);
-        err = PTR_ERR_OR_ZERO(*umem);
+        u = ib_umem_get(pd->uobject->context, start, length, access_flags, 0);
+        err = PTR_ERR_OR_ZERO(u);
        if (err) {
-                *umem = NULL;
+                mlx5_ib_dbg(dev, "umem get failed (%d)\n", err);
-                mlx5_ib_err(dev, "umem get failed (%d)\n", err);
                return err;
        }
-        mlx5_ib_cont_pages(*umem, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages,
+        mlx5_ib_cont_pages(u, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages,
                           page_shift, ncont, order);
        if (!*npages) {
                mlx5_ib_warn(dev, "avoid zero region\n");
-                ib_umem_release(*umem);
+                ib_umem_release(u);
                return -EINVAL;
        }
+        *umem = u;
        mlx5_ib_dbg(dev, "npages %d, ncont %d, order %d, page_shift %d\n",
                    *npages, *ncont, *order, *page_shift);
@@ -1458,13 +1461,12 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
        int access_flags = flags & IB_MR_REREG_ACCESS ?
                            new_access_flags :
                            mr->access_flags;
-        u64 addr = (flags & IB_MR_REREG_TRANS) ? virt_addr : mr->umem->address;
-        u64 len = (flags & IB_MR_REREG_TRANS) ? length : mr->umem->length;
        int page_shift = 0;
        int upd_flags = 0;
        int npages = 0;
        int ncont = 0;
        int order = 0;
+        u64 addr, len;
        int err;
        mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
@@ -1472,6 +1474,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
        atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
+        if (!mr->umem)
+                return -EINVAL;
+        if (flags & IB_MR_REREG_TRANS) {
+                addr = virt_addr;
+                len = length;
+        } else {
+                addr = mr->umem->address;
+                len = mr->umem->length;
+        }
        if (flags != IB_MR_REREG_PD) {
                /*
                 * Replace umem. This needs to be done whether or not UMR is
@@ -1479,6 +1492,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 */
                flags |= IB_MR_REREG_TRANS;
                ib_umem_release(mr->umem);
+                mr->umem = NULL;
                err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                  &npages, &page_shift, &ncont, &order);
                if (err)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 7ed4b70f6447..87b7c1be2a11 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -259,7 +259,11 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
        } else {
                if (ucmd) {
                        qp->rq.wqe_cnt = ucmd->rq_wqe_count;
+                        if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
+                                return -EINVAL;
                        qp->rq.wqe_shift = ucmd->rq_wqe_shift;
+                        if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig)
+                                return -EINVAL;
                        qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
                        qp->rq.max_post = qp->rq.wqe_cnt;
                } else {
@@ -2451,18 +2455,18 @@ enum {
 static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate)
 {
-        if (rate == IB_RATE_PORT_CURRENT) {
+        if (rate == IB_RATE_PORT_CURRENT)
                return 0;
-        } else if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS) {
+        if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS)
                return -EINVAL;
-        } else {
-                while (rate != IB_RATE_2_5_GBPS &&
-                       !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
-                         MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
-                        --rate;
-        }
-        return rate + MLX5_STAT_RATE_OFFSET;
+        while (rate != IB_RATE_PORT_CURRENT &&
+               !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
+                 MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
+                --rate;
+        return rate ? rate + MLX5_STAT_RATE_OFFSET : rate;
 }
 static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 0a75164cedea..007d5e8a0121 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -461,7 +461,7 @@ static bool nes_nic_send(struct sk_buff *skb, struct net_device *netdev)
 /**
 * nes_netdev_start_xmit
 */
-static int nes_netdev_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+static netdev_tx_t nes_netdev_start_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
        struct nes_vnic *nesvnic = netdev_priv(netdev);
        struct nes_device *nesdev = nesvnic->nesdev;
diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c
index 61927c165b59..4cf11063e0b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_opcode.c
+++ b/drivers/infiniband/sw/rxe/rxe_opcode.c
@@ -390,7 +390,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = {
                .name   = "IB_OPCODE_RC_SEND_ONLY_INV",
                .mask   = RXE_IETH_MASK | RXE_PAYLOAD_MASK | RXE_REQ_MASK
                                | RXE_COMP_MASK | RXE_RWR_MASK | RXE_SEND_MASK
-                                | RXE_END_MASK,
+                                | RXE_END_MASK  | RXE_START_MASK,
                .length = RXE_BTH_BYTES + RXE_IETH_BYTES,
                .offset = {
                        [RXE_BTH]       = 0,
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 7bdaf71b8221..785199990457 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -728,7 +728,6 @@ next_wqe:
                rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
                if (ret == -EAGAIN) {
-                        kfree_skb(skb);
                        rxe_run_task(&qp->req.task, 1);
                        goto exit;
                }
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index a65c9969f7fc..955ff3b6da9c 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -742,7 +742,6 @@ static enum resp_states read_reply(struct rxe_qp *qp,
        err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb);
        if (err) {
                pr_err("Failed sending RDMA reply.\n");
-                kfree_skb(skb);
                return RESPST_ERR_RNR;
        }
@@ -954,10 +953,8 @@ static int send_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
        }
        err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb);
-        if (err) {
+        if (err)
                pr_err_ratelimited("Failed sending ack\n");
-                kfree_skb(skb);
-        }
 err1:
        return err;
@@ -1141,7 +1138,6 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                        if (rc) {
                                pr_err("Failed resending result. This flow is not handled - skb ignored\n");
                                rxe_drop_ref(qp);
-                                kfree_skb(skb_copy);
                                rc = RESPST_CLEANUP;
                                goto out;
                        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 161ba8c76285..cf291f90b58f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1094,7 +1094,7 @@ drop_and_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
 }
-static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
        struct rdma_netdev *rn = netdev_priv(dev);
diff --git a/drivers/infiniband/ulp/srp/Kconfig b/drivers/infiniband/ulp/srp/Kconfig
index c74ee9633041..99db8fe5173a 100644
--- a/drivers/infiniband/ulp/srp/Kconfig
+++ b/drivers/infiniband/ulp/srp/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRP
        tristate "InfiniBand SCSI RDMA Protocol"
-        depends on SCSI
+        depends on SCSI && INFINIBAND_ADDR_TRANS
        select SCSI_SRP_ATTRS
        ---help---
          Support for the SCSI RDMA Protocol over InfiniBand.  This
diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig
index 31ee83d528d9..fb8b7182f05e 100644
--- a/drivers/infiniband/ulp/srpt/Kconfig
+++ b/drivers/infiniband/ulp/srpt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRPT
        tristate "InfiniBand SCSI RDMA Protocol target support"
-        depends on INFINIBAND && TARGET_CORE
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
        ---help---
          Support for the SCSI RDMA Protocol (SRP) Target driver. The
diff --git a/drivers/input/input-leds.c b/drivers/input/input-leds.c
index 766bf2660116..5f04b2d94635 100644
--- a/drivers/input/input-leds.c
+++ b/drivers/input/input-leds.c
@@ -88,6 +88,7 @@ static int input_leds_connect(struct input_handler *handler,
                              const struct input_device_id *id)
 {
        struct input_leds *leds;
+        struct input_led *led;
        unsigned int num_leds;
        unsigned int led_code;
        int led_no;
@@ -119,14 +120,13 @@ static int input_leds_connect(struct input_handler *handler,
        led_no = 0;
        for_each_set_bit(led_code, dev->ledbit, LED_CNT) {
-                struct input_led *led = &leds->leds[led_no];
+                if (!input_led_info[led_code].name)
+                        continue;
+                led = &leds->leds[led_no];
                led->handle = &leds->handle;
                led->code = led_code;
-                if (!input_led_info[led_code].name)
-                        continue;
                led->cdev.name = kasprintf(GFP_KERNEL, "%s::%s",
                                           dev_name(&dev->dev),
                                           input_led_info[led_code].name);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0a67f235ba88..38f9501acdf0 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -583,7 +583,7 @@ static void alps_process_trackstick_packet_v3(struct psmouse *psmouse)
        x = (s8)(((packet[0] & 0x20) << 2) | (packet[1] & 0x7f));
        y = (s8)(((packet[0] & 0x10) << 3) | (packet[2] & 0x7f));
-        z = packet[4] & 0x7c;
+        z = packet[4] & 0x7f;
        /*
         * The x and y values tend to be quite large, and when used
diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c
index 76edbf2c1bce..082defc329a8 100644
--- a/drivers/input/rmi4/rmi_spi.c
+++ b/drivers/input/rmi4/rmi_spi.c
@@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xport *rmi_spi,
        if (len > RMI_SPI_XFER_SIZE_LIMIT)
                return -EINVAL;
-        if (rmi_spi->xfer_buf_size < len)
+        if (rmi_spi->xfer_buf_size < len) {
-                rmi_spi_manage_pools(rmi_spi, len);
+                ret = rmi_spi_manage_pools(rmi_spi, len);
+                if (ret < 0)
+                        return ret;
+        }
        if (addr == 0)
                /*
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 4f15496fec8b..3e613afa10b4 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -362,7 +362,7 @@ config TOUCHSCREEN_HIDEEP
          If unsure, say N.
-          To compile this driver as a moudle, choose M here : the
+          To compile this driver as a module, choose M here : the
          module will be called hideep_ts.
 config TOUCHSCREEN_ILI210X
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 5d9699fe1b55..09194721aed2 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -280,7 +280,8 @@ struct mxt_data {
        struct input_dev *input_dev;
        char phys[64];          /* device physical location */
        struct mxt_object *object_table;
-        struct mxt_info info;
+        struct mxt_info *info;
+        void *raw_info_block;
        unsigned int irq;
        unsigned int max_x;
        unsigned int max_y;
@@ -460,12 +461,13 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 {
        u8 appmode = data->client->addr;
        u8 bootloader;
+        u8 family_id = data->info ? data->info->family_id : 0;
        switch (appmode) {
        case 0x4a:
        case 0x4b:
                /* Chips after 1664S use different scheme */
-                if (retry || data->info.family_id >= 0xa2) {
+                if (retry || family_id >= 0xa2) {
                        bootloader = appmode - 0x24;
                        break;
                }
@@ -692,7 +694,7 @@ mxt_get_object(struct mxt_data *data, u8 type)
        struct mxt_object *object;
        int i;
-        for (i = 0; i < data->info.object_num; i++) {
+        for (i = 0; i < data->info->object_num; i++) {
                object = data->object_table + i;
                if (object->type == type)
                        return object;
@@ -1462,12 +1464,12 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
                data_pos += offset;
        }
-        if (cfg_info.family_id != data->info.family_id) {
+        if (cfg_info.family_id != data->info->family_id) {
                dev_err(dev, "Family ID mismatch!\n");
                return -EINVAL;
        }
-        if (cfg_info.variant_id != data->info.variant_id) {
+        if (cfg_info.variant_id != data->info->variant_id) {
                dev_err(dev, "Variant ID mismatch!\n");
                return -EINVAL;
        }
@@ -1512,7 +1514,7 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
        /* Malloc memory to store configuration */
        cfg_start_ofs = MXT_OBJECT_START +
-                        data->info.object_num * sizeof(struct mxt_object) +
+                        data->info->object_num * sizeof(struct mxt_object) +
                        MXT_INFO_CHECKSUM_SIZE;
        config_mem_size = data->mem_size - cfg_start_ofs;
        config_mem = kzalloc(config_mem_size, GFP_KERNEL);
@@ -1563,20 +1565,6 @@ release_mem:
        return ret;
 }
-static int mxt_get_info(struct mxt_data *data)
-{
-        struct i2c_client *client = data->client;
-        struct mxt_info *info = &data->info;
-        int error;
-        /* Read 7-byte info block starting at address 0 */
-        error = __mxt_read_reg(client, 0, sizeof(*info), info);
-        if (error)
-                return error;
-        return 0;
-}
 static void mxt_free_input_device(struct mxt_data *data)
 {
        if (data->input_dev) {
@@ -1591,9 +1579,10 @@ static void mxt_free_object_table(struct mxt_data *data)
        video_unregister_device(&data->dbg.vdev);
        v4l2_device_unregister(&data->dbg.v4l2);
 #endif
-        kfree(data->object_table);
        data->object_table = NULL;
+        data->info = NULL;
+        kfree(data->raw_info_block);
+        data->raw_info_block = NULL;
        kfree(data->msg_buf);
        data->msg_buf = NULL;
        data->T5_address = 0;
@@ -1609,34 +1598,18 @@ static void mxt_free_object_table(struct mxt_data *data)
        data->max_reportid = 0;
 }
-static int mxt_get_object_table(struct mxt_data *data)
+static int mxt_parse_object_table(struct mxt_data *data,
+                                  struct mxt_object *object_table)
 {
        struct i2c_client *client = data->client;
-        size_t table_size;
-        struct mxt_object *object_table;
-        int error;
        int i;
        u8 reportid;
        u16 end_address;
-        table_size = data->info.object_num * sizeof(struct mxt_object);
-        object_table = kzalloc(table_size, GFP_KERNEL);
-        if (!object_table) {
-                dev_err(&data->client->dev, "Failed to allocate memory\n");
-                return -ENOMEM;
-        }
-        error = __mxt_read_reg(client, MXT_OBJECT_START, table_size,
-                        object_table);
-        if (error) {
-                kfree(object_table);
-                return error;
-        }
        /* Valid Report IDs start counting from 1 */
        reportid = 1;
        data->mem_size = 0;
-        for (i = 0; i < data->info.object_num; i++) {
+        for (i = 0; i < data->info->object_num; i++) {
                struct mxt_object *object = object_table + i;
                u8 min_id, max_id;
@@ -1660,8 +1633,8 @@ static int mxt_get_object_table(struct mxt_data *data)
                switch (object->type) {
                case MXT_GEN_MESSAGE_T5:
-                        if (data->info.family_id == 0x80 &&
+                        if (data->info->family_id == 0x80 &&
-                            data->info.version < 0x20) {
+                            data->info->version < 0x20) {
                                /*
                                 * On mXT224 firmware versions prior to V2.0
                                 * read and discard unused CRC byte otherwise
@@ -1716,24 +1689,102 @@ static int mxt_get_object_table(struct mxt_data *data)
        /* If T44 exists, T5 position has to be directly after */
        if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
                dev_err(&client->dev, "Invalid T44 position\n");
-                error = -EINVAL;
+                return -EINVAL;
-                goto free_object_table;
        }
        data->msg_buf = kcalloc(data->max_reportid,
                                data->T5_msg_size, GFP_KERNEL);
-        if (!data->msg_buf) {
+        if (!data->msg_buf)
-                dev_err(&client->dev, "Failed to allocate message buffer\n");
+                return -ENOMEM;
+        return 0;
+}
+static int mxt_read_info_block(struct mxt_data *data)
+{
+        struct i2c_client *client = data->client;
+        int error;
+        size_t size;
+        void *id_buf, *buf;
+        uint8_t num_objects;
+        u32 calculated_crc;
+        u8 *crc_ptr;
+        /* If info block already allocated, free it */
+        if (data->raw_info_block)
+                mxt_free_object_table(data);
+        /* Read 7-byte ID information block starting at address 0 */
+        size = sizeof(struct mxt_info);
+        id_buf = kzalloc(size, GFP_KERNEL);
+        if (!id_buf)
+                return -ENOMEM;
+        error = __mxt_read_reg(client, 0, size, id_buf);
+        if (error)
+                goto err_free_mem;
+        /* Resize buffer to give space for rest of info block */
+        num_objects = ((struct mxt_info *)id_buf)->object_num;
+        size += (num_objects * sizeof(struct mxt_object))
+                + MXT_INFO_CHECKSUM_SIZE;
+        buf = krealloc(id_buf, size, GFP_KERNEL);
+        if (!buf) {
                error = -ENOMEM;
-                goto free_object_table;
+                goto err_free_mem;
+        }
+        id_buf = buf;
+        /* Read rest of info block */
+        error = __mxt_read_reg(client, MXT_OBJECT_START,
+                               size - MXT_OBJECT_START,
+                               id_buf + MXT_OBJECT_START);
+        if (error)
+                goto err_free_mem;
+        /* Extract & calculate checksum */
+        crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
+        data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
+        calculated_crc = mxt_calculate_crc(id_buf, 0,
+                                           size - MXT_INFO_CHECKSUM_SIZE);
+        /*
+         * CRC mismatch can be caused by data corruption due to I2C comms
+         * issue or else device is not using Object Based Protocol (eg i2c-hid)
+         */
+        if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
+                dev_err(&client->dev,
+                        "Info Block CRC error calculated=0x%06X read=0x%06X\n",
+                        calculated_crc, data->info_crc);
+                error = -EIO;
+                goto err_free_mem;
+        }
+        data->raw_info_block = id_buf;
+        data->info = (struct mxt_info *)id_buf;
+        dev_info(&client->dev,
+                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
+                 data->info->family_id, data->info->variant_id,
+                 data->info->version >> 4, data->info->version & 0xf,
+                 data->info->build, data->info->object_num);
+        /* Parse object table information */
+        error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
+        if (error) {
+                dev_err(&client->dev, "Error %d parsing object table\n", error);
+                mxt_free_object_table(data);
+                goto err_free_mem;
        }
-        data->object_table = object_table;
+        data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
        return 0;
-free_object_table:
+err_free_mem:
-        mxt_free_object_table(data);
+        kfree(id_buf);
        return error;
 }
@@ -2046,7 +2097,7 @@ static int mxt_initialize(struct mxt_data *data)
        int error;
        while (1) {
-                error = mxt_get_info(data);
+                error = mxt_read_info_block(data);
                if (!error)
                        break;
@@ -2077,16 +2128,9 @@ static int mxt_initialize(struct mxt_data *data)
                msleep(MXT_FW_RESET_TIME);
        }
-        /* Get object table information */
-        error = mxt_get_object_table(data);
-        if (error) {
-                dev_err(&client->dev, "Error %d reading object table\n", error);
-                return error;
-        }
        error = mxt_acquire_irq(data);
        if (error)
-                goto err_free_object_table;
+                return error;
        error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
                                        &client->dev, GFP_KERNEL, data,
@@ -2094,14 +2138,10 @@ static int mxt_initialize(struct mxt_data *data)
        if (error) {
                dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
                        error);
-                goto err_free_object_table;
+                return error;
        }
        return 0;
-err_free_object_table:
-        mxt_free_object_table(data);
-        return error;
 }
 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
@@ -2162,7 +2202,7 @@ recheck:
 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
                               unsigned int y)
 {
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
        struct mxt_dbg *dbg = &data->dbg;
        unsigned int ofs, page;
        unsigned int col = 0;
@@ -2490,7 +2530,7 @@ static const struct video_device mxt_video_device = {
 static void mxt_debug_init(struct mxt_data *data)
 {
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
        struct mxt_dbg *dbg = &data->dbg;
        struct mxt_object *object;
        int error;
@@ -2576,7 +2616,6 @@ static int mxt_configure_objects(struct mxt_data *data,
                                 const struct firmware *cfg)
 {
        struct device *dev = &data->client->dev;
-        struct mxt_info *info = &data->info;
        int error;
        error = mxt_init_t7_power_cfg(data);
@@ -2601,11 +2640,6 @@ static int mxt_configure_objects(struct mxt_data *data,
        mxt_debug_init(data);
-        dev_info(dev,
-                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
-                 info->family_id, info->variant_id, info->version >> 4,
-                 info->version & 0xf, info->build, info->object_num);
        return 0;
 }
@@ -2614,7 +2648,7 @@ static ssize_t mxt_fw_version_show(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
        struct mxt_data *data = dev_get_drvdata(dev);
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
        return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
                         info->version >> 4, info->version & 0xf, info->build);
 }
@@ -2624,7 +2658,7 @@ static ssize_t mxt_hw_version_show(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
        struct mxt_data *data = dev_get_drvdata(dev);
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
        return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
                         info->family_id, info->variant_id);
 }
@@ -2663,7 +2697,7 @@ static ssize_t mxt_object_show(struct device *dev,
                return -ENOMEM;
        error = 0;
-        for (i = 0; i < data->info.object_num; i++) {
+        for (i = 0; i < data->info->object_num; i++) {
                object = data->object_table + i;
                if (!mxt_object_readable(object->type))
@@ -3035,6 +3069,15 @@ static const struct dmi_system_id mxt_dmi_table[] = {
                .driver_data = samus_platform_data,
        },
        {
+                /* Samsung Chromebook Pro */
+                .ident = "Samsung Chromebook Pro",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Caroline"),
+                },
+                .driver_data = samus_platform_data,
+        },
+        {
                /* Other Google Chromebooks */
                .ident = "Chromebook",
                .matches = {
@@ -3254,6 +3297,11 @@ static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
 static const struct of_device_id mxt_of_match[] = {
        { .compatible = "atmel,maxtouch", },
+        /* Compatibles listed below are deprecated */
+        { .compatible = "atmel,qt602240_ts", },
+        { .compatible = "atmel,atmel_mxt_ts", },
+        { .compatible = "atmel,atmel_mxt_tp", },
+        { .compatible = "atmel,mXT224", },
        {},
 };
 MODULE_DEVICE_TABLE(of, mxt_of_match);
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 2a99f0f14795..8fb8c737fffe 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -83,7 +83,6 @@
 static DEFINE_SPINLOCK(amd_iommu_devtable_lock);
 static DEFINE_SPINLOCK(pd_bitmap_lock);
-static DEFINE_SPINLOCK(iommu_table_lock);
 /* List of all available dev_data structures */
 static LLIST_HEAD(dev_data_list);
@@ -3562,6 +3561,7 @@ EXPORT_SYMBOL(amd_iommu_device_info);
 *****************************************************************************/
 static struct irq_chip amd_ir_chip;
+static DEFINE_SPINLOCK(iommu_table_lock);
 static void set_dte_irq_entry(u16 devid, struct irq_remap_table *table)
 {
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index f05f3cf90756..ddcbbdb5d658 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -167,40 +167,16 @@ EXPORT_SYMBOL(iommu_put_dma_cookie);
 * @list: Reserved region list from iommu_get_resv_regions()
 *
 * IOMMU drivers can use this to implement their .get_resv_regions callback
- * for general non-IOMMU-specific reservations. Currently, this covers host
+ * for general non-IOMMU-specific reservations. Currently, this covers GICv3
- * bridge windows for PCI devices and GICv3 ITS region reservation on ACPI
+ * ITS region reservation on ACPI based ARM platforms that may require HW MSI
- * based ARM platforms that may require HW MSI reservation.
+ * reservation.
 */
 void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list)
 {
-        struct pci_host_bridge *bridge;
-        struct resource_entry *window;
-        if (!is_of_node(dev->iommu_fwspec->iommu_fwnode) &&
-                iort_iommu_msi_get_resv_regions(dev, list) < 0)
-                return;
-        if (!dev_is_pci(dev))
-                return;
-        bridge = pci_find_host_bridge(to_pci_dev(dev)->bus);
-        resource_list_for_each_entry(window, &bridge->windows) {
-                struct iommu_resv_region *region;
-                phys_addr_t start;
-                size_t length;
-                if (resource_type(window->res) != IORESOURCE_MEM)
-                        continue;
-                start = window->res->start - window->offset;
+        if (!is_of_node(dev->iommu_fwspec->iommu_fwnode))
-                length = window->res->end - window->res->start + 1;
+                iort_iommu_msi_get_resv_regions(dev, list);
-                region = iommu_alloc_resv_region(start, length, 0,
-                                IOMMU_RESV_RESERVED);
-                if (!region)
-                        return;
-                list_add_tail(&region->list, list);
-        }
 }
 EXPORT_SYMBOL(iommu_dma_get_resv_regions);
@@ -229,6 +205,23 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie,
        return 0;
 }
+static void iova_reserve_pci_windows(struct pci_dev *dev,
+                struct iova_domain *iovad)
+{
+        struct pci_host_bridge *bridge = pci_find_host_bridge(dev->bus);
+        struct resource_entry *window;
+        unsigned long lo, hi;
+        resource_list_for_each_entry(window, &bridge->windows) {
+                if (resource_type(window->res) != IORESOURCE_MEM)
+                        continue;
+                lo = iova_pfn(iovad, window->res->start - window->offset);
+                hi = iova_pfn(iovad, window->res->end - window->offset);
+                reserve_iova(iovad, lo, hi);
+        }
+}
 static int iova_reserve_iommu_regions(struct device *dev,
                struct iommu_domain *domain)
 {
@@ -238,6 +231,9 @@ static int iova_reserve_iommu_regions(struct device *dev,
        LIST_HEAD(resv_regions);
        int ret = 0;
+        if (dev_is_pci(dev))
+                iova_reserve_pci_windows(to_pci_dev(dev), iovad);
        iommu_get_resv_regions(dev, &resv_regions);
        list_for_each_entry(region, &resv_regions, list) {
                unsigned long lo, hi;
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index accf58388bdb..460bed4fc5b1 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1345,7 +1345,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
        struct qi_desc desc;
        if (mask) {
-                BUG_ON(addr & ((1 << (VTD_PAGE_SHIFT + mask)) - 1));
+                WARN_ON_ONCE(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1));
                addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1;
                desc.high = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE;
        } else
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 66f69af2c219..3062a154a9fb 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -1136,7 +1136,7 @@ static void intel_ir_reconfigure_irte(struct irq_data *irqd, bool force)
        irte->dest_id = IRTE_DEST(cfg->dest_apicid);
        /* Update the hardware only if the interrupt is in remapped mode. */
-        if (!force || ir_data->irq_2_iommu.mode == IRQ_REMAPPING)
+        if (force || ir_data->irq_2_iommu.mode == IRQ_REMAPPING)
                modify_irte(&ir_data->irq_2_iommu, irte);
 }
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 5fc8656c60f9..0468acfa131f 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1098,7 +1098,7 @@ static int rk_iommu_of_xlate(struct device *dev,
        data->iommu = platform_get_drvdata(iommu_dev);
        dev->archdata.iommu = data;
-        of_dev_put(iommu_dev);
+        platform_device_put(iommu_dev);
        return 0;
 }
@@ -1175,8 +1175,15 @@ static int rk_iommu_probe(struct platform_device *pdev)
        for (i = 0; i < iommu->num_clocks; ++i)
                iommu->clocks[i].id = rk_iommu_clocks[i];
+        /*
+         * iommu clocks should be present for all new devices and devicetrees
+         * but there are older devicetrees without clocks out in the wild.
+         * So clocks as optional for the time being.
+         */
        err = devm_clk_bulk_get(iommu->dev, iommu->num_clocks, iommu->clocks);
-        if (err)
+        if (err == -ENOENT)
+                iommu->num_clocks = 0;
+        else if (err)
                return err;
        err = clk_bulk_prepare(iommu->num_clocks, iommu->clocks);
diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
index f31265937439..7f0c0be322e0 100644
--- a/drivers/irqchip/qcom-irq-combiner.c
+++ b/drivers/irqchip/qcom-irq-combiner.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -68,7 +68,7 @@ static void combiner_handle_irq(struct irq_desc *desc)
                bit = readl_relaxed(combiner->regs[reg].addr);
                status = bit & combiner->regs[reg].enabled;
-                if (!status)
+                if (bit && !status)
                        pr_warn_ratelimited("Unexpected IRQ on CPU%d: (%08x %08lx %p)\n",
                                            smp_processor_id(), bit,
                                            combiner->regs[reg].enabled,
diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index 004cc3cc6123..7fa2631b422c 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -290,7 +290,7 @@ do {									\
                if (kthread_should_stop() ||                            \
                    test_bit(CACHE_SET_IO_DISABLE, &ca->set->flags)) {  \
                        set_current_state(TASK_RUNNING);                \
-                        return 0;                                       \
+                        goto out;                                       \
                }                                                       \
                                                                        \
                schedule();                                             \
@@ -378,6 +378,9 @@ retry_invalidate:
                        bch_prio_write(ca);
                }
        }
+out:
+        wait_for_kthread_stop();
+        return 0;
 }
 /* Allocation */
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index d338b7086013..3a0cfb237af9 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -392,6 +392,8 @@ struct cached_dev {
 #define DEFAULT_CACHED_DEV_ERROR_LIMIT  64
        atomic_t                io_errors;
        unsigned                error_limit;
+        char                    backing_dev_name[BDEVNAME_SIZE];
 };
 enum alloc_reserve {
@@ -464,6 +466,8 @@ struct cache {
        atomic_long_t           meta_sectors_written;
        atomic_long_t           btree_sectors_written;
        atomic_long_t           sectors_written;
+        char                    cache_dev_name[BDEVNAME_SIZE];
 };
 struct gc_stat {
diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
index 028f7b386e01..4e63c6f6c04d 100644
--- a/drivers/md/bcache/debug.c
+++ b/drivers/md/bcache/debug.c
@@ -106,7 +106,6 @@ void bch_btree_verify(struct btree *b)
 void bch_data_verify(struct cached_dev *dc, struct bio *bio)
 {
-        char name[BDEVNAME_SIZE];
        struct bio *check;
        struct bio_vec bv, cbv;
        struct bvec_iter iter, citer = { 0 };
@@ -134,7 +133,7 @@ void bch_data_verify(struct cached_dev *dc, struct bio *bio)
                                        bv.bv_len),
                                 dc->disk.c,
                                 "verify failed at dev %s sector %llu",
-                                 bdevname(dc->bdev, name),
+                                 dc->backing_dev_name,
                                 (uint64_t) bio->bi_iter.bi_sector);
                kunmap_atomic(p1);
diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index 7fac97ae036e..2ddf8515e6a5 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -52,7 +52,6 @@ void bch_submit_bbio(struct bio *bio, struct cache_set *c,
 /* IO errors */
 void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
 {
-        char buf[BDEVNAME_SIZE];
        unsigned errors;
        WARN_ONCE(!dc, "NULL pointer of struct cached_dev");
@@ -60,7 +59,7 @@ void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
        errors = atomic_add_return(1, &dc->io_errors);
        if (errors < dc->error_limit)
                pr_err("%s: IO error on backing device, unrecoverable",
-                        bio_devname(bio, buf));
+                        dc->backing_dev_name);
        else
                bch_cached_dev_error(dc);
 }
@@ -105,19 +104,18 @@ void bch_count_io_errors(struct cache *ca,
        }
        if (error) {
-                char buf[BDEVNAME_SIZE];
                unsigned errors = atomic_add_return(1 << IO_ERROR_SHIFT,
                                                    &ca->io_errors);
                errors >>= IO_ERROR_SHIFT;
                if (errors < ca->set->error_limit)
                        pr_err("%s: IO error on %s%s",
-                               bdevname(ca->bdev, buf), m,
+                               ca->cache_dev_name, m,
                               is_read ? ", recovering." : ".");
                else
                        bch_cache_set_error(ca->set,
                                            "%s: too many IO errors %s",
-                                            bdevname(ca->bdev, buf), m);
+                                            ca->cache_dev_name, m);
        }
 }
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index a65e3365eeb9..8e3e8655ed63 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -649,11 +649,8 @@ static void backing_request_endio(struct bio *bio)
                 */
                if (unlikely(s->iop.writeback &&
                             bio->bi_opf & REQ_PREFLUSH)) {
-                        char buf[BDEVNAME_SIZE];
-                        bio_devname(bio, buf);
                        pr_err("Can't flush %s: returned bi_status %i",
-                                buf, bio->bi_status);
+                                dc->backing_dev_name, bio->bi_status);
                } else {
                        /* set to orig_bio->bi_status in bio_complete() */
                        s->iop.status = bio->bi_status;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index d90d9e59ca00..3dea06b41d43 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -936,7 +936,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc)
 static void cached_dev_detach_finish(struct work_struct *w)
 {
        struct cached_dev *dc = container_of(w, struct cached_dev, detach);
-        char buf[BDEVNAME_SIZE];
        struct closure cl;
        closure_init_stack(&cl);
@@ -967,7 +966,7 @@ static void cached_dev_detach_finish(struct work_struct *w)
        mutex_unlock(&bch_register_lock);
-        pr_info("Caching disabled for %s", bdevname(dc->bdev, buf));
+        pr_info("Caching disabled for %s", dc->backing_dev_name);
        /* Drop ref we took in cached_dev_detach() */
        closure_put(&dc->disk.cl);
@@ -999,29 +998,28 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
 {
        uint32_t rtime = cpu_to_le32(get_seconds());
        struct uuid_entry *u;
-        char buf[BDEVNAME_SIZE];
        struct cached_dev *exist_dc, *t;
-        bdevname(dc->bdev, buf);
        if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) ||
            (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)))
                return -ENOENT;
        if (dc->disk.c) {
-                pr_err("Can't attach %s: already attached", buf);
+                pr_err("Can't attach %s: already attached",
+                       dc->backing_dev_name);
                return -EINVAL;
        }
        if (test_bit(CACHE_SET_STOPPING, &c->flags)) {
-                pr_err("Can't attach %s: shutting down", buf);
+                pr_err("Can't attach %s: shutting down",
+                       dc->backing_dev_name);
                return -EINVAL;
        }
        if (dc->sb.block_size < c->sb.block_size) {
                /* Will die */
                pr_err("Couldn't attach %s: block size less than set's block size",
-                       buf);
+                       dc->backing_dev_name);
                return -EINVAL;
        }
@@ -1029,7 +1027,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
                if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
                        pr_err("Tried to attach %s but duplicate UUID already attached",
-                                buf);
+                                dc->backing_dev_name);
                        return -EINVAL;
                }
@@ -1047,13 +1045,15 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        if (!u) {
                if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
-                        pr_err("Couldn't find uuid for %s in set", buf);
+                        pr_err("Couldn't find uuid for %s in set",
+                               dc->backing_dev_name);
                        return -ENOENT;
                }
                u = uuid_find_empty(c);
                if (!u) {
-                        pr_err("Not caching %s, no room for UUID", buf);
+                        pr_err("Not caching %s, no room for UUID",
+                               dc->backing_dev_name);
                        return -EINVAL;
                }
        }
@@ -1112,7 +1112,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        up_write(&dc->writeback_lock);
        pr_info("Caching %s as %s on set %pU",
-                bdevname(dc->bdev, buf), dc->disk.disk->disk_name,
+                dc->backing_dev_name,
+                dc->disk.disk->disk_name,
                dc->disk.c->sb.set_uuid);
        return 0;
 }
@@ -1225,10 +1226,10 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
                                 struct block_device *bdev,
                                 struct cached_dev *dc)
 {
-        char name[BDEVNAME_SIZE];
        const char *err = "cannot allocate memory";
        struct cache_set *c;
+        bdevname(bdev, dc->backing_dev_name);
        memcpy(&dc->sb, sb, sizeof(struct cache_sb));
        dc->bdev = bdev;
        dc->bdev->bd_holder = dc;
@@ -1237,6 +1238,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        bio_first_bvec_all(&dc->sb_bio)->bv_page = sb_page;
        get_page(sb_page);
        if (cached_dev_init(dc, sb->block_size << 9))
                goto err;
@@ -1247,7 +1249,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        if (bch_cache_accounting_add_kobjs(&dc->accounting, &dc->disk.kobj))
                goto err;
-        pr_info("registered backing device %s", bdevname(bdev, name));
+        pr_info("registered backing device %s", dc->backing_dev_name);
        list_add(&dc->list, &uncached_devices);
        list_for_each_entry(c, &bch_cache_sets, list)
@@ -1259,7 +1261,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        return;
 err:
-        pr_notice("error %s: %s", bdevname(bdev, name), err);
+        pr_notice("error %s: %s", dc->backing_dev_name, err);
        bcache_device_stop(&dc->disk);
 }
@@ -1367,7 +1369,7 @@ int bch_flash_dev_create(struct cache_set *c, uint64_t size)
 bool bch_cached_dev_error(struct cached_dev *dc)
 {
-        char name[BDEVNAME_SIZE];
+        struct cache_set *c;
        if (!dc || test_bit(BCACHE_DEV_CLOSING, &dc->disk.flags))
                return false;
@@ -1377,7 +1379,22 @@ bool bch_cached_dev_error(struct cached_dev *dc)
        smp_mb();
        pr_err("stop %s: too many IO errors on backing device %s\n",
-                dc->disk.disk->disk_name, bdevname(dc->bdev, name));
+                dc->disk.disk->disk_name, dc->backing_dev_name);
+        /*
+         * If the cached device is still attached to a cache set,
+         * even dc->io_disable is true and no more I/O requests
+         * accepted, cache device internal I/O (writeback scan or
+         * garbage collection) may still prevent bcache device from
+         * being stopped. So here CACHE_SET_IO_DISABLE should be
+         * set to c->flags too, to make the internal I/O to cache
+         * device rejected and stopped immediately.
+         * If c is NULL, that means the bcache device is not attached
+         * to any cache set, then no CACHE_SET_IO_DISABLE bit to set.
+         */
+        c = dc->disk.c;
+        if (c && test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
+                pr_info("CACHE_SET_IO_DISABLE already set");
        bcache_device_stop(&dc->disk);
        return true;
@@ -1395,7 +1412,7 @@ bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...)
                return false;
        if (test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
-                pr_warn("CACHE_SET_IO_DISABLE already set");
+                pr_info("CACHE_SET_IO_DISABLE already set");
        /* XXX: we can be called from atomic context
        acquire_console_sem();
@@ -1539,6 +1556,20 @@ static void conditional_stop_bcache_device(struct cache_set *c,
                 */
                pr_warn("stop_when_cache_set_failed of %s is \"auto\" and cache is dirty, stop it to avoid potential data corruption.",
                        d->disk->disk_name);
+                        /*
+                         * There might be a small time gap that cache set is
+                         * released but bcache device is not. Inside this time
+                         * gap, regular I/O requests will directly go into
+                         * backing device as no cache set attached to. This
+                         * behavior may also introduce potential inconsistence
+                         * data in writeback mode while cache is dirty.
+                         * Therefore before calling bcache_device_stop() due
+                         * to a broken cache device, dc->io_disable should be
+                         * explicitly set to true.
+                         */
+                        dc->io_disable = true;
+                        /* make others know io_disable is true earlier */
+                        smp_mb();
                        bcache_device_stop(d);
        } else {
                /*
@@ -2003,12 +2034,10 @@ static int cache_alloc(struct cache *ca)
 static int register_cache(struct cache_sb *sb, struct page *sb_page,
                                struct block_device *bdev, struct cache *ca)
 {
-        char name[BDEVNAME_SIZE];
        const char *err = NULL; /* must be set for any error case */
        int ret = 0;
-        bdevname(bdev, name);
+        bdevname(bdev, ca->cache_dev_name);
        memcpy(&ca->sb, sb, sizeof(struct cache_sb));
        ca->bdev = bdev;
        ca->bdev->bd_holder = ca;
@@ -2045,14 +2074,14 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                goto out;
        }
-        pr_info("registered cache device %s", name);
+        pr_info("registered cache device %s", ca->cache_dev_name);
 out:
        kobject_put(&ca->kobj);
 err:
        if (err)
-                pr_notice("error %s: %s", name, err);
+                pr_notice("error %s: %s", ca->cache_dev_name, err);
        return ret;
 }
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 4a9547cdcdc5..ad45ebe1a74b 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -244,8 +244,10 @@ static void dirty_endio(struct bio *bio)
        struct keybuf_key *w = bio->bi_private;
        struct dirty_io *io = w->private;
-        if (bio->bi_status)
+        if (bio->bi_status) {
                SET_KEY_DIRTY(&w->key, false);
+                bch_count_backing_io_errors(io->dc, bio);
+        }
        closure_put(&io->cl);
 }
diff --git a/drivers/media/i2c/saa7115.c b/drivers/media/i2c/saa7115.c
index e216cd768409..b07114b5efb2 100644
--- a/drivers/media/i2c/saa7115.c
+++ b/drivers/media/i2c/saa7115.c
@@ -20,7 +20,7 @@
 //
 // VBI support (2004) and cleanups (2005) by Hans Verkuil <hverkuil@xs4all.nl>
 //
-// Copyright (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 //      SAA7111, SAA7113 and SAA7118 support
 #include "saa711x_regs.h"
diff --git a/drivers/media/i2c/saa711x_regs.h b/drivers/media/i2c/saa711x_regs.h
index a50d480e101a..44fabe08234d 100644
--- a/drivers/media/i2c/saa711x_regs.h
+++ b/drivers/media/i2c/saa711x_regs.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0+
 * saa711x - Philips SAA711x video decoder register specifications
 *
- * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #define R_00_CHIP_VERSION                             0x00
diff --git a/drivers/media/i2c/tda7432.c b/drivers/media/i2c/tda7432.c
index 1c5c61d829d6..9b4f21237810 100644
--- a/drivers/media/i2c/tda7432.c
+++ b/drivers/media/i2c/tda7432.c
@@ -8,7 +8,7 @@
 * Muting and tone control by Jonathan Isom <jisom@ematic.com>
 *
 * Copyright (c) 2000 Eric Sandeen <eric_sandeen@bigfoot.com>
- * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 * This code is placed under the terms of the GNU General Public License
 * Based on tda9855.c by Steve VanDeBogart (vandebo@uclink.berkeley.edu)
 * Which was based on tda8425.c by Greg Alexander (c) 1998
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 2476d812f669..1734ed4ede33 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -2,7 +2,7 @@
 //
 // tvp5150 - Texas Instruments TVP5150A/AM1 and TVP5151 video decoder driver
 //
-// Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 #include <dt-bindings/media/tvp5150.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/i2c/tvp5150_reg.h b/drivers/media/i2c/tvp5150_reg.h
index c43b7b844021..d3a764cae1a0 100644
--- a/drivers/media/i2c/tvp5150_reg.h
+++ b/drivers/media/i2c/tvp5150_reg.h
@@ -3,7 +3,7 @@
 *
 * tvp5150 - Texas Instruments TVP5150A/AM1 video decoder registers
 *
- * Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #define TVP5150_VD_IN_SRC_SEL_1      0x00 /* Video input source selection #1 */
diff --git a/drivers/media/i2c/tvp7002.c b/drivers/media/i2c/tvp7002.c
index a26c1a3f7183..4599b7e28a8d 100644
--- a/drivers/media/i2c/tvp7002.c
+++ b/drivers/media/i2c/tvp7002.c
@@ -5,7 +5,7 @@
 * Author: Santiago Nunez-Corrales <santiago.nunez@ridgerun.com>
 *
 * This code is partially based upon the TVP5150 driver
- * written by Mauro Carvalho Chehab (mchehab@infradead.org),
+ * written by Mauro Carvalho Chehab <mchehab@kernel.org>,
 * the TVP514x driver written by Vaibhav Hiremath <hvaibhav@ti.com>
 * and the TVP7002 driver in the TI LSP 2.10.00.14. Revisions by
 * Muralidharan Karicheri and Snehaprabha Narnakaje (TI).
diff --git a/drivers/media/i2c/tvp7002_reg.h b/drivers/media/i2c/tvp7002_reg.h
index 3c8c8b0a6a4c..7f56ba689dfe 100644
--- a/drivers/media/i2c/tvp7002_reg.h
+++ b/drivers/media/i2c/tvp7002_reg.h
@@ -5,7 +5,7 @@
 * Author: Santiago Nunez-Corrales <santiago.nunez@ridgerun.com>
 *
 * This code is partially based upon the TVP5150 driver
- * written by Mauro Carvalho Chehab (mchehab@infradead.org),
+ * written by Mauro Carvalho Chehab <mchehab@kernel.org>,
 * the TVP514x driver written by Vaibhav Hiremath <hvaibhav@ti.com>
 * and the TVP7002 driver in the TI LSP 2.10.00.14
 *
diff --git a/drivers/media/media-devnode.c b/drivers/media/media-devnode.c
index 67ac51eff15c..6b87a721dc49 100644
--- a/drivers/media/media-devnode.c
+++ b/drivers/media/media-devnode.c
@@ -4,7 +4,7 @@
 * Copyright (C) 2010 Nokia Corporation
 *
 * Based on drivers/media/video/v4l2_dev.c code authored by
- *      Mauro Carvalho Chehab <mchehab@infradead.org> (version 2)
+ *      Mauro Carvalho Chehab <mchehab@kernel.org> (version 2)
 *      Alan Cox, <alan@lxorguk.ukuu.org.uk> (version 1)
 *
 * Contacts: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
diff --git a/drivers/media/pci/bt8xx/bttv-audio-hook.c b/drivers/media/pci/bt8xx/bttv-audio-hook.c
index 9f1f9169fb5b..346fc7f58839 100644
--- a/drivers/media/pci/bt8xx/bttv-audio-hook.c
+++ b/drivers/media/pci/bt8xx/bttv-audio-hook.c
@@ -1,7 +1,7 @@
 /*
 * Handlers for board audio hooks, splitted from bttv-cards
 *
- * Copyright (c) 2006 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 * This code is placed under the terms of the GNU General Public License
 */
diff --git a/drivers/media/pci/bt8xx/bttv-audio-hook.h b/drivers/media/pci/bt8xx/bttv-audio-hook.h
index 159d07adeff8..be16a537a03a 100644
--- a/drivers/media/pci/bt8xx/bttv-audio-hook.h
+++ b/drivers/media/pci/bt8xx/bttv-audio-hook.h
@@ -1,7 +1,7 @@
 /*
 * Handlers for board audio hooks, splitted from bttv-cards
 *
- * Copyright (c) 2006 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 * This code is placed under the terms of the GNU General Public License
 */
diff --git a/drivers/media/pci/bt8xx/bttv-cards.c b/drivers/media/pci/bt8xx/bttv-cards.c
index 1902732f90e1..2616243b2c49 100644
--- a/drivers/media/pci/bt8xx/bttv-cards.c
+++ b/drivers/media/pci/bt8xx/bttv-cards.c
@@ -2447,7 +2447,7 @@ struct tvcard bttv_tvcards[] = {
        },
                /* ---- card 0x88---------------------------------- */
        [BTTV_BOARD_ACORP_Y878F] = {
-                /* Mauro Carvalho Chehab <mchehab@infradead.org> */
+                /* Mauro Carvalho Chehab <mchehab@kernel.org> */
                .name           = "Acorp Y878F",
                .video_inputs   = 3,
                /* .audio_inputs= 1, */
@@ -2688,7 +2688,7 @@ struct tvcard bttv_tvcards[] = {
        },
        [BTTV_BOARD_ENLTV_FM_2] = {
                /* Encore TV Tuner Pro ENL TV-FM-2
-                   Mauro Carvalho Chehab <mchehab@infradead.org */
+                   Mauro Carvalho Chehab <mchehab@kernel.org> */
                .name           = "Encore ENL TV-FM-2",
                .video_inputs   = 3,
                /* .audio_inputs= 1, */
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index 707f57a9f940..de3f44b8dec6 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -13,7 +13,7 @@
    (c) 2005-2006 Nickolay V. Shmyrev <nshmyrev@yandex.ru>
    Fixes to be fully V4L2 compliant by
-    (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+    (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
    Cropping and overscan support
    Copyright (C) 2005, 2006 Michael H. Schimek <mschimek@gmx.at>
diff --git a/drivers/media/pci/bt8xx/bttv-i2c.c b/drivers/media/pci/bt8xx/bttv-i2c.c
index eccd1e3d717a..c76823eb399d 100644
--- a/drivers/media/pci/bt8xx/bttv-i2c.c
+++ b/drivers/media/pci/bt8xx/bttv-i2c.c
@@ -8,7 +8,7 @@
                           & Marcus Metzler (mocm@thp.uni-koeln.de)
    (c) 1999-2003 Gerd Knorr <kraxel@bytesex.org>
-    (c) 2005 Mauro Carvalho Chehab <mchehab@infradead.org>
+    (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
        - Multituner support and i2c address binding
    This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/pci/cx23885/cx23885-input.c b/drivers/media/pci/cx23885/cx23885-input.c
index be49589a61d2..395ff9bba759 100644
--- a/drivers/media/pci/cx23885/cx23885-input.c
+++ b/drivers/media/pci/cx23885/cx23885-input.c
@@ -13,7 +13,7 @@
 *  Copyright (C) 2008 <srinivasa.deevi at conexant dot com>
 *  Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 *                     Markus Rechberger <mrechberger@gmail.com>
- *                     Mauro Carvalho Chehab <mchehab@infradead.org>
+ *                     Mauro Carvalho Chehab <mchehab@kernel.org>
 *                     Sascha Sommer <saschasommer@freenet.de>
 *  Copyright (C) 2004, 2005 Chris Pascoe
 *  Copyright (C) 2003, 2004 Gerd Knorr
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index ab09bb55cf45..8a28fda703a2 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -4,7 +4,7 @@
 *
 *    (c) 2007 Trent Piepho <xyzzy@speakeasy.org>
 *    (c) 2005,2006 Ricardo Cerqueira <v4l@cerqueira.org>
- *    (c) 2005 Mauro Carvalho Chehab <mchehab@infradead.org>
+ *    (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
 *    Based on a dummy cx88 module by Gerd Knorr <kraxel@bytesex.org>
 *    Based on dummy.c by Jaroslav Kysela <perex@perex.cz>
 *
@@ -103,7 +103,7 @@ MODULE_PARM_DESC(index, "Index value for cx88x capture interface(s).");
 MODULE_DESCRIPTION("ALSA driver module for cx2388x based TV cards");
 MODULE_AUTHOR("Ricardo Cerqueira");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(CX88_VERSION);
diff --git a/drivers/media/pci/cx88/cx88-blackbird.c b/drivers/media/pci/cx88/cx88-blackbird.c
index 0e0952e60795..7a4876cf9f08 100644
--- a/drivers/media/pci/cx88/cx88-blackbird.c
+++ b/drivers/media/pci/cx88/cx88-blackbird.c
@@ -5,7 +5,7 @@
 *    (c) 2004 Jelle Foks <jelle@foks.us>
 *    (c) 2004 Gerd Knorr <kraxel@bytesex.org>
 *
- *    (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ *    (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 *        - video_ioctl2 conversion
 *
 *  Includes parts from the ivtv driver <http://sourceforge.net/projects/ivtv/>
diff --git a/drivers/media/pci/cx88/cx88-core.c b/drivers/media/pci/cx88/cx88-core.c
index 8bfa5b7ed91b..60988e95b637 100644
--- a/drivers/media/pci/cx88/cx88-core.c
+++ b/drivers/media/pci/cx88/cx88-core.c
@@ -4,7 +4,7 @@
 *
 * (c) 2003 Gerd Knorr <kraxel@bytesex.org> [SuSE Labs]
 *
- * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 *     - Multituner support
 *     - video_ioctl2 conversion
 *     - PAL/M fixes
diff --git a/drivers/media/pci/cx88/cx88-i2c.c b/drivers/media/pci/cx88/cx88-i2c.c
index f7692775fb5a..99f88a05a7c9 100644
--- a/drivers/media/pci/cx88/cx88-i2c.c
+++ b/drivers/media/pci/cx88/cx88-i2c.c
@@ -8,7 +8,7 @@
 * (c) 2002 Yurij Sysoev <yurij@naturesoft.net>
 * (c) 1999-2003 Gerd Knorr <kraxel@bytesex.org>
 *
- * (c) 2005 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
 *      - Multituner support and i2c address binding
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 9be682cdb644..7b113bad70d2 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -5,7 +5,7 @@
 *
 * (c) 2003-04 Gerd Knorr <kraxel@bytesex.org> [SuSE Labs]
 *
- * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 *      - Multituner support
 *      - video_ioctl2 conversion
 *      - PAL/M fixes
diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
index 5ef635e72e10..4c52ac6d8bc5 100644
--- a/drivers/media/radio/radio-aimslab.c
+++ b/drivers/media/radio/radio-aimslab.c
@@ -4,7 +4,7 @@
 * Copyright 1997 M. Kirkwood
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 * Converted to new API by Alan Cox <alan@lxorguk.ukuu.org.uk>
 * Various bugfixes and enhancements by Russell Kroll <rkroll@exploits.org>
 *
diff --git a/drivers/media/radio/radio-aztech.c b/drivers/media/radio/radio-aztech.c
index 9e12c6027359..840b7d60462b 100644
--- a/drivers/media/radio/radio-aztech.c
+++ b/drivers/media/radio/radio-aztech.c
@@ -2,7 +2,7 @@
 * radio-aztech.c - Aztech radio card driver
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@xs4all.nl>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 * Adapted to support the Video for Linux API by
 * Russell Kroll <rkroll@exploits.org>.  Based on original tuner code by:
 *
diff --git a/drivers/media/radio/radio-gemtek.c b/drivers/media/radio/radio-gemtek.c
index 3ff4c4e1435f..f051f8694ab9 100644
--- a/drivers/media/radio/radio-gemtek.c
+++ b/drivers/media/radio/radio-gemtek.c
@@ -15,7 +15,7 @@
 *    Various bugfixes and enhancements by Russell Kroll <rkroll@exploits.org>
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Note: this card seems to swap the left and right audio channels!
 *
diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
index 95f06f3b35dc..e4e758739246 100644
--- a/drivers/media/radio/radio-maxiradio.c
+++ b/drivers/media/radio/radio-maxiradio.c
@@ -27,7 +27,7 @@
 * BUGS:
 *   - card unmutes if you change frequency
 *
- * (c) 2006, 2007 by Mauro Carvalho Chehab <mchehab@infradead.org>:
+ * (c) 2006, 2007 by Mauro Carvalho Chehab <mchehab@kernel.org>:
 *      - Conversion to V4L2 API
 *      - Uses video_ioctl2 for parsing and to add debug support
 */
diff --git a/drivers/media/radio/radio-rtrack2.c b/drivers/media/radio/radio-rtrack2.c
index abeaedd8d437..5a1470eb753e 100644
--- a/drivers/media/radio/radio-rtrack2.c
+++ b/drivers/media/radio/radio-rtrack2.c
@@ -7,7 +7,7 @@
 * Various bugfixes and enhancements by Russell Kroll <rkroll@exploits.org>
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Fully tested with actual hardware and the v4l2-compliance tool.
 */
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index fc4e63d36e4c..4f9b97edd9eb 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -13,7 +13,7 @@
 *  No volume control - only mute/unmute - you have to use line volume
 *  control on SB-part of SF16-FMI/SF16-FMP/SF16-FMD
 *
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/kernel.h>       /* __setup                      */
diff --git a/drivers/media/radio/radio-terratec.c b/drivers/media/radio/radio-terratec.c
index 4f116ea294fb..1af8f29cc7d1 100644
--- a/drivers/media/radio/radio-terratec.c
+++ b/drivers/media/radio/radio-terratec.c
@@ -17,7 +17,7 @@
 *  Volume Control is done digitally
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/module.h>       /* Modules                      */
diff --git a/drivers/media/radio/radio-trust.c b/drivers/media/radio/radio-trust.c
index 26a8c6002121..a4bad322ffff 100644
--- a/drivers/media/radio/radio-trust.c
+++ b/drivers/media/radio/radio-trust.c
@@ -12,7 +12,7 @@
 * Scott McGrath    (smcgrath@twilight.vtc.vsc.edu)
 * William McGrath  (wmcgrath@twilight.vtc.vsc.edu)
 *
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <stdarg.h>
diff --git a/drivers/media/radio/radio-typhoon.c b/drivers/media/radio/radio-typhoon.c
index eb72a4d13758..d0d67ad85b8f 100644
--- a/drivers/media/radio/radio-typhoon.c
+++ b/drivers/media/radio/radio-typhoon.c
@@ -25,7 +25,7 @@
 * The frequency change is necessary since the card never seems to be
 * completely silent.
 *
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/module.h>       /* Modules                        */
diff --git a/drivers/media/radio/radio-zoltrix.c b/drivers/media/radio/radio-zoltrix.c
index 026e88eef29c..6007cd09b328 100644
--- a/drivers/media/radio/radio-zoltrix.c
+++ b/drivers/media/radio/radio-zoltrix.c
@@ -27,7 +27,7 @@
 * 2002-07-15 - Fix Stereo typo
 *
 * 2006-07-24 - Converted to V4L2 API
- *              by Mauro Carvalho Chehab <mchehab@infradead.org>
+ *              by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
 *
diff --git a/drivers/media/rc/keymaps/rc-avermedia-m135a.c b/drivers/media/rc/keymaps/rc-avermedia-m135a.c
index f6977df1a75b..d275d98d066a 100644
--- a/drivers/media/rc/keymaps/rc-avermedia-m135a.c
+++ b/drivers/media/rc/keymaps/rc-avermedia-m135a.c
@@ -12,7 +12,7 @@
 *
 * On Avermedia M135A with IR model RM-JX, the same codes exist on both
 * Positivo (BR) and original IR, initial version and remote control codes
- * added by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * added by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Positivo also ships Avermedia M135A with model RM-K6, extra control
 * codes added by Herton Ronaldo Krzesinski <herton@mandriva.com.br>
diff --git a/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c b/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c
index e4e78c1f4123..057c13b765ef 100644
--- a/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c
+++ b/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Encore ENLTV-FM v5.3
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 static struct rc_map_table encore_enltv_fm53[] = {
diff --git a/drivers/media/rc/keymaps/rc-encore-enltv2.c b/drivers/media/rc/keymaps/rc-encore-enltv2.c
index c3d4437a6fda..cd0555924456 100644
--- a/drivers/media/rc/keymaps/rc-encore-enltv2.c
+++ b/drivers/media/rc/keymaps/rc-encore-enltv2.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Encore ENLTV2-FM  - silver plastic - "Wand Media" written at the botton
-    Mauro Carvalho Chehab <mchehab@infradead.org> */
+    Mauro Carvalho Chehab <mchehab@kernel.org> */
 static struct rc_map_table encore_enltv2[] = {
        { 0x4c, KEY_POWER2 },
diff --git a/drivers/media/rc/keymaps/rc-kaiomy.c b/drivers/media/rc/keymaps/rc-kaiomy.c
index f0f88df18606..a00051339842 100644
--- a/drivers/media/rc/keymaps/rc-kaiomy.c
+++ b/drivers/media/rc/keymaps/rc-kaiomy.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Kaiomy TVnPC U2
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 static struct rc_map_table kaiomy[] = {
diff --git a/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c b/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c
index 453e04377de7..db5edde3eeb1 100644
--- a/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c
+++ b/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Kworld Plus TV Analog Lite PCI IR
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 static struct rc_map_table kworld_plus_tv_analog[] = {
diff --git a/drivers/media/rc/keymaps/rc-pixelview-new.c b/drivers/media/rc/keymaps/rc-pixelview-new.c
index 791130f108ff..e4e34f2ccf74 100644
--- a/drivers/media/rc/keymaps/rc-pixelview-new.c
+++ b/drivers/media/rc/keymaps/rc-pixelview-new.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /*
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
   present on PV MPEG 8000GT
 */
diff --git a/drivers/media/tuners/tea5761.c b/drivers/media/tuners/tea5761.c
index 88b3e80c38ad..d78a2bdb3e36 100644
--- a/drivers/media/tuners/tea5761.c
+++ b/drivers/media/tuners/tea5761.c
@@ -2,7 +2,7 @@
 // For Philips TEA5761 FM Chip
 // I2C address is always 0x20 (0x10 at 7-bit mode).
 //
-// Copyright (c) 2005-2007 Mauro Carvalho Chehab (mchehab@infradead.org)
+// Copyright (c) 2005-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 #include <linux/i2c.h>
 #include <linux/slab.h>
@@ -337,5 +337,5 @@ EXPORT_SYMBOL_GPL(tea5761_attach);
 EXPORT_SYMBOL_GPL(tea5761_autodetection);
 MODULE_DESCRIPTION("Philips TEA5761 FM tuner driver");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/tuners/tea5767.c b/drivers/media/tuners/tea5767.c
index 2b2c064d7dc3..016d0d5ec50b 100644
--- a/drivers/media/tuners/tea5767.c
+++ b/drivers/media/tuners/tea5767.c
@@ -2,7 +2,7 @@
 // For Philips TEA5767 FM Chip used on some TV Cards like Prolink Pixelview
 // I2C address is always 0xC0.
 //
-// Copyright (c) 2005 Mauro Carvalho Chehab (mchehab@infradead.org)
+// Copyright (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // tea5767 autodetection thanks to Torsten Seeboth and Atsushi Nakagawa
 // from their contributions on DScaler.
@@ -469,5 +469,5 @@ EXPORT_SYMBOL_GPL(tea5767_attach);
 EXPORT_SYMBOL_GPL(tea5767_autodetection);
 MODULE_DESCRIPTION("Philips TEA5767 FM tuner driver");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/tuners/tuner-xc2028-types.h b/drivers/media/tuners/tuner-xc2028-types.h
index bb0437c36c03..50d017a4822a 100644
--- a/drivers/media/tuners/tuner-xc2028-types.h
+++ b/drivers/media/tuners/tuner-xc2028-types.h
@@ -5,7 +5,7 @@
 * This file includes internal tipes to be used inside tuner-xc2028.
 * Shouldn't be included outside tuner-xc2028
 *
- * Copyright (c) 2007-2008 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2007-2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 /* xc3028 firmware types */
diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
index fca85e08ebd7..84744e138982 100644
--- a/drivers/media/tuners/tuner-xc2028.c
+++ b/drivers/media/tuners/tuner-xc2028.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tuner-xc2028
 //
-// Copyright (c) 2007-2008 Mauro Carvalho Chehab (mchehab@infradead.org)
+// Copyright (c) 2007-2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig (michel.ludwig@gmail.com)
 //       - frontend interface
@@ -1518,7 +1518,7 @@ EXPORT_SYMBOL(xc2028_attach);
 MODULE_DESCRIPTION("Xceive xc2028/xc3028 tuner driver");
 MODULE_AUTHOR("Michel Ludwig <michel.ludwig@gmail.com>");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
 MODULE_FIRMWARE(XC2028_DEFAULT_FIRMWARE);
 MODULE_FIRMWARE(XC3028L_DEFAULT_FIRMWARE);
diff --git a/drivers/media/tuners/tuner-xc2028.h b/drivers/media/tuners/tuner-xc2028.h
index 03fd6d4233a4..7b58bc06e35c 100644
--- a/drivers/media/tuners/tuner-xc2028.h
+++ b/drivers/media/tuners/tuner-xc2028.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tuner-xc2028
 *
- * Copyright (c) 2007-2008 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2007-2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #ifndef __TUNER_XC2028_H__
diff --git a/drivers/media/usb/em28xx/em28xx-camera.c b/drivers/media/usb/em28xx/em28xx-camera.c
index 3c2694a16ed1..d1e66b503f4d 100644
--- a/drivers/media/usb/em28xx/em28xx-camera.c
+++ b/drivers/media/usb/em28xx/em28xx-camera.c
@@ -2,7 +2,7 @@
 //
 // em28xx-camera.c - driver for Empia EM25xx/27xx/28xx USB video capture devices
 //
-// Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@kernel.org>
 // Copyright (C) 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
 // This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 6e0e67d23876..7c3203d7044b 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -5,7 +5,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 36d341fb65dd..f28995383090 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -4,7 +4,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
@@ -32,7 +32,7 @@
 #define DRIVER_AUTHOR "Ludovico Cavedon <cavedon@sssup.it>, " \
                      "Markus Rechberger <mrechberger@gmail.com>, " \
-                      "Mauro Carvalho Chehab <mchehab@infradead.org>, " \
+                      "Mauro Carvalho Chehab <mchehab@kernel.org>, " \
                      "Sascha Sommer <saschasommer@freenet.de>"
 MODULE_AUTHOR(DRIVER_AUTHOR);
diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
index a54cb8dc52c9..3f493e0b0716 100644
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -2,7 +2,7 @@
 //
 // DVB device driver for em28xx
 //
-// (c) 2008-2011 Mauro Carvalho Chehab <mchehab@infradead.org>
+// (c) 2008-2011 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // (c) 2008 Devin Heitmueller <devin.heitmueller@gmail.com>
 //      - Fixes for the driver to properly work with HVR-950
@@ -63,7 +63,7 @@
 #include "tc90522.h"
 #include "qm1d1c0042.h"
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION(DRIVER_DESC " - digital TV interface");
 MODULE_VERSION(EM28XX_VERSION);
diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
index 9151bccd859a..6458682bc6e2 100644
--- a/drivers/media/usb/em28xx/em28xx-i2c.c
+++ b/drivers/media/usb/em28xx/em28xx-i2c.c
@@ -4,7 +4,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 2dc1be00b8b8..f84a1208d5d3 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -4,7 +4,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 //
 // This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index d70ee13cc52e..68571bf36d28 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -5,7 +5,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
@@ -44,7 +44,7 @@
 #define DRIVER_AUTHOR "Ludovico Cavedon <cavedon@sssup.it>, " \
                      "Markus Rechberger <mrechberger@gmail.com>, " \
-                      "Mauro Carvalho Chehab <mchehab@infradead.org>, " \
+                      "Mauro Carvalho Chehab <mchehab@kernel.org>, " \
                      "Sascha Sommer <saschasommer@freenet.de>"
 static unsigned int isoc_debug;
diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
index 63c7c6124707..b0378e77ddff 100644
--- a/drivers/media/usb/em28xx/em28xx.h
+++ b/drivers/media/usb/em28xx/em28xx.h
@@ -4,7 +4,7 @@
 *
 * Copyright (C) 2005 Markus Rechberger <mrechberger@gmail.com>
 *                    Ludovico Cavedon <cavedon@sssup.it>
- *                    Mauro Carvalho Chehab <mchehab@infradead.org>
+ *                    Mauro Carvalho Chehab <mchehab@kernel.org>
 * Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 *
 * Based on the em2800 driver from Sascha Sommer <saschasommer@freenet.de>
diff --git a/drivers/media/usb/gspca/zc3xx-reg.h b/drivers/media/usb/gspca/zc3xx-reg.h
index a1bd94e8ce52..71fda38e85e0 100644
--- a/drivers/media/usb/gspca/zc3xx-reg.h
+++ b/drivers/media/usb/gspca/zc3xx-reg.h
@@ -1,7 +1,7 @@
 /*
 * zc030x registers
 *
- * Copyright (c) 2008 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * The register aliases used here came from this driver:
 *      http://zc0302.sourceforge.net/zc0302.php
diff --git a/drivers/media/usb/tm6000/tm6000-cards.c b/drivers/media/usb/tm6000/tm6000-cards.c
index 70939e96b856..23df50aa0a4a 100644
--- a/drivers/media/usb/tm6000/tm6000-cards.c
+++ b/drivers/media/usb/tm6000/tm6000-cards.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-cards.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 #include <linux/init.h>
 #include <linux/module.h>
diff --git a/drivers/media/usb/tm6000/tm6000-core.c b/drivers/media/usb/tm6000/tm6000-core.c
index 23a1332d98e6..d3229aa45fcb 100644
--- a/drivers/media/usb/tm6000/tm6000-core.c
+++ b/drivers/media/usb/tm6000/tm6000-core.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-core.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 //     - DVB-T support
diff --git a/drivers/media/usb/tm6000/tm6000-i2c.c b/drivers/media/usb/tm6000/tm6000-i2c.c
index c9a62bbff27a..659b63febf85 100644
--- a/drivers/media/usb/tm6000/tm6000-i2c.c
+++ b/drivers/media/usb/tm6000/tm6000-i2c.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-i2c.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 //      - Fix SMBus Read Byte command
diff --git a/drivers/media/usb/tm6000/tm6000-regs.h b/drivers/media/usb/tm6000/tm6000-regs.h
index 21587fcf11e3..d10424673db9 100644
--- a/drivers/media/usb/tm6000/tm6000-regs.h
+++ b/drivers/media/usb/tm6000/tm6000-regs.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tm6000-regs.h - driver for TM5600/TM6000/TM6010 USB video capture devices
 *
- * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 /*
diff --git a/drivers/media/usb/tm6000/tm6000-usb-isoc.h b/drivers/media/usb/tm6000/tm6000-usb-isoc.h
index 5c615b0a7a46..b275dbce3a1b 100644
--- a/drivers/media/usb/tm6000/tm6000-usb-isoc.h
+++ b/drivers/media/usb/tm6000/tm6000-usb-isoc.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tm6000-buf.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 *
- * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/videodev2.h>
diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index b2399d4266da..aa85fe31c835 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-video.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 //      - Fixed module load/unload
diff --git a/drivers/media/usb/tm6000/tm6000.h b/drivers/media/usb/tm6000/tm6000.h
index e1e45770e28d..0864ed7314eb 100644
--- a/drivers/media/usb/tm6000/tm6000.h
+++ b/drivers/media/usb/tm6000/tm6000.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tm6000.h - driver for TM5600/TM6000/TM6010 USB video capture devices
 *
- * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 *      - DVB-T support
diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index 1d0b2208e8fb..c080dcc75393 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -10,7 +10,7 @@
 *      2 of the License, or (at your option) any later version.
 *
 * Authors:     Alan Cox, <alan@lxorguk.ukuu.org.uk> (version 1)
- *              Mauro Carvalho Chehab <mchehab@infradead.org> (version 2)
+ *              Mauro Carvalho Chehab <mchehab@kernel.org> (version 2)
 *
 * Fixes:       20000516  Claudio Matsuoka <claudio@conectiva.com>
 *              - Added procfs support
@@ -1072,7 +1072,7 @@ static void __exit videodev_exit(void)
 subsys_initcall(videodev_init);
 module_exit(videodev_exit)
-MODULE_AUTHOR("Alan Cox, Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Alan Cox, Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_DESCRIPTION("Device registrar for Video4Linux drivers v2");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CHARDEV_MAJOR(VIDEO_MAJOR);
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index f48c505550e0..de5d96dbe69e 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -9,7 +9,7 @@
 * 2 of the License, or (at your option) any later version.
 *
 * Authors:     Alan Cox, <alan@lxorguk.ukuu.org.uk> (version 1)
- *              Mauro Carvalho Chehab <mchehab@infradead.org> (version 2)
+ *              Mauro Carvalho Chehab <mchehab@kernel.org> (version 2)
 */
 #include <linux/mm.h>
diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
index 2b3981842b4b..7491b337002c 100644
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -1,11 +1,11 @@
 /*
 * generic helper functions for handling video4linux capture buffers
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
@@ -38,7 +38,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_DESCRIPTION("helper module to manage video4linux buffers");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 #define dprintk(level, fmt, arg...)                                     \
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
index e02353e340dd..f46132504d88 100644
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -7,7 +7,7 @@
 * Copyright (c) 2008 Magnus Damm
 *
 * Based on videobuf-vmalloc.c,
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index add2edb23eac..7770034aae28 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -6,11 +6,11 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
@@ -48,7 +48,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_DESCRIPTION("helper module to manage video4linux dma sg buffers");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 #define dprintk(level, fmt, arg...)                                     \
diff --git a/drivers/media/v4l2-core/videobuf-vmalloc.c b/drivers/media/v4l2-core/videobuf-vmalloc.c
index 2ff7fcc77b11..45fe781aeeec 100644
--- a/drivers/media/v4l2-core/videobuf-vmalloc.c
+++ b/drivers/media/v4l2-core/videobuf-vmalloc.c
@@ -6,7 +6,7 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -41,7 +41,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_DESCRIPTION("helper module to manage video4linux vmalloc buffers");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 #define dprintk(level, fmt, arg...)                                     \
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 0c125f207aea..33053b0d1fdf 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -518,7 +518,7 @@ static int at24_get_pdata(struct device *dev, struct at24_platform_data *pdata)
        if (of_node && of_match_device(at24_of_match, dev))
                cdata = of_device_get_match_data(dev);
        else if (id)
-                cdata = (void *)&id->driver_data;
+                cdata = (void *)id->driver_data;
        else
                cdata = acpi_device_get_match_data(dev);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f9a3c1a76d5d..f33b25fbca63 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2144,14 +2144,21 @@ static const struct net_device_ops bcm_sysport_netdev_ops = {
        .ndo_select_queue       = bcm_sysport_select_queue,
 };
-static int bcm_sysport_map_queues(struct net_device *dev,
+static int bcm_sysport_map_queues(struct notifier_block *nb,
                                  struct dsa_notifier_register_info *info)
 {
-        struct bcm_sysport_priv *priv = netdev_priv(dev);
        struct bcm_sysport_tx_ring *ring;
+        struct bcm_sysport_priv *priv;
        struct net_device *slave_dev;
        unsigned int num_tx_queues;
        unsigned int q, start, port;
+        struct net_device *dev;
+        priv = container_of(nb, struct bcm_sysport_priv, dsa_notifier);
+        if (priv->netdev != info->master)
+                return 0;
+        dev = info->master;
        /* We can't be setting up queue inspection for non directly attached
         * switches
@@ -2174,11 +2181,12 @@ static int bcm_sysport_map_queues(struct net_device *dev,
        if (priv->is_lite)
                netif_set_real_num_tx_queues(slave_dev,
                                             slave_dev->num_tx_queues / 2);
        num_tx_queues = slave_dev->real_num_tx_queues;
        if (priv->per_port_num_tx_queues &&
            priv->per_port_num_tx_queues != num_tx_queues)
-                netdev_warn(slave_dev, "asymetric number of per-port queues\n");
+                netdev_warn(slave_dev, "asymmetric number of per-port queues\n");
        priv->per_port_num_tx_queues = num_tx_queues;
@@ -2201,7 +2209,7 @@ static int bcm_sysport_map_queues(struct net_device *dev,
        return 0;
 }
-static int bcm_sysport_dsa_notifier(struct notifier_block *unused,
+static int bcm_sysport_dsa_notifier(struct notifier_block *nb,
                                    unsigned long event, void *ptr)
 {
        struct dsa_notifier_register_info *info;
@@ -2211,7 +2219,7 @@ static int bcm_sysport_dsa_notifier(struct notifier_block *unused,
        info = ptr;
-        return notifier_from_errno(bcm_sysport_map_queues(info->master, info));
+        return notifier_from_errno(bcm_sysport_map_queues(nb, info));
 }
 #define REV_FMT "v%2x.%02x"
diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
index 4df282ed22c7..0beee2cc2ddd 100644
--- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
@@ -61,7 +61,7 @@ static const char hw_stat_gstrings[][ETH_GSTRING_LEN] = {
 static const char tx_fw_stat_gstrings[][ETH_GSTRING_LEN] = {
        "tx-single-collision",
        "tx-multiple-collision",
-        "tx-late-collsion",
+        "tx-late-collision",
        "tx-aborted-frames",
        "tx-lost-frames",
        "tx-carrier-sense-errors",
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 4202f9b5b966..6f410235987c 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -942,6 +942,7 @@ struct mvpp2 {
        struct clk *pp_clk;
        struct clk *gop_clk;
        struct clk *mg_clk;
+        struct clk *mg_core_clk;
        struct clk *axi_clk;
        /* List of pointers to port structures */
@@ -8768,18 +8769,27 @@ static int mvpp2_probe(struct platform_device *pdev)
                        err = clk_prepare_enable(priv->mg_clk);
                        if (err < 0)
                                goto err_gop_clk;
+                        priv->mg_core_clk = devm_clk_get(&pdev->dev, "mg_core_clk");
+                        if (IS_ERR(priv->mg_core_clk)) {
+                                priv->mg_core_clk = NULL;
+                        } else {
+                                err = clk_prepare_enable(priv->mg_core_clk);
+                                if (err < 0)
+                                        goto err_mg_clk;
+                        }
                }
                priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
                if (IS_ERR(priv->axi_clk)) {
                        err = PTR_ERR(priv->axi_clk);
                        if (err == -EPROBE_DEFER)
-                                goto err_gop_clk;
+                                goto err_mg_core_clk;
                        priv->axi_clk = NULL;
                } else {
                        err = clk_prepare_enable(priv->axi_clk);
                        if (err < 0)
-                                goto err_gop_clk;
+                                goto err_mg_core_clk;
                }
                /* Get system's tclk rate */
@@ -8793,7 +8803,7 @@ static int mvpp2_probe(struct platform_device *pdev)
        if (priv->hw_version == MVPP22) {
                err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
                if (err)
-                        goto err_mg_clk;
+                        goto err_axi_clk;
                /* Sadly, the BM pools all share the same register to
                 * store the high 32 bits of their address. So they
                 * must all have the same high 32 bits, which forces
@@ -8801,14 +8811,14 @@ static int mvpp2_probe(struct platform_device *pdev)
                 */
                err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
                if (err)
-                        goto err_mg_clk;
+                        goto err_axi_clk;
        }
        /* Initialize network controller */
        err = mvpp2_init(pdev, priv);
        if (err < 0) {
                dev_err(&pdev->dev, "failed to initialize controller\n");
-                goto err_mg_clk;
+                goto err_axi_clk;
        }
        /* Initialize ports */
@@ -8821,7 +8831,7 @@ static int mvpp2_probe(struct platform_device *pdev)
        if (priv->port_count == 0) {
                dev_err(&pdev->dev, "no ports enabled\n");
                err = -ENODEV;
-                goto err_mg_clk;
+                goto err_axi_clk;
        }
        /* Statistics must be gathered regularly because some of them (like
@@ -8849,8 +8859,13 @@ err_port_probe:
                        mvpp2_port_remove(priv->port_list[i]);
                i++;
        }
-err_mg_clk:
+err_axi_clk:
        clk_disable_unprepare(priv->axi_clk);
+err_mg_core_clk:
+        if (priv->hw_version == MVPP22)
+                clk_disable_unprepare(priv->mg_core_clk);
+err_mg_clk:
        if (priv->hw_version == MVPP22)
                clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8897,6 +8912,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                return 0;
        clk_disable_unprepare(priv->axi_clk);
+        clk_disable_unprepare(priv->mg_core_clk);
        clk_disable_unprepare(priv->mg_clk);
        clk_disable_unprepare(priv->pp_clk);
        clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index bfef69235d71..211578ffc70d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1317,7 +1317,7 @@ static int mlx4_mf_unbond(struct mlx4_dev *dev)
        ret = mlx4_unbond_fs_rules(dev);
        if (ret)
-                mlx4_warn(dev, "multifunction unbond for flow rules failedi (%d)\n", ret);
+                mlx4_warn(dev, "multifunction unbond for flow rules failed (%d)\n", ret);
        ret1 = mlx4_unbond_mac_table(dev);
        if (ret1) {
                mlx4_warn(dev, "multifunction unbond for MAC table failed (%d)\n", ret1);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 3d46ef48d5b8..c641d5656b2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -1007,12 +1007,14 @@ static void mlx5e_trust_update_sq_inline_mode(struct mlx5e_priv *priv)
        mutex_lock(&priv->state_lock);
-        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
-                goto out;
        new_channels.params = priv->channels.params;
        mlx5e_trust_update_tx_min_inline_mode(priv, &new_channels.params);
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+                priv->channels.params = new_channels.params;
+                goto out;
+        }
        /* Skip if tx_min_inline is the same */
        if (new_channels.params.tx_min_inline_mode ==
            priv->channels.params.tx_min_inline_mode)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index d8f68e4d1018..876c3e4c6193 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -877,13 +877,14 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = {
 };
 static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev,
-                                   struct mlx5e_params *params)
+                                   struct mlx5e_params *params, u16 mtu)
 {
        u8 cq_period_mode = MLX5_CAP_GEN(mdev, cq_period_start_from_cqe) ?
                                         MLX5_CQ_PERIOD_MODE_START_FROM_CQE :
                                         MLX5_CQ_PERIOD_MODE_START_FROM_EQE;
        params->hard_mtu    = MLX5E_ETH_HARD_MTU;
+        params->sw_mtu      = mtu;
        params->log_sq_size = MLX5E_REP_PARAMS_LOG_SQ_SIZE;
        params->rq_wq_type  = MLX5_WQ_TYPE_LINKED_LIST;
        params->log_rq_mtu_frames = MLX5E_REP_PARAMS_LOG_RQ_SIZE;
@@ -931,7 +932,7 @@ static void mlx5e_init_rep(struct mlx5_core_dev *mdev,
        priv->channels.params.num_channels = profile->max_nch(mdev);
-        mlx5e_build_rep_params(mdev, &priv->channels.params);
+        mlx5e_build_rep_params(mdev, &priv->channels.params, netdev->mtu);
        mlx5e_build_rep_netdev(netdev);
        mlx5e_timestamp_init(priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 707976482c09..027f54ac1ca2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -290,7 +290,7 @@ static int mlx5e_test_loopback(struct mlx5e_priv *priv)
        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                netdev_err(priv->netdev,
-                           "\tCan't perform loobpack test while device is down\n");
+                           "\tCan't perform loopback test while device is down\n");
                return -ENODEV;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 4197001f9801..3c534fc43400 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1864,7 +1864,8 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
        }
        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
-        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+        if (modify_ip_header && ip_proto != IPPROTO_TCP &&
+            ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) {
                pr_info("can't offload re-write of ip proto %d\n", ip_proto);
                return false;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 20297108528a..5532aa3675c7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -255,7 +255,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                dma_addr = dma_map_single(sq->pdev, skb_data, headlen,
                                          DMA_TO_DEVICE);
                if (unlikely(dma_mapping_error(sq->pdev, dma_addr)))
-                        return -ENOMEM;
+                        goto dma_unmap_wqe_err;
                dseg->addr       = cpu_to_be64(dma_addr);
                dseg->lkey       = sq->mkey_be;
@@ -273,7 +273,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                dma_addr = skb_frag_dma_map(sq->pdev, frag, 0, fsz,
                                            DMA_TO_DEVICE);
                if (unlikely(dma_mapping_error(sq->pdev, dma_addr)))
-                        return -ENOMEM;
+                        goto dma_unmap_wqe_err;
                dseg->addr       = cpu_to_be64(dma_addr);
                dseg->lkey       = sq->mkey_be;
@@ -285,6 +285,10 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        }
        return num_dma;
+dma_unmap_wqe_err:
+        mlx5e_dma_unmap_wqe_err(sq, num_dma);
+        return -ENOMEM;
 }
 static inline void
@@ -380,17 +384,15 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen,
                                          (struct mlx5_wqe_data_seg *)cseg + ds_cnt);
        if (unlikely(num_dma < 0))
-                goto dma_unmap_wqe_err;
+                goto err_drop;
        mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma,
                             num_bytes, num_dma, wi, cseg);
        return NETDEV_TX_OK;
-dma_unmap_wqe_err:
+err_drop:
        sq->stats.dropped++;
-        mlx5e_dma_unmap_wqe_err(sq, wi->num_dma);
        dev_kfree_skb_any(skb);
        return NETDEV_TX_OK;
@@ -645,17 +647,15 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen,
                                          (struct mlx5_wqe_data_seg *)cseg + ds_cnt);
        if (unlikely(num_dma < 0))
-                goto dma_unmap_wqe_err;
+                goto err_drop;
        mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma,
                             num_bytes, num_dma, wi, cseg);
        return NETDEV_TX_OK;
-dma_unmap_wqe_err:
+err_drop:
        sq->stats.dropped++;
-        mlx5e_dma_unmap_wqe_err(sq, wi->num_dma);
        dev_kfree_skb_any(skb);
        return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index de51e7c39bc8..c39c1692e674 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -187,6 +187,7 @@ static void del_sw_ns(struct fs_node *node);
 static void del_sw_hw_rule(struct fs_node *node);
 static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1,
                                struct mlx5_flow_destination *d2);
+static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns);
 static struct mlx5_flow_rule *
 find_flow_rule(struct fs_fte *fte,
               struct mlx5_flow_destination *dest);
@@ -481,7 +482,8 @@ static void del_sw_hw_rule(struct fs_node *node)
        if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_COUNTER  &&
            --fte->dests_size) {
-                modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION);
+                modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION) |
+                              BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_FLOW_COUNTERS);
                fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_COUNT;
                update_fte = true;
                goto out;
@@ -2351,23 +2353,27 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering)
 static int init_root_ns(struct mlx5_flow_steering *steering)
 {
+        int err;
        steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
        if (!steering->root_ns)
-                goto cleanup;
+                return -ENOMEM;
-        if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
+        err = init_root_tree(steering, &root_fs, &steering->root_ns->ns.node);
-                goto cleanup;
+        if (err)
+                goto out_err;
        set_prio_attrs(steering->root_ns);
+        err = create_anchor_flow_table(steering);
-        if (create_anchor_flow_table(steering))
+        if (err)
-                goto cleanup;
+                goto out_err;
        return 0;
-cleanup:
+out_err:
-        mlx5_cleanup_fs(steering->dev);
+        cleanup_root_ns(steering->root_ns);
-        return -ENOMEM;
+        steering->root_ns = NULL;
+        return err;
 }
 static void clean_tree(struct fs_node *node)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index c11c9a635866..4ed01182a82c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1718,13 +1718,11 @@ __mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
        struct net_device *dev = mlxsw_sp_port->dev;
        int err;
-        if (bridge_port->bridge_device->multicast_enabled) {
+        if (bridge_port->bridge_device->multicast_enabled &&
-                if (bridge_port->bridge_device->multicast_enabled) {
+            !bridge_port->mrouter) {
-                        err = mlxsw_sp_port_smid_set(mlxsw_sp_port, mid->mid,
+                err = mlxsw_sp_port_smid_set(mlxsw_sp_port, mid->mid, false);
-                                                     false);
+                if (err)
-                        if (err)
+                        netdev_err(dev, "Unable to remove port from SMID\n");
-                                netdev_err(dev, "Unable to remove port from SMID\n");
-                }
        }
        err = mlxsw_sp_port_remove_from_mid(mlxsw_sp_port, mid);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index b3567a596fc1..80df9a5d4217 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -183,17 +183,21 @@ static int
 nfp_fl_set_ipv4_udp_tun(struct nfp_fl_set_ipv4_udp_tun *set_tun,
                        const struct tc_action *action,
                        struct nfp_fl_pre_tunnel *pre_tun,
-                        enum nfp_flower_tun_type tun_type)
+                        enum nfp_flower_tun_type tun_type,
+                        struct net_device *netdev)
 {
        size_t act_size = sizeof(struct nfp_fl_set_ipv4_udp_tun);
        struct ip_tunnel_info *ip_tun = tcf_tunnel_info(action);
        u32 tmp_set_ip_tun_type_index = 0;
        /* Currently support one pre-tunnel so index is always 0. */
        int pretun_idx = 0;
+        struct net *net;
        if (ip_tun->options_len)
                return -EOPNOTSUPP;
+        net = dev_net(netdev);
        set_tun->head.jump_id = NFP_FL_ACTION_OPCODE_SET_IPV4_TUNNEL;
        set_tun->head.len_lw = act_size >> NFP_FL_LW_SIZ;
@@ -204,6 +208,7 @@ nfp_fl_set_ipv4_udp_tun(struct nfp_fl_set_ipv4_udp_tun *set_tun,
        set_tun->tun_type_index = cpu_to_be32(tmp_set_ip_tun_type_index);
        set_tun->tun_id = ip_tun->key.tun_id;
+        set_tun->ttl = net->ipv4.sysctl_ip_default_ttl;
        /* Complete pre_tunnel action. */
        pre_tun->ipv4_dst = ip_tun->key.u.ipv4.dst;
@@ -511,7 +516,8 @@ nfp_flower_loop_action(const struct tc_action *a,
                *a_len += sizeof(struct nfp_fl_pre_tunnel);
                set_tun = (void *)&nfp_fl->action_data[*a_len];
-                err = nfp_fl_set_ipv4_udp_tun(set_tun, a, pre_tun, *tun_type);
+                err = nfp_fl_set_ipv4_udp_tun(set_tun, a, pre_tun, *tun_type,
+                                              netdev);
                if (err)
                        return err;
                *a_len += sizeof(struct nfp_fl_set_ipv4_udp_tun);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index b6c0fd053a50..bee4367a2c38 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -190,7 +190,10 @@ struct nfp_fl_set_ipv4_udp_tun {
        __be16 reserved;
        __be64 tun_id __packed;
        __be32 tun_type_index;
-        __be32 extra[3];
+        __be16 reserved2;
+        u8 ttl;
+        u8 reserved3;
+        __be32 extra[2];
 };
 /* Metadata with L2 (1W/4B)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index ad02592a82b7..a997e34bcec2 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -360,7 +360,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
                }
                SET_NETDEV_DEV(repr, &priv->nn->pdev->dev);
-                nfp_net_get_mac_addr(app->pf, port);
+                nfp_net_get_mac_addr(app->pf, repr, port);
                cmsg_port_id = nfp_flower_cmsg_phys_port(phys_port);
                err = nfp_repr_init(app, repr,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
index 2a2f2fbc8850..b9618c37403f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
@@ -69,7 +69,7 @@ int nfp_app_nic_vnic_alloc(struct nfp_app *app, struct nfp_net *nn,
        if (err)
                return err < 0 ? err : 0;
-        nfp_net_get_mac_addr(app->pf, nn->port);
+        nfp_net_get_mac_addr(app->pf, nn->dp.netdev, nn->port);
        return 0;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h b/drivers/net/ethernet/netronome/nfp/nfp_main.h
index add46e28212b..42211083b51f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h
@@ -171,7 +171,9 @@ void nfp_net_pci_remove(struct nfp_pf *pf);
 int nfp_hwmon_register(struct nfp_pf *pf);
 void nfp_hwmon_unregister(struct nfp_pf *pf);
-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port);
+void
+nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev,
+                     struct nfp_port *port);
 bool nfp_ctrl_tx(struct nfp_net *nn, struct sk_buff *skb);
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
index 15fa47f622aa..45cd2092e498 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
@@ -67,23 +67,26 @@
 /**
 * nfp_net_get_mac_addr() - Get the MAC address.
 * @pf:       NFP PF handle
+ * @netdev:   net_device to set MAC address on
 * @port:     NFP port structure
 *
 * First try to get the MAC address from NSP ETH table. If that
 * fails generate a random address.
 */
-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port)
+void
+nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev,
+                     struct nfp_port *port)
 {
        struct nfp_eth_table_port *eth_port;
        eth_port = __nfp_port_get_eth_port(port);
        if (!eth_port) {
-                eth_hw_addr_random(port->netdev);
+                eth_hw_addr_random(netdev);
                return;
        }
-        ether_addr_copy(port->netdev->dev_addr, eth_port->mac_addr);
+        ether_addr_copy(netdev->dev_addr, eth_port->mac_addr);
-        ether_addr_copy(port->netdev->perm_addr, eth_port->mac_addr);
+        ether_addr_copy(netdev->perm_addr, eth_port->mac_addr);
 }
 static struct nfp_eth_table_port *
@@ -511,16 +514,18 @@ static int nfp_net_pci_map_mem(struct nfp_pf *pf)
                return PTR_ERR(mem);
        }
-        min_size =  NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1);
+        if (pf->eth_tbl) {
-        pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats",
+                min_size =  NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1);
-                                          "net.macstats", min_size,
+                pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats",
-                                          &pf->mac_stats_bar);
+                                                  "net.macstats", min_size,
-        if (IS_ERR(pf->mac_stats_mem)) {
+                                                  &pf->mac_stats_bar);
-                if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) {
+                if (IS_ERR(pf->mac_stats_mem)) {
-                        err = PTR_ERR(pf->mac_stats_mem);
+                        if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) {
-                        goto err_unmap_ctrl;
+                                err = PTR_ERR(pf->mac_stats_mem);
+                                goto err_unmap_ctrl;
+                        }
+                        pf->mac_stats_mem = NULL;
                }
-                pf->mac_stats_mem = NULL;
        }
        pf->vf_cfg_mem = nfp_net_pf_map_rtsym(pf, "net.vfcfg",
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 74fc626b1ec1..38502815d681 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2370,7 +2370,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)
        u8 flags = 0;
        if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
-                DP_INFO(cdev, "Cannot transmit a checksumed packet\n");
+                DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index fb7c2d1562ae..6acfd43c1a4f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -848,7 +848,7 @@ int qed_roce_query_qp(struct qed_hwfn *p_hwfn,
        if (!(qp->resp_offloaded)) {
                DP_NOTICE(p_hwfn,
-                          "The responder's qp should be offloded before requester's\n");
+                          "The responder's qp should be offloaded before requester's\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index d24b47b8e0b2..d118da5a10a2 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -2224,7 +2224,7 @@ static void rtl8139_poll_controller(struct net_device *dev)
        struct rtl8139_private *tp = netdev_priv(dev);
        const int irq = tp->pci_dev->irq;
-        disable_irq(irq);
+        disable_irq_nosync(irq);
        rtl8139_interrupt(irq, dev);
        enable_irq(irq);
 }
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 63036d9bf3e6..d90a7b1f4088 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4784,8 +4784,9 @@ expire:
         * will set rule->filter_id to EFX_ARFS_FILTER_ID_PENDING, meaning that
         * the rule is not removed by efx_rps_hash_del() below.
         */
-        ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
+        if (ret)
-                                              filter_idx, true) == 0;
+                ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
+                                                      filter_idx, true) == 0;
        /* While we can't safely dereference rule (we dropped the lock), we can
         * still test it for NULL.
         */
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 64a94f242027..d2e254f2f72b 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -839,6 +839,8 @@ static void efx_filter_rfs_work(struct work_struct *data)
        int rc;
        rc = efx->type->filter_insert(efx, &req->spec, true);
+        if (rc >= 0)
+                rc %= efx->type->max_rx_ip_filters;
        if (efx->rps_hash_table) {
                spin_lock_bh(&efx->rps_hash_lock);
                rule = efx_rps_hash_find(efx, &req->spec);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 74f828412055..28d893b93d30 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1340,6 +1340,8 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
        cpsw_ale_add_ucast(cpsw->ale, priv->mac_addr,
                           HOST_PORT_NUM, ALE_VLAN |
                           ALE_SECURE, slave->port_vlan);
+        cpsw_ale_control_set(cpsw->ale, slave_port,
+                             ALE_PORT_DROP_UNKNOWN_VLAN, 1);
 }
 static void soft_reset_slave(struct cpsw_slave *slave)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index ac23322a32e1..9e4ba8e80a18 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -535,8 +535,17 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id,
        /* Grab the bits from PHYIR1, and put them in the upper half */
        phy_reg = mdiobus_read(bus, addr, MII_PHYSID1);
-        if (phy_reg < 0)
+        if (phy_reg < 0) {
+                /* if there is no device, return without an error so scanning
+                 * the bus works properly
+                 */
+                if (phy_reg == -EIO || phy_reg == -ENODEV) {
+                        *phy_id = 0xffffffff;
+                        return 0;
+                }
                return -EIO;
+        }
        *phy_id = (phy_reg & 0xffff) << 16;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c853e7410f5a..42565dd33aa6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1098,6 +1098,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x9080, 8)},
        {QMI_FIXED_INTF(0x05c6, 0x9083, 3)},
        {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
+        {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)},    /* ublox R410M */
        {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
        {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
@@ -1343,6 +1344,18 @@ static int qmi_wwan_probe(struct usb_interface *intf,
                id->driver_info = (unsigned long)&qmi_wwan_info;
        }
+        /* There are devices where the same interface number can be
+         * configured as different functions. We should only bind to
+         * vendor specific functions when matching on interface number
+         */
+        if (id->match_flags & USB_DEVICE_ID_MATCH_INT_NUMBER &&
+            desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) {
+                dev_dbg(&intf->dev,
+                        "Rejecting interface number match for class %02x\n",
+                        desc->bInterfaceClass);
+                return -ENODEV;
+        }
        /* Quectel EC20 quirk where we've QMI on interface 4 instead of 0 */
        if (quectel_ec20_detected(intf) && desc->bInterfaceNumber == 0) {
                dev_dbg(&intf->dev, "Quectel EC20 quirk, skipping interface 0\n");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index 9277f4c2bfeb..94e177d7c9b5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -459,7 +459,7 @@ static void brcmf_fw_free_request(struct brcmf_fw_request *req)
        kfree(req);
 }
-static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
 {
        struct brcmf_fw *fwctx = ctx;
        struct brcmf_fw_item *cur;
@@ -498,13 +498,10 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
        brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
        cur->nv_data.data = nvram;
        cur->nv_data.len = nvram_length;
-        return;
+        return 0;
 fail:
-        brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+        return -ENOENT;
-        fwctx->done(fwctx->dev, -ENOENT, NULL);
-        brcmf_fw_free_request(fwctx->req);
-        kfree(fwctx);
 }
 static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
@@ -553,20 +550,27 @@ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
        brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
                  fw ? "" : "not ");
-        if (fw) {
+        if (!fw)
-                if (cur->type == BRCMF_FW_TYPE_BINARY)
-                        cur->binary = fw;
-                else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-                        brcmf_fw_request_nvram_done(fw, fwctx);
-                else
-                        release_firmware(fw);
-        } else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
-                brcmf_fw_request_nvram_done(NULL, fwctx);
-        } else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
                ret = -ENOENT;
+        switch (cur->type) {
+        case BRCMF_FW_TYPE_NVRAM:
+                ret = brcmf_fw_request_nvram_done(fw, fwctx);
+                break;
+        case BRCMF_FW_TYPE_BINARY:
+                cur->binary = fw;
+                break;
+        default:
+                /* something fishy here so bail out early */
+                brcmf_err("unknown fw type: %d\n", cur->type);
+                release_firmware(fw);
+                ret = -EINVAL;
                goto fail;
        }
+        if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+                goto fail;
        do {
                if (++fwctx->curpos == fwctx->req->n_items) {
                        ret = 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 7af3a0f51b77..a17c4a79b8d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -8,6 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -749,13 +750,9 @@ struct iwl_scan_req_umac {
 } __packed;
 #define IWL_SCAN_REQ_UMAC_SIZE_V8 sizeof(struct iwl_scan_req_umac)
-#define IWL_SCAN_REQ_UMAC_SIZE_V7 (sizeof(struct iwl_scan_req_umac) - \
+#define IWL_SCAN_REQ_UMAC_SIZE_V7 48
-                                         4 * sizeof(u8))
+#define IWL_SCAN_REQ_UMAC_SIZE_V6 44
-#define IWL_SCAN_REQ_UMAC_SIZE_V6 (sizeof(struct iwl_scan_req_umac) - \
+#define IWL_SCAN_REQ_UMAC_SIZE_V1 36
-                                   2 * sizeof(u8) - sizeof(__le16))
-#define IWL_SCAN_REQ_UMAC_SIZE_V1 (sizeof(struct iwl_scan_req_umac) - \
-                                   2 * sizeof(__le32) - 2 * sizeof(u8) - \
-                                   sizeof(__le16))
 /**
 * struct iwl_umac_scan_abort
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 8928613e033e..ca0174680af9 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -76,6 +76,7 @@
 #include "iwl-io.h"
 #include "iwl-csr.h"
 #include "fw/acpi.h"
+#include "fw/api/nvm-reg.h"
 /* NVM offsets (in words) definitions */
 enum nvm_offsets {
@@ -146,8 +147,8 @@ static const u8 iwl_ext_nvm_channels[] = {
        149, 153, 157, 161, 165, 169, 173, 177, 181
 };
-#define IWL_NUM_CHANNELS                ARRAY_SIZE(iwl_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS            ARRAY_SIZE(iwl_nvm_channels)
-#define IWL_NUM_CHANNELS_EXT    ARRAY_SIZE(iwl_ext_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS_EXT        ARRAY_SIZE(iwl_ext_nvm_channels)
 #define NUM_2GHZ_CHANNELS               14
 #define NUM_2GHZ_CHANNELS_EXT   14
 #define FIRST_2GHZ_HT_MINUS             5
@@ -301,11 +302,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
        const u8 *nvm_chan;
        if (cfg->nvm_type != IWL_NVM_EXT) {
-                num_of_ch = IWL_NUM_CHANNELS;
+                num_of_ch = IWL_NVM_NUM_CHANNELS;
                nvm_chan = &iwl_nvm_channels[0];
                num_2ghz_channels = NUM_2GHZ_CHANNELS;
        } else {
-                num_of_ch = IWL_NUM_CHANNELS_EXT;
+                num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
                nvm_chan = &iwl_ext_nvm_channels[0];
                num_2ghz_channels = NUM_2GHZ_CHANNELS_EXT;
        }
@@ -720,12 +721,12 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        if (cfg->nvm_type != IWL_NVM_EXT)
                data = kzalloc(sizeof(*data) +
                               sizeof(struct ieee80211_channel) *
-                               IWL_NUM_CHANNELS,
+                               IWL_NVM_NUM_CHANNELS,
                               GFP_KERNEL);
        else
                data = kzalloc(sizeof(*data) +
                               sizeof(struct ieee80211_channel) *
-                               IWL_NUM_CHANNELS_EXT,
+                               IWL_NVM_NUM_CHANNELS_EXT,
                               GFP_KERNEL);
        if (!data)
                return NULL;
@@ -842,24 +843,34 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
        return flags;
 }
+struct regdb_ptrs {
+        struct ieee80211_wmm_rule *rule;
+        u32 token;
+};
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
-                       int num_of_ch, __le32 *channels, u16 fw_mcc)
+                       int num_of_ch, __le32 *channels, u16 fw_mcc,
+                       u16 geo_info)
 {
        int ch_idx;
        u16 ch_flags;
        u32 reg_rule_flags, prev_reg_rule_flags = 0;
        const u8 *nvm_chan = cfg->nvm_type == IWL_NVM_EXT ?
                             iwl_ext_nvm_channels : iwl_nvm_channels;
-        struct ieee80211_regdomain *regd;
+        struct ieee80211_regdomain *regd, *copy_rd;
-        int size_of_regd;
+        int size_of_regd, regd_to_copy, wmms_to_copy;
+        int size_of_wmms = 0;
        struct ieee80211_reg_rule *rule;
+        struct ieee80211_wmm_rule *wmm_rule, *d_wmm, *s_wmm;
+        struct regdb_ptrs *regdb_ptrs;
        enum nl80211_band band;
        int center_freq, prev_center_freq = 0;
-        int valid_rules = 0;
+        int valid_rules = 0, n_wmms = 0;
+        int i;
        bool new_rule;
        int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
-                         IWL_NUM_CHANNELS_EXT : IWL_NUM_CHANNELS;
+                         IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
                return ERR_PTR(-EINVAL);
@@ -875,10 +886,26 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                sizeof(struct ieee80211_regdomain) +
                num_of_ch * sizeof(struct ieee80211_reg_rule);
-        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (geo_info & GEO_WMM_ETSI_5GHZ_INFO)
+                size_of_wmms =
+                        num_of_ch * sizeof(struct ieee80211_wmm_rule);
+        regd = kzalloc(size_of_regd + size_of_wmms, GFP_KERNEL);
        if (!regd)
                return ERR_PTR(-ENOMEM);
+        regdb_ptrs = kcalloc(num_of_ch, sizeof(*regdb_ptrs), GFP_KERNEL);
+        if (!regdb_ptrs) {
+                copy_rd = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+        /* set alpha2 from FW. */
+        regd->alpha2[0] = fw_mcc >> 8;
+        regd->alpha2[1] = fw_mcc & 0xff;
+        wmm_rule = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
        for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
                ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
                band = (ch_idx < NUM_2GHZ_CHANNELS) ?
@@ -927,14 +954,66 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
                                            nvm_chan[ch_idx], ch_flags);
+                if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
+                    band == NL80211_BAND_2GHZ)
+                        continue;
+                if (!reg_query_regdb_wmm(regd->alpha2, center_freq,
+                                         &regdb_ptrs[n_wmms].token, wmm_rule)) {
+                        /* Add only new rules */
+                        for (i = 0; i < n_wmms; i++) {
+                                if (regdb_ptrs[i].token ==
+                                    regdb_ptrs[n_wmms].token) {
+                                        rule->wmm_rule = regdb_ptrs[i].rule;
+                                        break;
+                                }
+                        }
+                        if (i == n_wmms) {
+                                rule->wmm_rule = wmm_rule;
+                                regdb_ptrs[n_wmms++].rule = wmm_rule;
+                                wmm_rule++;
+                        }
+                }
        }
        regd->n_reg_rules = valid_rules;
+        regd->n_wmm_rules = n_wmms;
-        /* set alpha2 from FW. */
+        /*
-        regd->alpha2[0] = fw_mcc >> 8;
+         * Narrow down regdom for unused regulatory rules to prevent hole
-        regd->alpha2[1] = fw_mcc & 0xff;
+         * between reg rules to wmm rules.
+         */
+        regd_to_copy = sizeof(struct ieee80211_regdomain) +
+                valid_rules * sizeof(struct ieee80211_reg_rule);
+        wmms_to_copy = sizeof(struct ieee80211_wmm_rule) * n_wmms;
+        copy_rd = kzalloc(regd_to_copy + wmms_to_copy, GFP_KERNEL);
+        if (!copy_rd) {
+                copy_rd = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+        memcpy(copy_rd, regd, regd_to_copy);
+        memcpy((u8 *)copy_rd + regd_to_copy, (u8 *)regd + size_of_regd,
+               wmms_to_copy);
+        d_wmm = (struct ieee80211_wmm_rule *)((u8 *)copy_rd + regd_to_copy);
+        s_wmm = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
+        for (i = 0; i < regd->n_reg_rules; i++) {
+                if (!regd->reg_rules[i].wmm_rule)
+                        continue;
+                copy_rd->reg_rules[i].wmm_rule = d_wmm +
+                        (regd->reg_rules[i].wmm_rule - s_wmm) /
+                        sizeof(struct ieee80211_wmm_rule);
+        }
-        return regd;
+out:
+        kfree(regdb_ptrs);
+        kfree(regd);
+        return copy_rd;
 }
 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
index 306736c7a042..3071a23b7606 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
@@ -101,12 +101,14 @@ void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
 *
 * This function parses the regulatory channel data received as a
 * MCC_UPDATE_CMD command. It returns a newly allocation regulatory domain,
- * to be fed into the regulatory core. An ERR_PTR is returned on error.
+ * to be fed into the regulatory core. In case the geo_info is set handle
+ * accordingly. An ERR_PTR is returned on error.
 * If not given to the regulatory core, the user is responsible for freeing
 * the regdomain returned here with kfree.
 */
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
-                       int num_of_ch, __le32 *channels, u16 fw_mcc);
+                       int num_of_ch, __le32 *channels, u16 fw_mcc,
+                       u16 geo_info);
 #endif /* __iwl_nvm_parse_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 51b30424575b..90f8c89ea59c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -311,7 +311,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
        regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                      __le32_to_cpu(resp->n_channels),
                                      resp->channels,
-                                      __le16_to_cpu(resp->mcc));
+                                      __le16_to_cpu(resp->mcc),
+                                      __le16_to_cpu(resp->geo_info));
        /* Store the return source id */
        src_id = resp->source_id;
        kfree(resp);
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
index 8b6b07a936f5..b026e80940a4 100644
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
@@ -158,16 +158,6 @@ static u8 halbtc_get_wifi_central_chnl(struct btc_coexist *btcoexist)
 static u8 rtl_get_hwpg_single_ant_path(struct rtl_priv *rtlpriv)
 {
-        struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
-        /* override ant_num / ant_path */
-        if (mod_params->ant_sel) {
-                rtlpriv->btcoexist.btc_info.ant_num =
-                        (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
-                rtlpriv->btcoexist.btc_info.single_ant_path =
-                        (mod_params->ant_sel == 1 ? 0 : 1);
-        }
        return rtlpriv->btcoexist.btc_info.single_ant_path;
 }
@@ -178,7 +168,6 @@ static u8 rtl_get_hwpg_bt_type(struct rtl_priv *rtlpriv)
 static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv)
 {
-        struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
        u8 num;
        if (rtlpriv->btcoexist.btc_info.ant_num == ANT_X2)
@@ -186,10 +175,6 @@ static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv)
        else
                num = 1;
-        /* override ant_num / ant_path */
-        if (mod_params->ant_sel)
-                num = (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1) + 1;
        return num;
 }
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index e7bbbc95cdb1..b4f3f91b590e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -848,6 +848,9 @@ static bool _rtl8723be_init_mac(struct ieee80211_hw *hw)
                return false;
        }
+        if (rtlpriv->cfg->ops->get_btc_status())
+                rtlpriv->btcoexist.btc_ops->btc_power_on_setting(rtlpriv);
        bytetmp = rtl_read_byte(rtlpriv, REG_MULTI_FUNC_CTRL);
        rtl_write_byte(rtlpriv, REG_MULTI_FUNC_CTRL, bytetmp | BIT(3));
@@ -2696,21 +2699,21 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
                rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B;
                rtlpriv->btcoexist.btc_info.ant_num = (value & 0x1);
                rtlpriv->btcoexist.btc_info.single_ant_path =
-                         (value & 0x40);        /*0xc3[6]*/
+                         (value & 0x40 ? ANT_AUX : ANT_MAIN);   /*0xc3[6]*/
        } else {
                rtlpriv->btcoexist.btc_info.btcoexist = 0;
                rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B;
                rtlpriv->btcoexist.btc_info.ant_num = ANT_X2;
-                rtlpriv->btcoexist.btc_info.single_ant_path = 0;
+                rtlpriv->btcoexist.btc_info.single_ant_path = ANT_MAIN;
        }
        /* override ant_num / ant_path */
        if (mod_params->ant_sel) {
                rtlpriv->btcoexist.btc_info.ant_num =
-                        (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
+                        (mod_params->ant_sel == 1 ? ANT_X1 : ANT_X2);
                rtlpriv->btcoexist.btc_info.single_ant_path =
-                        (mod_params->ant_sel == 1 ? 0 : 1);
+                        (mod_params->ant_sel == 1 ? ANT_AUX : ANT_MAIN);
        }
 }
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index d27e33960e77..ce1754054a07 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -2823,6 +2823,11 @@ enum bt_ant_num {
        ANT_X1 = 1,
 };
+enum bt_ant_path {
+        ANT_MAIN = 0,
+        ANT_AUX = 1,
+};
 enum bt_co_type {
        BT_2WIRE = 0,
        BT_ISSC_3WIRE = 1,
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index b979cf3bce65..88a8b5916624 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -27,7 +27,7 @@ config NVME_FABRICS
 config NVME_RDMA
        tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND && BLOCK
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK
        select NVME_CORE
        select NVME_FABRICS
        select SG_POOL
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9df4f71e58ca..a3771c5729f5 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -764,6 +764,7 @@ static int nvme_submit_user_cmd(struct request_queue *q,
                                ret = PTR_ERR(meta);
                                goto out_unmap;
                        }
+                        req->cmd_flags |= REQ_INTEGRITY;
                }
        }
@@ -2997,31 +2998,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
        if (nvme_init_ns_head(ns, nsid, id))
                goto out_free_id;
        nvme_setup_streams_ns(ctrl, ns);
-        
+        nvme_set_disk_name(disk_name, ns, ctrl, &flags);
-#ifdef CONFIG_NVME_MULTIPATH
-        /*
-         * If multipathing is enabled we need to always use the subsystem
-         * instance number for numbering our devices to avoid conflicts
-         * between subsystems that have multiple controllers and thus use
-         * the multipath-aware subsystem node and those that have a single
-         * controller and use the controller node directly.
-         */
-        if (ns->head->disk) {
-                sprintf(disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
-                                ctrl->cntlid, ns->head->instance);
-                flags = GENHD_FL_HIDDEN;
-        } else {
-                sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance,
-                                ns->head->instance);
-        }
-#else
-        /*
-         * But without the multipath code enabled, multiple controller per
-         * subsystems are visible as devices and thus we cannot use the
-         * subsystem instance.
-         */
-        sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
-#endif
        if ((ctrl->quirks & NVME_QUIRK_LIGHTNVM) && id->vs[0] == 0x1) {
                if (nvme_nvm_register(ns, disk_name, node)) {
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 124c458806df..7ae732a77fe8 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -668,6 +668,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->transport);
                        opts->transport = p;
                        break;
                case NVMF_OPT_NQN:
@@ -676,6 +677,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->subsysnqn);
                        opts->subsysnqn = p;
                        nqnlen = strlen(opts->subsysnqn);
                        if (nqnlen >= NVMF_NQN_SIZE) {
@@ -698,6 +700,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->traddr);
                        opts->traddr = p;
                        break;
                case NVMF_OPT_TRSVCID:
@@ -706,6 +709,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->trsvcid);
                        opts->trsvcid = p;
                        break;
                case NVMF_OPT_QUEUE_SIZE:
@@ -792,6 +796,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -EINVAL;
                                goto out;
                        }
+                        nvmf_host_put(opts->host);
                        opts->host = nvmf_host_add(p);
                        kfree(p);
                        if (!opts->host) {
@@ -817,6 +822,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->host_traddr);
                        opts->host_traddr = p;
                        break;
                case NVMF_OPT_HOST_ID:
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 956e0b8e9c4d..d7b664ae5923 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -15,10 +15,32 @@
 #include "nvme.h"
 static bool multipath = true;
-module_param(multipath, bool, 0644);
+module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
        "turn on native support for multiple controllers per subsystem");
+/*
+ * If multipathing is enabled we need to always use the subsystem instance
+ * number for numbering our devices to avoid conflicts between subsystems that
+ * have multiple controllers and thus use the multipath-aware subsystem node
+ * and those that have a single controller and use the controller node
+ * directly.
+ */
+void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+                        struct nvme_ctrl *ctrl, int *flags)
+{
+        if (!multipath) {
+                sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
+        } else if (ns->head->disk) {
+                sprintf(disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
+                                ctrl->cntlid, ns->head->instance);
+                *flags = GENHD_FL_HIDDEN;
+        } else {
+                sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance,
+                                ns->head->instance);
+        }
+}
 void nvme_failover_req(struct request *req)
 {
        struct nvme_ns *ns = req->q->queuedata;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 061fecfd44f5..7ded7a51c430 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -436,6 +436,8 @@ extern const struct attribute_group nvme_ns_id_attr_group;
 extern const struct block_device_operations nvme_ns_head_ops;
 #ifdef CONFIG_NVME_MULTIPATH
+void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+                        struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
 bool nvme_req_needs_failover(struct request *req, blk_status_t error);
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
@@ -461,6 +463,16 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
 }
 #else
+/*
+ * Without the multipath code enabled, multiple controller per subsystems are
+ * visible as devices and thus we cannot use the subsystem instance.
+ */
+static inline void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+                                      struct nvme_ctrl *ctrl, int *flags)
+{
+        sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
+}
 static inline void nvme_failover_req(struct request *req)
 {
 }
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 5f4f8b16685f..3c7b61ddb0d1 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP
 config NVME_TARGET_RDMA
        tristate "NVMe over Fabrics RDMA target support"
-        depends on INFINIBAND
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
        depends on NVME_TARGET
        select SGL_ALLOC
        help
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 31fdfba556a8..27a8561c0cb9 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -469,6 +469,12 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
        nvme_stop_ctrl(&ctrl->ctrl);
        nvme_loop_shutdown_ctrl(ctrl);
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+                /* state change failure should never happen */
+                WARN_ON_ONCE(1);
+                return;
+        }
        ret = nvme_loop_configure_admin_queue(ctrl);
        if (ret)
                goto out_disable;
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index acba1f56af3e..126cf19e869b 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -1263,7 +1263,7 @@ static struct parisc_driver ccio_driver __refdata = {
 * I/O Page Directory, the resource map, and initalizing the
 * U2/Uturn chip into virtual mode.
 */
-static void
+static void __init
 ccio_ioc_init(struct ioc *ioc)
 {
        int i;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 39d06dd1f63a..bc309c5327ff 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -154,7 +154,7 @@ config DELL_LAPTOP
        depends on ACPI_VIDEO || ACPI_VIDEO = n
        depends on RFKILL || RFKILL = n
        depends on SERIO_I8042
-        select DELL_SMBIOS
+        depends on DELL_SMBIOS
        select POWER_SUPPLY
        select LEDS_CLASS
        select NEW_LEDS
diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
index d4aeac3477f5..f086469ea740 100644
--- a/drivers/platform/x86/asus-wireless.c
+++ b/drivers/platform/x86/asus-wireless.c
@@ -178,8 +178,10 @@ static int asus_wireless_remove(struct acpi_device *adev)
 {
        struct asus_wireless_data *data = acpi_driver_data(adev);
-        if (data->wq)
+        if (data->wq) {
+                devm_led_classdev_unregister(&adev->dev, &data->led);
                destroy_workqueue(data->wq);
+        }
        return 0;
 }
diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
index 8e70a627e0bb..cbbafdcaaecb 100644
--- a/drivers/remoteproc/qcom_q6v5_pil.c
+++ b/drivers/remoteproc/qcom_q6v5_pil.c
@@ -1083,6 +1083,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
                dev_err(qproc->dev, "unable to resolve mba region\n");
                return ret;
        }
+        of_node_put(node);
        qproc->mba_phys = r.start;
        qproc->mba_size = resource_size(&r);
@@ -1100,6 +1101,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
                dev_err(qproc->dev, "unable to resolve mpss region\n");
                return ret;
        }
+        of_node_put(node);
        qproc->mpss_phys = qproc->mpss_reloc = r.start;
        qproc->mpss_size = resource_size(&r);
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 6d9c5832ce47..a9609d971f7f 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1163,7 +1163,7 @@ int rproc_trigger_recovery(struct rproc *rproc)
        if (ret)
                return ret;
-        ret = rproc_stop(rproc, false);
+        ret = rproc_stop(rproc, true);
        if (ret)
                goto unlock_mutex;
@@ -1316,7 +1316,7 @@ void rproc_shutdown(struct rproc *rproc)
        if (!atomic_dec_and_test(&rproc->power))
                goto out;
-        ret = rproc_stop(rproc, true);
+        ret = rproc_stop(rproc, false);
        if (ret) {
                atomic_inc(&rproc->power);
                goto out;
diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 64b6de9763ee..1efdf9ff8679 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -581,4 +581,6 @@ static void rpmsg_chrdev_exit(void)
        unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX);
 }
 module_exit(rpmsg_chrdev_exit);
+MODULE_ALIAS("rpmsg:rpmsg_chrdev");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/sbus/char/oradax.c b/drivers/sbus/char/oradax.c
index c44d7c7ffc92..1754f55e2fac 100644
--- a/drivers/sbus/char/oradax.c
+++ b/drivers/sbus/char/oradax.c
@@ -3,7 +3,7 @@
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
+ * the Free Software Foundation, either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
index edb7be786c65..9e8de1462593 100644
--- a/drivers/scsi/isci/port_config.c
+++ b/drivers/scsi/isci/port_config.c
@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost,
                 * Note: We have not moved the current phy_index so we will actually
                 *       compare the startting phy with itself.
                 *       This is expected and required to add the phy to the port. */
-                while (phy_index < SCI_MAX_PHYS) {
+                for (; phy_index < SCI_MAX_PHYS; phy_index++) {
                        if ((phy_mask & (1 << phy_index)) == 0)
                                continue;
                        sci_phy_get_sas_address(&ihost->phys[phy_index],
@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost,
                                              &ihost->phys[phy_index]);
                        assigned_phy_mask |= (1 << phy_index);
-                        phy_index++;
                }
        }
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 8c51d628b52e..a2ec0bc9e9fa 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1722,11 +1722,14 @@ static int storvsc_probe(struct hv_device *device,
                max_targets = STORVSC_MAX_TARGETS;
                max_channels = STORVSC_MAX_CHANNELS;
                /*
-                 * On Windows8 and above, we support sub-channels for storage.
+                 * On Windows8 and above, we support sub-channels for storage
+                 * on SCSI and FC controllers.
                 * The number of sub-channels offerred is based on the number of
                 * VCPUs in the guest.
                 */
-                max_sub_channels = (num_cpus / storvsc_vcpus_per_sub_channel);
+                if (!dev_is_ide)
+                        max_sub_channels =
+                                (num_cpus - 1) / storvsc_vcpus_per_sub_channel;
        }
        scsi_driver.can_queue = (max_outstanding_req_per_channel *
diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
index 16cab40156ca..aeab05f682d9 100644
--- a/drivers/staging/media/imx/imx-media-csi.c
+++ b/drivers/staging/media/imx/imx-media-csi.c
@@ -1799,7 +1799,7 @@ static int imx_csi_probe(struct platform_device *pdev)
        priv->dev->of_node = pdata->of_node;
        pinctrl = devm_pinctrl_get_select_default(priv->dev);
        if (IS_ERR(pinctrl)) {
-                ret = PTR_ERR(priv->vdev);
+                ret = PTR_ERR(pinctrl);
                dev_dbg(priv->dev,
                        "devm_pinctrl_get_select_default() failed: %d\n", ret);
                if (ret != -ENODEV)
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 07c814c42648..60429011292a 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -427,8 +427,8 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
        struct scatterlist *sg = &cmd->t_data_sg[0];
-        unsigned char *buf, zero = 0x00, *p = &zero;
+        unsigned char *buf, *not_zero;
-        int rc, ret;
+        int ret;
        buf = kmap(sg_page(sg)) + sg->offset;
        if (!buf)
@@ -437,10 +437,10 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd)
         * Fall back to block_execute_write_same() slow-path if
         * incoming WRITE_SAME payload does not contain zeros.
         */
-        rc = memcmp(buf, p, cmd->data_length);
+        not_zero = memchr_inv(buf, 0x00, cmd->data_length);
        kunmap(sg_page(sg));
-        if (rc)
+        if (not_zero)
                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
        ret = blkdev_issue_zeroout(bdev,
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index c821b4b9647e..7b5cb28ffb35 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -191,7 +191,9 @@ static const unsigned short full_speed_maxpacket_maxes[4] = {
 static const unsigned short high_speed_maxpacket_maxes[4] = {
        [USB_ENDPOINT_XFER_CONTROL] = 64,
        [USB_ENDPOINT_XFER_ISOC] = 1024,
-        [USB_ENDPOINT_XFER_BULK] = 512,
+        /* Bulk should be 512, but some devices use 1024: we will warn below */
+        [USB_ENDPOINT_XFER_BULK] = 1024,
        [USB_ENDPOINT_XFER_INT] = 1024,
 };
 static const unsigned short super_speed_maxpacket_maxes[4] = {
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index d83be5651f87..a666e0758a99 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -985,6 +985,7 @@ struct dwc2_hsotg {
        /* DWC OTG HW Release versions */
 #define DWC2_CORE_REV_2_71a     0x4f54271a
+#define DWC2_CORE_REV_2_72a     0x4f54272a
 #define DWC2_CORE_REV_2_80a     0x4f54280a
 #define DWC2_CORE_REV_2_90a     0x4f54290a
 #define DWC2_CORE_REV_2_91a     0x4f54291a
@@ -992,6 +993,7 @@ struct dwc2_hsotg {
 #define DWC2_CORE_REV_2_94a     0x4f54294a
 #define DWC2_CORE_REV_3_00a     0x4f54300a
 #define DWC2_CORE_REV_3_10a     0x4f54310a
+#define DWC2_CORE_REV_4_00a     0x4f54400a
 #define DWC2_FS_IOT_REV_1_00a   0x5531100a
 #define DWC2_HS_IOT_REV_1_00a   0x5532100a
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 6c32bf26e48e..83cb5577a52f 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3928,6 +3928,27 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
        if (index && !hs_ep->isochronous)
                epctrl |= DXEPCTL_SETD0PID;
+        /* WA for Full speed ISOC IN in DDMA mode.
+         * By Clear NAK status of EP, core will send ZLP
+         * to IN token and assert NAK interrupt relying
+         * on TxFIFO status only
+         */
+        if (hsotg->gadget.speed == USB_SPEED_FULL &&
+            hs_ep->isochronous && dir_in) {
+                /* The WA applies only to core versions from 2.72a
+                 * to 4.00a (including both). Also for FS_IOT_1.00a
+                 * and HS_IOT_1.00a.
+                 */
+                u32 gsnpsid = dwc2_readl(hsotg->regs + GSNPSID);
+                if ((gsnpsid >= DWC2_CORE_REV_2_72a &&
+                     gsnpsid <= DWC2_CORE_REV_4_00a) ||
+                     gsnpsid == DWC2_FS_IOT_REV_1_00a ||
+                     gsnpsid == DWC2_HS_IOT_REV_1_00a)
+                        epctrl |= DXEPCTL_CNAK;
+        }
        dev_dbg(hsotg->dev, "%s: write DxEPCTL=0x%08x\n",
                __func__, epctrl);
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 190f95964000..c51b73b3e048 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -358,9 +358,14 @@ static void dwc2_gusbcfg_init(struct dwc2_hsotg *hsotg)
 static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg)
 {
+        int ret;
        hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus");
-        if (IS_ERR(hsotg->vbus_supply))
+        if (IS_ERR(hsotg->vbus_supply)) {
-                return 0;
+                ret = PTR_ERR(hsotg->vbus_supply);
+                hsotg->vbus_supply = NULL;
+                return ret == -ENODEV ? 0 : ret;
+        }
        return regulator_enable(hsotg->vbus_supply);
 }
@@ -4342,9 +4347,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
        spin_unlock_irqrestore(&hsotg->lock, flags);
-        dwc2_vbus_supply_init(hsotg);
+        return dwc2_vbus_supply_init(hsotg);
-        return 0;
 }
 /*
diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
index 7f21747007f1..bea2e8ec0369 100644
--- a/drivers/usb/dwc2/pci.c
+++ b/drivers/usb/dwc2/pci.c
@@ -141,8 +141,10 @@ static int dwc2_pci_probe(struct pci_dev *pci,
                goto err;
        glue = devm_kzalloc(dev, sizeof(*glue), GFP_KERNEL);
-        if (!glue)
+        if (!glue) {
+                ret = -ENOMEM;
                goto err;
+        }
        ret = platform_device_add(dwc2);
        if (ret) {
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8796a5ee9bb9..0dedf8a799f4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -166,7 +166,7 @@ static void dwc3_ep_inc_deq(struct dwc3_ep *dep)
        dwc3_ep_inc_trb(&dep->trb_dequeue);
 }
-void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
+static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
                struct dwc3_request *req, int status)
 {
        struct dwc3                     *dwc = dep->dwc;
@@ -1424,7 +1424,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                                        dwc->lock);
                        if (!r->trb)
-                                goto out1;
+                                goto out0;
                        if (r->num_pending_sgs) {
                                struct dwc3_trb *trb;
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index 7889bcc0509a..8b72b192c747 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -221,7 +221,7 @@ static void pn_tx_complete(struct usb_ep *ep, struct usb_request *req)
        netif_wake_queue(dev);
 }
-static int pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct phonet_port *port = netdev_priv(dev);
        struct f_phonet *fp;
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 4c6c08b675b5..21307d862af6 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -73,9 +73,10 @@ static struct ehci_qh *ehci_qh_alloc (struct ehci_hcd *ehci, gfp_t flags)
        if (!qh)
                goto done;
        qh->hw = (struct ehci_qh_hw *)
-                dma_pool_zalloc(ehci->qh_pool, flags, &dma);
+                dma_pool_alloc(ehci->qh_pool, flags, &dma);
        if (!qh->hw)
                goto fail;
+        memset(qh->hw, 0, sizeof *qh->hw);
        qh->qh_dma = dma;
        // INIT_LIST_HEAD (&qh->qh_list);
        INIT_LIST_HEAD (&qh->qtd_list);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 28e2a338b481..e56db44708bc 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1287,7 +1287,7 @@ itd_urb_transaction(
                } else {
 alloc_itd:
                        spin_unlock_irqrestore(&ehci->lock, flags);
-                        itd = dma_pool_zalloc(ehci->itd_pool, mem_flags,
+                        itd = dma_pool_alloc(ehci->itd_pool, mem_flags,
                                        &itd_dma);
                        spin_lock_irqsave(&ehci->lock, flags);
                        if (!itd) {
@@ -1297,6 +1297,7 @@ itd_urb_transaction(
                        }
                }
+                memset(itd, 0, sizeof(*itd));
                itd->itd_dma = itd_dma;
                itd->frame = NO_FRAME;
                list_add(&itd->itd_list, &sched->td_list);
@@ -2080,7 +2081,7 @@ sitd_urb_transaction(
                } else {
 alloc_sitd:
                        spin_unlock_irqrestore(&ehci->lock, flags);
-                        sitd = dma_pool_zalloc(ehci->sitd_pool, mem_flags,
+                        sitd = dma_pool_alloc(ehci->sitd_pool, mem_flags,
                                        &sitd_dma);
                        spin_lock_irqsave(&ehci->lock, flags);
                        if (!sitd) {
@@ -2090,6 +2091,7 @@ sitd_urb_transaction(
                        }
                }
+                memset(sitd, 0, sizeof(*sitd));
                sitd->sitd_dma = sitd_dma;
                sitd->frame = NO_FRAME;
                list_add(&sitd->sitd_list, &iso_sched->td_list);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 9b27798ecce5..711da3306b14 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3621,6 +3621,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
                del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
        }
        xhci_debugfs_remove_slot(xhci, udev->slot_id);
+        virt_dev->udev = NULL;
        ret = xhci_disable_slot(xhci, udev->slot_id);
        if (ret)
                xhci_free_virt_device(xhci, udev->slot_id);
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index e564695c6c8d..71c5835ea9cd 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -417,7 +417,6 @@ void musb_g_tx(struct musb *musb, u8 epnum)
        req = next_request(musb_ep);
        request = &req->request;
-        trace_musb_req_tx(req);
        csr = musb_readw(epio, MUSB_TXCSR);
        musb_dbg(musb, "<== %s, txcsr %04x", musb_ep->end_point.name, csr);
@@ -456,6 +455,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                u8      is_dma = 0;
                bool    short_packet = false;
+                trace_musb_req_tx(req);
                if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
                        is_dma = 1;
                        csr |= MUSB_TXCSR_P_WZC_BITS;
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 4fa372c845e1..e7f99d55922a 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -990,7 +990,9 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
                        /* set tx_reinit and schedule the next qh */
                        ep->tx_reinit = 1;
                }
-                musb_start_urb(musb, is_in, next_qh);
+                if (next_qh)
+                        musb_start_urb(musb, is_in, next_qh);
        }
 }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c3f252283ab9..2058852a87fa 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,6 +233,8 @@ static void option_instat_callback(struct urb *urb);
 /* These Quectel products use Qualcomm's vendor ID */
 #define QUECTEL_PRODUCT_UC20                    0x9003
 #define QUECTEL_PRODUCT_UC15                    0x9090
+/* These u-blox products use Qualcomm's vendor ID */
+#define UBLOX_PRODUCT_R410M                     0x90b2
 /* These Yuga products use Qualcomm's vendor ID */
 #define YUGA_PRODUCT_CLM920_NC5                 0x9625
@@ -1065,6 +1067,9 @@ static const struct usb_device_id option_ids[] = {
        /* Yuga products use Qualcomm vendor ID */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5),
          .driver_info = RSVD(1) | RSVD(4) },
+        /* u-blox products using Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+          .driver_info = RSVD(1) | RSVD(3) },
        /* Quectel products using Quectel vendor ID */
        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
          .driver_info = RSVD(4) },
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index f5373ed2cd45..8ddbecc25d89 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -335,47 +335,48 @@ static int palm_os_3_probe(struct usb_serial *serial,
                goto exit;
        }
-        if (retval == sizeof(*connection_info)) {
+        if (retval != sizeof(*connection_info)) {
-                        connection_info = (struct visor_connection_info *)
+                dev_err(dev, "Invalid connection information received from device\n");
-                                                        transfer_buffer;
+                retval = -ENODEV;
+                goto exit;
-                num_ports = le16_to_cpu(connection_info->num_ports);
-                for (i = 0; i < num_ports; ++i) {
-                        switch (
-                           connection_info->connections[i].port_function_id) {
-                        case VISOR_FUNCTION_GENERIC:
-                                string = "Generic";
-                                break;
-                        case VISOR_FUNCTION_DEBUGGER:
-                                string = "Debugger";
-                                break;
-                        case VISOR_FUNCTION_HOTSYNC:
-                                string = "HotSync";
-                                break;
-                        case VISOR_FUNCTION_CONSOLE:
-                                string = "Console";
-                                break;
-                        case VISOR_FUNCTION_REMOTE_FILE_SYS:
-                                string = "Remote File System";
-                                break;
-                        default:
-                                string = "unknown";
-                                break;
-                        }
-                        dev_info(dev, "%s: port %d, is for %s use\n",
-                                serial->type->description,
-                                connection_info->connections[i].port, string);
-                }
        }
-        /*
-        * Handle devices that report invalid stuff here.
+        connection_info = (struct visor_connection_info *)transfer_buffer;
-        */
+        num_ports = le16_to_cpu(connection_info->num_ports);
+        /* Handle devices that report invalid stuff here. */
        if (num_ports == 0 || num_ports > 2) {
                dev_warn(dev, "%s: No valid connect info available\n",
                        serial->type->description);
                num_ports = 2;
        }
+        for (i = 0; i < num_ports; ++i) {
+                switch (connection_info->connections[i].port_function_id) {
+                case VISOR_FUNCTION_GENERIC:
+                        string = "Generic";
+                        break;
+                case VISOR_FUNCTION_DEBUGGER:
+                        string = "Debugger";
+                        break;
+                case VISOR_FUNCTION_HOTSYNC:
+                        string = "HotSync";
+                        break;
+                case VISOR_FUNCTION_CONSOLE:
+                        string = "Console";
+                        break;
+                case VISOR_FUNCTION_REMOTE_FILE_SYS:
+                        string = "Remote File System";
+                        break;
+                default:
+                        string = "unknown";
+                        break;
+                }
+                dev_info(dev, "%s: port %d, is for %s use\n",
+                        serial->type->description,
+                        connection_info->connections[i].port, string);
+        }
        dev_info(dev, "%s: Number of ports: %d\n", serial->type->description,
                num_ports);
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 677d12138dbd..ded49e3bf2b0 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -3725,6 +3725,7 @@ void tcpm_unregister_port(struct tcpm_port *port)
        for (i = 0; i < ARRAY_SIZE(port->port_altmode); i++)
                typec_unregister_altmode(port->port_altmode[i]);
        typec_unregister_port(port->typec_port);
+        usb_role_switch_put(port->role_sw);
        tcpm_debugfs_exit(port);
        destroy_workqueue(port->wq);
 }
diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
index 8b8406867c02..4b4c8d271b27 100644
--- a/drivers/usb/typec/tps6598x.c
+++ b/drivers/usb/typec/tps6598x.c
@@ -73,6 +73,7 @@ struct tps6598x {
        struct device *dev;
        struct regmap *regmap;
        struct mutex lock; /* device lock */
+        u8 i2c_protocol:1;
        struct typec_port *port;
        struct typec_partner *partner;
@@ -80,19 +81,39 @@ struct tps6598x {
        struct typec_capability typec_cap;
 };
+static int
+tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
+{
+        u8 data[len + 1];
+        int ret;
+        if (!tps->i2c_protocol)
+                return regmap_raw_read(tps->regmap, reg, val, len);
+        ret = regmap_raw_read(tps->regmap, reg, data, sizeof(data));
+        if (ret)
+                return ret;
+        if (data[0] < len)
+                return -EIO;
+        memcpy(val, &data[1], len);
+        return 0;
+}
 static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val)
 {
-        return regmap_raw_read(tps->regmap, reg, val, sizeof(u16));
+        return tps6598x_block_read(tps, reg, val, sizeof(u16));
 }
 static inline int tps6598x_read32(struct tps6598x *tps, u8 reg, u32 *val)
 {
-        return regmap_raw_read(tps->regmap, reg, val, sizeof(u32));
+        return tps6598x_block_read(tps, reg, val, sizeof(u32));
 }
 static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val)
 {
-        return regmap_raw_read(tps->regmap, reg, val, sizeof(u64));
+        return tps6598x_block_read(tps, reg, val, sizeof(u64));
 }
 static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val)
@@ -121,8 +142,8 @@ static int tps6598x_read_partner_identity(struct tps6598x *tps)
        struct tps6598x_rx_identity_reg id;
        int ret;
-        ret = regmap_raw_read(tps->regmap, TPS_REG_RX_IDENTITY_SOP,
+        ret = tps6598x_block_read(tps, TPS_REG_RX_IDENTITY_SOP,
-                              &id, sizeof(id));
+                                  &id, sizeof(id));
        if (ret)
                return ret;
@@ -224,13 +245,13 @@ static int tps6598x_exec_cmd(struct tps6598x *tps, const char *cmd,
        } while (val);
        if (out_len) {
-                ret = regmap_raw_read(tps->regmap, TPS_REG_DATA1,
+                ret = tps6598x_block_read(tps, TPS_REG_DATA1,
-                                      out_data, out_len);
+                                          out_data, out_len);
                if (ret)
                        return ret;
                val = out_data[0];
        } else {
-                ret = regmap_read(tps->regmap, TPS_REG_DATA1, &val);
+                ret = tps6598x_block_read(tps, TPS_REG_DATA1, &val, sizeof(u8));
                if (ret)
                        return ret;
        }
@@ -385,6 +406,16 @@ static int tps6598x_probe(struct i2c_client *client)
        if (!vid)
                return -ENODEV;
+        /*
+         * Checking can the adapter handle SMBus protocol. If it can not, the
+         * driver needs to take care of block reads separately.
+         *
+         * FIXME: Testing with I2C_FUNC_I2C. regmap-i2c uses I2C protocol
+         * unconditionally if the adapter has I2C_FUNC_I2C set.
+         */
+        if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
+                tps->i2c_protocol = true;
        ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
        if (ret < 0)
                return ret;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e2f16b68fcbf..51b5e2da708c 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3142,7 +3142,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
        struct rb_node *node;
        int ret = 0;
+        spin_lock(&root->fs_info->trans_lock);
        cur_trans = root->fs_info->running_transaction;
+        if (cur_trans)
+                refcount_inc(&cur_trans->use_count);
+        spin_unlock(&root->fs_info->trans_lock);
        if (!cur_trans)
                return 0;
@@ -3151,6 +3155,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
        head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
        if (!head) {
                spin_unlock(&delayed_refs->lock);
+                btrfs_put_transaction(cur_trans);
                return 0;
        }
@@ -3167,6 +3172,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
                mutex_lock(&head->mutex);
                mutex_unlock(&head->mutex);
                btrfs_put_delayed_ref_head(head);
+                btrfs_put_transaction(cur_trans);
                return -EAGAIN;
        }
        spin_unlock(&delayed_refs->lock);
@@ -3199,6 +3205,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
        }
        spin_unlock(&head->lock);
        mutex_unlock(&head->mutex);
+        btrfs_put_transaction(cur_trans);
        return ret;
 }
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 00b7d3231821..b041b945a7ae 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1841,7 +1841,7 @@ again:
                old_bytenr = btrfs_node_blockptr(parent, slot);
                blocksize = fs_info->nodesize;
                old_ptr_gen = btrfs_node_ptr_generation(parent, slot);
-                btrfs_node_key_to_cpu(parent, &key, slot);
+                btrfs_node_key_to_cpu(parent, &first_key, slot);
                if (level <= max_level) {
                        eb = path->nodes[level];
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 221e5cdb060b..c0074d2d7d6d 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5236,6 +5236,10 @@ static int send_write_or_clone(struct send_ctx *sctx,
                len = btrfs_file_extent_num_bytes(path->nodes[0], ei);
        }
+        if (offset >= sctx->cur_inode_size) {
+                ret = 0;
+                goto out;
+        }
        if (offset + len > sctx->cur_inode_size)
                len = sctx->cur_inode_size - offset;
        if (len == 0) {
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 741749a98614..5f132d59dfc2 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -197,7 +197,7 @@ config CIFS_SMB311
 config CIFS_SMB_DIRECT
        bool "SMB Direct support (Experimental)"
-        depends on CIFS=m && INFINIBAND || CIFS=y && INFINIBAND=y
+        depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
        help
          Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1.
          SMB Direct allows transferring SMB packets over RDMA. If unsure,
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 47d7c151fcba..471d863958bc 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1961,7 +1961,7 @@ void wb_workfn(struct work_struct *work)
        }
        if (!list_empty(&wb->work_list))
-                mod_delayed_work(bdi_wq, &wb->dwork, 0);
+                wb_wakeup(wb);
        else if (wb_has_dirty_io(wb) && dirty_writeback_interval)
                wb_wakeup_delayed(wb);
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index ce4a34a2751d..35a124400d60 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -511,7 +511,14 @@ xfs_attr_shortform_addname(xfs_da_args_t *args)
                if (args->flags & ATTR_CREATE)
                        return retval;
                retval = xfs_attr_shortform_remove(args);
-                ASSERT(retval == 0);
+                if (retval)
+                        return retval;
+                /*
+                 * Since we have removed the old attr, clear ATTR_REPLACE so
+                 * that the leaf format add routine won't trip over the attr
+                 * not being around.
+                 */
+                args->flags &= ~ATTR_REPLACE;
        }
        if (args->namelen >= XFS_ATTR_SF_ENTSIZE_MAX ||
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 6a7c2f03ea11..040eeda8426f 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -725,12 +725,16 @@ xfs_bmap_extents_to_btree(
        *logflagsp = 0;
        if ((error = xfs_alloc_vextent(&args))) {
                xfs_iroot_realloc(ip, -1, whichfork);
+                ASSERT(ifp->if_broot == NULL);
+                XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
                xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
                return error;
        }
        if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
                xfs_iroot_realloc(ip, -1, whichfork);
+                ASSERT(ifp->if_broot == NULL);
+                XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
                xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
                return -ENOSPC;
        }
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index ef68b1de006a..1201107eabc6 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -466,6 +466,8 @@ xfs_dinode_verify(
                                return __this_address;
                        if (di_size > XFS_DFORK_DSIZE(dip, mp))
                                return __this_address;
+                        if (dip->di_nextents)
+                                return __this_address;
                        /* fall through */
                case XFS_DINODE_FMT_EXTENTS:
                case XFS_DINODE_FMT_BTREE:
@@ -484,12 +486,31 @@ xfs_dinode_verify(
        if (XFS_DFORK_Q(dip)) {
                switch (dip->di_aformat) {
                case XFS_DINODE_FMT_LOCAL:
+                        if (dip->di_anextents)
+                                return __this_address;
+                /* fall through */
                case XFS_DINODE_FMT_EXTENTS:
                case XFS_DINODE_FMT_BTREE:
                        break;
                default:
                        return __this_address;
                }
+        } else {
+                /*
+                 * If there is no fork offset, this may be a freshly-made inode
+                 * in a new disk cluster, in which case di_aformat is zeroed.
+                 * Otherwise, such an inode must be in EXTENTS format; this goes
+                 * for freed inodes as well.
+                 */
+                switch (dip->di_aformat) {
+                case 0:
+                case XFS_DINODE_FMT_EXTENTS:
+                        break;
+                default:
+                        return __this_address;
+                }
+                if (dip->di_anextents)
+                        return __this_address;
        }
        /* only version 3 or greater inodes are extensively verified here */
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 299aee4b7b0b..e70fb8ccecea 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -778,22 +778,26 @@ xfs_file_fallocate(
                if (error)
                        goto out_unlock;
        } else if (mode & FALLOC_FL_INSERT_RANGE) {
-                unsigned int blksize_mask = i_blocksize(inode) - 1;
+                unsigned int    blksize_mask = i_blocksize(inode) - 1;
+                loff_t          isize = i_size_read(inode);
-                new_size = i_size_read(inode) + len;
                if (offset & blksize_mask || len & blksize_mask) {
                        error = -EINVAL;
                        goto out_unlock;
                }
-                /* check the new inode size does not wrap through zero */
+                /*
-                if (new_size > inode->i_sb->s_maxbytes) {
+                 * New inode size must not exceed ->s_maxbytes, accounting for
+                 * possible signed overflow.
+                 */
+                if (inode->i_sb->s_maxbytes - isize < len) {
                        error = -EFBIG;
                        goto out_unlock;
                }
+                new_size = isize + len;
                /* Offset should be less than i_size */
-                if (offset >= i_size_read(inode)) {
+                if (offset >= isize) {
                        error = -EINVAL;
                        goto out_unlock;
                }
@@ -876,8 +880,18 @@ xfs_file_dedupe_range(
        struct file     *dst_file,
        u64             dst_loff)
 {
+        struct inode    *srci = file_inode(src_file);
+        u64             max_dedupe;
        int             error;
+        /*
+         * Since we have to read all these pages in to compare them, cut
+         * it off at MAX_RW_COUNT/2 rounded down to the nearest block.
+         * That means we won't do more than MAX_RW_COUNT IO per request.
+         */
+        max_dedupe = (MAX_RW_COUNT >> 1) & ~(i_blocksize(srci) - 1);
+        if (len > max_dedupe)
+                len = max_dedupe;
        error = xfs_reflink_remap_range(src_file, loff, dst_file, dst_loff,
                                     len, true);
        if (error)
diff --git a/include/dt-bindings/clock/stm32mp1-clks.h b/include/dt-bindings/clock/stm32mp1-clks.h
index 86e3ec662ef4..90ec780bfc68 100644
--- a/include/dt-bindings/clock/stm32mp1-clks.h
+++ b/include/dt-bindings/clock/stm32mp1-clks.h
@@ -76,7 +76,7 @@
 #define I2C6            63
 #define USART1          64
 #define RTCAPB          65
-#define TZC             66
+#define TZC1            66
 #define TZPC            67
 #define IWDG1           68
 #define BSEC            69
@@ -123,6 +123,7 @@
 #define CRC1            110
 #define USBH            111
 #define ETHSTP          112
+#define TZC2            113
 /* Kernel clocks */
 #define SDMMC1_K        118
@@ -228,7 +229,6 @@
 #define CK_MCO2         212
 /* TRACE & DEBUG clocks */
-#define DBG             213
 #define CK_DBG          214
 #define CK_TRACE        215
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 24f03941ada8..e7efe12a81bd 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -131,6 +131,7 @@ struct vgic_irq {
                u32 mpidr;                      /* GICv3 target VCPU */
        };
        u8 source;                      /* GICv2 SGIs only */
+        u8 active_source;               /* GICv2 SGIs only */
        u8 priority;
        enum vgic_irq_config config;    /* Level or edge */
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 486e65e3db26..469b20e1dd7e 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -31,6 +31,7 @@ struct bpf_map_ops {
        void (*map_release)(struct bpf_map *map, struct file *map_file);
        void (*map_free)(struct bpf_map *map);
        int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key);
+        void (*map_release_uref)(struct bpf_map *map);
        /* funcs callable from userspace and from eBPF programs */
        void *(*map_lookup_elem)(struct bpf_map *map, void *key);
@@ -351,6 +352,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
                struct bpf_prog **_prog, *__prog;       \
                struct bpf_prog_array *_array;          \
                u32 _ret = 1;                           \
+                preempt_disable();                      \
                rcu_read_lock();                        \
                _array = rcu_dereference(array);        \
                if (unlikely(check_non_null && !_array))\
@@ -362,6 +364,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
                }                                       \
 _out:                                                   \
                rcu_read_unlock();                      \
+                preempt_enable_no_resched();            \
                _ret;                                   \
         })
@@ -434,7 +437,6 @@ int bpf_stackmap_copy(struct bpf_map *map, void *key, void *value);
 int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
                                 void *key, void *value, u64 map_flags);
 int bpf_fd_array_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
-void bpf_fd_array_map_clear(struct bpf_map *map);
 int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
                                void *key, void *value, u64 map_flags);
 int bpf_fd_htab_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 210a890008f9..1d25e149c1c5 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -765,6 +765,9 @@ int __clk_mux_determine_rate(struct clk_hw *hw,
 int __clk_determine_rate(struct clk_hw *core, struct clk_rate_request *req);
 int __clk_mux_determine_rate_closest(struct clk_hw *hw,
                                     struct clk_rate_request *req);
+int clk_mux_determine_rate_flags(struct clk_hw *hw,
+                                 struct clk_rate_request *req,
+                                 unsigned long flags);
 void clk_hw_reparent(struct clk_hw *hw, struct clk_hw *new_parent);
 void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate,
                           unsigned long max_rate);
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index c826b0b5232a..6cb8a5789668 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -368,7 +368,9 @@ static inline void free_part_stats(struct hd_struct *part)
        part_stat_add(cpu, gendiskp, field, -subnd)
 void part_in_flight(struct request_queue *q, struct hd_struct *part,
-                        unsigned int inflight[2]);
+                    unsigned int inflight[2]);
+void part_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                       unsigned int inflight[2]);
 void part_dec_in_flight(struct request_queue *q, struct hd_struct *part,
                        int rw);
 void part_inc_in_flight(struct request_queue *q, struct hd_struct *part,
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 767d193c269a..2a156c5dfadd 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -1284,25 +1284,19 @@ enum {
 };
 static inline const struct cpumask *
-mlx5_get_vector_affinity(struct mlx5_core_dev *dev, int vector)
+mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
 {
-        const struct cpumask *mask;
        struct irq_desc *desc;
        unsigned int irq;
        int eqn;
        int err;
-        err = mlx5_vector2eqn(dev, MLX5_EQ_VEC_COMP_BASE + vector, &eqn, &irq);
+        err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
        if (err)
                return NULL;
        desc = irq_to_desc(irq);
-#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        return desc->affinity_hint;
-        mask = irq_data_get_effective_affinity_mask(&desc->irq_data);
-#else
-        mask = desc->irq_common_data.affinity;
-#endif
-        return mask;
 }
 #endif /* MLX5_DRIVER_H */
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index d09a9c7af109..dfdaede9139e 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -569,7 +569,7 @@ static inline struct rproc *vdev_to_rproc(struct virtio_device *vdev)
 void rproc_add_subdev(struct rproc *rproc,
                      struct rproc_subdev *subdev,
                      int (*probe)(struct rproc_subdev *subdev),
-                      void (*remove)(struct rproc_subdev *subdev, bool graceful));
+                      void (*remove)(struct rproc_subdev *subdev, bool crashed));
 void rproc_remove_subdev(struct rproc *rproc, struct rproc_subdev *subdev);
diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
index 4b6b9283fa7b..8675e145ea8b 100644
--- a/include/linux/usb/composite.h
+++ b/include/linux/usb/composite.h
@@ -52,7 +52,7 @@
 #define USB_GADGET_DELAYED_STATUS       0x7fff  /* Impossibly large value */
 /* big enough to hold our biggest descriptor */
-#define USB_COMP_EP0_BUFSIZ     1024
+#define USB_COMP_EP0_BUFSIZ     4096
 /* OS feature descriptor length <= 4kB */
 #define USB_COMP_EP0_OS_DESC_BUFSIZ     4096
diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h
index 9318b2166439..2b0072fa5e92 100644
--- a/include/linux/wait_bit.h
+++ b/include/linux/wait_bit.h
@@ -305,4 +305,21 @@ do {									\
        __ret;                                                          \
 })
+/**
+ * clear_and_wake_up_bit - clear a bit and wake up anyone waiting on that bit
+ *
+ * @bit: the bit of the word being waited on
+ * @word: the word being waited on, a kernel virtual address
+ *
+ * You can use this helper if bitflags are manipulated atomically rather than
+ * non-atomically under a lock.
+ */
+static inline void clear_and_wake_up_bit(int bit, void *word)
+{
+        clear_bit_unlock(bit, word);
+        /* See wake_up_bit() for which memory barrier you need to use. */
+        smp_mb__after_atomic();
+        wake_up_bit(word, bit);
+}
 #endif /* _LINUX_WAIT_BIT_H */
diff --git a/include/media/i2c/tvp7002.h b/include/media/i2c/tvp7002.h
index 5ee007c1cead..cb213c136089 100644
--- a/include/media/i2c/tvp7002.h
+++ b/include/media/i2c/tvp7002.h
@@ -5,7 +5,7 @@
 * Author: Santiago Nunez-Corrales <santiago.nunez@ridgerun.com>
 *
 * This code is partially based upon the TVP5150 driver
- * written by Mauro Carvalho Chehab (mchehab@infradead.org),
+ * written by Mauro Carvalho Chehab <mchehab@kernel.org>,
 * the TVP514x driver written by Vaibhav Hiremath <hvaibhav@ti.com>
 * and the TVP7002 driver in the TI LSP 2.10.00.14
 *
diff --git a/include/media/videobuf-core.h b/include/media/videobuf-core.h
index 0bda0adc744f..60a664febba0 100644
--- a/include/media/videobuf-core.h
+++ b/include/media/videobuf-core.h
@@ -1,11 +1,11 @@
 /*
 * generic helper functions for handling video4linux capture buffers
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/include/media/videobuf-dma-sg.h b/include/media/videobuf-dma-sg.h
index d8b27854e3bf..01bd142b979d 100644
--- a/include/media/videobuf-dma-sg.h
+++ b/include/media/videobuf-dma-sg.h
@@ -6,11 +6,11 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/include/media/videobuf-vmalloc.h b/include/media/videobuf-vmalloc.h
index 486a97efdb56..36c6a4ad3504 100644
--- a/include/media/videobuf-vmalloc.h
+++ b/include/media/videobuf-vmalloc.h
@@ -6,7 +6,7 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/include/net/tls.h b/include/net/tls.h
index 3da8e13a6d96..b400d0bb7448 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -148,6 +148,7 @@ struct tls_context {
        struct scatterlist *partially_sent_record;
        u16 partially_sent_offset;
        unsigned long flags;
+        bool in_tcp_sendpages;
        u16 pending_open_record_frags;
        int (*push_pending_record)(struct sock *sk, int flags);
diff --git a/include/trace/events/initcall.h b/include/trace/events/initcall.h
index 8d6cf10d27c9..eb903c3f195f 100644
--- a/include/trace/events/initcall.h
+++ b/include/trace/events/initcall.h
@@ -31,7 +31,11 @@ TRACE_EVENT(initcall_start,
        TP_ARGS(func),
        TP_STRUCT__entry(
-                __field(initcall_t, func)
+                /*
+                 * Use field_struct to avoid is_signed_type()
+                 * comparison of a function pointer
+                 */
+                __field_struct(initcall_t, func)
        ),
        TP_fast_assign(
@@ -48,8 +52,12 @@ TRACE_EVENT(initcall_finish,
        TP_ARGS(func, ret),
        TP_STRUCT__entry(
-                __field(initcall_t,     func)
+                /*
-                __field(int,            ret)
+                 * Use field_struct to avoid is_signed_type()
+                 * comparison of a function pointer
+                 */
+                __field_struct(initcall_t,      func)
+                __field(int,                    ret)
        ),
        TP_fast_assign(
diff --git a/include/uapi/linux/if_infiniband.h b/include/uapi/linux/if_infiniband.h
index 050b92dcf8cf..0fc33bf30e45 100644
--- a/include/uapi/linux/if_infiniband.h
+++ b/include/uapi/linux/if_infiniband.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
 /*
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h
index a66b213de3d7..20c6bd0b0007 100644
--- a/include/uapi/linux/rds.h
+++ b/include/uapi/linux/rds.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2008 Oracle.  All rights reserved.
 *
diff --git a/include/uapi/linux/tls.h b/include/uapi/linux/tls.h
index c6633e97eca4..ff02287495ac 100644
--- a/include/uapi/linux/tls.h
+++ b/include/uapi/linux/tls.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved.
 *
diff --git a/include/uapi/rdma/cxgb3-abi.h b/include/uapi/rdma/cxgb3-abi.h
index 9acb4b7a6246..85aed672f43e 100644
--- a/include/uapi/rdma/cxgb3-abi.h
+++ b/include/uapi/rdma/cxgb3-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
 *
diff --git a/include/uapi/rdma/cxgb4-abi.h b/include/uapi/rdma/cxgb4-abi.h
index 1fefd0140c26..a159ba8dcf8f 100644
--- a/include/uapi/rdma/cxgb4-abi.h
+++ b/include/uapi/rdma/cxgb4-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
 *
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index 7092c8de4bd8..78613b609fa8 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016 Hisilicon Limited.
 *
diff --git a/include/uapi/rdma/ib_user_cm.h b/include/uapi/rdma/ib_user_cm.h
index 4a8f9562f7cd..e2709bb8cb18 100644
--- a/include/uapi/rdma/ib_user_cm.h
+++ b/include/uapi/rdma/ib_user_cm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005 Intel Corporation.  All rights reserved.
diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h
index 04e46ea517d3..625545d862d7 100644
--- a/include/uapi/rdma/ib_user_ioctl_verbs.h
+++ b/include/uapi/rdma/ib_user_ioctl_verbs.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2017-2018, Mellanox Technologies inc.  All rights reserved.
 *
diff --git a/include/uapi/rdma/ib_user_mad.h b/include/uapi/rdma/ib_user_mad.h
index ef92118dad97..90c0cf228020 100644
--- a/include/uapi/rdma/ib_user_mad.h
+++ b/include/uapi/rdma/ib_user_mad.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2004 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
diff --git a/include/uapi/rdma/ib_user_sa.h b/include/uapi/rdma/ib_user_sa.h
index 0d2607f0cd20..435155d6e1c6 100644
--- a/include/uapi/rdma/ib_user_sa.h
+++ b/include/uapi/rdma/ib_user_sa.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Intel Corporation.  All rights reserved.
 *
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 9be07394fdbe..6aeb03315b0b 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
diff --git a/include/uapi/rdma/mlx4-abi.h b/include/uapi/rdma/mlx4-abi.h
index 04f64bc4045f..f74557528175 100644
--- a/include/uapi/rdma/mlx4-abi.h
+++ b/include/uapi/rdma/mlx4-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2007 Cisco Systems, Inc. All rights reserved.
 * Copyright (c) 2007, 2008 Mellanox Technologies. All rights reserved.
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index cb4a02c4a1ce..fdaf00e20649 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2013-2015, Mellanox Technologies. All rights reserved.
 *
diff --git a/include/uapi/rdma/mthca-abi.h b/include/uapi/rdma/mthca-abi.h
index ac756cd9e807..91b12e1a6f43 100644
--- a/include/uapi/rdma/mthca-abi.h
+++ b/include/uapi/rdma/mthca-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
diff --git a/include/uapi/rdma/nes-abi.h b/include/uapi/rdma/nes-abi.h
index 35bfd4015d07..f80495baa969 100644
--- a/include/uapi/rdma/nes-abi.h
+++ b/include/uapi/rdma/nes-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2006 - 2011 Intel Corporation.  All rights reserved.
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
diff --git a/include/uapi/rdma/qedr-abi.h b/include/uapi/rdma/qedr-abi.h
index 8ba098900e9a..24c658b3c790 100644
--- a/include/uapi/rdma/qedr-abi.h
+++ b/include/uapi/rdma/qedr-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /* QLogic qedr NIC Driver
 * Copyright (c) 2015-2016  QLogic Corporation
 *
diff --git a/include/uapi/rdma/rdma_user_cm.h b/include/uapi/rdma/rdma_user_cm.h
index e1269024af47..0d1e78ebad05 100644
--- a/include/uapi/rdma/rdma_user_cm.h
+++ b/include/uapi/rdma/rdma_user_cm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005-2006 Intel Corporation.  All rights reserved.
 *
diff --git a/include/uapi/rdma/rdma_user_ioctl.h b/include/uapi/rdma/rdma_user_ioctl.h
index d223f4164a0f..d92d2721b28c 100644
--- a/include/uapi/rdma/rdma_user_ioctl.h
+++ b/include/uapi/rdma/rdma_user_ioctl.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016 Mellanox Technologies, LTD. All rights reserved.
 *
diff --git a/include/uapi/rdma/rdma_user_rxe.h b/include/uapi/rdma/rdma_user_rxe.h
index 1f8a9e7daea4..44ef6a3b7afc 100644
--- a/include/uapi/rdma/rdma_user_rxe.h
+++ b/include/uapi/rdma/rdma_user_rxe.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
 *
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 14750e7c5ee4..027107f4be53 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -476,7 +476,7 @@ static u32 prog_fd_array_sys_lookup_elem(void *ptr)
 }
 /* decrement refcnt of all bpf_progs that are stored in this map */
-void bpf_fd_array_map_clear(struct bpf_map *map)
+static void bpf_fd_array_map_clear(struct bpf_map *map)
 {
        struct bpf_array *array = container_of(map, struct bpf_array, map);
        int i;
@@ -495,6 +495,7 @@ const struct bpf_map_ops prog_array_map_ops = {
        .map_fd_get_ptr = prog_fd_array_get_ptr,
        .map_fd_put_ptr = prog_fd_array_put_ptr,
        .map_fd_sys_lookup_elem = prog_fd_array_sys_lookup_elem,
+        .map_release_uref = bpf_fd_array_map_clear,
 };
 static struct bpf_event_entry *bpf_event_entry_gen(struct file *perf_file,
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index a3b21385e947..098eca568c2b 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -43,6 +43,7 @@
 #include <net/tcp.h>
 #include <linux/ptr_ring.h>
 #include <net/inet_common.h>
+#include <linux/sched/signal.h>
 #define SOCK_CREATE_FLAG_MASK \
        (BPF_F_NUMA_NODE | BPF_F_RDONLY | BPF_F_WRONLY)
@@ -325,6 +326,9 @@ retry:
                        if (ret > 0) {
                                if (apply)
                                        apply_bytes -= ret;
+                                sg->offset += ret;
+                                sg->length -= ret;
                                size -= ret;
                                offset += ret;
                                if (uncharge)
@@ -332,8 +336,6 @@ retry:
                                goto retry;
                        }
-                        sg->length = size;
-                        sg->offset = offset;
                        return ret;
                }
@@ -391,7 +393,8 @@ static void return_mem_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
        } while (i != md->sg_end);
 }
-static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
+static void free_bytes_sg(struct sock *sk, int bytes,
+                          struct sk_msg_buff *md, bool charge)
 {
        struct scatterlist *sg = md->sg_data;
        int i = md->sg_start, free;
@@ -401,11 +404,13 @@ static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
                if (bytes < free) {
                        sg[i].length -= bytes;
                        sg[i].offset += bytes;
-                        sk_mem_uncharge(sk, bytes);
+                        if (charge)
+                                sk_mem_uncharge(sk, bytes);
                        break;
                }
-                sk_mem_uncharge(sk, sg[i].length);
+                if (charge)
+                        sk_mem_uncharge(sk, sg[i].length);
                put_page(sg_page(&sg[i]));
                bytes -= sg[i].length;
                sg[i].length = 0;
@@ -416,6 +421,7 @@ static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
                if (i == MAX_SKB_FRAGS)
                        i = 0;
        }
+        md->sg_start = i;
 }
 static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
@@ -523,8 +529,6 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
        i = md->sg_start;
        do {
-                r->sg_data[i] = md->sg_data[i];
                size = (apply && apply_bytes < md->sg_data[i].length) ?
                        apply_bytes : md->sg_data[i].length;
@@ -535,6 +539,7 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
                }
                sk_mem_charge(sk, size);
+                r->sg_data[i] = md->sg_data[i];
                r->sg_data[i].length = size;
                md->sg_data[i].length -= size;
                md->sg_data[i].offset += size;
@@ -575,10 +580,10 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
                                       struct sk_msg_buff *md,
                                       int flags)
 {
+        bool ingress = !!(md->flags & BPF_F_INGRESS);
        struct smap_psock *psock;
        struct scatterlist *sg;
-        int i, err, free = 0;
+        int err = 0;
-        bool ingress = !!(md->flags & BPF_F_INGRESS);
        sg = md->sg_data;
@@ -606,16 +611,8 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
 out_rcu:
        rcu_read_unlock();
 out:
-        i = md->sg_start;
+        free_bytes_sg(NULL, send, md, false);
-        while (sg[i].length) {
+        return err;
-                free += sg[i].length;
-                put_page(sg_page(&sg[i]));
-                sg[i].length = 0;
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
-        }
-        return free;
 }
 static inline void bpf_md_init(struct smap_psock *psock)
@@ -700,19 +697,26 @@ more_data:
                err = bpf_tcp_sendmsg_do_redirect(redir, send, m, flags);
                lock_sock(sk);
+                if (unlikely(err < 0)) {
+                        free_start_sg(sk, m);
+                        psock->sg_size = 0;
+                        if (!cork)
+                                *copied -= send;
+                } else {
+                        psock->sg_size -= send;
+                }
                if (cork) {
                        free_start_sg(sk, m);
+                        psock->sg_size = 0;
                        kfree(m);
                        m = NULL;
+                        err = 0;
                }
-                if (unlikely(err))
-                        *copied -= err;
-                else
-                        psock->sg_size -= send;
                break;
        case __SK_DROP:
        default:
-                free_bytes_sg(sk, send, m);
+                free_bytes_sg(sk, send, m, true);
                apply_bytes_dec(psock, send);
                *copied -= send;
                psock->sg_size -= send;
@@ -732,6 +736,26 @@ out_err:
        return err;
 }
+static int bpf_wait_data(struct sock *sk,
+                         struct smap_psock *psk, int flags,
+                         long timeo, int *err)
+{
+        int rc;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
+        add_wait_queue(sk_sleep(sk), &wait);
+        sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+        rc = sk_wait_event(sk, &timeo,
+                           !list_empty(&psk->ingress) ||
+                           !skb_queue_empty(&sk->sk_receive_queue),
+                           &wait);
+        sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return rc;
+}
 static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                           int nonblock, int flags, int *addr_len)
 {
@@ -755,6 +779,7 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
        lock_sock(sk);
+bytes_ready:
        while (copied != len) {
                struct scatterlist *sg;
                struct sk_msg_buff *md;
@@ -809,6 +834,28 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                }
        }
+        if (!copied) {
+                long timeo;
+                int data;
+                int err = 0;
+                timeo = sock_rcvtimeo(sk, nonblock);
+                data = bpf_wait_data(sk, psock, flags, timeo, &err);
+                if (data) {
+                        if (!skb_queue_empty(&sk->sk_receive_queue)) {
+                                release_sock(sk);
+                                smap_release_sock(psock, sk);
+                                copied = tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
+                                return copied;
+                        }
+                        goto bytes_ready;
+                }
+                if (err)
+                        copied = err;
+        }
        release_sock(sk);
        smap_release_sock(psock, sk);
        return copied;
@@ -1831,7 +1878,7 @@ static int sock_map_update_elem(struct bpf_map *map,
        return err;
 }
-static void sock_map_release(struct bpf_map *map, struct file *map_file)
+static void sock_map_release(struct bpf_map *map)
 {
        struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
        struct bpf_prog *orig;
@@ -1855,7 +1902,7 @@ const struct bpf_map_ops sock_map_ops = {
        .map_get_next_key = sock_map_get_next_key,
        .map_update_elem = sock_map_update_elem,
        .map_delete_elem = sock_map_delete_elem,
-        .map_release = sock_map_release,
+        .map_release_uref = sock_map_release,
 };
 BPF_CALL_4(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock,
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 4ca46df19c9a..ebfe9f29dae8 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -257,8 +257,8 @@ static void bpf_map_free_deferred(struct work_struct *work)
 static void bpf_map_put_uref(struct bpf_map *map)
 {
        if (atomic_dec_and_test(&map->usercnt)) {
-                if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY)
+                if (map->ops->map_release_uref)
-                        bpf_fd_array_map_clear(map);
+                        map->ops->map_release_uref(map);
        }
 }
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index ce6848e46e94..1725b902983f 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -491,7 +491,7 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
        if (!uprobe)
                return NULL;
-        uprobe->inode = igrab(inode);
+        uprobe->inode = inode;
        uprobe->offset = offset;
        init_rwsem(&uprobe->register_rwsem);
        init_rwsem(&uprobe->consumer_rwsem);
@@ -502,7 +502,6 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
        if (cur_uprobe) {
                kfree(uprobe);
                uprobe = cur_uprobe;
-                iput(inode);
        }
        return uprobe;
@@ -701,7 +700,6 @@ static void delete_uprobe(struct uprobe *uprobe)
        rb_erase(&uprobe->rb_node, &uprobes_tree);
        spin_unlock(&uprobes_treelock);
        RB_CLEAR_NODE(&uprobe->rb_node); /* for uprobe_is_active() */
-        iput(uprobe->inode);
        put_uprobe(uprobe);
 }
@@ -873,7 +871,8 @@ static void __uprobe_unregister(struct uprobe *uprobe, struct uprobe_consumer *u
 * tuple).  Creation refcount stops uprobe_unregister from freeing the
 * @uprobe even before the register operation is complete. Creation
 * refcount is released when the last @uc for the @uprobe
- * unregisters.
+ * unregisters. Caller of uprobe_register() is required to keep @inode
+ * (and the containing mount) referenced.
 *
 * Return errno if it cannot successully install probes
 * else return 0 (success)
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 0e974cface0b..84f37420fcf5 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -119,6 +119,16 @@ static DEFINE_SPINLOCK(watchdog_lock);
 static int watchdog_running;
 static atomic_t watchdog_reset_pending;
+static void inline clocksource_watchdog_lock(unsigned long *flags)
+{
+        spin_lock_irqsave(&watchdog_lock, *flags);
+}
+static void inline clocksource_watchdog_unlock(unsigned long *flags)
+{
+        spin_unlock_irqrestore(&watchdog_lock, *flags);
+}
 static int clocksource_watchdog_kthread(void *data);
 static void __clocksource_change_rating(struct clocksource *cs, int rating);
@@ -142,9 +152,19 @@ static void __clocksource_unstable(struct clocksource *cs)
        cs->flags &= ~(CLOCK_SOURCE_VALID_FOR_HRES | CLOCK_SOURCE_WATCHDOG);
        cs->flags |= CLOCK_SOURCE_UNSTABLE;
+        /*
+         * If the clocksource is registered clocksource_watchdog_kthread() will
+         * re-rate and re-select.
+         */
+        if (list_empty(&cs->list)) {
+                cs->rating = 0;
+                return;
+        }
        if (cs->mark_unstable)
                cs->mark_unstable(cs);
+        /* kick clocksource_watchdog_kthread() */
        if (finished_booting)
                schedule_work(&watchdog_work);
 }
@@ -153,10 +173,8 @@ static void __clocksource_unstable(struct clocksource *cs)
 * clocksource_mark_unstable - mark clocksource unstable via watchdog
 * @cs:         clocksource to be marked unstable
 *
- * This function is called instead of clocksource_change_rating from
+ * This function is called by the x86 TSC code to mark clocksources as unstable;
- * cpu hotplug code to avoid a deadlock between the clocksource mutex
+ * it defers demotion and re-selection to a kthread.
- * and the cpu hotplug mutex. It defers the update of the clocksource
- * to the watchdog thread.
 */
 void clocksource_mark_unstable(struct clocksource *cs)
 {
@@ -164,7 +182,7 @@ void clocksource_mark_unstable(struct clocksource *cs)
        spin_lock_irqsave(&watchdog_lock, flags);
        if (!(cs->flags & CLOCK_SOURCE_UNSTABLE)) {
-                if (list_empty(&cs->wd_list))
+                if (!list_empty(&cs->list) && list_empty(&cs->wd_list))
                        list_add(&cs->wd_list, &watchdog_list);
                __clocksource_unstable(cs);
        }
@@ -319,9 +337,8 @@ static void clocksource_resume_watchdog(void)
 static void clocksource_enqueue_watchdog(struct clocksource *cs)
 {
-        unsigned long flags;
+        INIT_LIST_HEAD(&cs->wd_list);
-        spin_lock_irqsave(&watchdog_lock, flags);
        if (cs->flags & CLOCK_SOURCE_MUST_VERIFY) {
                /* cs is a clocksource to be watched. */
                list_add(&cs->wd_list, &watchdog_list);
@@ -331,7 +348,6 @@ static void clocksource_enqueue_watchdog(struct clocksource *cs)
                if (cs->flags & CLOCK_SOURCE_IS_CONTINUOUS)
                        cs->flags |= CLOCK_SOURCE_VALID_FOR_HRES;
        }
-        spin_unlock_irqrestore(&watchdog_lock, flags);
 }
 static void clocksource_select_watchdog(bool fallback)
@@ -373,9 +389,6 @@ static void clocksource_select_watchdog(bool fallback)
 static void clocksource_dequeue_watchdog(struct clocksource *cs)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&watchdog_lock, flags);
        if (cs != watchdog) {
                if (cs->flags & CLOCK_SOURCE_MUST_VERIFY) {
                        /* cs is a watched clocksource. */
@@ -384,21 +397,19 @@ static void clocksource_dequeue_watchdog(struct clocksource *cs)
                        clocksource_stop_watchdog();
                }
        }
-        spin_unlock_irqrestore(&watchdog_lock, flags);
 }
 static int __clocksource_watchdog_kthread(void)
 {
        struct clocksource *cs, *tmp;
        unsigned long flags;
-        LIST_HEAD(unstable);
        int select = 0;
        spin_lock_irqsave(&watchdog_lock, flags);
        list_for_each_entry_safe(cs, tmp, &watchdog_list, wd_list) {
                if (cs->flags & CLOCK_SOURCE_UNSTABLE) {
                        list_del_init(&cs->wd_list);
-                        list_add(&cs->wd_list, &unstable);
+                        __clocksource_change_rating(cs, 0);
                        select = 1;
                }
                if (cs->flags & CLOCK_SOURCE_RESELECT) {
@@ -410,11 +421,6 @@ static int __clocksource_watchdog_kthread(void)
        clocksource_stop_watchdog();
        spin_unlock_irqrestore(&watchdog_lock, flags);
-        /* Needs to be done outside of watchdog lock */
-        list_for_each_entry_safe(cs, tmp, &unstable, wd_list) {
-                list_del_init(&cs->wd_list);
-                __clocksource_change_rating(cs, 0);
-        }
        return select;
 }
@@ -447,6 +453,9 @@ static inline int __clocksource_watchdog_kthread(void) { return 0; }
 static bool clocksource_is_watchdog(struct clocksource *cs) { return false; }
 void clocksource_mark_unstable(struct clocksource *cs) { }
+static void inline clocksource_watchdog_lock(unsigned long *flags) { }
+static void inline clocksource_watchdog_unlock(unsigned long *flags) { }
 #endif /* CONFIG_CLOCKSOURCE_WATCHDOG */
 /**
@@ -779,14 +788,19 @@ EXPORT_SYMBOL_GPL(__clocksource_update_freq_scale);
 */
 int __clocksource_register_scale(struct clocksource *cs, u32 scale, u32 freq)
 {
+        unsigned long flags;
        /* Initialize mult/shift and max_idle_ns */
        __clocksource_update_freq_scale(cs, scale, freq);
        /* Add clocksource to the clocksource list */
        mutex_lock(&clocksource_mutex);
+        clocksource_watchdog_lock(&flags);
        clocksource_enqueue(cs);
        clocksource_enqueue_watchdog(cs);
+        clocksource_watchdog_unlock(&flags);
        clocksource_select();
        clocksource_select_watchdog(false);
        mutex_unlock(&clocksource_mutex);
@@ -808,8 +822,13 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating)
 */
 void clocksource_change_rating(struct clocksource *cs, int rating)
 {
+        unsigned long flags;
        mutex_lock(&clocksource_mutex);
+        clocksource_watchdog_lock(&flags);
        __clocksource_change_rating(cs, rating);
+        clocksource_watchdog_unlock(&flags);
        clocksource_select();
        clocksource_select_watchdog(false);
        mutex_unlock(&clocksource_mutex);
@@ -821,6 +840,8 @@ EXPORT_SYMBOL(clocksource_change_rating);
 */
 static int clocksource_unbind(struct clocksource *cs)
 {
+        unsigned long flags;
        if (clocksource_is_watchdog(cs)) {
                /* Select and try to install a replacement watchdog. */
                clocksource_select_watchdog(true);
@@ -834,8 +855,12 @@ static int clocksource_unbind(struct clocksource *cs)
                if (curr_clocksource == cs)
                        return -EBUSY;
        }
+        clocksource_watchdog_lock(&flags);
        clocksource_dequeue_watchdog(cs);
        list_del_init(&cs->list);
+        clocksource_watchdog_unlock(&flags);
        return 0;
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 16bbf062018f..8d83bcf9ef69 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5514,10 +5514,10 @@ static __init int ftrace_init_dyn_tracefs(struct dentry *d_tracer)
        ftrace_create_filter_files(&global_ops, d_tracer);
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        trace_create_file("set_graph_function", 0444, d_tracer,
+        trace_create_file("set_graph_function", 0644, d_tracer,
                                    NULL,
                                    &ftrace_graph_fops);
-        trace_create_file("set_graph_notrace", 0444, d_tracer,
+        trace_create_file("set_graph_notrace", 0644, d_tracer,
                                    NULL,
                                    &ftrace_graph_notrace_fops);
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 0d7b3ffbecc2..b9061ed59bbd 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -2466,6 +2466,7 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
                else if (strcmp(modifier, "usecs") == 0)
                        *flags |= HIST_FIELD_FL_TIMESTAMP_USECS;
                else {
+                        hist_err("Invalid field modifier: ", modifier);
                        field = ERR_PTR(-EINVAL);
                        goto out;
                }
@@ -2481,6 +2482,7 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
        else {
                field = trace_find_event_field(file->event_call, field_name);
                if (!field || !field->size) {
+                        hist_err("Couldn't find field: ", field_name);
                        field = ERR_PTR(-EINVAL);
                        goto out;
                }
@@ -4913,6 +4915,16 @@ static void hist_field_print(struct seq_file *m, struct hist_field *hist_field)
                seq_printf(m, "%s", field_name);
        } else if (hist_field->flags & HIST_FIELD_FL_TIMESTAMP)
                seq_puts(m, "common_timestamp");
+        if (hist_field->flags) {
+                if (!(hist_field->flags & HIST_FIELD_FL_VAR_REF) &&
+                    !(hist_field->flags & HIST_FIELD_FL_EXPR)) {
+                        const char *flags = get_hist_field_flags(hist_field);
+                        if (flags)
+                                seq_printf(m, ".%s", flags);
+                }
+        }
 }
 static int event_hist_trigger_print(struct seq_file *m,
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 3c7bfc4bf5e9..4237eba4ef20 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -472,7 +472,7 @@ static __init int stack_trace_init(void)
                        NULL, &stack_trace_fops);
 #ifdef CONFIG_DYNAMIC_FTRACE
-        trace_create_file("stack_trace_filter", 0444, d_tracer,
+        trace_create_file("stack_trace_filter", 0644, d_tracer,
                          &trace_ops, &stack_trace_filter_fops);
 #endif
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 34fd0e0ec51d..ac892878dbe6 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -55,6 +55,7 @@ struct trace_uprobe {
        struct list_head                list;
        struct trace_uprobe_filter      filter;
        struct uprobe_consumer          consumer;
+        struct path                     path;
        struct inode                    *inode;
        char                            *filename;
        unsigned long                   offset;
@@ -289,7 +290,7 @@ static void free_trace_uprobe(struct trace_uprobe *tu)
        for (i = 0; i < tu->tp.nr_args; i++)
                traceprobe_free_probe_arg(&tu->tp.args[i]);
-        iput(tu->inode);
+        path_put(&tu->path);
        kfree(tu->tp.call.class->system);
        kfree(tu->tp.call.name);
        kfree(tu->filename);
@@ -363,7 +364,6 @@ end:
 static int create_trace_uprobe(int argc, char **argv)
 {
        struct trace_uprobe *tu;
-        struct inode *inode;
        char *arg, *event, *group, *filename;
        char buf[MAX_EVENT_NAME_LEN];
        struct path path;
@@ -371,7 +371,6 @@ static int create_trace_uprobe(int argc, char **argv)
        bool is_delete, is_return;
        int i, ret;
-        inode = NULL;
        ret = 0;
        is_delete = false;
        is_return = false;
@@ -437,21 +436,16 @@ static int create_trace_uprobe(int argc, char **argv)
        }
        /* Find the last occurrence, in case the path contains ':' too. */
        arg = strrchr(argv[1], ':');
-        if (!arg) {
+        if (!arg)
-                ret = -EINVAL;
+                return -EINVAL;
-                goto fail_address_parse;
-        }
        *arg++ = '\0';
        filename = argv[1];
        ret = kern_path(filename, LOOKUP_FOLLOW, &path);
        if (ret)
-                goto fail_address_parse;
+                return ret;
-        inode = igrab(d_real_inode(path.dentry));
-        path_put(&path);
-        if (!inode || !S_ISREG(inode->i_mode)) {
+        if (!d_is_reg(path.dentry)) {
                ret = -EINVAL;
                goto fail_address_parse;
        }
@@ -490,7 +484,7 @@ static int create_trace_uprobe(int argc, char **argv)
                goto fail_address_parse;
        }
        tu->offset = offset;
-        tu->inode = inode;
+        tu->path = path;
        tu->filename = kstrdup(filename, GFP_KERNEL);
        if (!tu->filename) {
@@ -558,7 +552,7 @@ error:
        return ret;
 fail_address_parse:
-        iput(inode);
+        path_put(&path);
        pr_info("Failed to parse address or file.\n");
@@ -922,6 +916,7 @@ probe_event_enable(struct trace_uprobe *tu, struct trace_event_file *file,
                goto err_flags;
        tu->consumer.filter = filter;
+        tu->inode = d_real_inode(tu->path.dentry);
        ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
        if (ret)
                goto err_buffer;
@@ -967,6 +962,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file)
        WARN_ON(!uprobe_filter_is_empty(&tu->filter));
        uprobe_unregister(tu->inode, tu->offset, &tu->consumer);
+        tu->inode = NULL;
        tu->tp.flags &= file ? ~TP_FLAG_TRACE : ~TP_FLAG_PROFILE;
        uprobe_buffer_disable();
@@ -1337,7 +1333,6 @@ struct trace_event_call *
 create_local_trace_uprobe(char *name, unsigned long offs, bool is_return)
 {
        struct trace_uprobe *tu;
-        struct inode *inode;
        struct path path;
        int ret;
@@ -1345,11 +1340,8 @@ create_local_trace_uprobe(char *name, unsigned long offs, bool is_return)
        if (ret)
                return ERR_PTR(ret);
-        inode = igrab(d_inode(path.dentry));
+        if (!d_is_reg(path.dentry)) {
-        path_put(&path);
+                path_put(&path);
-        if (!inode || !S_ISREG(inode->i_mode)) {
-                iput(inode);
                return ERR_PTR(-EINVAL);
        }
@@ -1364,11 +1356,12 @@ create_local_trace_uprobe(char *name, unsigned long offs, bool is_return)
        if (IS_ERR(tu)) {
                pr_info("Failed to allocate trace_uprobe.(%d)\n",
                        (int)PTR_ERR(tu));
+                path_put(&path);
                return ERR_CAST(tu);
        }
        tu->offset = offs;
-        tu->inode = inode;
+        tu->path = path;
        tu->filename = kstrdup(name, GFP_KERNEL);
        init_trace_event_call(tu, &tu->tp.call);
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 671b13457387..1e37da2e0c25 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -207,7 +207,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
                        lockdep_is_held(&tracepoints_mutex));
        old = func_add(&tp_funcs, func, prio);
        if (IS_ERR(old)) {
-                WARN_ON_ONCE(1);
+                WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
                return PTR_ERR(old);
        }
@@ -239,7 +239,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
                        lockdep_is_held(&tracepoints_mutex));
        old = func_remove(&tp_funcs, func);
        if (IS_ERR(old)) {
-                WARN_ON_ONCE(1);
+                WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
                return PTR_ERR(old);
        }
diff --git a/lib/errseq.c b/lib/errseq.c
index df782418b333..81f9e33aa7e7 100644
--- a/lib/errseq.c
+++ b/lib/errseq.c
@@ -111,27 +111,22 @@ EXPORT_SYMBOL(errseq_set);
 * errseq_sample() - Grab current errseq_t value.
 * @eseq: Pointer to errseq_t to be sampled.
 *
- * This function allows callers to sample an errseq_t value, marking it as
+ * This function allows callers to initialise their errseq_t variable.
- * "seen" if required.
+ * If the error has been "seen", new callers will not see an old error.
+ * If there is an unseen error in @eseq, the caller of this function will
+ * see it the next time it checks for an error.
 *
+ * Context: Any context.
 * Return: The current errseq value.
 */
 errseq_t errseq_sample(errseq_t *eseq)
 {
        errseq_t old = READ_ONCE(*eseq);
-        errseq_t new = old;
-        /*
+        /* If nobody has seen this error yet, then we can be the first. */
-         * For the common case of no errors ever having been set, we can skip
+        if (!(old & ERRSEQ_SEEN))
-         * marking the SEEN bit. Once an error has been set, the value will
+                old = 0;
-         * never go back to zero.
+        return old;
-         */
-        if (old != 0) {
-                new |= ERRSEQ_SEEN;
-                if (old != new)
-                        cmpxchg(eseq, old, new);
-        }
-        return new;
 }
 EXPORT_SYMBOL(errseq_sample);
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index fece57566d45..12fbaa445637 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -737,7 +737,7 @@ out_unmap:
        swiotlb_tbl_unmap_single(dev, phys_addr, size, DMA_TO_DEVICE,
                        DMA_ATTR_SKIP_CPU_SYNC);
 out_warn:
-        if ((attrs & DMA_ATTR_NO_WARN) && printk_ratelimit()) {
+        if (!(attrs & DMA_ATTR_NO_WARN) && printk_ratelimit()) {
                dev_warn(dev,
                        "swiotlb: coherent allocation failed, size=%zu\n",
                        size);
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 023190c69dce..7441bd93b732 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -115,6 +115,7 @@ static int bdi_debug_register(struct backing_dev_info *bdi, const char *name)
                                               bdi, &bdi_debug_stats_fops);
        if (!bdi->debug_stats) {
                debugfs_remove(bdi->debug_dir);
+                bdi->debug_dir = NULL;
                return -ENOMEM;
        }
@@ -383,7 +384,7 @@ static void wb_shutdown(struct bdi_writeback *wb)
         * the barrier provided by test_and_clear_bit() above.
         */
        smp_wmb();
-        clear_bit(WB_shutting_down, &wb->state);
+        clear_and_wake_up_bit(WB_shutting_down, &wb->state);
 }
 static void wb_exit(struct bdi_writeback *wb)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 82c1a6f430b3..5bb6681fa91e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -518,8 +518,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
                return -ELOOP;
        }
-        /* Device is already being bridged */
+        /* Device has master upper dev */
-        if (br_port_exists(dev))
+        if (netdev_master_upper_dev_get(dev))
                return -EBUSY;
        /* No bridging devices that dislike that (e.g. wireless) */
diff --git a/net/compat.c b/net/compat.c
index 5ae7437d3853..7242cce5631b 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -377,7 +377,8 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
            optname == SO_ATTACH_REUSEPORT_CBPF)
                return do_set_attach_filter(sock, level, optname,
                                            optval, optlen);
-        if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+        if (!COMPAT_USE_64BIT_TIME &&
+            (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
                return do_set_sock_timeout(sock, level, optname, optval, optlen);
        return sock_setsockopt(sock, level, optname, optval, optlen);
@@ -448,7 +449,8 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
 static int compat_sock_getsockopt(struct socket *sock, int level, int optname,
                                char __user *optval, int __user *optlen)
 {
-        if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+        if (!COMPAT_USE_64BIT_TIME &&
+            (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
                return do_get_sock_timeout(sock, level, optname, optval, optlen);
        return sock_getsockopt(sock, level, optname, optval, optlen);
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 03416e6dd5d7..ba02f0dfe85c 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1032,6 +1032,11 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
                info_size = sizeof(info);
                if (copy_from_user(&info, useraddr, info_size))
                        return -EFAULT;
+                /* Since malicious users may modify the original data,
+                 * we need to check whether FLOW_RSS is still requested.
+                 */
+                if (!(info.flow_type & FLOW_RSS))
+                        return -EINVAL;
        }
        if (info.cmd == ETHTOOL_GRXCLSRLALL) {
diff --git a/net/core/filter.c b/net/core/filter.c
index d31aff93270d..e77c30ca491d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3240,6 +3240,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
        skb_dst_set(skb, (struct dst_entry *) md);
        info = &md->u.tun_info;
+        memset(info, 0, sizeof(*info));
        info->mode = IP_TUNNEL_INFO_TX;
        info->key.tun_flags = TUNNEL_KEY | TUNNEL_CSUM | TUNNEL_NOCACHE;
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 92d016e87816..385f153fe031 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -126,6 +126,16 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val)
                                                  DCCPF_SEQ_WMAX));
 }
+static void dccp_tasklet_schedule(struct sock *sk)
+{
+        struct tasklet_struct *t = &dccp_sk(sk)->dccps_xmitlet;
+        if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) {
+                sock_hold(sk);
+                __tasklet_schedule(t);
+        }
+}
 static void ccid2_hc_tx_rto_expire(struct timer_list *t)
 {
        struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer);
@@ -166,7 +176,7 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
        /* if we were blocked before, we may now send cwnd=1 packet */
        if (sender_was_blocked)
-                tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+                dccp_tasklet_schedule(sk);
        /* restart backed-off timer */
        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 out:
@@ -706,7 +716,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 done:
        /* check if incoming Acks allow pending packets to be sent */
        if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
-                tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+                dccp_tasklet_schedule(sk);
        dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index b50a8732ff43..1501a20a94ca 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -232,6 +232,7 @@ static void dccp_write_xmitlet(unsigned long data)
        else
                dccp_write_xmit(sk);
        bh_unlock_sock(sk);
+        sock_put(sk);
 }
 static void dccp_write_xmit_timer(struct timer_list *t)
@@ -240,7 +241,6 @@ static void dccp_write_xmit_timer(struct timer_list *t)
        struct sock *sk = &dp->dccps_inet_connection.icsk_inet.sk;
        dccp_write_xmitlet((unsigned long)sk);
-        sock_put(sk);
 }
 void dccp_init_xmit_timers(struct sock *sk)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ccb25d80f679..1412a7baf0b9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -709,7 +709,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                fnhe->fnhe_gw = gw;
                fnhe->fnhe_pmtu = pmtu;
                fnhe->fnhe_mtu_locked = lock;
-                fnhe->fnhe_expires = expires;
+                fnhe->fnhe_expires = max(1UL, expires);
                /* Exception created; mark the cached routes for the nexthop
                 * stale, so anyone caching it rechecks if this exception
@@ -1297,6 +1297,36 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
        return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
 }
+static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
+{
+        struct fnhe_hash_bucket *hash;
+        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
+        u32 hval = fnhe_hashfun(daddr);
+        spin_lock_bh(&fnhe_lock);
+        hash = rcu_dereference_protected(nh->nh_exceptions,
+                                         lockdep_is_held(&fnhe_lock));
+        hash += hval;
+        fnhe_p = &hash->chain;
+        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
+        while (fnhe) {
+                if (fnhe->fnhe_daddr == daddr) {
+                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
+                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
+                        fnhe_flush_routes(fnhe);
+                        kfree_rcu(fnhe, rcu);
+                        break;
+                }
+                fnhe_p = &fnhe->fnhe_next;
+                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
+                                                 lockdep_is_held(&fnhe_lock));
+        }
+        spin_unlock_bh(&fnhe_lock);
+}
 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
 {
        struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
@@ -1310,8 +1340,14 @@ static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
        for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
             fnhe = rcu_dereference(fnhe->fnhe_next)) {
-                if (fnhe->fnhe_daddr == daddr)
+                if (fnhe->fnhe_daddr == daddr) {
+                        if (fnhe->fnhe_expires &&
+                            time_after(jiffies, fnhe->fnhe_expires)) {
+                                ip_del_fnhe(nh, daddr);
+                                break;
+                        }
                        return fnhe;
+                }
        }
        return NULL;
 }
@@ -1636,36 +1672,6 @@ static void ip_handle_martian_source(struct net_device *dev,
 #endif
 }
-static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
-{
-        struct fnhe_hash_bucket *hash;
-        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
-        u32 hval = fnhe_hashfun(daddr);
-        spin_lock_bh(&fnhe_lock);
-        hash = rcu_dereference_protected(nh->nh_exceptions,
-                                         lockdep_is_held(&fnhe_lock));
-        hash += hval;
-        fnhe_p = &hash->chain;
-        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
-        while (fnhe) {
-                if (fnhe->fnhe_daddr == daddr) {
-                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
-                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
-                        fnhe_flush_routes(fnhe);
-                        kfree_rcu(fnhe, rcu);
-                        break;
-                }
-                fnhe_p = &fnhe->fnhe_next;
-                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
-                                                 lockdep_is_held(&fnhe_lock));
-        }
-        spin_unlock_bh(&fnhe_lock);
-}
 /* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
                           const struct fib_result *res,
@@ -1719,20 +1725,10 @@ static int __mkroute_input(struct sk_buff *skb,
        fnhe = find_exception(&FIB_RES_NH(*res), daddr);
        if (do_cache) {
-                if (fnhe) {
+                if (fnhe)
                        rth = rcu_dereference(fnhe->fnhe_rth_input);
-                        if (rth && rth->dst.expires &&
+                else
-                            time_after(jiffies, rth->dst.expires)) {
+                        rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
-                                ip_del_fnhe(&FIB_RES_NH(*res), daddr);
-                                fnhe = NULL;
-                        } else {
-                                goto rt_cache;
-                        }
-                }
-                rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
-rt_cache:
                if (rt_cache_valid(rth)) {
                        skb_dst_set_noref(skb, &rth->dst);
                        goto out;
@@ -2216,39 +2212,31 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                 * the loopback interface and the IP_PKTINFO ipi_ifindex will
                 * be set to the loopback interface as well.
                 */
-                fi = NULL;
+                do_cache = false;
        }
        fnhe = NULL;
        do_cache &= fi != NULL;
-        if (do_cache) {
+        if (fi) {
                struct rtable __rcu **prth;
                struct fib_nh *nh = &FIB_RES_NH(*res);
                fnhe = find_exception(nh, fl4->daddr);
+                if (!do_cache)
+                        goto add;
                if (fnhe) {
                        prth = &fnhe->fnhe_rth_output;
-                        rth = rcu_dereference(*prth);
+                } else {
-                        if (rth && rth->dst.expires &&
+                        if (unlikely(fl4->flowi4_flags &
-                            time_after(jiffies, rth->dst.expires)) {
+                                     FLOWI_FLAG_KNOWN_NH &&
-                                ip_del_fnhe(nh, fl4->daddr);
+                                     !(nh->nh_gw &&
-                                fnhe = NULL;
+                                       nh->nh_scope == RT_SCOPE_LINK))) {
-                        } else {
+                                do_cache = false;
-                                goto rt_cache;
+                                goto add;
                        }
+                        prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                }
-                if (unlikely(fl4->flowi4_flags &
-                             FLOWI_FLAG_KNOWN_NH &&
-                             !(nh->nh_gw &&
-                               nh->nh_scope == RT_SCOPE_LINK))) {
-                        do_cache = false;
-                        goto add;
-                }
-                prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                rth = rcu_dereference(*prth);
-rt_cache:
                if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst))
                        return rth;
        }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9ce1c726185e..c9d00ef54dec 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -697,7 +697,7 @@ static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
 {
        return skb->len < size_goal &&
               sock_net(sk)->ipv4.sysctl_tcp_autocorking &&
-               skb != tcp_write_queue_head(sk) &&
+               !tcp_rtx_queue_empty(sk) &&
               refcount_read(&sk->sk_wmem_alloc) > skb->truesize;
 }
@@ -1204,7 +1204,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
                        uarg->zerocopy = 0;
        }
-        if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect)) {
+        if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect) &&
+            !tp->repair) {
                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
                if (err == -EINPROGRESS && copied_syn > 0)
                        goto out;
@@ -2673,7 +2674,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
        case TCP_REPAIR_QUEUE:
                if (!tp->repair)
                        err = -EPERM;
-                else if (val < TCP_QUEUES_NR)
+                else if ((unsigned int)val < TCP_QUEUES_NR)
                        tp->repair_queue = val;
                else
                        err = -EINVAL;
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 158d105e76da..58e2f479ffb4 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -806,7 +806,9 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
                        }
                }
        }
-        bbr->idle_restart = 0;
+        /* Restart after idle ends only once we process a new S/ACK for data */
+        if (rs->delivered > 0)
+                bbr->idle_restart = 0;
 }
 static void bbr_update_model(struct sock *sk, const struct rate_sample *rs)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index cde7d8251377..f4d61736c41a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
        const struct ipv6hdr *inner_iph;
        const struct icmp6hdr *icmph;
        struct ipv6hdr _inner_iph;
+        struct icmp6hdr _icmph;
        if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
                goto out;
-        icmph = icmp6_hdr(skb);
+        icmph = skb_header_pointer(skb, skb_transport_offset(skb),
+                                   sizeof(_icmph), &_icmph);
+        if (!icmph)
+                goto out;
        if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
            icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
            icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index eea1d8611b20..13b38ad0fa4a 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -547,7 +547,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
        rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
                 ic->i_send_cq, ic->i_recv_cq);
-        return ret;
+        goto out;
 sends_out:
        vfree(ic->i_sends);
@@ -572,6 +572,7 @@ send_cq_out:
                ic->i_send_cq = NULL;
 rds_ibdev_out:
        rds_ib_remove_conn(rds_ibdev, conn);
+out:
        rds_ib_dev_put(rds_ibdev);
        return ret;
diff --git a/net/rds/recv.c b/net/rds/recv.c
index de50e2126e40..dc67458b52f0 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -558,6 +558,7 @@ static int rds_cmsg_recv(struct rds_incoming *inc, struct msghdr *msg,
                struct rds_cmsg_rx_trace t;
                int i, j;
+                memset(&t, 0, sizeof(t));
                inc->i_rx_lat_trace[RDS_MSG_RX_CMSG] = local_clock();
                t.rx_traces =  rs->rs_rx_traces;
                for (i = 0; i < rs->rs_rx_traces; i++) {
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index a366e4c9413a..4808713c73b9 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -128,6 +128,28 @@ static bool fq_flow_is_detached(const struct fq_flow *f)
        return f->next == &detached;
 }
+static bool fq_flow_is_throttled(const struct fq_flow *f)
+{
+        return f->next == &throttled;
+}
+static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
+{
+        if (head->first)
+                head->last->next = flow;
+        else
+                head->first = flow;
+        head->last = flow;
+        flow->next = NULL;
+}
+static void fq_flow_unset_throttled(struct fq_sched_data *q, struct fq_flow *f)
+{
+        rb_erase(&f->rate_node, &q->delayed);
+        q->throttled_flows--;
+        fq_flow_add_tail(&q->old_flows, f);
+}
 static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
 {
        struct rb_node **p = &q->delayed.rb_node, *parent = NULL;
@@ -155,15 +177,6 @@ static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
 static struct kmem_cache *fq_flow_cachep __read_mostly;
-static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
-{
-        if (head->first)
-                head->last->next = flow;
-        else
-                head->first = flow;
-        head->last = flow;
-        flow->next = NULL;
-}
 /* limit number of collected flows per round */
 #define FQ_GC_MAX 8
@@ -267,6 +280,8 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
                                     f->socket_hash != sk->sk_hash)) {
                                f->credit = q->initial_quantum;
                                f->socket_hash = sk->sk_hash;
+                                if (fq_flow_is_throttled(f))
+                                        fq_flow_unset_throttled(q, f);
                                f->time_next_packet = 0ULL;
                        }
                        return f;
@@ -438,9 +453,7 @@ static void fq_check_throttled(struct fq_sched_data *q, u64 now)
                        q->time_next_delayed_flow = f->time_next_packet;
                        break;
                }
-                rb_erase(p, &q->delayed);
+                fq_flow_unset_throttled(q, f);
-                q->throttled_flows--;
-                fq_flow_add_tail(&q->old_flows, f);
        }
 }
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 23ebc5318edc..eb93ffe2408b 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -217,7 +217,7 @@ new_skb:
        skb_pull(chunk->skb, sizeof(*ch));
        chunk->subh.v = NULL; /* Subheader is no longer valid.  */
-        if (chunk->chunk_end + sizeof(*ch) < skb_tail_pointer(chunk->skb)) {
+        if (chunk->chunk_end + sizeof(*ch) <= skb_tail_pointer(chunk->skb)) {
                /* This is not a singleton */
                chunk->singleton = 0;
        } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2e3f7b75a8ec..42247110d842 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -895,6 +895,9 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
        if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
                return 1;
+        if (addr1->sa.sa_family == AF_INET && addr2->sa.sa_family == AF_INET)
+                return addr1->v4.sin_addr.s_addr == addr2->v4.sin_addr.s_addr;
        return __sctp_v6_cmp_addr(addr1, addr2);
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index dd0594a10961..28c070e187c2 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1794,6 +1794,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
                               GFP_ATOMIC))
                goto nomem;
+        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
+                goto nomem;
        /* Make sure no new addresses are being added during the
         * restart.  Though this is a pretty complicated attack
         * since you'd have to get inside the cookie.
@@ -1906,6 +1909,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_b(
                               GFP_ATOMIC))
                goto nomem;
+        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
+                goto nomem;
        /* Update the content of current association.  */
        sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
@@ -2050,7 +2056,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_d(
                }
        }
-        repl = sctp_make_cookie_ack(new_asoc, chunk);
+        repl = sctp_make_cookie_ack(asoc, chunk);
        if (!repl)
                goto nomem;
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index f799043abec9..f1f1d1b232ba 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -240,6 +240,8 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
        new->out = NULL;
        new->in  = NULL;
+        new->outcnt = 0;
+        new->incnt  = 0;
 }
 static int sctp_send_reconf(struct sctp_association *asoc,
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index f5d4b69dbabc..544bab42f925 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -292,6 +292,17 @@ static void smc_copy_sock_settings_to_smc(struct smc_sock *smc)
        smc_copy_sock_settings(&smc->sk, smc->clcsock->sk, SK_FLAGS_CLC_TO_SMC);
 }
+/* register a new rmb */
+static int smc_reg_rmb(struct smc_link *link, struct smc_buf_desc *rmb_desc)
+{
+        /* register memory region for new rmb */
+        if (smc_wr_reg_send(link, rmb_desc->mr_rx[SMC_SINGLE_LINK])) {
+                rmb_desc->regerr = 1;
+                return -EFAULT;
+        }
+        return 0;
+}
 static int smc_clnt_conf_first_link(struct smc_sock *smc)
 {
        struct smc_link_group *lgr = smc->conn.lgr;
@@ -321,9 +332,7 @@ static int smc_clnt_conf_first_link(struct smc_sock *smc)
        smc_wr_remember_qp_attr(link);
-        rc = smc_wr_reg_send(link,
+        if (smc_reg_rmb(link, smc->conn.rmb_desc))
-                             smc->conn.rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-        if (rc)
                return SMC_CLC_DECL_INTERR;
        /* send CONFIRM LINK response over RoCE fabric */
@@ -473,13 +482,8 @@ static int smc_connect_rdma(struct smc_sock *smc)
                        goto decline_rdma_unlock;
                }
        } else {
-                struct smc_buf_desc *buf_desc = smc->conn.rmb_desc;
+                if (!smc->conn.rmb_desc->reused) {
+                        if (smc_reg_rmb(link, smc->conn.rmb_desc)) {
-                if (!buf_desc->reused) {
-                        /* register memory region for new rmb */
-                        rc = smc_wr_reg_send(link,
-                                             buf_desc->mr_rx[SMC_SINGLE_LINK]);
-                        if (rc) {
                                reason_code = SMC_CLC_DECL_INTERR;
                                goto decline_rdma_unlock;
                        }
@@ -719,9 +723,7 @@ static int smc_serv_conf_first_link(struct smc_sock *smc)
        link = &lgr->lnk[SMC_SINGLE_LINK];
-        rc = smc_wr_reg_send(link,
+        if (smc_reg_rmb(link, smc->conn.rmb_desc))
-                             smc->conn.rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-        if (rc)
                return SMC_CLC_DECL_INTERR;
        /* send CONFIRM LINK request to client over the RoCE fabric */
@@ -854,13 +856,8 @@ static void smc_listen_work(struct work_struct *work)
        smc_rx_init(new_smc);
        if (local_contact != SMC_FIRST_CONTACT) {
-                struct smc_buf_desc *buf_desc = new_smc->conn.rmb_desc;
+                if (!new_smc->conn.rmb_desc->reused) {
+                        if (smc_reg_rmb(link, new_smc->conn.rmb_desc)) {
-                if (!buf_desc->reused) {
-                        /* register memory region for new rmb */
-                        rc = smc_wr_reg_send(link,
-                                             buf_desc->mr_rx[SMC_SINGLE_LINK]);
-                        if (rc) {
                                reason_code = SMC_CLC_DECL_INTERR;
                                goto decline_rdma_unlock;
                        }
@@ -978,10 +975,6 @@ static void smc_tcp_listen_work(struct work_struct *work)
        }
 out:
-        if (lsmc->clcsock) {
-                sock_release(lsmc->clcsock);
-                lsmc->clcsock = NULL;
-        }
        release_sock(lsk);
        sock_put(&lsmc->sk); /* sock_hold in smc_listen */
 }
@@ -1170,13 +1163,15 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
                /* delegate to CLC child sock */
                release_sock(sk);
                mask = smc->clcsock->ops->poll(file, smc->clcsock, wait);
-                /* if non-blocking connect finished ... */
                lock_sock(sk);
-                if ((sk->sk_state == SMC_INIT) && (mask & EPOLLOUT)) {
+                sk->sk_err = smc->clcsock->sk->sk_err;
-                        sk->sk_err = smc->clcsock->sk->sk_err;
+                if (sk->sk_err) {
-                        if (sk->sk_err) {
+                        mask |= EPOLLERR;
-                                mask |= EPOLLERR;
+                } else {
-                        } else {
+                        /* if non-blocking connect finished ... */
+                        if (sk->sk_state == SMC_INIT &&
+                            mask & EPOLLOUT &&
+                            smc->clcsock->sk->sk_state != TCP_CLOSE) {
                                rc = smc_connect_rdma(smc);
                                if (rc < 0)
                                        mask |= EPOLLERR;
@@ -1320,8 +1315,11 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page,
        smc = smc_sk(sk);
        lock_sock(sk);
-        if (sk->sk_state != SMC_ACTIVE)
+        if (sk->sk_state != SMC_ACTIVE) {
+                release_sock(sk);
                goto out;
+        }
+        release_sock(sk);
        if (smc->use_fallback)
                rc = kernel_sendpage(smc->clcsock, page, offset,
                                     size, flags);
@@ -1329,7 +1327,6 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page,
                rc = sock_no_sendpage(sock, page, offset, size, flags);
 out:
-        release_sock(sk);
        return rc;
 }
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index f44f6803f7ff..d4bd01bb44e1 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -32,6 +32,9 @@
 static u32 smc_lgr_num;                 /* unique link group number */
+static void smc_buf_free(struct smc_buf_desc *buf_desc, struct smc_link *lnk,
+                         bool is_rmb);
 static void smc_lgr_schedule_free_work(struct smc_link_group *lgr)
 {
        /* client link group creation always follows the server link group
@@ -234,9 +237,22 @@ static void smc_buf_unuse(struct smc_connection *conn)
                conn->sndbuf_size = 0;
        }
        if (conn->rmb_desc) {
-                conn->rmb_desc->reused = true;
+                if (!conn->rmb_desc->regerr) {
-                conn->rmb_desc->used = 0;
+                        conn->rmb_desc->reused = 1;
-                conn->rmbe_size = 0;
+                        conn->rmb_desc->used = 0;
+                        conn->rmbe_size = 0;
+                } else {
+                        /* buf registration failed, reuse not possible */
+                        struct smc_link_group *lgr = conn->lgr;
+                        struct smc_link *lnk;
+                        write_lock_bh(&lgr->rmbs_lock);
+                        list_del(&conn->rmb_desc->list);
+                        write_unlock_bh(&lgr->rmbs_lock);
+                        lnk = &lgr->lnk[SMC_SINGLE_LINK];
+                        smc_buf_free(conn->rmb_desc, lnk, true);
+                }
        }
 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index 07e2a393e6d9..5dfcb15d529f 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -123,7 +123,8 @@ struct smc_buf_desc {
                                                 */
        u32                     order;          /* allocation order */
        u32                     used;           /* currently used / unused */
-        bool                    reused;         /* new created / reused */
+        u8                      reused  : 1;    /* new created / reused */
+        u8                      regerr  : 1;    /* err during registration */
 };
 struct smc_rtoken {                             /* address/key of remote RMB */
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 6f98b56dd48e..baaf93f12cbd 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2244,7 +2244,7 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb)
        rtnl_lock();
        for (bearer_id = prev_bearer; bearer_id < MAX_BEARERS; bearer_id++) {
-                err = __tipc_nl_add_monitor(net, &msg, prev_bearer);
+                err = __tipc_nl_add_monitor(net, &msg, bearer_id);
                if (err)
                        break;
        }
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 0d379970960e..cc03e00785c7 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -114,6 +114,7 @@ int tls_push_sg(struct sock *sk,
        size = sg->length - offset;
        offset += sg->offset;
+        ctx->in_tcp_sendpages = true;
        while (1) {
                if (sg_is_last(sg))
                        sendpage_flags = flags;
@@ -148,6 +149,8 @@ retry:
        }
        clear_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags);
+        ctx->in_tcp_sendpages = false;
+        ctx->sk_write_space(sk);
        return 0;
 }
@@ -217,6 +220,10 @@ static void tls_write_space(struct sock *sk)
 {
        struct tls_context *ctx = tls_get_ctx(sk);
+        /* We are already sending pages, ignore notification */
+        if (ctx->in_tcp_sendpages)
+                return;
        if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
                gfp_t sk_allocation = sk->sk_allocation;
                int rc;
diff --git a/samples/sockmap/Makefile b/samples/sockmap/Makefile
index 9bf2881bd11b..fa53f4d77834 100644
--- a/samples/sockmap/Makefile
+++ b/samples/sockmap/Makefile
@@ -65,11 +65,14 @@ $(src)/*.c: verify_target_bpf
 # asm/sysreg.h - inline assembly used by it is incompatible with llvm.
 # But, there is no easy way to fix it, so just exclude it since it is
 # useless for BPF samples.
+#
+# -target bpf option required with SK_MSG programs, this is to ensure
+#  reading 'void *' data types for data and data_end are __u64 reads.
 $(obj)/%.o: $(src)/%.c
        $(CLANG) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(EXTRA_CFLAGS) -I$(obj) \
                -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \
                -Wno-compare-distinct-pointer-types \
                -Wno-gnu-variable-sized-type-not-at-end \
                -Wno-address-of-packed-member -Wno-tautological-compare \
-                -Wno-unknown-warning-option \
+                -Wno-unknown-warning-option -O2 -target bpf \
-                -O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
+                -emit-llvm -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index b2a95af7df18..7f5c86246138 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -14,7 +14,7 @@ ifdef CONFIG_GCC_PLUGINS
  endif
  ifdef CONFIG_GCC_PLUGIN_SANCOV
-    ifeq ($(CFLAGS_KCOV),)
+    ifeq ($(strip $(CFLAGS_KCOV)),)
      # It is needed because of the gcc-plugin.sh and gcc version checks.
      gcc-plugin-$(CONFIG_GCC_PLUGIN_SANCOV)           += sancov_plugin.so
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 07d07409f16f..5af34a2b0cd9 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -196,7 +196,7 @@ $(obj)/%.tab.c: $(src)/%.y FORCE
        $(call if_changed,bison)
 quiet_cmd_bison_h = YACC    $@
-      cmd_bison_h = bison -o/dev/null --defines=$@ -t -l $<
+      cmd_bison_h = $(YACC) -o/dev/null --defines=$@ -t -l $<
 $(obj)/%.tab.h: $(src)/%.y FORCE
        $(call if_changed,bison_h)
diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
index 61d9b256c658..a1c51b7e4baf 100755
--- a/scripts/extract_xc3028.pl
+++ b/scripts/extract_xc3028.pl
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
-# Copyright (c) Mauro Carvalho Chehab <mchehab@infradead.org>
+# Copyright (c) Mauro Carvalho Chehab <mchehab@kernel.org>
 # Released under GPLv2
 #
 # In order to use, you need to:
diff --git a/scripts/genksyms/Makefile b/scripts/genksyms/Makefile
index ef0287e42957..03b7ce97de14 100644
--- a/scripts/genksyms/Makefile
+++ b/scripts/genksyms/Makefile
@@ -14,14 +14,14 @@ genksyms-objs	:= genksyms.o parse.tab.o lex.lex.o
 # so that 'bison: not found' will be displayed if it is missing.
 ifeq ($(findstring 1,$(KBUILD_ENABLE_EXTRA_GCC_CHECKS)),)
-quiet_cmd_bison_no_warn = $(quet_cmd_bison)
+quiet_cmd_bison_no_warn = $(quiet_cmd_bison)
      cmd_bison_no_warn = $(YACC) --version >/dev/null; \
                          $(cmd_bison) 2>/dev/null
 $(obj)/parse.tab.c: $(src)/parse.y FORCE
        $(call if_changed,bison_no_warn)
-quiet_cmd_bison_h_no_warn = $(quet_cmd_bison_h)
+quiet_cmd_bison_h_no_warn = $(quiet_cmd_bison_h)
      cmd_bison_h_no_warn = $(YACC) --version >/dev/null; \
                            $(cmd_bison_h) 2>/dev/null
diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index 944418da9fe3..0f6dcb4011a8 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -330,14 +330,7 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
                goto out;
        }
-        /* There will be a line like so:
+        /* Sum all files in the same dir or subdirs. */
-                deps_drivers/net/dummy.o := \
-                  drivers/net/dummy.c \
-                    $(wildcard include/config/net/fastroute.h) \
-                  include/linux/module.h \
-           Sum all files in the same dir or subdirs.
-        */
        while ((line = get_next_line(&pos, file, flen)) != NULL) {
                char* p = line;
diff --git a/scripts/split-man.pl b/scripts/split-man.pl
index bfe16cbe42df..c3db607ee9ec 100755
--- a/scripts/split-man.pl
+++ b/scripts/split-man.pl
@@ -1,7 +1,7 @@
 #!/usr/bin/perl
 # SPDX-License-Identifier: GPL-2.0
 #
-# Author: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+# Author: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
 #
 # Produce manpages from kernel-doc.
 # See Documentation/doc-guide/kernel-doc.rst for instructions
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 06d7c40af570..6491afbb5fd5 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -423,6 +423,8 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
                return -ENOTTY;
        if (substream->stream != dir)
                return -EINVAL;
+        if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN)
+                return -EBADFD;
        if ((ch = substream->runtime->channels) > 128)
                return -EINVAL;
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index f48a4cd24ffc..289ae6bb81d9 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -174,12 +174,12 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
                        }
                        return;
                }
+                spin_lock_irqsave(&substream->runtime->lock, flags);
                if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
                        if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
-                                return;
+                                goto out;
                        vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
                }
-                spin_lock_irqsave(&substream->runtime->lock, flags);
                while (1) {
                        count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
                        if (count <= 0)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 58e349fc893f..eab7f594ebe7 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -831,9 +831,11 @@ static int loopback_rate_shift_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].rate_shift;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
@@ -865,9 +867,11 @@ static int loopback_notify_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].notify;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
@@ -879,12 +883,14 @@ static int loopback_notify_put(struct snd_kcontrol *kcontrol,
        int change = 0;
        val = ucontrol->value.integer.value[0] ? 1 : 0;
+        mutex_lock(&loopback->cable_lock);
        if (val != loopback->setup[kcontrol->id.subdevice]
                                [kcontrol->id.device].notify) {
                loopback->setup[kcontrol->id.subdevice]
                        [kcontrol->id.device].notify = val;
                change = 1;
        }
+        mutex_unlock(&loopback->cable_lock);
        return change;
 }
@@ -892,15 +898,18 @@ static int loopback_active_get(struct snd_kcontrol *kcontrol,
                               struct snd_ctl_elem_value *ucontrol)
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
-        struct loopback_cable *cable = loopback->cables
+        struct loopback_cable *cable;
-                        [kcontrol->id.subdevice][kcontrol->id.device ^ 1];
        unsigned int val = 0;
+        mutex_lock(&loopback->cable_lock);
+        cable = loopback->cables[kcontrol->id.subdevice][kcontrol->id.device ^ 1];
        if (cable != NULL) {
                unsigned int running = cable->running ^ cable->pause;
                val = (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) ? 1 : 0;
        }
+        mutex_unlock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] = val;
        return 0;
 }
@@ -943,9 +952,11 @@ static int loopback_rate_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].rate;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
@@ -965,9 +976,11 @@ static int loopback_channels_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].channels;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
index 4a1dc145327b..cb9acfe60f6a 100644
--- a/sound/firewire/amdtp-stream.c
+++ b/sound/firewire/amdtp-stream.c
@@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(struct fw_iso_context *context,
        u32 cycle;
        unsigned int packets;
-        s->max_payload_length = amdtp_stream_get_max_payload(s);
        /*
         * For in-stream, first packet has come.
         * For out-stream, prepared to transmit first packet
@@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed)
        amdtp_stream_update(s);
+        if (s->direction == AMDTP_IN_STREAM)
+                s->max_payload_length = amdtp_stream_get_max_payload(s);
        if (s->flags & CIP_NO_HEADER)
                s->tag = TAG_NO_CIP_HEADER;
        else
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 8c238e51bb5a..2dd34dd77447 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3832,7 +3832,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec,
        }
 }
-#if IS_REACHABLE(INPUT)
+#if IS_REACHABLE(CONFIG_INPUT)
 static void gpio2_mic_hotkey_event(struct hda_codec *codec,
                                   struct hda_jack_callback *event)
 {
diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile
index 1ea545965ee3..53b60ad452f5 100644
--- a/tools/bpf/Makefile
+++ b/tools/bpf/Makefile
@@ -76,6 +76,8 @@ $(OUTPUT)bpf_asm: $(OUTPUT)bpf_asm.o $(OUTPUT)bpf_exp.yacc.o $(OUTPUT)bpf_exp.le
        $(QUIET_LINK)$(CC) $(CFLAGS) -o $@ $^
 $(OUTPUT)bpf_exp.lex.c: $(OUTPUT)bpf_exp.yacc.c
+$(OUTPUT)bpf_exp.yacc.o: $(OUTPUT)bpf_exp.yacc.c
+$(OUTPUT)bpf_exp.lex.o: $(OUTPUT)bpf_exp.lex.c
 clean: bpftool_clean
        $(call QUIET_CLEAN, bpf-progs)
diff --git a/tools/bpf/bpf_dbg.c b/tools/bpf/bpf_dbg.c
index 4f254bcc4423..61b9aa5d6415 100644
--- a/tools/bpf/bpf_dbg.c
+++ b/tools/bpf/bpf_dbg.c
@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file)
 static int cmd_load(char *arg)
 {
-        char *subcmd, *cont, *tmp = strdup(arg);
+        char *subcmd, *cont = NULL, *tmp = strdup(arg);
        int ret = CMD_OK;
        subcmd = strtok_r(tmp, " ", &cont);
@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg)
                bpf_reset();
                bpf_reset_breakpoints();
-                ret = cmd_load_bpf(cont);
+                if (!cont)
+                        ret = CMD_ERR;
+                else
+                        ret = cmd_load_bpf(cont);
        } else if (matches(subcmd, "pcap") == 0) {
                ret = cmd_load_pcap(cont);
        } else {
diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
index 2cccbba64418..f304be71c278 100644
--- a/tools/power/acpi/Makefile.config
+++ b/tools/power/acpi/Makefile.config
@@ -56,6 +56,7 @@ INSTALL_SCRIPT = ${INSTALL_PROGRAM}
 # to compile vs uClibc, that can be done here as well.
 CROSS = #/usr/i386-linux-uclibc/usr/bin/i386-uclibc-
 CROSS_COMPILE ?= $(CROSS)
+LD = $(CC)
 HOSTCC = gcc
 # check if compiler option is supported
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index faadbe233966..4123d0ab90ba 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1108,7 +1108,7 @@ static void test_stacktrace_build_id(void)
        assert(system("dd if=/dev/urandom of=/dev/zero count=4 2> /dev/null")
               == 0);
-        assert(system("./urandom_read if=/dev/urandom of=/dev/zero count=4 2> /dev/null") == 0);
+        assert(system("./urandom_read") == 0);
        /* disable stack trace collection */
        key = 0;
        val = 1;
@@ -1158,7 +1158,7 @@ static void test_stacktrace_build_id(void)
        } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
        CHECK(build_id_matches < 1, "build id match",
-              "Didn't find expected build ID from the map");
+              "Didn't find expected build ID from the map\n");
 disable_pmu:
        ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 195e9d4739a9..c1b1a4dc6a96 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -20,10 +20,10 @@ all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
 .ONESHELL:
 define RUN_TESTS
-        @export KSFT_TAP_LEVEL=`echo 1`;
+        @export KSFT_TAP_LEVEL=`echo 1`;                \
-        @test_num=`echo 0`;
+        test_num=`echo 0`;                              \
-        @echo "TAP version 13";
+        echo "TAP version 13";                          \
-        @for TEST in $(1); do                           \
+        for TEST in $(1); do                            \
                BASENAME_TEST=`basename $$TEST`;        \
                test_num=`echo $$test_num+1 | bc`;      \
                echo "selftests: $$BASENAME_TEST";      \
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 8f1e13d2e547..daf5effec3f0 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,7 +5,8 @@ CFLAGS =  -Wall -Wl,--no-as-needed -O2 -g
 CFLAGS += -I../../../../usr/include/
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
-TEST_PROGS += fib_tests.sh fib-onlink-tests.sh in_netns.sh pmtu.sh
+TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh
+TEST_GEN_PROGS_EXTENDED := in_netns.sh
 TEST_GEN_FILES =  socket
 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
 TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 68378fe17a0e..e07156c30323 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -423,7 +423,7 @@ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
         * We cannot rely on the vgic maintenance interrupt to be
         * delivered synchronously. This means we can only use it to
         * exit the VM, and we perform the handling of EOIed
-         * interrupts on the exit path (see vgic_process_maintenance).
+         * interrupts on the exit path (see vgic_fold_lr_state).
         */
        return IRQ_HANDLED;
 }
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index dbe99d635c80..ff9655cfeb2f 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -289,10 +289,16 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
               irq->vcpu->cpu != -1) /* VCPU thread is running */
                cond_resched_lock(&irq->irq_lock);
-        if (irq->hw)
+        if (irq->hw) {
                vgic_hw_irq_change_active(vcpu, irq, active, !requester_vcpu);
-        else
+        } else {
+                u32 model = vcpu->kvm->arch.vgic.vgic_model;
                irq->active = active;
+                if (model == KVM_DEV_TYPE_ARM_VGIC_V2 &&
+                    active && vgic_irq_is_sgi(irq->intid))
+                        irq->active_source = requester_vcpu->vcpu_id;
+        }
        if (irq->active)
                vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 45aa433f018f..a5f2e44f1c33 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -37,13 +37,6 @@ void vgic_v2_init_lrs(void)
                vgic_v2_write_lr(i, 0);
 }
-void vgic_v2_set_npie(struct kvm_vcpu *vcpu)
-{
-        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
-        cpuif->vgic_hcr |= GICH_HCR_NPIE;
-}
 void vgic_v2_set_underflow(struct kvm_vcpu *vcpu)
 {
        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
@@ -71,13 +64,18 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
        int lr;
        unsigned long flags;
-        cpuif->vgic_hcr &= ~(GICH_HCR_UIE | GICH_HCR_NPIE);
+        cpuif->vgic_hcr &= ~GICH_HCR_UIE;
        for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                u32 val = cpuif->vgic_lr[lr];
-                u32 intid = val & GICH_LR_VIRTUALID;
+                u32 cpuid, intid = val & GICH_LR_VIRTUALID;
                struct vgic_irq *irq;
+                /* Extract the source vCPU id from the LR */
+                cpuid = val & GICH_LR_PHYSID_CPUID;
+                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
+                cpuid &= 7;
                /* Notify fds when the guest EOI'ed a level-triggered SPI */
                if (lr_signals_eoi_mi(val) && vgic_valid_spi(vcpu->kvm, intid))
                        kvm_notify_acked_irq(vcpu->kvm, 0,
@@ -90,17 +88,16 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
                /* Always preserve the active bit */
                irq->active = !!(val & GICH_LR_ACTIVE_BIT);
+                if (irq->active && vgic_irq_is_sgi(intid))
+                        irq->active_source = cpuid;
                /* Edge is the only case where we preserve the pending bit */
                if (irq->config == VGIC_CONFIG_EDGE &&
                    (val & GICH_LR_PENDING_BIT)) {
                        irq->pending_latch = true;
-                        if (vgic_irq_is_sgi(intid)) {
+                        if (vgic_irq_is_sgi(intid))
-                                u32 cpuid = val & GICH_LR_PHYSID_CPUID;
-                                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
                                irq->source |= (1 << cpuid);
-                        }
                }
                /*
@@ -152,8 +149,15 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
        u32 val = irq->intid;
        bool allow_pending = true;
-        if (irq->active)
+        if (irq->active) {
                val |= GICH_LR_ACTIVE_BIT;
+                if (vgic_irq_is_sgi(irq->intid))
+                        val |= irq->active_source << GICH_LR_PHYSID_CPUID_SHIFT;
+                if (vgic_irq_is_multi_sgi(irq)) {
+                        allow_pending = false;
+                        val |= GICH_LR_EOI;
+                }
+        }
        if (irq->hw) {
                val |= GICH_LR_HW;
@@ -190,8 +194,10 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
                        BUG_ON(!src);
                        val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
                        irq->source &= ~(1 << (src - 1));
-                        if (irq->source)
+                        if (irq->source) {
                                irq->pending_latch = true;
+                                val |= GICH_LR_EOI;
+                        }
                }
        }
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 8195f52ae6f0..c7423f3768e5 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -27,13 +27,6 @@ static bool group1_trap;
 static bool common_trap;
 static bool gicv4_enable;
-void vgic_v3_set_npie(struct kvm_vcpu *vcpu)
-{
-        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
-        cpuif->vgic_hcr |= ICH_HCR_NPIE;
-}
 void vgic_v3_set_underflow(struct kvm_vcpu *vcpu)
 {
        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
@@ -55,17 +48,23 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
        int lr;
        unsigned long flags;
-        cpuif->vgic_hcr &= ~(ICH_HCR_UIE | ICH_HCR_NPIE);
+        cpuif->vgic_hcr &= ~ICH_HCR_UIE;
        for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                u64 val = cpuif->vgic_lr[lr];
-                u32 intid;
+                u32 intid, cpuid;
                struct vgic_irq *irq;
+                bool is_v2_sgi = false;
-                if (model == KVM_DEV_TYPE_ARM_VGIC_V3)
+                cpuid = val & GICH_LR_PHYSID_CPUID;
+                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
+                if (model == KVM_DEV_TYPE_ARM_VGIC_V3) {
                        intid = val & ICH_LR_VIRTUAL_ID_MASK;
-                else
+                } else {
                        intid = val & GICH_LR_VIRTUALID;
+                        is_v2_sgi = vgic_irq_is_sgi(intid);
+                }
                /* Notify fds when the guest EOI'ed a level-triggered IRQ */
                if (lr_signals_eoi_mi(val) && vgic_valid_spi(vcpu->kvm, intid))
@@ -81,18 +80,16 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
                /* Always preserve the active bit */
                irq->active = !!(val & ICH_LR_ACTIVE_BIT);
+                if (irq->active && is_v2_sgi)
+                        irq->active_source = cpuid;
                /* Edge is the only case where we preserve the pending bit */
                if (irq->config == VGIC_CONFIG_EDGE &&
                    (val & ICH_LR_PENDING_BIT)) {
                        irq->pending_latch = true;
-                        if (vgic_irq_is_sgi(intid) &&
+                        if (is_v2_sgi)
-                            model == KVM_DEV_TYPE_ARM_VGIC_V2) {
-                                u32 cpuid = val & GICH_LR_PHYSID_CPUID;
-                                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
                                irq->source |= (1 << cpuid);
-                        }
                }
                /*
@@ -133,10 +130,20 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
 {
        u32 model = vcpu->kvm->arch.vgic.vgic_model;
        u64 val = irq->intid;
-        bool allow_pending = true;
+        bool allow_pending = true, is_v2_sgi;
-        if (irq->active)
+        is_v2_sgi = (vgic_irq_is_sgi(irq->intid) &&
+                     model == KVM_DEV_TYPE_ARM_VGIC_V2);
+        if (irq->active) {
                val |= ICH_LR_ACTIVE_BIT;
+                if (is_v2_sgi)
+                        val |= irq->active_source << GICH_LR_PHYSID_CPUID_SHIFT;
+                if (vgic_irq_is_multi_sgi(irq)) {
+                        allow_pending = false;
+                        val |= ICH_LR_EOI;
+                }
+        }
        if (irq->hw) {
                val |= ICH_LR_HW;
@@ -174,8 +181,10 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
                        BUG_ON(!src);
                        val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
                        irq->source &= ~(1 << (src - 1));
-                        if (irq->source)
+                        if (irq->source) {
                                irq->pending_latch = true;
+                                val |= ICH_LR_EOI;
+                        }
                }
        }
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 702936cbe173..97bfba8d9a59 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -725,14 +725,6 @@ static inline void vgic_set_underflow(struct kvm_vcpu *vcpu)
                vgic_v3_set_underflow(vcpu);
 }
-static inline void vgic_set_npie(struct kvm_vcpu *vcpu)
-{
-        if (kvm_vgic_global_state.type == VGIC_V2)
-                vgic_v2_set_npie(vcpu);
-        else
-                vgic_v3_set_npie(vcpu);
-}
 /* Requires the ap_list_lock to be held. */
 static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
                                 bool *multi_sgi)
@@ -746,17 +738,15 @@ static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
        DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock));
        list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
+                int w;
                spin_lock(&irq->irq_lock);
                /* GICv2 SGIs can count for more than one... */
-                if (vgic_irq_is_sgi(irq->intid) && irq->source) {
+                w = vgic_irq_get_lr_count(irq);
-                        int w = hweight8(irq->source);
-                        count += w;
-                        *multi_sgi |= (w > 1);
-                } else {
-                        count++;
-                }
                spin_unlock(&irq->irq_lock);
+                count += w;
+                *multi_sgi |= (w > 1);
        }
        return count;
 }
@@ -767,7 +757,6 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        struct vgic_irq *irq;
        int count;
-        bool npie = false;
        bool multi_sgi;
        u8 prio = 0xff;
@@ -797,10 +786,8 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
                if (likely(vgic_target_oracle(irq) == vcpu)) {
                        vgic_populate_lr(vcpu, irq, count++);
-                        if (irq->source) {
+                        if (irq->source)
-                                npie = true;
                                prio = irq->priority;
-                        }
                }
                spin_unlock(&irq->irq_lock);
@@ -813,9 +800,6 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
                }
        }
-        if (npie)
-                vgic_set_npie(vcpu);
        vcpu->arch.vgic_cpu.used_lrs = count;
        /* Nuke remaining LRs */
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index 830e815748a0..32c25d42c93f 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -110,6 +110,20 @@ static inline bool vgic_irq_is_mapped_level(struct vgic_irq *irq)
        return irq->config == VGIC_CONFIG_LEVEL && irq->hw;
 }
+static inline int vgic_irq_get_lr_count(struct vgic_irq *irq)
+{
+        /* Account for the active state as an interrupt */
+        if (vgic_irq_is_sgi(irq->intid) && irq->source)
+                return hweight8(irq->source) + irq->active;
+        return irq_is_pending(irq) || irq->active;
+}
+static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq)
+{
+        return vgic_irq_get_lr_count(irq) > 1;
+}
 /*
 * This struct provides an intermediate representation of the fields contained
 * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC