189 files changed, 2533 insertions, 1514 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 92be777d060a..cc996af953b8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1208,7 +1208,6 @@ F:	drivers/*/*alpine*
 ARM/ARTPEC MACHINE SUPPORT
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
 M:      Lars Persson <lars.persson@axis.com>
-M:      Niklas Cassel <niklas.cassel@axis.com>
 S:      Maintained
 L:      linux-arm-kernel@axis.com
 F:      arch/arm/mach-artpec
@@ -2617,7 +2616,7 @@ S:	Maintained
 F:      drivers/net/hamradio/baycom*
 BCACHE (BLOCK LAYER CACHE)
-M:      Michael Lyle <mlyle@lyle.org>
+M:      Coly Li <colyli@suse.de>
 M:      Kent Overstreet <kent.overstreet@gmail.com>
 L:      linux-bcache@vger.kernel.org
 W:      http://bcache.evilpiepirate.org
@@ -10909,7 +10908,6 @@ F:	drivers/pci/host/
 F:      drivers/pci/dwc/
 PCIE DRIVER FOR AXIS ARTPEC
-M:      Niklas Cassel <niklas.cassel@axis.com>
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
 L:      linux-arm-kernel@axis.com
 L:      linux-pci@vger.kernel.org
diff --git a/arch/arm/boot/dts/gemini-nas4220b.dts b/arch/arm/boot/dts/gemini-nas4220b.dts
index 8bbb6f85d161..4785fbcc41ed 100644
--- a/arch/arm/boot/dts/gemini-nas4220b.dts
+++ b/arch/arm/boot/dts/gemini-nas4220b.dts
@@ -134,37 +134,37 @@
                                                function = "gmii";
                                                groups = "gmii_gmac0_grp";
                                        };
-                                        /* Settings come from OpenWRT */
+                                        /* Settings come from OpenWRT, pins on SL3516 */
                                        conf0 {
-                                                pins = "R8 GMAC0 RXDV", "U11 GMAC1 RXDV";
+                                                pins = "V8 GMAC0 RXDV", "T10 GMAC1 RXDV";
                                                skew-delay = <0>;
                                        };
                                        conf1 {
-                                                pins = "T8 GMAC0 RXC", "T11 GMAC1 RXC";
+                                                pins = "Y7 GMAC0 RXC", "Y11 GMAC1 RXC";
                                                skew-delay = <15>;
                                        };
                                        conf2 {
-                                                pins = "P8 GMAC0 TXEN", "V11 GMAC1 TXEN";
+                                                pins = "T8 GMAC0 TXEN", "W11 GMAC1 TXEN";
                                                skew-delay = <7>;
                                        };
                                        conf3 {
-                                                pins = "V7 GMAC0 TXC";
+                                                pins = "U8 GMAC0 TXC";
                                                skew-delay = <11>;
                                        };
                                        conf4 {
-                                                pins = "P10 GMAC1 TXC";
+                                                pins = "V11 GMAC1 TXC";
                                                skew-delay = <10>;
                                        };
                                        conf5 {
                                                /* The data lines all have default skew */
-                                                pins = "U8 GMAC0 RXD0", "V8 GMAC0 RXD1",
+                                                pins = "W8 GMAC0 RXD0", "V9 GMAC0 RXD1",
-                                                       "P9 GMAC0 RXD2", "R9 GMAC0 RXD3",
+                                                       "Y8 GMAC0 RXD2", "U9 GMAC0 RXD3",
-                                                       "U7 GMAC0 TXD0", "T7 GMAC0 TXD1",
+                                                       "T7 GMAC0 TXD0", "U6 GMAC0 TXD1",
-                                                       "R7 GMAC0 TXD2", "P7 GMAC0 TXD3",
+                                                       "V7 GMAC0 TXD2", "U7 GMAC0 TXD3",
-                                                       "R11 GMAC1 RXD0", "P11 GMAC1 RXD1",
+                                                       "Y12 GMAC1 RXD0", "V12 GMAC1 RXD1",
-                                                       "V12 GMAC1 RXD2", "U12 GMAC1 RXD3",
+                                                       "T11 GMAC1 RXD2", "W12 GMAC1 RXD3",
-                                                       "R10 GMAC1 TXD0", "T10 GMAC1 TXD1",
+                                                       "U10 GMAC1 TXD0", "Y10 GMAC1 TXD1",
-                                                       "U10 GMAC1 TXD2", "V10 GMAC1 TXD3";
+                                                       "W10 GMAC1 TXD2", "T9 GMAC1 TXD3";
                                                skew-delay = <7>;
                                        };
                                        /* Set up drive strength on GMAC0 to 16 mA */
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 475904894b86..e554b6e039f3 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -163,10 +163,10 @@
                        cm2: cm2@8000 {
                                compatible = "ti,omap4-cm2", "simple-bus";
-                                reg = <0x8000 0x3000>;
+                                reg = <0x8000 0x2000>;
                                #address-cells = <1>;
                                #size-cells = <1>;
-                                ranges = <0 0x8000 0x3000>;
+                                ranges = <0 0x8000 0x2000>;
                                cm2_clocks: clocks {
                                        #address-cells = <1>;
@@ -250,11 +250,11 @@
                                prm: prm@6000 {
                                        compatible = "ti,omap4-prm";
-                                        reg = <0x6000 0x3000>;
+                                        reg = <0x6000 0x2000>;
                                        interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
                                        #address-cells = <1>;
                                        #size-cells = <1>;
-                                        ranges = <0 0x6000 0x3000>;
+                                        ranges = <0 0x6000 0x2000>;
                                        prm_clocks: clocks {
                                                #address-cells = <1>;
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
index 2a63fa10c813..553777ac2814 100644
--- a/arch/arm/configs/gemini_defconfig
+++ b/arch/arm/configs/gemini_defconfig
@@ -1,6 +1,7 @@
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_USER_NS=y
 CONFIG_RELAY=y
@@ -12,15 +13,21 @@ CONFIG_ARCH_GEMINI=y
 CONFIG_PCI=y
 CONFIG_PREEMPT=y
 CONFIG_AEABI=y
+CONFIG_HIGHMEM=y
+CONFIG_CMA=y
 CONFIG_CMDLINE="console=ttyS0,115200n8"
 CONFIG_KEXEC=y
 CONFIG_BINFMT_MISC=y
 CONFIG_PM=y
+CONFIG_NET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_CFI_AMDSTD=y
 CONFIG_MTD_CFI_STAA=y
@@ -33,6 +40,11 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=y
 CONFIG_PATA_FTIDE010=y
+CONFIG_NETDEVICES=y
+CONFIG_GEMINI_ETHERNET=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_GPIO=y
+CONFIG_REALTEK_PHY=y
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
@@ -43,9 +55,19 @@ CONFIG_SERIAL_8250_NR_UARTS=1
 CONFIG_SERIAL_8250_RUNTIME_UARTS=1
 CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HW_RANDOM is not set
-# CONFIG_HWMON is not set
+CONFIG_I2C_GPIO=y
+CONFIG_SPI=y
+CONFIG_SPI_GPIO=y
+CONFIG_SENSORS_GPIO_FAN=y
+CONFIG_SENSORS_LM75=y
+CONFIG_THERMAL=y
 CONFIG_WATCHDOG=y
-CONFIG_GEMINI_WATCHDOG=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_DRM=y
+CONFIG_DRM_PANEL_ILITEK_IL9322=y
+CONFIG_DRM_TVE200=y
+CONFIG_LOGO=y
 CONFIG_USB=y
 CONFIG_USB_MON=y
 CONFIG_USB_FOTG210_HCD=y
@@ -54,6 +76,7 @@ CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_DISK=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
 CONFIG_DMADEVICES=y
diff --git a/arch/arm/configs/socfpga_defconfig b/arch/arm/configs/socfpga_defconfig
index 2620ce790db0..371fca4e1ab7 100644
--- a/arch/arm/configs/socfpga_defconfig
+++ b/arch/arm/configs/socfpga_defconfig
@@ -57,6 +57,7 @@ CONFIG_MTD_M25P80=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_DENALI_DT=y
 CONFIG_MTD_SPI_NOR=y
+# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
 CONFIG_SPI_CADENCE_QUADSPI=y
 CONFIG_OF_OVERLAY=y
 CONFIG_OF_CONFIGFS=y
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 4603c30fef73..0d9ce58bc464 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -243,8 +243,4 @@ arch/arm/mach-omap2/pm-asm-offsets.s: arch/arm/mach-omap2/pm-asm-offsets.c
 include/generated/ti-pm-asm-offsets.h: arch/arm/mach-omap2/pm-asm-offsets.s FORCE
        $(call filechk,offsets,__TI_PM_ASM_OFFSETS_H__)
-# For rule to generate ti-emif-asm-offsets.h dependency
+$(obj)/sleep33xx.o $(obj)/sleep43xx.o: include/generated/ti-pm-asm-offsets.h
-include drivers/memory/Makefile.asm-offsets
-arch/arm/mach-omap2/sleep33xx.o: include/generated/ti-pm-asm-offsets.h include/generated/ti-emif-asm-offsets.h
-arch/arm/mach-omap2/sleep43xx.o: include/generated/ti-pm-asm-offsets.h include/generated/ti-emif-asm-offsets.h
diff --git a/arch/arm/mach-omap2/pm-asm-offsets.c b/arch/arm/mach-omap2/pm-asm-offsets.c
index 6d4392da7c11..b9846b19e5e2 100644
--- a/arch/arm/mach-omap2/pm-asm-offsets.c
+++ b/arch/arm/mach-omap2/pm-asm-offsets.c
@@ -7,9 +7,12 @@
 #include <linux/kbuild.h>
 #include <linux/platform_data/pm33xx.h>
+#include <linux/ti-emif-sram.h>
 int main(void)
 {
+        ti_emif_asm_offsets();
        DEFINE(AMX3_PM_WFI_FLAGS_OFFSET,
               offsetof(struct am33xx_pm_sram_data, wfi_flags));
        DEFINE(AMX3_PM_L2_AUX_CTRL_VAL_OFFSET,
diff --git a/arch/arm/mach-omap2/sleep33xx.S b/arch/arm/mach-omap2/sleep33xx.S
index 218d79930b04..322b3bb868b4 100644
--- a/arch/arm/mach-omap2/sleep33xx.S
+++ b/arch/arm/mach-omap2/sleep33xx.S
@@ -6,7 +6,6 @@
 *      Dave Gerlach, Vaibhav Bedia
 */
-#include <generated/ti-emif-asm-offsets.h>
 #include <generated/ti-pm-asm-offsets.h>
 #include <linux/linkage.h>
 #include <linux/ti-emif-sram.h>
diff --git a/arch/arm/mach-omap2/sleep43xx.S b/arch/arm/mach-omap2/sleep43xx.S
index b24be624e8b9..8903814a6677 100644
--- a/arch/arm/mach-omap2/sleep43xx.S
+++ b/arch/arm/mach-omap2/sleep43xx.S
@@ -6,7 +6,6 @@
 *      Dave Gerlach, Vaibhav Bedia
 */
-#include <generated/ti-emif-asm-offsets.h>
 #include <generated/ti-pm-asm-offsets.h>
 #include <linux/linkage.h>
 #include <linux/ti-emif-sram.h>
diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c
index 59589a4a0d4b..885e8f12e4b9 100644
--- a/arch/arm/mach-s3c24xx/mach-jive.c
+++ b/arch/arm/mach-s3c24xx/mach-jive.c
@@ -427,9 +427,9 @@ static struct gpiod_lookup_table jive_wm8750_gpiod_table = {
        .dev_id         = "spi_gpio",
        .table          = {
                GPIO_LOOKUP("GPIOB", 4,
-                            "gpio-sck", GPIO_ACTIVE_HIGH),
+                            "sck", GPIO_ACTIVE_HIGH),
                GPIO_LOOKUP("GPIOB", 9,
-                            "gpio-mosi", GPIO_ACTIVE_HIGH),
+                            "mosi", GPIO_ACTIVE_HIGH),
                GPIO_LOOKUP("GPIOH", 10,
                            "cs", GPIO_ACTIVE_HIGH),
                { },
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index 4eef36b22538..88e712ea757a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -212,3 +212,7 @@
        pinctrl-0 = <&uart_ao_a_pins>;
        pinctrl-names = "default";
 };
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index 22bf37404ff1..3e3eb31748a3 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -271,3 +271,15 @@
        pinctrl-0 = <&uart_ao_a_pins>;
        pinctrl-names = "default";
 };
+&usb0 {
+        status = "okay";
+};
+&usb2_phy0 {
+        /*
+         * even though the schematics don't show it:
+         * HDMI_5V is also used as supply for the USB VBUS.
+         */
+        phy-supply = <&hdmi_5v>;
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 69c721a70e44..6739697be1de 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -215,3 +215,7 @@
        pinctrl-0 = <&uart_ao_a_pins>;
        pinctrl-names = "default";
 };
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index 0a0953fbc7d4..0cfd701809de 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -185,3 +185,7 @@
        pinctrl-0 = <&uart_ao_a_pins>;
        pinctrl-names = "default";
 };
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index e1a39cbed8c9..dba365ed4bd5 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -20,6 +20,67 @@
                        no-map;
                };
        };
+        soc {
+                usb0: usb@c9000000 {
+                        status = "disabled";
+                        compatible = "amlogic,meson-gxl-dwc3";
+                        #address-cells = <2>;
+                        #size-cells = <2>;
+                        ranges;
+                        clocks = <&clkc CLKID_USB>;
+                        clock-names = "usb_general";
+                        resets = <&reset RESET_USB_OTG>;
+                        reset-names = "usb_otg";
+                        dwc3: dwc3@c9000000 {
+                                compatible = "snps,dwc3";
+                                reg = <0x0 0xc9000000 0x0 0x100000>;
+                                interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+                                dr_mode = "host";
+                                maximum-speed = "high-speed";
+                                snps,dis_u2_susphy_quirk;
+                                phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>;
+                        };
+                };
+        };
+};
+&apb {
+        usb2_phy0: phy@78000 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78000 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+        usb2_phy1: phy@78020 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78020 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+        usb3_phy: phy@78080 {
+                compatible = "amlogic,meson-gxl-usb3-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78080 0x0 0x20>;
+                interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>;
+                clocks = <&clkc CLKID_USB>, <&clkc_AO CLKID_AO_CEC_32K>;
+                clock-names = "phy", "peripheral";
+                resets = <&reset RESET_USB_OTG>, <&reset RESET_USB_OTG>;
+                reset-names = "phy", "peripheral";
+                status = "okay";
+        };
 };
 &ethmac {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 4fd46c1546a7..0868da476e41 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -406,3 +406,7 @@
        status = "okay";
        vref-supply = <&vddio_ao18>;
 };
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
index d076a7c425dd..247888d68a3a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
@@ -80,6 +80,19 @@
        };
 };
+&apb {
+        usb2_phy2: phy@78040 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78040 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+};
 &clkc_AO {
        compatible = "amlogic,meson-gxm-aoclkc", "amlogic,meson-gx-aoclkc";
 };
@@ -100,3 +113,7 @@
 &hdmi_tx {
        compatible = "amlogic,meson-gxm-dw-hdmi", "amlogic,meson-gx-dw-hdmi";
 };
+&dwc3 {
+        phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>, <&usb2_phy2>;
+};
diff --git a/arch/arm64/boot/dts/arm/juno-motherboard.dtsi b/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
index 2ac43221ddb6..69804c5f1197 100644
--- a/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
@@ -56,8 +56,6 @@
                        gpio_keys {
                                compatible = "gpio-keys";
-                                #address-cells = <1>;
-                                #size-cells = <0>;
                                power-button {
                                        debounce_interval = <50>;
diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
index 4b5465da81d8..8c68e0c26f1b 100644
--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
+++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
@@ -36,11 +36,11 @@
                #size-cells = <1>;
                ranges = <0x0 0x0 0x67d00000 0x00800000>;
-                sata0: ahci@210000 {
+                sata0: ahci@0 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00210000 0x1000>;
+                        reg = <0x00000000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -52,9 +52,9 @@
                        };
                };
-                sata_phy0: sata_phy@212100 {
+                sata_phy0: sata_phy@2100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00212100 0x1000>;
+                        reg = <0x00002100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -66,11 +66,11 @@
                        };
                };
-                sata1: ahci@310000 {
+                sata1: ahci@10000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00310000 0x1000>;
+                        reg = <0x00010000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 347 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -82,9 +82,9 @@
                        };
                };
-                sata_phy1: sata_phy@312100 {
+                sata_phy1: sata_phy@12100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00312100 0x1000>;
+                        reg = <0x00012100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -96,11 +96,11 @@
                        };
                };
-                sata2: ahci@120000 {
+                sata2: ahci@20000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00120000 0x1000>;
+                        reg = <0x00020000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -112,9 +112,9 @@
                        };
                };
-                sata_phy2: sata_phy@122100 {
+                sata_phy2: sata_phy@22100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00122100 0x1000>;
+                        reg = <0x00022100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -126,11 +126,11 @@
                        };
                };
-                sata3: ahci@130000 {
+                sata3: ahci@30000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00130000 0x1000>;
+                        reg = <0x00030000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -142,9 +142,9 @@
                        };
                };
-                sata_phy3: sata_phy@132100 {
+                sata_phy3: sata_phy@32100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00132100 0x1000>;
+                        reg = <0x00032100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -156,11 +156,11 @@
                        };
                };
-                sata4: ahci@330000 {
+                sata4: ahci@100000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00330000 0x1000>;
+                        reg = <0x00100000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 351 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -172,9 +172,9 @@
                        };
                };
-                sata_phy4: sata_phy@332100 {
+                sata_phy4: sata_phy@102100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00332100 0x1000>;
+                        reg = <0x00102100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -186,11 +186,11 @@
                        };
                };
-                sata5: ahci@400000 {
+                sata5: ahci@110000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00400000 0x1000>;
+                        reg = <0x00110000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -202,9 +202,9 @@
                        };
                };
-                sata_phy5: sata_phy@402100 {
+                sata_phy5: sata_phy@112100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00402100 0x1000>;
+                        reg = <0x00112100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -216,11 +216,11 @@
                        };
                };
-                sata6: ahci@410000 {
+                sata6: ahci@120000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00410000 0x1000>;
+                        reg = <0x00120000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -232,9 +232,9 @@
                        };
                };
-                sata_phy6: sata_phy@412100 {
+                sata_phy6: sata_phy@122100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00412100 0x1000>;
+                        reg = <0x00122100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
@@ -246,11 +246,11 @@
                        };
                };
-                sata7: ahci@420000 {
+                sata7: ahci@130000 {
                        compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00420000 0x1000>;
+                        reg = <0x00130000 0x1000>;
                        reg-names = "ahci";
-                        interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        status = "disabled";
@@ -262,9 +262,9 @@
                        };
                };
-                sata_phy7: sata_phy@422100 {
+                sata_phy7: sata_phy@132100 {
                        compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00422100 0x1000>;
+                        reg = <0x00132100 0x1000>;
                        reg-names = "phy";
                        #address-cells = <1>;
                        #size-cells = <0>;
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index 23d8acca5c90..cd4fd85fde84 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -11,6 +11,7 @@ config RISCV
        select ARCH_WANT_FRAME_POINTERS
        select CLONE_BACKWARDS
        select COMMON_CLK
+        select DMA_DIRECT_OPS
        select GENERIC_CLOCKEVENTS
        select GENERIC_CPU_DEVICES
        select GENERIC_IRQ_SHOW
@@ -89,9 +90,6 @@ config PGTABLE_LEVELS
 config HAVE_KPROBES
        def_bool n
-config DMA_DIRECT_OPS
-        def_bool y
 menu "Platform type"
 choice
diff --git a/arch/riscv/include/asm/Kbuild b/arch/riscv/include/asm/Kbuild
index 1e5fd280fb4d..4286a5f83876 100644
--- a/arch/riscv/include/asm/Kbuild
+++ b/arch/riscv/include/asm/Kbuild
@@ -15,7 +15,6 @@ generic-y += fcntl.h
 generic-y += futex.h
 generic-y += hardirq.h
 generic-y += hash.h
-generic-y += handle_irq.h
 generic-y += hw_irq.h
 generic-y += ioctl.h
 generic-y += ioctls.h
diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
index 324568d33921..f6561b783b61 100644
--- a/arch/riscv/kernel/vdso/Makefile
+++ b/arch/riscv/kernel/vdso/Makefile
@@ -52,7 +52,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
 # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions.
 # Make sure only to export the intended __vdso_xxx symbol offsets.
 quiet_cmd_vdsold = VDSOLD  $@
-      cmd_vdsold = $(CC) $(KCFLAGS) -nostdlib $(SYSCFLAGS_$(@F)) \
+      cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \
                           -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \
                   $(CROSS_COMPILE)objcopy \
                           $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 83ba57533ce6..3c883c368eb0 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -45,6 +45,9 @@ struct thread_info {
 void arch_release_task_struct(struct task_struct *tsk);
 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
+void arch_setup_new_exec(void);
+#define arch_setup_new_exec arch_setup_new_exec
 #endif
 /*
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 5a83be955c70..0dc8ac8548ee 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -465,11 +465,11 @@ int module_finalize(const Elf_Ehdr *hdr,
                        apply_alternatives(aseg, aseg + s->sh_size);
                if (IS_ENABLED(CONFIG_EXPOLINE) &&
-                    (!strcmp(".nospec_call_table", secname)))
+                    (!strncmp(".s390_indirect", secname, 14)))
                        nospec_revert(aseg, aseg + s->sh_size);
                if (IS_ENABLED(CONFIG_EXPOLINE) &&
-                    (!strcmp(".nospec_return_table", secname)))
+                    (!strncmp(".s390_return", secname, 12)))
                        nospec_revert(aseg, aseg + s->sh_size);
        }
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
index 5ee27dc9a10c..feebb2944882 100644
--- a/arch/s390/kernel/perf_cpum_cf_events.c
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
 CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
 CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
 CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
+CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_SPECIAL, 0x00db);
 CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
 CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
 CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
+CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
 };
 static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
-        CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
+        CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
        CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
        CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
        CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
 };
 static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
-        CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
+        CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
        CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
        CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
        CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 70576a2f69cf..6e758bb6cd29 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -29,6 +29,7 @@
 #include <linux/random.h>
 #include <linux/export.h>
 #include <linux/init_task.h>
+#include <asm/cpu_mf.h>
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/vtimer.h>
@@ -48,6 +49,15 @@ void flush_thread(void)
 {
 }
+void arch_setup_new_exec(void)
+{
+        if (S390_lowcore.current_pid != current->pid) {
+                S390_lowcore.current_pid = current->pid;
+                if (test_facility(40))
+                        lpp(&S390_lowcore.lpp);
+        }
+}
 void arch_release_task_struct(struct task_struct *tsk)
 {
        runtime_instr_release(tsk);
diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
index d9d1f512f019..5007fac01bb5 100644
--- a/arch/s390/kernel/uprobes.c
+++ b/arch/s390/kernel/uprobes.c
@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
        return orig;
 }
+bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
+                             struct pt_regs *regs)
+{
+        if (ctx == RP_CHECK_CHAIN_CALL)
+                return user_stack_pointer(regs) <= ret->stack;
+        else
+                return user_stack_pointer(regs) < ret->stack;
+}
 /* Instruction Emulation */
 static void adjust_psw_addr(psw_t *psw, unsigned long len)
diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
index 09ad88572746..cc8f8fcf9b4a 100644
--- a/arch/x86/include/asm/ftrace.h
+++ b/arch/x86/include/asm/ftrace.h
@@ -46,7 +46,21 @@ int ftrace_int3_handler(struct pt_regs *regs);
 #endif /* CONFIG_FUNCTION_TRACER */
-#if !defined(__ASSEMBLY__) && !defined(COMPILE_OFFSETS)
+#ifndef __ASSEMBLY__
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+{
+        /*
+         * Compare the symbol name with the system call name. Skip the
+         * "__x64_sys", "__ia32_sys" or simple "sys" prefix.
+         */
+        return !strcmp(sym + 3, name + 3) ||
+                (!strncmp(sym, "__x64_", 6) && !strcmp(sym + 9, name + 3)) ||
+                (!strncmp(sym, "__ia32_", 7) && !strcmp(sym + 10, name + 3));
+}
+#ifndef COMPILE_OFFSETS
 #if defined(CONFIG_FTRACE_SYSCALLS) && defined(CONFIG_IA32_EMULATION)
 #include <asm/compat.h>
@@ -67,6 +81,7 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
        return false;
 }
 #endif /* CONFIG_FTRACE_SYSCALLS && CONFIG_IA32_EMULATION */
-#endif /* !__ASSEMBLY__  && !COMPILE_OFFSETS */
+#endif /* !COMPILE_OFFSETS */
+#endif /* !__ASSEMBLY__ */
 #endif /* _ASM_X86_FTRACE_H */
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index f0ecd98509d8..771ae9730ac6 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -4934,8 +4934,16 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio)
        bool new_queue = false;
        bool bfqq_already_existing = false, split = false;
-        if (!rq->elv.icq)
+        /*
+         * Even if we don't have an icq attached, we should still clear
+         * the scheduler pointers, as they might point to previously
+         * allocated bic/bfqq structs.
+         */
+        if (!rq->elv.icq) {
+                rq->elv.priv[0] = rq->elv.priv[1] = NULL;
                return;
+        }
        bic = icq_to_bic(rq->elv.icq);
        spin_lock_irq(&bfqd->lock);
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 1c16694ae145..eb85cb87c40f 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1177,26 +1177,20 @@ int blkcg_init_queue(struct request_queue *q)
        preloaded = !radix_tree_preload(GFP_KERNEL);
-        /*
+        /* Make sure the root blkg exists. */
-         * Make sure the root blkg exists and count the existing blkgs.  As
-         * @q is bypassing at this point, blkg_lookup_create() can't be
-         * used.  Open code insertion.
-         */
        rcu_read_lock();
        spin_lock_irq(q->queue_lock);
        blkg = blkg_create(&blkcg_root, q, new_blkg);
+        if (IS_ERR(blkg))
+                goto err_unlock;
+        q->root_blkg = blkg;
+        q->root_rl.blkg = blkg;
        spin_unlock_irq(q->queue_lock);
        rcu_read_unlock();
        if (preloaded)
                radix_tree_preload_end();
-        if (IS_ERR(blkg))
-                return PTR_ERR(blkg);
-        q->root_blkg = blkg;
-        q->root_rl.blkg = blkg;
        ret = blk_throtl_init(q);
        if (ret) {
                spin_lock_irq(q->queue_lock);
@@ -1204,6 +1198,13 @@ int blkcg_init_queue(struct request_queue *q)
                spin_unlock_irq(q->queue_lock);
        }
        return ret;
+err_unlock:
+        spin_unlock_irq(q->queue_lock);
+        rcu_read_unlock();
+        if (preloaded)
+                radix_tree_preload_end();
+        return PTR_ERR(blkg);
 }
 /**
@@ -1410,9 +1411,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
        __clear_bit(pol->plid, q->blkcg_pols);
        list_for_each_entry(blkg, &q->blkg_list, q_node) {
-                /* grab blkcg lock too while removing @pd from @blkg */
-                spin_lock(&blkg->blkcg->lock);
                if (blkg->pd[pol->plid]) {
                        if (!blkg->pd[pol->plid]->offline &&
                            pol->pd_offline_fn) {
@@ -1422,8 +1420,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
                        pol->pd_free_fn(blkg->pd[pol->plid]);
                        blkg->pd[pol->plid] = NULL;
                }
-                spin_unlock(&blkg->blkcg->lock);
        }
        spin_unlock_irq(q->queue_lock);
diff --git a/block/blk-core.c b/block/blk-core.c
index 806ce2442819..85909b431eb0 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -201,6 +201,10 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
        rq->part = NULL;
        seqcount_init(&rq->gstate_seq);
        u64_stats_init(&rq->aborted_gstate_sync);
+        /*
+         * See comment of blk_mq_init_request
+         */
+        WRITE_ONCE(rq->gstate, MQ_RQ_GEN_INC);
 }
 EXPORT_SYMBOL(blk_rq_init);
@@ -915,7 +919,6 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
        while (true) {
                bool success = false;
-                int ret;
                rcu_read_lock();
                if (percpu_ref_tryget_live(&q->q_usage_counter)) {
@@ -947,14 +950,12 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
                 */
                smp_rmb();
-                ret = wait_event_interruptible(q->mq_freeze_wq,
+                wait_event(q->mq_freeze_wq,
-                                (atomic_read(&q->mq_freeze_depth) == 0 &&
+                           (atomic_read(&q->mq_freeze_depth) == 0 &&
-                                 (preempt || !blk_queue_preempt_only(q))) ||
+                            (preempt || !blk_queue_preempt_only(q))) ||
-                                blk_queue_dying(q));
+                           blk_queue_dying(q));
                if (blk_queue_dying(q))
                        return -ENODEV;
-                if (ret)
-                        return ret;
        }
 }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0dc9e341c2a7..c3621453ad87 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2042,6 +2042,13 @@ static int blk_mq_init_request(struct blk_mq_tag_set *set, struct request *rq,
        seqcount_init(&rq->gstate_seq);
        u64_stats_init(&rq->aborted_gstate_sync);
+        /*
+         * start gstate with gen 1 instead of 0, otherwise it will be equal
+         * to aborted_gstate, and be identified timed out by
+         * blk_mq_terminate_expired.
+         */
+        WRITE_ONCE(rq->gstate, MQ_RQ_GEN_INC);
        return 0;
 }
@@ -2329,7 +2336,7 @@ static void blk_mq_free_map_and_requests(struct blk_mq_tag_set *set,
 static void blk_mq_map_swqueue(struct request_queue *q)
 {
-        unsigned int i;
+        unsigned int i, hctx_idx;
        struct blk_mq_hw_ctx *hctx;
        struct blk_mq_ctx *ctx;
        struct blk_mq_tag_set *set = q->tag_set;
@@ -2346,8 +2353,23 @@ static void blk_mq_map_swqueue(struct request_queue *q)
        /*
         * Map software to hardware queues.
+         *
+         * If the cpu isn't present, the cpu is mapped to first hctx.
         */
        for_each_possible_cpu(i) {
+                hctx_idx = q->mq_map[i];
+                /* unmapped hw queue can be remapped after CPU topo changed */
+                if (!set->tags[hctx_idx] &&
+                    !__blk_mq_alloc_rq_map(set, hctx_idx)) {
+                        /*
+                         * If tags initialization fail for some hctx,
+                         * that hctx won't be brought online.  In this
+                         * case, remap the current ctx to hctx[0] which
+                         * is guaranteed to always have tags allocated
+                         */
+                        q->mq_map[i] = 0;
+                }
                ctx = per_cpu_ptr(q->queue_ctx, i);
                hctx = blk_mq_map_queue(q, i);
@@ -2359,8 +2381,21 @@ static void blk_mq_map_swqueue(struct request_queue *q)
        mutex_unlock(&q->sysfs_lock);
        queue_for_each_hw_ctx(q, hctx, i) {
-                /* every hctx should get mapped by at least one CPU */
+                /*
-                WARN_ON(!hctx->nr_ctx);
+                 * If no software queues are mapped to this hardware queue,
+                 * disable it and free the request entries.
+                 */
+                if (!hctx->nr_ctx) {
+                        /* Never unmap queue 0.  We need it as a
+                         * fallback in case of a new remap fails
+                         * allocation
+                         */
+                        if (i && set->tags[i])
+                                blk_mq_free_map_and_requests(set, i);
+                        hctx->tags = NULL;
+                        continue;
+                }
                hctx->tags = set->tags[i];
                WARN_ON(!hctx->tags);
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 88c558f71819..89b5cd3a6c70 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -7,6 +7,9 @@
 struct blk_mq_tag_set;
+/**
+ * struct blk_mq_ctx - State for a software queue facing the submitting CPUs
+ */
 struct blk_mq_ctx {
        struct {
                spinlock_t              lock;
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 76fb96966f7b..2f2e737be0f8 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
        return opregion;
 }
+static bool dmi_is_desktop(void)
+{
+        const char *chassis_type;
+        chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+        if (!chassis_type)
+                return false;
+        if (!strcmp(chassis_type, "3") || /*  3: Desktop */
+            !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
+            !strcmp(chassis_type, "5") || /*  5: Pizza Box */
+            !strcmp(chassis_type, "6") || /*  6: Mini Tower */
+            !strcmp(chassis_type, "7") || /*  7: Tower */
+            !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
+                return true;
+        return false;
+}
 int acpi_video_register(void)
 {
        int ret = 0;
@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
         * win8 ready (where we also prefer the native backlight driver, so
         * normally the acpi_video code should not register there anyways).
         */
-        if (only_lcd == -1)
+        if (only_lcd == -1) {
-                only_lcd = acpi_osi_is_win8();
+                if (dmi_is_desktop() && acpi_osi_is_win8())
+                        only_lcd = true;
+                else
+                        only_lcd = false;
+        }
        dmi_check_system(video_dmi_table);
diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index ebb626ffb5fa..4bde16fb97d8 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -12,23 +12,64 @@
 #define pr_fmt(fmt) "ACPI: watchdog: " fmt
 #include <linux/acpi.h>
+#include <linux/dmi.h>
 #include <linux/ioport.h>
 #include <linux/platform_device.h>
 #include "internal.h"
+static const struct dmi_system_id acpi_watchdog_skip[] = {
+        {
+                /*
+                 * On Lenovo Z50-70 there are two issues with the WDAT
+                 * table. First some of the instructions use RTC SRAM
+                 * to store persistent information. This does not work well
+                 * with Linux RTC driver. Second, more important thing is
+                 * that the instructions do not actually reset the system.
+                 *
+                 * On this particular system iTCO_wdt seems to work just
+                 * fine so we prefer that over WDAT for now.
+                 *
+                 * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033.
+                 */
+                .ident = "Lenovo Z50-70",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "20354"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"),
+                },
+        },
+        {}
+};
+static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void)
+{
+        const struct acpi_table_wdat *wdat = NULL;
+        acpi_status status;
+        if (acpi_disabled)
+                return NULL;
+        if (dmi_check_system(acpi_watchdog_skip))
+                return NULL;
+        status = acpi_get_table(ACPI_SIG_WDAT, 0,
+                                (struct acpi_table_header **)&wdat);
+        if (ACPI_FAILURE(status)) {
+                /* It is fine if there is no WDAT */
+                return NULL;
+        }
+        return wdat;
+}
 /**
 * Returns true if this system should prefer ACPI based watchdog instead of
 * the native one (which are typically the same hardware).
 */
 bool acpi_has_watchdog(void)
 {
-        struct acpi_table_header hdr;
+        return !!acpi_watchdog_get_wdat();
-        if (acpi_disabled)
-                return false;
-        return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr));
 }
 EXPORT_SYMBOL_GPL(acpi_has_watchdog);
@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void)
        struct platform_device *pdev;
        struct resource *resources;
        size_t nresources = 0;
-        acpi_status status;
        int i;
-        status = acpi_get_table(ACPI_SIG_WDAT, 0,
+        wdat = acpi_watchdog_get_wdat();
-                                (struct acpi_table_header **)&wdat);
+        if (!wdat) {
-        if (ACPI_FAILURE(status)) {
                /* It is fine if there is no WDAT */
                return;
        }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index e1eee7a60fad..f1cc4f9d31cd 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -635,4 +635,26 @@ module_param_call(lid_init_state,
                  NULL, 0644);
 MODULE_PARM_DESC(lid_init_state, "Behavior for reporting LID initial state");
-module_acpi_driver(acpi_button_driver);
+static int acpi_button_register_driver(struct acpi_driver *driver)
+{
+        /*
+         * Modules such as nouveau.ko and i915.ko have a link time dependency
+         * on acpi_lid_open(), and would therefore not be loadable on ACPI
+         * capable kernels booted in non-ACPI mode if the return value of
+         * acpi_bus_register_driver() is returned from here with ACPI disabled
+         * when this driver is built as a module.
+         */
+        if (acpi_disabled)
+                return 0;
+        return acpi_bus_register_driver(driver);
+}
+static void acpi_button_unregister_driver(struct acpi_driver *driver)
+{
+        if (!acpi_disabled)
+                acpi_bus_unregister_driver(driver);
+}
+module_driver(acpi_button_driver, acpi_button_register_driver,
+               acpi_button_unregister_driver);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index cc234e6a6297..970dd87d347c 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2166,10 +2166,10 @@ int __init acpi_scan_init(void)
        acpi_cmos_rtc_init();
        acpi_container_init();
        acpi_memory_hotplug_init();
+        acpi_watchdog_init();
        acpi_pnp_init();
        acpi_int340x_thermal_init();
        acpi_amba_init();
-        acpi_watchdog_init();
        acpi_init_lpit();
        acpi_scan_add_handler(&generic_device_handler);
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 99a1a650326d..974e58457697 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -364,6 +364,19 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
                DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
                },
        },
+        /*
+         * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using
+         * the Low Power S0 Idle firmware interface (see
+         * https://bugzilla.kernel.org/show_bug.cgi?id=199057).
+         */
+        {
+        .callback = init_no_lps0,
+        .ident = "ThinkPad X1 Tablet(2016)",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"),
+                },
+        },
        {},
 };
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index 1e6396bb807b..597d40893862 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -312,8 +312,9 @@ static int __dma_mmap_from_coherent(struct dma_coherent_mem *mem,
 * This checks whether the memory was allocated from the per-device
 * coherent memory pool and if so, maps that memory to the provided vma.
 *
- * Returns 1 if we correctly mapped the memory, or 0 if the caller should
+ * Returns 1 if @vaddr belongs to the device coherent pool and the caller
- * proceed with mapping memory from generic pools.
+ * should return @ret, or 0 if they should proceed with mapping memory from
+ * generic areas.
 */
 int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma,
                           void *vaddr, size_t size, int *ret)
diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
index 3b118353ea17..d82566d6e237 100644
--- a/drivers/base/dma-mapping.c
+++ b/drivers/base/dma-mapping.c
@@ -226,7 +226,6 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
 #ifndef CONFIG_ARCH_NO_COHERENT_DMA_MMAP
        unsigned long user_count = vma_pages(vma);
        unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
-        unsigned long pfn = page_to_pfn(virt_to_page(cpu_addr));
        unsigned long off = vma->vm_pgoff;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
@@ -234,12 +233,11 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
        if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                return ret;
-        if (off < count && user_count <= (count - off)) {
+        if (off < count && user_count <= (count - off))
                ret = remap_pfn_range(vma, vma->vm_start,
-                                      pfn + off,
+                                      page_to_pfn(virt_to_page(cpu_addr)) + off,
                                      user_count << PAGE_SHIFT,
                                      vma->vm_page_prot);
-        }
 #endif  /* !CONFIG_ARCH_NO_COHERENT_DMA_MMAP */
        return ret;
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index c9d04497a415..5d4e31655d96 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -451,25 +451,47 @@ static int lo_req_flush(struct loop_device *lo, struct request *rq)
 static void lo_complete_rq(struct request *rq)
 {
        struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+        blk_status_t ret = BLK_STS_OK;
-        if (unlikely(req_op(cmd->rq) == REQ_OP_READ && cmd->use_aio &&
+        if (!cmd->use_aio || cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) ||
-                     cmd->ret >= 0 && cmd->ret < blk_rq_bytes(cmd->rq))) {
+            req_op(rq) != REQ_OP_READ) {
-                struct bio *bio = cmd->rq->bio;
+                if (cmd->ret < 0)
+                        ret = BLK_STS_IOERR;
-                bio_advance(bio, cmd->ret);
+                goto end_io;
-                zero_fill_bio(bio);
        }
-        blk_mq_end_request(rq, cmd->ret < 0 ? BLK_STS_IOERR : BLK_STS_OK);
+        /*
+         * Short READ - if we got some data, advance our request and
+         * retry it. If we got no data, end the rest with EIO.
+         */
+        if (cmd->ret) {
+                blk_update_request(rq, BLK_STS_OK, cmd->ret);
+                cmd->ret = 0;
+                blk_mq_requeue_request(rq, true);
+        } else {
+                if (cmd->use_aio) {
+                        struct bio *bio = rq->bio;
+                        while (bio) {
+                                zero_fill_bio(bio);
+                                bio = bio->bi_next;
+                        }
+                }
+                ret = BLK_STS_IOERR;
+end_io:
+                blk_mq_end_request(rq, ret);
+        }
 }
 static void lo_rw_aio_do_completion(struct loop_cmd *cmd)
 {
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
        if (!atomic_dec_and_test(&cmd->ref))
                return;
        kfree(cmd->bvec);
        cmd->bvec = NULL;
-        blk_mq_complete_request(cmd->rq);
+        blk_mq_complete_request(rq);
 }
 static void lo_rw_aio_complete(struct kiocb *iocb, long ret, long ret2)
@@ -487,7 +509,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
 {
        struct iov_iter iter;
        struct bio_vec *bvec;
-        struct request *rq = cmd->rq;
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
        struct bio *bio = rq->bio;
        struct file *file = lo->lo_backing_file;
        unsigned int offset;
@@ -1702,15 +1724,16 @@ EXPORT_SYMBOL(loop_unregister_transfer);
 static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
                const struct blk_mq_queue_data *bd)
 {
-        struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
+        struct request *rq = bd->rq;
-        struct loop_device *lo = cmd->rq->q->queuedata;
+        struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+        struct loop_device *lo = rq->q->queuedata;
-        blk_mq_start_request(bd->rq);
+        blk_mq_start_request(rq);
        if (lo->lo_state != Lo_bound)
                return BLK_STS_IOERR;
-        switch (req_op(cmd->rq)) {
+        switch (req_op(rq)) {
        case REQ_OP_FLUSH:
        case REQ_OP_DISCARD:
        case REQ_OP_WRITE_ZEROES:
@@ -1723,8 +1746,8 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
        /* always use the first bio's css */
 #ifdef CONFIG_BLK_CGROUP
-        if (cmd->use_aio && cmd->rq->bio && cmd->rq->bio->bi_css) {
+        if (cmd->use_aio && rq->bio && rq->bio->bi_css) {
-                cmd->css = cmd->rq->bio->bi_css;
+                cmd->css = rq->bio->bi_css;
                css_get(cmd->css);
        } else
 #endif
@@ -1736,8 +1759,9 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 static void loop_handle_cmd(struct loop_cmd *cmd)
 {
-        const bool write = op_is_write(req_op(cmd->rq));
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
-        struct loop_device *lo = cmd->rq->q->queuedata;
+        const bool write = op_is_write(req_op(rq));
+        struct loop_device *lo = rq->q->queuedata;
        int ret = 0;
        if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) {
@@ -1745,12 +1769,12 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
                goto failed;
        }
-        ret = do_req_filebacked(lo, cmd->rq);
+        ret = do_req_filebacked(lo, rq);
 failed:
        /* complete non-aio request */
        if (!cmd->use_aio || ret) {
                cmd->ret = ret ? -EIO : 0;
-                blk_mq_complete_request(cmd->rq);
+                blk_mq_complete_request(rq);
        }
 }
@@ -1767,9 +1791,7 @@ static int loop_init_request(struct blk_mq_tag_set *set, struct request *rq,
 {
        struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
-        cmd->rq = rq;
        kthread_init_work(&cmd->work, loop_queue_work);
        return 0;
 }
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 0f45416e4fcf..b78de9879f4f 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -66,7 +66,6 @@ struct loop_device {
 struct loop_cmd {
        struct kthread_work work;
-        struct request *rq;
        bool use_aio; /* use AIO interface to handle I/O */
        atomic_t ref; /* only for aio */
        long ret;
diff --git a/drivers/block/swim.c b/drivers/block/swim.c
index 64e066eba72e..0e31884a9519 100644
--- a/drivers/block/swim.c
+++ b/drivers/block/swim.c
@@ -110,7 +110,7 @@ struct iwm {
 /* Select values for swim_select and swim_readbit */
 #define READ_DATA_0     0x074
-#define TWOMEG_DRIVE    0x075
+#define ONEMEG_DRIVE    0x075
 #define SINGLE_SIDED    0x076
 #define DRIVE_PRESENT   0x077
 #define DISK_IN         0x170
@@ -118,9 +118,9 @@ struct iwm {
 #define TRACK_ZERO      0x172
 #define TACHO           0x173
 #define READ_DATA_1     0x174
-#define MFM_MODE        0x175
+#define GCR_MODE        0x175
 #define SEEK_COMPLETE   0x176
-#define ONEMEG_MEDIA    0x177
+#define TWOMEG_MEDIA    0x177
 /* Bits in handshake register */
@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
                struct floppy_struct *g;
                fs->disk_in = 1;
                fs->write_protected = swim_readbit(base, WRITE_PROT);
-                fs->type = swim_readbit(base, ONEMEG_MEDIA);
                if (swim_track00(base))
                        printk(KERN_ERR
@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
                swim_track00(base);
+                fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
+                        HD_MEDIA : DD_MEDIA;
+                fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
                get_floppy_geometry(fs, 0, &g);
                fs->total_secs = g->size;
                fs->secpercyl = g->head * g->sect;
@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
        swim_write(base, setup, S_IBM_DRIVE  | S_FCLK_DIV2);
        udelay(10);
-        swim_drive(base, INTERNAL_DRIVE);
+        swim_drive(base, fs->location);
        swim_motor(base, ON);
        swim_action(base, SETMFM);
        if (fs->ejected)
@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
                goto out;
        }
+        set_capacity(fs->disk, fs->total_secs);
        if (mode & FMODE_NDELAY)
                return 0;
@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
                if (copy_to_user((void __user *) param, (void *) &floppy_type,
                                 sizeof(struct floppy_struct)))
                        return -EFAULT;
-                break;
+                return 0;
-        default:
-                printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
-                       cmd);
-                return -ENOSYS;
        }
-        return 0;
+        return -ENOTTY;
 }
 static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
        struct swim_priv *swd = data;
        int drive = (*part & 3);
-        if (drive > swd->floppy_count)
+        if (drive >= swd->floppy_count)
                return NULL;
        *part = 0;
@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
        swim_motor(base, OFF);
-        if (swim_readbit(base, SINGLE_SIDED))
+        fs->type = HD_MEDIA;
-                fs->head_number = 1;
+        fs->head_number = 2;
-        else
-                fs->head_number = 2;
        fs->ref_count = 0;
        fs->ejected = 1;
@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
        /* scan floppy drives */
        swim_drive(base, INTERNAL_DRIVE);
-        if (swim_readbit(base, DRIVE_PRESENT))
+        if (swim_readbit(base, DRIVE_PRESENT) &&
+            !swim_readbit(base, ONEMEG_DRIVE))
                swim_add_floppy(swd, INTERNAL_DRIVE);
        swim_drive(base, EXTERNAL_DRIVE);
-        if (swim_readbit(base, DRIVE_PRESENT))
+        if (swim_readbit(base, DRIVE_PRESENT) &&
+            !swim_readbit(base, ONEMEG_DRIVE))
                swim_add_floppy(swd, EXTERNAL_DRIVE);
        /* register floppy drives */
@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
                                                              &swd->lock);
                if (!swd->unit[drive].disk->queue) {
                        err = -ENOMEM;
-                        put_disk(swd->unit[drive].disk);
                        goto exit_put_disks;
                }
                blk_queue_bounce_limit(swd->unit[drive].disk->queue,
@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
                goto out;
        }
-        swim_base = ioremap(res->start, resource_size(res));
+        swim_base = (struct swim __iomem *)res->start;
        if (!swim_base) {
                ret = -ENOMEM;
                goto out_release_io;
@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
        if (!get_swim_mode(swim_base)) {
                printk(KERN_INFO "SWIM device not found !\n");
                ret = -ENODEV;
-                goto out_iounmap;
+                goto out_release_io;
        }
        /* set platform driver data */
@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
        swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
        if (!swd) {
                ret = -ENOMEM;
-                goto out_iounmap;
+                goto out_release_io;
        }
        platform_set_drvdata(dev, swd);
@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
 out_kfree:
        kfree(swd);
-out_iounmap:
-        iounmap(swim_base);
 out_release_io:
        release_mem_region(res->start, resource_size(res));
 out:
@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
        for (drive = 0; drive < swd->floppy_count; drive++)
                floppy_eject(&swd->unit[drive]);
-        iounmap(swd->base);
        res = platform_get_resource(dev, IORESOURCE_MEM, 0);
        if (res)
                release_mem_region(res->start, resource_size(res));
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index af51015d056e..469541c1e51e 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -148,7 +148,7 @@ struct swim3 {
 #define MOTOR_ON        2
 #define RELAX           3       /* also eject in progress */
 #define READ_DATA_0     4
-#define TWOMEG_DRIVE    5
+#define ONEMEG_DRIVE    5
 #define SINGLE_SIDED    6       /* drive or diskette is 4MB type? */
 #define DRIVE_PRESENT   7
 #define DISK_IN         8
@@ -156,9 +156,9 @@ struct swim3 {
 #define TRACK_ZERO      10
 #define TACHO           11
 #define READ_DATA_1     12
-#define MFM_MODE        13
+#define GCR_MODE        13
 #define SEEK_COMPLETE   14
-#define ONEMEG_MEDIA    15
+#define TWOMEG_MEDIA    15
 /* Definitions of values used in writing and formatting */
 #define DATA_ESCAPE     0x99
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index d1c0b60e9326..6dc177bf4c42 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -33,6 +33,7 @@ config HISILICON_LPC
        bool "Support for ISA I/O space on HiSilicon Hip06/7"
        depends on ARM64 && (ARCH_HISI || COMPILE_TEST)
        select INDIRECT_PIO
+        select MFD_CORE if ACPI
        help
          Driver to enable I/O access to devices attached to the Low Pin
          Count bus on the HiSilicon Hip06/7 SoC.
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 8327478effd0..bfc566d3f31a 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2371,7 +2371,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
        if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
                return media_changed(cdi, 1);
-        if ((unsigned int)arg >= cdi->capacity)
+        if (arg >= cdi->capacity)
                return -EINVAL;
        info = kmalloc(sizeof(*info), GFP_KERNEL);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 3cd3aae24d6d..cd888d4ee605 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -261,6 +261,7 @@
 #include <linux/ptrace.h>
 #include <linux/workqueue.h>
 #include <linux/irq.h>
+#include <linux/ratelimit.h>
 #include <linux/syscalls.h>
 #include <linux/completion.h>
 #include <linux/uuid.h>
@@ -438,6 +439,16 @@ static void _crng_backtrack_protect(struct crng_state *crng,
 static void process_random_ready_list(void);
 static void _get_random_bytes(void *buf, int nbytes);
+static struct ratelimit_state unseeded_warning =
+        RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
+static struct ratelimit_state urandom_warning =
+        RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
+static int ratelimit_disable __read_mostly;
+module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
+MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
 /**********************************************************************
 *
 * OS independent entropy store.   Here are the functions which handle
@@ -789,7 +800,7 @@ static void crng_initialize(struct crng_state *crng)
 }
 #ifdef CONFIG_NUMA
-static void numa_crng_init(void)
+static void do_numa_crng_init(struct work_struct *work)
 {
        int i;
        struct crng_state *crng;
@@ -810,6 +821,13 @@ static void numa_crng_init(void)
                kfree(pool);
        }
 }
+static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init);
+static void numa_crng_init(void)
+{
+        schedule_work(&numa_crng_init_work);
+}
 #else
 static void numa_crng_init(void) {}
 #endif
@@ -925,6 +943,18 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
                process_random_ready_list();
                wake_up_interruptible(&crng_init_wait);
                pr_notice("random: crng init done\n");
+                if (unseeded_warning.missed) {
+                        pr_notice("random: %d get_random_xx warning(s) missed "
+                                  "due to ratelimiting\n",
+                                  unseeded_warning.missed);
+                        unseeded_warning.missed = 0;
+                }
+                if (urandom_warning.missed) {
+                        pr_notice("random: %d urandom warning(s) missed "
+                                  "due to ratelimiting\n",
+                                  urandom_warning.missed);
+                        urandom_warning.missed = 0;
+                }
        }
 }
@@ -1565,8 +1595,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
 #ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
        print_once = true;
 #endif
-        pr_notice("random: %s called from %pS with crng_init=%d\n",
+        if (__ratelimit(&unseeded_warning))
-                  func_name, caller, crng_init);
+                pr_notice("random: %s called from %pS with crng_init=%d\n",
+                          func_name, caller, crng_init);
 }
 /*
@@ -1760,6 +1791,10 @@ static int rand_initialize(void)
        init_std_data(&blocking_pool);
        crng_initialize(&primary_crng);
        crng_global_init_time = jiffies;
+        if (ratelimit_disable) {
+                urandom_warning.interval = 0;
+                unseeded_warning.interval = 0;
+        }
        return 0;
 }
 early_initcall(rand_initialize);
@@ -1827,9 +1862,10 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
        if (!crng_ready() && maxwarn > 0) {
                maxwarn--;
-                printk(KERN_NOTICE "random: %s: uninitialized urandom read "
+                if (__ratelimit(&urandom_warning))
-                       "(%zd bytes read)\n",
+                        printk(KERN_NOTICE "random: %s: uninitialized "
-                       current->comm, nbytes);
+                               "urandom read (%zd bytes read)\n",
+                               current->comm, nbytes);
                spin_lock_irqsave(&primary_crng.lock, flags);
                crng_init_cnt = 0;
                spin_unlock_irqrestore(&primary_crng.lock, flags);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 468f06134012..21085515814f 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -422,7 +422,7 @@ static void reclaim_dma_bufs(void)
        }
 }
-static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
+static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size,
                                     int pages)
 {
        struct port_buffer *buf;
@@ -445,16 +445,16 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
                return buf;
        }
-        if (is_rproc_serial(vq->vdev)) {
+        if (is_rproc_serial(vdev)) {
                /*
                 * Allocate DMA memory from ancestor. When a virtio
                 * device is created by remoteproc, the DMA memory is
                 * associated with the grandparent device:
                 * vdev => rproc => platform-dev.
                 */
-                if (!vq->vdev->dev.parent || !vq->vdev->dev.parent->parent)
+                if (!vdev->dev.parent || !vdev->dev.parent->parent)
                        goto free_buf;
-                buf->dev = vq->vdev->dev.parent->parent;
+                buf->dev = vdev->dev.parent->parent;
                /* Increase device refcnt to avoid freeing it */
                get_device(buf->dev);
@@ -838,7 +838,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
        count = min((size_t)(32 * 1024), count);
-        buf = alloc_buf(port->out_vq, count, 0);
+        buf = alloc_buf(port->portdev->vdev, count, 0);
        if (!buf)
                return -ENOMEM;
@@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
        if (ret < 0)
                goto error_out;
-        buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
+        buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs);
        if (!buf) {
                ret = -ENOMEM;
                goto error_out;
@@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
        nr_added_bufs = 0;
        do {
-                buf = alloc_buf(vq, PAGE_SIZE, 0);
+                buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
                if (!buf)
                        break;
@@ -1402,7 +1402,6 @@ static int add_port(struct ports_device *portdev, u32 id)
 {
        char debugfs_name[16];
        struct port *port;
-        struct port_buffer *buf;
        dev_t devt;
        unsigned int nr_added_bufs;
        int err;
@@ -1513,8 +1512,6 @@ static int add_port(struct ports_device *portdev, u32 id)
        return 0;
 free_inbufs:
-        while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
-                free_buf(buf, true);
 free_device:
        device_destroy(pdrvdata.class, port->dev->devt);
 free_cdev:
@@ -1539,34 +1536,14 @@ static void remove_port(struct kref *kref)
 static void remove_port_data(struct port *port)
 {
-        struct port_buffer *buf;
        spin_lock_irq(&port->inbuf_lock);
        /* Remove unused data this port might have received. */
        discard_port_data(port);
        spin_unlock_irq(&port->inbuf_lock);
-        /* Remove buffers we queued up for the Host to send us data in. */
-        do {
-                spin_lock_irq(&port->inbuf_lock);
-                buf = virtqueue_detach_unused_buf(port->in_vq);
-                spin_unlock_irq(&port->inbuf_lock);
-                if (buf)
-                        free_buf(buf, true);
-        } while (buf);
        spin_lock_irq(&port->outvq_lock);
        reclaim_consumed_buffers(port);
        spin_unlock_irq(&port->outvq_lock);
-        /* Free pending buffers from the out-queue. */
-        do {
-                spin_lock_irq(&port->outvq_lock);
-                buf = virtqueue_detach_unused_buf(port->out_vq);
-                spin_unlock_irq(&port->outvq_lock);
-                if (buf)
-                        free_buf(buf, true);
-        } while (buf);
 }
 /*
@@ -1791,13 +1768,24 @@ static void control_work_handler(struct work_struct *work)
        spin_unlock(&portdev->c_ivq_lock);
 }
+static void flush_bufs(struct virtqueue *vq, bool can_sleep)
+{
+        struct port_buffer *buf;
+        unsigned int len;
+        while ((buf = virtqueue_get_buf(vq, &len)))
+                free_buf(buf, can_sleep);
+}
 static void out_intr(struct virtqueue *vq)
 {
        struct port *port;
        port = find_port_by_vq(vq->vdev->priv, vq);
-        if (!port)
+        if (!port) {
+                flush_bufs(vq, false);
                return;
+        }
        wake_up_interruptible(&port->waitqueue);
 }
@@ -1808,8 +1796,10 @@ static void in_intr(struct virtqueue *vq)
        unsigned long flags;
        port = find_port_by_vq(vq->vdev->priv, vq);
-        if (!port)
+        if (!port) {
+                flush_bufs(vq, false);
                return;
+        }
        spin_lock_irqsave(&port->inbuf_lock, flags);
        port->inbuf = get_inbuf(port);
@@ -1984,24 +1974,54 @@ static const struct file_operations portdev_fops = {
 static void remove_vqs(struct ports_device *portdev)
 {
+        struct virtqueue *vq;
+        virtio_device_for_each_vq(portdev->vdev, vq) {
+                struct port_buffer *buf;
+                flush_bufs(vq, true);
+                while ((buf = virtqueue_detach_unused_buf(vq)))
+                        free_buf(buf, true);
+        }
        portdev->vdev->config->del_vqs(portdev->vdev);
        kfree(portdev->in_vqs);
        kfree(portdev->out_vqs);
 }
-static void remove_controlq_data(struct ports_device *portdev)
+static void virtcons_remove(struct virtio_device *vdev)
 {
-        struct port_buffer *buf;
+        struct ports_device *portdev;
-        unsigned int len;
+        struct port *port, *port2;
-        if (!use_multiport(portdev))
+        portdev = vdev->priv;
-                return;
-        while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
+        spin_lock_irq(&pdrvdata_lock);
-                free_buf(buf, true);
+        list_del(&portdev->list);
+        spin_unlock_irq(&pdrvdata_lock);
-        while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
+        /* Disable interrupts for vqs */
-                free_buf(buf, true);
+        vdev->config->reset(vdev);
+        /* Finish up work that's lined up */
+        if (use_multiport(portdev))
+                cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
+        list_for_each_entry_safe(port, port2, &portdev->ports, list)
+                unplug_port(port);
+        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
+        /*
+         * When yanking out a device, we immediately lose the
+         * (device-side) queues.  So there's no point in keeping the
+         * guest side around till we drop our final reference.  This
+         * also means that any ports which are in an open state will
+         * have to just stop using the port, as the vqs are going
+         * away.
+         */
+        remove_vqs(portdev);
+        kfree(portdev);
 }
 /*
@@ -2070,6 +2090,7 @@ static int virtcons_probe(struct virtio_device *vdev)
        spin_lock_init(&portdev->ports_lock);
        INIT_LIST_HEAD(&portdev->ports);
+        INIT_LIST_HEAD(&portdev->list);
        virtio_device_ready(portdev->vdev);
@@ -2087,8 +2108,15 @@ static int virtcons_probe(struct virtio_device *vdev)
                if (!nr_added_bufs) {
                        dev_err(&vdev->dev,
                                "Error allocating buffers for control queue\n");
-                        err = -ENOMEM;
+                        /*
-                        goto free_vqs;
+                         * The host might want to notify mgmt sw about device
+                         * add failure.
+                         */
+                        __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
+                                           VIRTIO_CONSOLE_DEVICE_READY, 0);
+                        /* Device was functional: we need full cleanup. */
+                        virtcons_remove(vdev);
+                        return -ENOMEM;
                }
        } else {
                /*
@@ -2119,11 +2147,6 @@ static int virtcons_probe(struct virtio_device *vdev)
        return 0;
-free_vqs:
-        /* The host might want to notify mgmt sw about device add failure */
-        __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
-                           VIRTIO_CONSOLE_DEVICE_READY, 0);
-        remove_vqs(portdev);
 free_chrdev:
        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
 free:
@@ -2132,43 +2155,6 @@ fail:
        return err;
 }
-static void virtcons_remove(struct virtio_device *vdev)
-{
-        struct ports_device *portdev;
-        struct port *port, *port2;
-        portdev = vdev->priv;
-        spin_lock_irq(&pdrvdata_lock);
-        list_del(&portdev->list);
-        spin_unlock_irq(&pdrvdata_lock);
-        /* Disable interrupts for vqs */
-        vdev->config->reset(vdev);
-        /* Finish up work that's lined up */
-        if (use_multiport(portdev))
-                cancel_work_sync(&portdev->control_work);
-        else
-                cancel_work_sync(&portdev->config_work);
-        list_for_each_entry_safe(port, port2, &portdev->ports, list)
-                unplug_port(port);
-        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
-        /*
-         * When yanking out a device, we immediately lose the
-         * (device-side) queues.  So there's no point in keeping the
-         * guest side around till we drop our final reference.  This
-         * also means that any ports which are in an open state will
-         * have to just stop using the port, as the vqs are going
-         * away.
-         */
-        remove_controlq_data(portdev);
-        remove_vqs(portdev);
-        kfree(portdev);
-}
 static struct virtio_device_id id_table[] = {
        { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
        { 0 },
@@ -2209,7 +2195,6 @@ static int virtcons_freeze(struct virtio_device *vdev)
         */
        if (use_multiport(portdev))
                virtqueue_disable_cb(portdev->c_ivq);
-        remove_controlq_data(portdev);
        list_for_each_entry(port, &portdev->ports, list) {
                virtqueue_disable_cb(port->in_vq);
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 7f56fe5183f2..de55c7d57438 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,16 +71,6 @@ config ARM_BRCMSTB_AVS_CPUFREQ
          Say Y, if you have a Broadcom SoC with AVS support for DFS or DVFS.
-config ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-        bool "Broadcom STB AVS CPUfreq driver sysfs debug capability"
-        depends on ARM_BRCMSTB_AVS_CPUFREQ
-        help
-          Enabling this option turns on debug support via sysfs under
-          /sys/kernel/debug/brcmstb-avs-cpufreq. It is possible to read all and
-          write some AVS mailbox registers through sysfs entries.
-          If in doubt, say N.
 config ARM_EXYNOS5440_CPUFREQ
        tristate "SAMSUNG EXYNOS5440"
        depends on SOC_EXYNOS5440
diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 6cdac1aaf23c..b07559b9ed99 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -49,13 +49,6 @@
 #include <linux/platform_device.h>
 #include <linux/semaphore.h>
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-#include <linux/ctype.h>
-#include <linux/debugfs.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-#endif
 /* Max number of arguments AVS calls take */
 #define AVS_MAX_CMD_ARGS        4
 /*
@@ -182,88 +175,11 @@ struct private_data {
        void __iomem *base;
        void __iomem *avs_intr_base;
        struct device *dev;
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-        struct dentry *debugfs;
-#endif
        struct completion done;
        struct semaphore sem;
        struct pmap pmap;
 };
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-enum debugfs_format {
-        DEBUGFS_NORMAL,
-        DEBUGFS_FLOAT,
-        DEBUGFS_REV,
-};
-struct debugfs_data {
-        struct debugfs_entry *entry;
-        struct private_data *priv;
-};
-struct debugfs_entry {
-        char *name;
-        u32 offset;
-        fmode_t mode;
-        enum debugfs_format format;
-};
-#define DEBUGFS_ENTRY(name, mode, format)       { \
-        #name, AVS_MBOX_##name, mode, format \
-}
-/*
- * These are used for debugfs only. Otherwise we use AVS_MBOX_PARAM() directly.
- */
-#define AVS_MBOX_PARAM1         AVS_MBOX_PARAM(0)
-#define AVS_MBOX_PARAM2         AVS_MBOX_PARAM(1)
-#define AVS_MBOX_PARAM3         AVS_MBOX_PARAM(2)
-#define AVS_MBOX_PARAM4         AVS_MBOX_PARAM(3)
-/*
- * This table stores the name, access permissions and offset for each hardware
- * register and is used to generate debugfs entries.
- */
-static struct debugfs_entry debugfs_entries[] = {
-        DEBUGFS_ENTRY(COMMAND, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(STATUS, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(VOLTAGE0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(TEMP0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PV0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(MV0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PARAM1, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM2, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM3, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM4, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(REVISION, 0, DEBUGFS_REV),
-        DEBUGFS_ENTRY(PSTATE, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(HEARTBEAT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(MAGIC, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(SIGMA_HVT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(SIGMA_SVT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(VOLTAGE1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(TEMP1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PV1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(MV1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(FREQUENCY, 0, DEBUGFS_NORMAL),
-};
-static int brcm_avs_target_index(struct cpufreq_policy *, unsigned int);
-static char *__strtolower(char *s)
-{
-        char *p;
-        for (p = s; *p; p++)
-                *p = tolower(*p);
-        return s;
-}
-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */
 static void __iomem *__map_region(const char *name)
 {
        struct device_node *np;
@@ -516,238 +432,6 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv)
        return table;
 }
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-#define MANT(x) (unsigned int)(abs((x)) / 1000)
-#define FRAC(x) (unsigned int)(abs((x)) - abs((x)) / 1000 * 1000)
-static int brcm_avs_debug_show(struct seq_file *s, void *data)
-{
-        struct debugfs_data *dbgfs = s->private;
-        void __iomem *base;
-        u32 val, offset;
-        if (!dbgfs) {
-                seq_puts(s, "No device pointer\n");
-                return 0;
-        }
-        base = dbgfs->priv->base;
-        offset = dbgfs->entry->offset;
-        val = readl(base + offset);
-        switch (dbgfs->entry->format) {
-        case DEBUGFS_NORMAL:
-                seq_printf(s, "%u\n", val);
-                break;
-        case DEBUGFS_FLOAT:
-                seq_printf(s, "%d.%03d\n", MANT(val), FRAC(val));
-                break;
-        case DEBUGFS_REV:
-                seq_printf(s, "%c.%c.%c.%c\n", (val >> 24 & 0xff),
-                           (val >> 16 & 0xff), (val >> 8 & 0xff),
-                           val & 0xff);
-                break;
-        }
-        seq_printf(s, "0x%08x\n", val);
-        return 0;
-}
-#undef MANT
-#undef FRAC
-static ssize_t brcm_avs_seq_write(struct file *file, const char __user *buf,
-                                  size_t size, loff_t *ppos)
-{
-        struct seq_file *s = file->private_data;
-        struct debugfs_data *dbgfs = s->private;
-        struct private_data *priv = dbgfs->priv;
-        void __iomem *base, *avs_intr_base;
-        bool use_issue_command = false;
-        unsigned long val, offset;
-        char str[128];
-        int ret;
-        char *str_ptr = str;
-        if (size >= sizeof(str))
-                return -E2BIG;
-        memset(str, 0, sizeof(str));
-        ret = copy_from_user(str, buf, size);
-        if (ret)
-                return ret;
-        base = priv->base;
-        avs_intr_base = priv->avs_intr_base;
-        offset = dbgfs->entry->offset;
-        /*
-         * Special case writing to "command" entry only: if the string starts
-         * with a 'c', we use the driver's __issue_avs_command() function.
-         * Otherwise, we perform a raw write. This should allow testing of raw
-         * access as well as using the higher level function. (Raw access
-         * doesn't clear the firmware return status after issuing the command.)
-         */
-        if (str_ptr[0] == 'c' && offset == AVS_MBOX_COMMAND) {
-                use_issue_command = true;
-                str_ptr++;
-        }
-        if (kstrtoul(str_ptr, 0, &val) != 0)
-                return -EINVAL;
-        /*
-         * Setting the P-state is a special case. We need to update the CPU
-         * frequency we report.
-         */
-        if (val == AVS_CMD_SET_PSTATE) {
-                struct cpufreq_policy *policy;
-                unsigned int pstate;
-                policy = cpufreq_cpu_get(smp_processor_id());
-                /* Read back the P-state we are about to set */
-                pstate = readl(base + AVS_MBOX_PARAM(0));
-                if (use_issue_command) {
-                        ret = brcm_avs_target_index(policy, pstate);
-                        return ret ? ret : size;
-                }
-                policy->cur = policy->freq_table[pstate].frequency;
-        }
-        if (use_issue_command) {
-                ret = __issue_avs_command(priv, val, false, NULL);
-        } else {
-                /* Locking here is not perfect, but is only for debug. */
-                ret = down_interruptible(&priv->sem);
-                if (ret)
-                        return ret;
-                writel(val, base + offset);
-                /* We have to wake up the firmware to process a command. */
-                if (offset == AVS_MBOX_COMMAND)
-                        writel(AVS_CPU_L2_INT_MASK,
-                               avs_intr_base + AVS_CPU_L2_SET0);
-                up(&priv->sem);
-        }
-        return ret ? ret : size;
-}
-static struct debugfs_entry *__find_debugfs_entry(const char *name)
-{
-        int i;
-        for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++)
-                if (strcasecmp(debugfs_entries[i].name, name) == 0)
-                        return &debugfs_entries[i];
-        return NULL;
-}
-static int brcm_avs_debug_open(struct inode *inode, struct file *file)
-{
-        struct debugfs_data *data;
-        fmode_t fmode;
-        int ret;
-        /*
-         * seq_open(), which is called by single_open(), clears "write" access.
-         * We need write access to some files, so we preserve our access mode
-         * and restore it.
-         */
-        fmode = file->f_mode;
-        /*
-         * Check access permissions even for root. We don't want to be writing
-         * to read-only registers. Access for regular users has already been
-         * checked by the VFS layer.
-         */
-        if ((fmode & FMODE_WRITER) && !(inode->i_mode & S_IWUSR))
-                return -EACCES;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-        /*
-         * We use the same file system operations for all our debug files. To
-         * produce specific output, we look up the file name upon opening a
-         * debugfs entry and map it to a memory offset. This offset is then used
-         * in the generic "show" function to read a specific register.
-         */
-        data->entry = __find_debugfs_entry(file->f_path.dentry->d_iname);
-        data->priv = inode->i_private;
-        ret = single_open(file, brcm_avs_debug_show, data);
-        if (ret)
-                kfree(data);
-        file->f_mode = fmode;
-        return ret;
-}
-static int brcm_avs_debug_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq_priv = file->private_data;
-        struct debugfs_data *data = seq_priv->private;
-        kfree(data);
-        return single_release(inode, file);
-}
-static const struct file_operations brcm_avs_debug_ops = {
-        .open           = brcm_avs_debug_open,
-        .read           = seq_read,
-        .write          = brcm_avs_seq_write,
-        .llseek         = seq_lseek,
-        .release        = brcm_avs_debug_release,
-};
-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev)
-{
-        struct private_data *priv = platform_get_drvdata(pdev);
-        struct dentry *dir;
-        int i;
-        if (!priv)
-                return;
-        dir = debugfs_create_dir(BRCM_AVS_CPUFREQ_NAME, NULL);
-        if (IS_ERR_OR_NULL(dir))
-                return;
-        priv->debugfs = dir;
-        for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++) {
-                /*
-                 * The DEBUGFS_ENTRY macro generates uppercase strings. We
-                 * convert them to lowercase before creating the debugfs
-                 * entries.
-                 */
-                char *entry = __strtolower(debugfs_entries[i].name);
-                fmode_t mode = debugfs_entries[i].mode;
-                if (!debugfs_create_file(entry, S_IFREG | S_IRUGO | mode,
-                                         dir, priv, &brcm_avs_debug_ops)) {
-                        priv->debugfs = NULL;
-                        debugfs_remove_recursive(dir);
-                        break;
-                }
-        }
-}
-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev)
-{
-        struct private_data *priv = platform_get_drvdata(pdev);
-        if (priv && priv->debugfs) {
-                debugfs_remove_recursive(priv->debugfs);
-                priv->debugfs = NULL;
-        }
-}
-#else
-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev) {}
-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev) {}
-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */
 /*
 * To ensure the right firmware is running we need to
 *    - check the MAGIC matches what we expect
@@ -1016,11 +700,8 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
                return ret;
        brcm_avs_driver.driver_data = pdev;
-        ret = cpufreq_register_driver(&brcm_avs_driver);
-        if (!ret)
-                brcm_avs_cpufreq_debug_init(pdev);
-        return ret;
+        return cpufreq_register_driver(&brcm_avs_driver);
 }
 static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
@@ -1032,8 +713,6 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
        if (ret)
                return ret;
-        brcm_avs_cpufreq_debug_exit(pdev);
        priv = platform_get_drvdata(pdev);
        iounmap(priv->base);
        iounmap(priv->avs_intr_base);
diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
index e6f17825db79..2b90606452a2 100644
--- a/drivers/firmware/arm_scmi/clock.c
+++ b/drivers/firmware/arm_scmi/clock.c
@@ -284,7 +284,7 @@ scmi_clock_info_get(const struct scmi_handle *handle, u32 clk_id)
        struct clock_info *ci = handle->clk_priv;
        struct scmi_clock_info *clk = ci->clk + clk_id;
-        if (!clk->name || !clk->name[0])
+        if (!clk->name[0])
                return NULL;
        return clk;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index b0e591eaa71a..e14263fca1c9 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -1459,10 +1459,11 @@ static const u32 sgpr_init_compute_shader[] =
 static const u32 vgpr_init_regs[] =
 {
        mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0xffffffff,
-        mmCOMPUTE_RESOURCE_LIMITS, 0,
+        mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */
        mmCOMPUTE_NUM_THREAD_X, 256*4,
        mmCOMPUTE_NUM_THREAD_Y, 1,
        mmCOMPUTE_NUM_THREAD_Z, 1,
+        mmCOMPUTE_PGM_RSRC1, 0x100004f, /* VGPRS=15 (64 logical VGPRs), SGPRS=1 (16 SGPRs), BULKY=1 */
        mmCOMPUTE_PGM_RSRC2, 20,
        mmCOMPUTE_USER_DATA_0, 0xedcedc00,
        mmCOMPUTE_USER_DATA_1, 0xedcedc01,
@@ -1479,10 +1480,11 @@ static const u32 vgpr_init_regs[] =
 static const u32 sgpr1_init_regs[] =
 {
        mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0x0f,
-        mmCOMPUTE_RESOURCE_LIMITS, 0x1000000,
+        mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */
        mmCOMPUTE_NUM_THREAD_X, 256*5,
        mmCOMPUTE_NUM_THREAD_Y, 1,
        mmCOMPUTE_NUM_THREAD_Z, 1,
+        mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */
        mmCOMPUTE_PGM_RSRC2, 20,
        mmCOMPUTE_USER_DATA_0, 0xedcedc00,
        mmCOMPUTE_USER_DATA_1, 0xedcedc01,
@@ -1503,6 +1505,7 @@ static const u32 sgpr2_init_regs[] =
        mmCOMPUTE_NUM_THREAD_X, 256*5,
        mmCOMPUTE_NUM_THREAD_Y, 1,
        mmCOMPUTE_NUM_THREAD_Z, 1,
+        mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */
        mmCOMPUTE_PGM_RSRC2, 20,
        mmCOMPUTE_USER_DATA_0, 0xedcedc00,
        mmCOMPUTE_USER_DATA_1, 0xedcedc01,
diff --git a/drivers/gpu/drm/amd/amdkfd/Kconfig b/drivers/gpu/drm/amd/amdkfd/Kconfig
index ed2f06c9f346..3858820a0055 100644
--- a/drivers/gpu/drm/amd/amdkfd/Kconfig
+++ b/drivers/gpu/drm/amd/amdkfd/Kconfig
@@ -6,5 +6,6 @@ config HSA_AMD
        tristate "HSA kernel driver for AMD GPU devices"
        depends on DRM_AMDGPU && X86_64
        imply AMD_IOMMU_V2
+        select MMU_NOTIFIER
        help
          Enable this if you want to use HSA features on AMD GPU devices.
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index cd679cf1fd30..59808a39ecf4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -749,12 +749,13 @@ static int kfd_ioctl_get_clock_counters(struct file *filep,
        struct timespec64 time;
        dev = kfd_device_by_id(args->gpu_id);
-        if (dev == NULL)
+        if (dev)
-                return -EINVAL;
+                /* Reading GPU clock counter from KGD */
+                args->gpu_clock_counter =
-        /* Reading GPU clock counter from KGD */
+                        dev->kfd2kgd->get_gpu_clock_counter(dev->kgd);
-        args->gpu_clock_counter =
+        else
-                dev->kfd2kgd->get_gpu_clock_counter(dev->kgd);
+                /* Node without GPU resource */
+                args->gpu_clock_counter = 0;
        /* No access to rdtsc. Using raw monotonic time */
        getrawmonotonic64(&time);
@@ -1147,7 +1148,7 @@ err_unlock:
        return ret;
 }
-bool kfd_dev_is_large_bar(struct kfd_dev *dev)
+static bool kfd_dev_is_large_bar(struct kfd_dev *dev)
 {
        struct kfd_local_mem_info mem_info;
@@ -1421,7 +1422,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
        pdd = kfd_get_process_device_data(dev, p);
        if (!pdd) {
-                err = PTR_ERR(pdd);
+                err = -EINVAL;
                goto bind_process_to_device_failed;
        }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 4e2f379ce217..1dd1142246c2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4557,6 +4557,7 @@ static int dm_update_crtcs_state(struct dc *dc,
                struct amdgpu_dm_connector *aconnector = NULL;
                struct drm_connector_state *new_con_state = NULL;
                struct dm_connector_state *dm_conn_state = NULL;
+                struct drm_plane_state *new_plane_state = NULL;
                new_stream = NULL;
@@ -4564,6 +4565,13 @@ static int dm_update_crtcs_state(struct dc *dc,
                dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
                acrtc = to_amdgpu_crtc(crtc);
+                new_plane_state = drm_atomic_get_new_plane_state(state, new_crtc_state->crtc->primary);
+                if (new_crtc_state->enable && new_plane_state && !new_plane_state->fb) {
+                        ret = -EINVAL;
+                        goto fail;
+                }
                aconnector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc);
                /* TODO This hack should go away */
@@ -4760,7 +4768,7 @@ static int dm_update_planes_state(struct dc *dc,
                        if (!dm_old_crtc_state->stream)
                                continue;
-                        DRM_DEBUG_DRIVER("Disabling DRM plane: %d on DRM crtc %d\n",
+                        DRM_DEBUG_ATOMIC("Disabling DRM plane: %d on DRM crtc %d\n",
                                        plane->base.id, old_plane_crtc->base.id);
                        if (!dc_remove_plane_from_context(
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
index 490017df371d..4be21bf54749 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
@@ -329,14 +329,15 @@ void amdgpu_dm_irq_fini(struct amdgpu_device *adev)
 {
        int src;
        struct irq_list_head *lh;
+        unsigned long irq_table_flags;
        DRM_DEBUG_KMS("DM_IRQ: releasing resources.\n");
        for (src = 0; src < DAL_IRQ_SOURCES_NUMBER; src++) {
+                DM_IRQ_TABLE_LOCK(adev, irq_table_flags);
                /* The handler was removed from the table,
                 * it means it is safe to flush all the 'work'
                 * (because no code can schedule a new one). */
                lh = &adev->dm.irq_handler_list_low_tab[src];
+                DM_IRQ_TABLE_UNLOCK(adev, irq_table_flags);
                flush_work(&lh->work);
        }
 }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 8291d74f26bc..ace9ad578ca0 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -161,6 +161,11 @@ dm_dp_mst_connector_destroy(struct drm_connector *connector)
        struct amdgpu_dm_connector *amdgpu_dm_connector = to_amdgpu_dm_connector(connector);
        struct amdgpu_encoder *amdgpu_encoder = amdgpu_dm_connector->mst_encoder;
+        if (amdgpu_dm_connector->edid) {
+                kfree(amdgpu_dm_connector->edid);
+                amdgpu_dm_connector->edid = NULL;
+        }
        drm_encoder_cleanup(&amdgpu_encoder->base);
        kfree(amdgpu_encoder);
        drm_connector_cleanup(connector);
@@ -181,28 +186,22 @@ static const struct drm_connector_funcs dm_dp_mst_connector_funcs = {
 void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
 {
        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
-        struct edid *edid;
        struct dc_sink *dc_sink;
        struct dc_sink_init_data init_params = {
                        .link = aconnector->dc_link,
                        .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
+        /* FIXME none of this is safe. we shouldn't touch aconnector here in
+         * atomic_check
+         */
        /*
         * TODO: Need to further figure out why ddc.algo is NULL while MST port exists
         */
        if (!aconnector->port || !aconnector->port->aux.ddc.algo)
                return;
-        edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
+        ASSERT(aconnector->edid);
-        if (!edid) {
-                drm_mode_connector_update_edid_property(
-                        &aconnector->base,
-                        NULL);
-                return;
-        }
-        aconnector->edid = edid;
        dc_sink = dc_link_add_remote_sink(
                aconnector->dc_link,
@@ -215,9 +214,6 @@ void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
        amdgpu_dm_add_sink_to_freesync_module(
                        connector, aconnector->edid);
-        drm_mode_connector_update_edid_property(
-                                        &aconnector->base, aconnector->edid);
 }
 static int dm_dp_mst_get_modes(struct drm_connector *connector)
@@ -230,10 +226,6 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
        if (!aconnector->edid) {
                struct edid *edid;
-                struct dc_sink *dc_sink;
-                struct dc_sink_init_data init_params = {
-                                .link = aconnector->dc_link,
-                                .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
                edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
                if (!edid) {
@@ -244,11 +236,17 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
                }
                aconnector->edid = edid;
+        }
+        if (!aconnector->dc_sink) {
+                struct dc_sink *dc_sink;
+                struct dc_sink_init_data init_params = {
+                                .link = aconnector->dc_link,
+                                .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
                dc_sink = dc_link_add_remote_sink(
                        aconnector->dc_link,
-                        (uint8_t *)edid,
+                        (uint8_t *)aconnector->edid,
-                        (edid->extensions + 1) * EDID_LENGTH,
+                        (aconnector->edid->extensions + 1) * EDID_LENGTH,
                        &init_params);
                dc_sink->priv = aconnector;
@@ -256,12 +254,12 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
                if (aconnector->dc_sink)
                        amdgpu_dm_add_sink_to_freesync_module(
-                                        connector, edid);
+                                        connector, aconnector->edid);
-                drm_mode_connector_update_edid_property(
-                                                &aconnector->base, edid);
        }
+        drm_mode_connector_update_edid_property(
+                                        &aconnector->base, aconnector->edid);
        ret = drm_add_edid_modes(connector, aconnector->edid);
        return ret;
@@ -424,14 +422,6 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                dc_sink_release(aconnector->dc_sink);
                aconnector->dc_sink = NULL;
        }
-        if (aconnector->edid) {
-                kfree(aconnector->edid);
-                aconnector->edid = NULL;
-        }
-        drm_mode_connector_update_edid_property(
-                        &aconnector->base,
-                        NULL);
        aconnector->mst_connected = false;
 }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 134069f36482..39f1db4acda4 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -4451,6 +4451,7 @@ drm_reset_display_info(struct drm_connector *connector)
        info->max_tmds_clock = 0;
        info->dvi_dual = false;
        info->has_hdmi_infoframe = false;
+        memset(&info->hdmi, 0, sizeof(info->hdmi));
        info->non_desktop = 0;
 }
@@ -4462,17 +4463,11 @@ u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edi
        u32 quirks = edid_get_quirks(edid);
+        drm_reset_display_info(connector);
        info->width_mm = edid->width_cm * 10;
        info->height_mm = edid->height_cm * 10;
-        /* driver figures it out in this case */
-        info->bpc = 0;
-        info->color_formats = 0;
-        info->cea_rev = 0;
-        info->max_tmds_clock = 0;
-        info->dvi_dual = false;
-        info->has_hdmi_infoframe = false;
        info->non_desktop = !!(quirks & EDID_QUIRK_NON_DESKTOP);
        DRM_DEBUG_KMS("non_desktop set to %d\n", info->non_desktop);
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index fc8b2c6e3508..32d24c69da3c 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -2140,10 +2140,22 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
                }
        }
-        /* According to BSpec, "The CD clock frequency must be at least twice
+        /*
+         * According to BSpec, "The CD clock frequency must be at least twice
         * the frequency of the Azalia BCLK." and BCLK is 96 MHz by default.
+         *
+         * FIXME: Check the actual, not default, BCLK being used.
+         *
+         * FIXME: This does not depend on ->has_audio because the higher CDCLK
+         * is required for audio probe, also when there are no audio capable
+         * displays connected at probe time. This leads to unnecessarily high
+         * CDCLK when audio is not required.
+         *
+         * FIXME: This limit is only applied when there are displays connected
+         * at probe time. If we probe without displays, we'll still end up using
+         * the platform minimum CDCLK, failing audio probe.
         */
-        if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
+        if (INTEL_GEN(dev_priv) >= 9)
                min_cdclk = max(2 * 96000, min_cdclk);
        /*
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index d4368589b355..a80fbad9be0f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -49,12 +49,12 @@
 * check the condition before the timeout.
 */
 #define __wait_for(OP, COND, US, Wmin, Wmax) ({ \
-        unsigned long timeout__ = jiffies + usecs_to_jiffies(US) + 1;   \
+        const ktime_t end__ = ktime_add_ns(ktime_get_raw(), 1000ll * (US)); \
        long wait__ = (Wmin); /* recommended min for usleep is 10 us */ \
        int ret__;                                                      \
        might_sleep();                                                  \
        for (;;) {                                                      \
-                bool expired__ = time_after(jiffies, timeout__);        \
+                const bool expired__ = ktime_after(ktime_get_raw(), end__); \
                OP;                                                     \
                if (COND) {                                             \
                        ret__ = 0;                                      \
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 6f12adc06365..6467a5cc2ca3 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -806,7 +806,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
                return;
        intel_fbdev_sync(ifbdev);
-        if (ifbdev->vma)
+        if (ifbdev->vma || ifbdev->helper.deferred_setup)
                drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 53ea564f971e..66de4b2dc8b7 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -641,19 +641,18 @@ void skl_enable_dc6(struct drm_i915_private *dev_priv)
        DRM_DEBUG_KMS("Enabling DC6\n");
-        gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6);
+        /* Wa Display #1183: skl,kbl,cfl */
+        if (IS_GEN9_BC(dev_priv))
+                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
+                           SKL_SELECT_ALTERNATE_DC_EXIT);
+        gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6);
 }
 void skl_disable_dc6(struct drm_i915_private *dev_priv)
 {
        DRM_DEBUG_KMS("Disabling DC6\n");
-        /* Wa Display #1183: skl,kbl,cfl */
-        if (IS_GEN9_BC(dev_priv))
-                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
-                           SKL_SELECT_ALTERNATE_DC_EXIT);
        gen9_set_dc_state(dev_priv, DC_STATE_DISABLE);
 }
diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
index 6e5e1aa54ce1..b001699297c4 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
@@ -351,6 +351,7 @@ static void mdp4_crtc_atomic_flush(struct drm_crtc *crtc,
        spin_lock_irqsave(&dev->event_lock, flags);
        mdp4_crtc->event = crtc->state->event;
+        crtc->state->event = NULL;
        spin_unlock_irqrestore(&dev->event_lock, flags);
        blend_setup(crtc);
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index 9893e43ba6c5..76b96081916f 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -708,6 +708,7 @@ static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc,
        spin_lock_irqsave(&dev->event_lock, flags);
        mdp5_crtc->event = crtc->state->event;
+        crtc->state->event = NULL;
        spin_unlock_irqrestore(&dev->event_lock, flags);
        /*
diff --git a/drivers/gpu/drm/msm/disp/mdp_format.c b/drivers/gpu/drm/msm/disp/mdp_format.c
index b4a8aa4490ee..005760bee708 100644
--- a/drivers/gpu/drm/msm/disp/mdp_format.c
+++ b/drivers/gpu/drm/msm/disp/mdp_format.c
@@ -171,7 +171,8 @@ uint32_t mdp_get_formats(uint32_t *pixel_formats, uint32_t max_formats,
        return i;
 }
-const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format)
+const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format,
+                uint64_t modifier)
 {
        int i;
        for (i = 0; i < ARRAY_SIZE(formats); i++) {
diff --git a/drivers/gpu/drm/msm/disp/mdp_kms.h b/drivers/gpu/drm/msm/disp/mdp_kms.h
index 1185487e7e5e..4fa8dbe4e165 100644
--- a/drivers/gpu/drm/msm/disp/mdp_kms.h
+++ b/drivers/gpu/drm/msm/disp/mdp_kms.h
@@ -98,7 +98,7 @@ struct mdp_format {
 #define MDP_FORMAT_IS_YUV(mdp_format) ((mdp_format)->is_yuv)
 uint32_t mdp_get_formats(uint32_t *formats, uint32_t max_formats, bool rgb_only);
-const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format);
+const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format, uint64_t modifier);
 /* MDP capabilities */
 #define MDP_CAP_SMP             BIT(0)  /* Shared Memory Pool                 */
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 7a03a9489708..8baba30d6c65 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -173,6 +173,7 @@ struct msm_dsi_host {
        bool registered;
        bool power_on;
+        bool enabled;
        int irq;
 };
@@ -775,7 +776,7 @@ static inline enum dsi_cmd_dst_format dsi_get_cmd_fmt(
        switch (mipi_fmt) {
        case MIPI_DSI_FMT_RGB888:       return CMD_DST_FORMAT_RGB888;
        case MIPI_DSI_FMT_RGB666_PACKED:
-        case MIPI_DSI_FMT_RGB666:       return VID_DST_FORMAT_RGB666;
+        case MIPI_DSI_FMT_RGB666:       return CMD_DST_FORMAT_RGB666;
        case MIPI_DSI_FMT_RGB565:       return CMD_DST_FORMAT_RGB565;
        default:                        return CMD_DST_FORMAT_RGB888;
        }
@@ -986,13 +987,19 @@ static void dsi_set_tx_power_mode(int mode, struct msm_dsi_host *msm_host)
 static void dsi_wait4video_done(struct msm_dsi_host *msm_host)
 {
+        u32 ret = 0;
+        struct device *dev = &msm_host->pdev->dev;
        dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_VIDEO_DONE, 1);
        reinit_completion(&msm_host->video_comp);
-        wait_for_completion_timeout(&msm_host->video_comp,
+        ret = wait_for_completion_timeout(&msm_host->video_comp,
                        msecs_to_jiffies(70));
+        if (ret <= 0)
+                dev_err(dev, "wait for video done timed out\n");
        dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_VIDEO_DONE, 0);
 }
@@ -1001,7 +1008,7 @@ static void dsi_wait4video_eng_busy(struct msm_dsi_host *msm_host)
        if (!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
                return;
-        if (msm_host->power_on) {
+        if (msm_host->power_on && msm_host->enabled) {
                dsi_wait4video_done(msm_host);
                /* delay 4 ms to skip BLLP */
                usleep_range(2000, 4000);
@@ -2203,7 +2210,7 @@ int msm_dsi_host_enable(struct mipi_dsi_host *host)
         *      pm_runtime_put_autosuspend(&msm_host->pdev->dev);
         * }
         */
+        msm_host->enabled = true;
        return 0;
 }
@@ -2211,6 +2218,7 @@ int msm_dsi_host_disable(struct mipi_dsi_host *host)
 {
        struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+        msm_host->enabled = false;
        dsi_op_mode_config(msm_host,
                !!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO), false);
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
index 8e9d5c255820..9a9fa0c75a13 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
@@ -265,6 +265,115 @@ int msm_dsi_dphy_timing_calc_v2(struct msm_dsi_dphy_timing *timing,
        return 0;
 }
+int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+        struct msm_dsi_phy_clk_request *clk_req)
+{
+        const unsigned long bit_rate = clk_req->bitclk_rate;
+        const unsigned long esc_rate = clk_req->escclk_rate;
+        s32 ui, ui_x8, lpx;
+        s32 tmax, tmin;
+        s32 pcnt0 = 50;
+        s32 pcnt1 = 50;
+        s32 pcnt2 = 10;
+        s32 pcnt3 = 30;
+        s32 pcnt4 = 10;
+        s32 pcnt5 = 2;
+        s32 coeff = 1000; /* Precision, should avoid overflow */
+        s32 hb_en, hb_en_ckln;
+        s32 temp;
+        if (!bit_rate || !esc_rate)
+                return -EINVAL;
+        timing->hs_halfbyte_en = 0;
+        hb_en = 0;
+        timing->hs_halfbyte_en_ckln = 0;
+        hb_en_ckln = 0;
+        ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+        ui_x8 = ui << 3;
+        lpx = mult_frac(NSEC_PER_MSEC, coeff, esc_rate / 1000);
+        temp = S_DIV_ROUND_UP(38 * coeff, ui_x8);
+        tmin = max_t(s32, temp, 0);
+        temp = (95 * coeff) / ui_x8;
+        tmax = max_t(s32, temp, 0);
+        timing->clk_prepare = linear_inter(tmax, tmin, pcnt0, 0, false);
+        temp = 300 * coeff - (timing->clk_prepare << 3) * ui;
+        tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = (tmin > 255) ? 511 : 255;
+        timing->clk_zero = linear_inter(tmax, tmin, pcnt5, 0, false);
+        tmin = DIV_ROUND_UP(60 * coeff + 3 * ui, ui_x8);
+        temp = 105 * coeff + 12 * ui - 20 * coeff;
+        tmax = (temp + 3 * ui) / ui_x8;
+        timing->clk_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+        temp = S_DIV_ROUND_UP(40 * coeff + 4 * ui, ui_x8);
+        tmin = max_t(s32, temp, 0);
+        temp = (85 * coeff + 6 * ui) / ui_x8;
+        tmax = max_t(s32, temp, 0);
+        timing->hs_prepare = linear_inter(tmax, tmin, pcnt1, 0, false);
+        temp = 145 * coeff + 10 * ui - (timing->hs_prepare << 3) * ui;
+        tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = 255;
+        timing->hs_zero = linear_inter(tmax, tmin, pcnt4, 0, false);
+        tmin = DIV_ROUND_UP(60 * coeff + 4 * ui, ui_x8) - 1;
+        temp = 105 * coeff + 12 * ui - 20 * coeff;
+        tmax = (temp / ui_x8) - 1;
+        timing->hs_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+        temp = 50 * coeff + ((hb_en << 2) - 8) * ui;
+        timing->hs_rqst = S_DIV_ROUND_UP(temp, ui_x8);
+        tmin = DIV_ROUND_UP(100 * coeff, ui_x8) - 1;
+        tmax = 255;
+        timing->hs_exit = linear_inter(tmax, tmin, pcnt2, 0, false);
+        temp = 50 * coeff + ((hb_en_ckln << 2) - 8) * ui;
+        timing->hs_rqst_ckln = S_DIV_ROUND_UP(temp, ui_x8);
+        temp = 60 * coeff + 52 * ui - 43 * ui;
+        tmin = DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = 63;
+        timing->shared_timings.clk_post =
+                linear_inter(tmax, tmin, pcnt2, 0, false);
+        temp = 8 * ui + (timing->clk_prepare << 3) * ui;
+        temp += (((timing->clk_zero + 3) << 3) + 11) * ui;
+        temp += hb_en_ckln ? (((timing->hs_rqst_ckln << 3) + 4) * ui) :
+                (((timing->hs_rqst_ckln << 3) + 8) * ui);
+        tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = 63;
+        if (tmin > tmax) {
+                temp = linear_inter(tmax << 1, tmin, pcnt2, 0, false);
+                timing->shared_timings.clk_pre = temp >> 1;
+                timing->shared_timings.clk_pre_inc_by_2 = 1;
+        } else {
+                timing->shared_timings.clk_pre =
+                        linear_inter(tmax, tmin, pcnt2, 0, false);
+                        timing->shared_timings.clk_pre_inc_by_2 = 0;
+        }
+        timing->ta_go = 3;
+        timing->ta_sure = 0;
+        timing->ta_get = 4;
+        DBG("%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d",
+                timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+                timing->shared_timings.clk_pre_inc_by_2, timing->clk_zero,
+                timing->clk_trail, timing->clk_prepare, timing->hs_exit,
+                timing->hs_zero, timing->hs_prepare, timing->hs_trail,
+                timing->hs_rqst, timing->hs_rqst_ckln, timing->hs_halfbyte_en,
+                timing->hs_halfbyte_en_ckln, timing->hs_prep_dly,
+                timing->hs_prep_dly_ckln);
+        return 0;
+}
 void msm_dsi_phy_set_src_pll(struct msm_dsi_phy *phy, int pll_id, u32 reg,
                                u32 bit_mask)
 {
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
index c56268cbdb3d..a24ab80994a3 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
@@ -101,6 +101,8 @@ int msm_dsi_dphy_timing_calc(struct msm_dsi_dphy_timing *timing,
                             struct msm_dsi_phy_clk_request *clk_req);
 int msm_dsi_dphy_timing_calc_v2(struct msm_dsi_dphy_timing *timing,
                                struct msm_dsi_phy_clk_request *clk_req);
+int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+                                struct msm_dsi_phy_clk_request *clk_req);
 void msm_dsi_phy_set_src_pll(struct msm_dsi_phy *phy, int pll_id, u32 reg,
                                u32 bit_mask);
 int msm_dsi_phy_init_common(struct msm_dsi_phy *phy);
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
index 0af951aaeea1..b3fffc8dbb2a 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
@@ -79,34 +79,6 @@ static void dsi_phy_hw_v3_0_lane_settings(struct msm_dsi_phy *phy)
        dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_TX_DCTRL(3), 0x04);
 }
-static int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
-                                       struct msm_dsi_phy_clk_request *clk_req)
-{
-        /*
-         * TODO: These params need to be computed, they're currently hardcoded
-         * for a 1440x2560@60Hz panel with a byteclk of 100.618 Mhz, and a
-         * default escape clock of 19.2 Mhz.
-         */
-        timing->hs_halfbyte_en = 0;
-        timing->clk_zero = 0x1c;
-        timing->clk_prepare = 0x07;
-        timing->clk_trail = 0x07;
-        timing->hs_exit = 0x23;
-        timing->hs_zero = 0x21;
-        timing->hs_prepare = 0x07;
-        timing->hs_trail = 0x07;
-        timing->hs_rqst = 0x05;
-        timing->ta_sure = 0x00;
-        timing->ta_go = 0x03;
-        timing->ta_get = 0x04;
-        timing->shared_timings.clk_pre = 0x2d;
-        timing->shared_timings.clk_post = 0x0d;
-        return 0;
-}
 static int dsi_10nm_phy_enable(struct msm_dsi_phy *phy, int src_pll_id,
                               struct msm_dsi_phy_clk_request *clk_req)
 {
diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c
index 0e0c87252ab0..7a16242bf8bf 100644
--- a/drivers/gpu/drm/msm/msm_fb.c
+++ b/drivers/gpu/drm/msm/msm_fb.c
@@ -183,7 +183,8 @@ static struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev,
        hsub = drm_format_horz_chroma_subsampling(mode_cmd->pixel_format);
        vsub = drm_format_vert_chroma_subsampling(mode_cmd->pixel_format);
-        format = kms->funcs->get_format(kms, mode_cmd->pixel_format);
+        format = kms->funcs->get_format(kms, mode_cmd->pixel_format,
+                        mode_cmd->modifier[0]);
        if (!format) {
                dev_err(dev->dev, "unsupported pixel format: %4.4s\n",
                                (char *)&mode_cmd->pixel_format);
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index c178563fcd4d..456622b46335 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
        if (IS_ERR(fb)) {
                dev_err(dev->dev, "failed to allocate fb\n");
-                ret = PTR_ERR(fb);
+                return PTR_ERR(fb);
-                goto fail;
        }
        bo = msm_framebuffer_bo(fb, 0);
@@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
 fail_unlock:
        mutex_unlock(&dev->struct_mutex);
-fail:
+        drm_framebuffer_remove(fb);
-        if (ret) {
-                if (fb)
-                        drm_framebuffer_remove(fb);
-        }
        return ret;
 }
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 95196479f651..f583bb4222f9 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -132,17 +132,19 @@ static void put_pages(struct drm_gem_object *obj)
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
        if (msm_obj->pages) {
-                /* For non-cached buffers, ensure the new pages are clean
+                if (msm_obj->sgt) {
-                 * because display controller, GPU, etc. are not coherent:
+                        /* For non-cached buffers, ensure the new
-                 */
+                         * pages are clean because display controller,
-                if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+                         * GPU, etc. are not coherent:
-                        dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
+                         */
-                                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+                        if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+                                dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
+                                             msm_obj->sgt->nents,
+                                             DMA_BIDIRECTIONAL);
-                if (msm_obj->sgt)
                        sg_free_table(msm_obj->sgt);
+                        kfree(msm_obj->sgt);
-                kfree(msm_obj->sgt);
+                }
                if (use_pages(obj))
                        drm_gem_put_pages(obj, msm_obj->pages, true, false);
diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
index 17d5824417ad..aaa329dc020e 100644
--- a/drivers/gpu/drm/msm/msm_kms.h
+++ b/drivers/gpu/drm/msm/msm_kms.h
@@ -48,8 +48,11 @@ struct msm_kms_funcs {
        /* functions to wait for atomic commit completed on each CRTC */
        void (*wait_for_crtc_commit_done)(struct msm_kms *kms,
                                        struct drm_crtc *crtc);
+        /* get msm_format w/ optional format modifiers from drm_mode_fb_cmd2 */
+        const struct msm_format *(*get_format)(struct msm_kms *kms,
+                                        const uint32_t format,
+                                        const uint64_t modifiers);
        /* misc: */
-        const struct msm_format *(*get_format)(struct msm_kms *kms, uint32_t format);
        long (*round_pixclk)(struct msm_kms *kms, unsigned long rate,
                        struct drm_encoder *encoder);
        int (*set_split_display)(struct msm_kms *kms,
diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
index c0fb52c6d4ca..01665b98c57e 100644
--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -179,10 +179,9 @@ qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *relea
                              uint32_t type, bool interruptible)
 {
        struct qxl_command cmd;
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
        cmd.type = type;
-        cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
+        cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
        return qxl_ring_push(qdev->command_ring, &cmd, interruptible);
 }
@@ -192,10 +191,9 @@ qxl_push_cursor_ring_release(struct qxl_device *qdev, struct qxl_release *releas
                             uint32_t type, bool interruptible)
 {
        struct qxl_command cmd;
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
        cmd.type = type;
-        cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
+        cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
        return qxl_ring_push(qdev->cursor_ring, &cmd, interruptible);
 }
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
index 00a1a66b052a..864b456080c4 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -167,6 +167,7 @@ struct qxl_release {
        int id;
        int type;
+        struct qxl_bo *release_bo;
        uint32_t release_offset;
        uint32_t surface_release_id;
        struct ww_acquire_ctx ticket;
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index e238a1a2eca1..6cc9f3367fa0 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -182,9 +182,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
                goto out_free_reloc;
        /* TODO copy slow path code from i915 */
-        fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
+        fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_MASK));
        unwritten = __copy_from_user_inatomic_nocache
-                (fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),
+                (fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_MASK),
                 u64_to_user_ptr(cmd->command), cmd->command_size);
        {
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 5d84a66fed36..7cb214577275 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -173,6 +173,7 @@ qxl_release_free_list(struct qxl_release *release)
                list_del(&entry->tv.head);
                kfree(entry);
        }
+        release->release_bo = NULL;
 }
 void
@@ -296,7 +297,6 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
 {
        if (surface_cmd_type == QXL_SURFACE_CMD_DESTROY && create_rel) {
                int idr_ret;
-                struct qxl_bo_list *entry = list_first_entry(&create_rel->bos, struct qxl_bo_list, tv.head);
                struct qxl_bo *bo;
                union qxl_release_info *info;
@@ -304,8 +304,9 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
                idr_ret = qxl_release_alloc(qdev, QXL_RELEASE_SURFACE_CMD, release);
                if (idr_ret < 0)
                        return idr_ret;
-                bo = to_qxl_bo(entry->tv.bo);
+                bo = create_rel->release_bo;
+                (*release)->release_bo = bo;
                (*release)->release_offset = create_rel->release_offset + 64;
                qxl_release_list_add(*release, bo);
@@ -365,6 +366,7 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
        bo = qxl_bo_ref(qdev->current_release_bo[cur_idx]);
+        (*release)->release_bo = bo;
        (*release)->release_offset = qdev->current_release_bo_offset[cur_idx] * release_size_per_bo[cur_idx];
        qdev->current_release_bo_offset[cur_idx]++;
@@ -408,13 +410,12 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
 {
        void *ptr;
        union qxl_release_info *info;
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+        struct qxl_bo *bo = release->release_bo;
-        struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
-        ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_SIZE);
+        ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_MASK);
        if (!ptr)
                return NULL;
-        info = ptr + (release->release_offset & ~PAGE_SIZE);
+        info = ptr + (release->release_offset & ~PAGE_MASK);
        return info;
 }
@@ -422,11 +423,10 @@ void qxl_release_unmap(struct qxl_device *qdev,
                       struct qxl_release *release,
                       union qxl_release_info *info)
 {
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+        struct qxl_bo *bo = release->release_bo;
-        struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
        void *ptr;
-        ptr = ((void *)info) - (release->release_offset & ~PAGE_SIZE);
+        ptr = ((void *)info) - (release->release_offset & ~PAGE_MASK);
        qxl_bo_kunmap_atomic_page(qdev, bo, ptr);
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_lvds.c b/drivers/gpu/drm/sun4i/sun4i_lvds.c
index bffff4c9fbf5..be3f14d7746d 100644
--- a/drivers/gpu/drm/sun4i/sun4i_lvds.c
+++ b/drivers/gpu/drm/sun4i/sun4i_lvds.c
@@ -94,64 +94,9 @@ static void sun4i_lvds_encoder_disable(struct drm_encoder *encoder)
        }
 }
-static enum drm_mode_status sun4i_lvds_encoder_mode_valid(struct drm_encoder *crtc,
-                                                          const struct drm_display_mode *mode)
-{
-        struct sun4i_lvds *lvds = drm_encoder_to_sun4i_lvds(crtc);
-        struct sun4i_tcon *tcon = lvds->tcon;
-        u32 hsync = mode->hsync_end - mode->hsync_start;
-        u32 vsync = mode->vsync_end - mode->vsync_start;
-        unsigned long rate = mode->clock * 1000;
-        long rounded_rate;
-        DRM_DEBUG_DRIVER("Validating modes...\n");
-        if (hsync < 1)
-                return MODE_HSYNC_NARROW;
-        if (hsync > 0x3ff)
-                return MODE_HSYNC_WIDE;
-        if ((mode->hdisplay < 1) || (mode->htotal < 1))
-                return MODE_H_ILLEGAL;
-        if ((mode->hdisplay > 0x7ff) || (mode->htotal > 0xfff))
-                return MODE_BAD_HVALUE;
-        DRM_DEBUG_DRIVER("Horizontal parameters OK\n");
-        if (vsync < 1)
-                return MODE_VSYNC_NARROW;
-        if (vsync > 0x3ff)
-                return MODE_VSYNC_WIDE;
-        if ((mode->vdisplay < 1) || (mode->vtotal < 1))
-                return MODE_V_ILLEGAL;
-        if ((mode->vdisplay > 0x7ff) || (mode->vtotal > 0xfff))
-                return MODE_BAD_VVALUE;
-        DRM_DEBUG_DRIVER("Vertical parameters OK\n");
-        tcon->dclk_min_div = 7;
-        tcon->dclk_max_div = 7;
-        rounded_rate = clk_round_rate(tcon->dclk, rate);
-        if (rounded_rate < rate)
-                return MODE_CLOCK_LOW;
-        if (rounded_rate > rate)
-                return MODE_CLOCK_HIGH;
-        DRM_DEBUG_DRIVER("Clock rate OK\n");
-        return MODE_OK;
-}
 static const struct drm_encoder_helper_funcs sun4i_lvds_enc_helper_funcs = {
        .disable        = sun4i_lvds_encoder_disable,
        .enable         = sun4i_lvds_encoder_enable,
-        .mode_valid     = sun4i_lvds_encoder_mode_valid,
 };
 static const struct drm_encoder_funcs sun4i_lvds_enc_funcs = {
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 48e4f1df6e5d..020070d483d3 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -293,7 +293,7 @@ retry:
        ret = virtqueue_add_sgs(vq, sgs, outcnt, incnt, vbuf, GFP_ATOMIC);
        if (ret == -ENOSPC) {
                spin_unlock(&vgdev->ctrlq.qlock);
-                wait_event(vgdev->ctrlq.ack_queue, vq->num_free);
+                wait_event(vgdev->ctrlq.ack_queue, vq->num_free >= outcnt + incnt);
                spin_lock(&vgdev->ctrlq.qlock);
                goto retry;
        } else {
@@ -368,7 +368,7 @@ retry:
        ret = virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC);
        if (ret == -ENOSPC) {
                spin_unlock(&vgdev->cursorq.qlock);
-                wait_event(vgdev->cursorq.ack_queue, vq->num_free);
+                wait_event(vgdev->cursorq.ack_queue, vq->num_free >= outcnt);
                spin_lock(&vgdev->cursorq.qlock);
                goto retry;
        } else {
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 051a72eecb24..d2cc55e21374 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
 #define PCI_DEVICE_ID_AMD_17H_DF_F3     0x1463
 #endif
+#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
+#define PCI_DEVICE_ID_AMD_17H_RR_NB     0x15d0
+#endif
 /* CPUID function 0x80000001, ebx */
 #define CPUID_PKGTYPE_MASK      0xf0000000
 #define CPUID_PKGTYPE_F         0x00000000
@@ -72,6 +76,7 @@ struct k10temp_data {
        struct pci_dev *pdev;
        void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
        int temp_offset;
+        u32 temp_adjust_mask;
 };
 struct tctl_offset {
@@ -84,6 +89,7 @@ static const struct tctl_offset tctl_offset_table[] = {
        { 0x17, "AMD Ryzen 5 1600X", 20000 },
        { 0x17, "AMD Ryzen 7 1700X", 20000 },
        { 0x17, "AMD Ryzen 7 1800X", 20000 },
+        { 0x17, "AMD Ryzen 7 2700X", 10000 },
        { 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
        { 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
        { 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
@@ -129,6 +135,8 @@ static ssize_t temp1_input_show(struct device *dev,
        data->read_tempreg(data->pdev, &regval);
        temp = (regval >> 21) * 125;
+        if (regval & data->temp_adjust_mask)
+                temp -= 49000;
        if (temp > data->temp_offset)
                temp -= data->temp_offset;
        else
@@ -259,12 +267,14 @@ static int k10temp_probe(struct pci_dev *pdev,
        data->pdev = pdev;
        if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
-                                          boot_cpu_data.x86_model == 0x70))
+                                          boot_cpu_data.x86_model == 0x70)) {
                data->read_tempreg = read_tempreg_nb_f15;
-        else if (boot_cpu_data.x86 == 0x17)
+        } else if (boot_cpu_data.x86 == 0x17) {
+                data->temp_adjust_mask = 0x80000;
                data->read_tempreg = read_tempreg_nb_f17;
-        else
+        } else {
                data->read_tempreg = read_tempreg_pci;
+        }
        for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
                const struct tctl_offset *entry = &tctl_offset_table[i];
@@ -292,6 +302,7 @@ static const struct pci_device_id k10temp_id_table[] = {
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
        {}
 };
 MODULE_DEVICE_TABLE(pci, k10temp_id_table);
diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
index 8b0bc4fc06e8..b0bc77bf2cd9 100644
--- a/drivers/hwmon/nct6683.c
+++ b/drivers/hwmon/nct6683.c
@@ -1380,8 +1380,8 @@ static int __init nct6683_find(int sioaddr, struct nct6683_sio_data *sio_data)
        /* Activate logical device if needed */
        val = superio_inb(sioaddr, SIO_REG_ENABLE);
        if (!(val & 0x01)) {
-                pr_err("EC is disabled\n");
+                pr_warn("Forcibly enabling EC access. Data may be unusable.\n");
-                goto fail;
+                superio_outb(sioaddr, SIO_REG_ENABLE, val | 0x01);
        }
        superio_exit(sioaddr);
diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
index 363bf56eb0f2..91976b6ca300 100644
--- a/drivers/hwmon/scmi-hwmon.c
+++ b/drivers/hwmon/scmi-hwmon.c
@@ -170,7 +170,10 @@ static int scmi_hwmon_probe(struct scmi_device *sdev)
        scmi_chip_info.info = ptr_scmi_ci;
        chip_info = &scmi_chip_info;
-        for (type = 0; type < hwmon_max && nr_count[type]; type++) {
+        for (type = 0; type < hwmon_max; type++) {
+                if (!nr_count[type])
+                        continue;
                scmi_hwmon_add_chan_info(scmi_hwmon_chan, dev, nr_count[type],
                                         type, hwmon_attributes[type]);
                *ptr_scmi_ci++ = scmi_hwmon_chan++;
diff --git a/drivers/memory/emif-asm-offsets.c b/drivers/memory/emif-asm-offsets.c
index 71a89d5d3efd..db8043019ec6 100644
--- a/drivers/memory/emif-asm-offsets.c
+++ b/drivers/memory/emif-asm-offsets.c
@@ -16,77 +16,7 @@
 int main(void)
 {
-        DEFINE(EMIF_SDCFG_VAL_OFFSET,
+        ti_emif_asm_offsets();
-               offsetof(struct emif_regs_amx3, emif_sdcfg_val));
-        DEFINE(EMIF_TIMING1_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing1_val));
-        DEFINE(EMIF_TIMING2_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing2_val));
-        DEFINE(EMIF_TIMING3_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing3_val));
-        DEFINE(EMIF_REF_CTRL_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ref_ctrl_val));
-        DEFINE(EMIF_ZQCFG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_zqcfg_val));
-        DEFINE(EMIF_PMCR_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_pmcr_val));
-        DEFINE(EMIF_PMCR_SHDW_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_pmcr_shdw_val));
-        DEFINE(EMIF_RD_WR_LEVEL_RAMP_CTRL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_rd_wr_level_ramp_ctrl));
-        DEFINE(EMIF_RD_WR_EXEC_THRESH_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_rd_wr_exec_thresh));
-        DEFINE(EMIF_COS_CONFIG_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_cos_config));
-        DEFINE(EMIF_PRIORITY_TO_COS_MAPPING_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_priority_to_cos_mapping));
-        DEFINE(EMIF_CONNECT_ID_SERV_1_MAP_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_connect_id_serv_1_map));
-        DEFINE(EMIF_CONNECT_ID_SERV_2_MAP_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_connect_id_serv_2_map));
-        DEFINE(EMIF_OCP_CONFIG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ocp_config_val));
-        DEFINE(EMIF_LPDDR2_NVM_TIM_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim));
-        DEFINE(EMIF_LPDDR2_NVM_TIM_SHDW_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim_shdw));
-        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val));
-        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_SHDW_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val_shdw));
-        DEFINE(EMIF_DDR_PHY_CTLR_1_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ddr_phy_ctlr_1));
-        DEFINE(EMIF_EXT_PHY_CTRL_VALS_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ext_phy_ctrl_vals));
-        DEFINE(EMIF_REGS_AMX3_SIZE, sizeof(struct emif_regs_amx3));
-        BLANK();
-        DEFINE(EMIF_PM_BASE_ADDR_VIRT_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_virt));
-        DEFINE(EMIF_PM_BASE_ADDR_PHYS_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_phys));
-        DEFINE(EMIF_PM_CONFIG_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_sram_config));
-        DEFINE(EMIF_PM_REGS_VIRT_OFFSET,
-               offsetof(struct ti_emif_pm_data, regs_virt));
-        DEFINE(EMIF_PM_REGS_PHYS_OFFSET,
-               offsetof(struct ti_emif_pm_data, regs_phys));
-        DEFINE(EMIF_PM_DATA_SIZE, sizeof(struct ti_emif_pm_data));
-        BLANK();
-        DEFINE(EMIF_PM_SAVE_CONTEXT_OFFSET,
-               offsetof(struct ti_emif_pm_functions, save_context));
-        DEFINE(EMIF_PM_RESTORE_CONTEXT_OFFSET,
-               offsetof(struct ti_emif_pm_functions, restore_context));
-        DEFINE(EMIF_PM_ENTER_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, enter_sr));
-        DEFINE(EMIF_PM_EXIT_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, exit_sr));
-        DEFINE(EMIF_PM_ABORT_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, abort_sr));
-        DEFINE(EMIF_PM_FUNCTIONS_SIZE, sizeof(struct ti_emif_pm_functions));
        return 0;
 }
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 231f3a1e27bf..86503f60468f 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_driver_template = {
        .cmd_per_lun                    = 7,
        .use_clustering                 = ENABLE_CLUSTERING,
        .shost_attrs                    = mptscsih_host_attrs,
+        .no_write_same                  = 1,
 };
 static int mptsas_get_linkerrors(struct sas_phy *phy)
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index d4c07b85f18e..f5695be14499 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -45,6 +45,7 @@
 #define I82802AB        0x00ad
 #define I82802AC        0x00ac
 #define PF38F4476       0x881c
+#define M28F00AP30      0x8963
 /* STMicroelectronics chips */
 #define M50LPW080       0x002F
 #define M50FLW080A      0x0080
@@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi,
                extp->MinorVersion = '1';
 }
+static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
+{
+        /*
+         * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
+         * Erase Supend for their small Erase Blocks(0x8000)
+         */
+        if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
+                return 1;
+        return 0;
+}
 static inline struct cfi_pri_intelext *
 read_pri_intelext(struct map_info *map, __u16 adr)
 {
@@ -831,21 +843,30 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
                     (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
                        goto sleep;
+                /* Do not allow suspend iff read/write to EB address */
+                if ((adr & chip->in_progress_block_mask) ==
+                    chip->in_progress_block_addr)
+                        goto sleep;
+                /* do not suspend small EBs, buggy Micron Chips */
+                if (cfi_is_micron_28F00AP30(cfi, chip) &&
+                    (chip->in_progress_block_mask == ~(0x8000-1)))
+                        goto sleep;
                /* Erase suspend */
-                map_write(map, CMD(0xB0), adr);
+                map_write(map, CMD(0xB0), chip->in_progress_block_addr);
                /* If the flash has finished erasing, then 'erase suspend'
                 * appears to make some (28F320) flash devices switch to
                 * 'read' mode.  Make sure that we switch to 'read status'
                 * mode so we get the right data. --rmk
                 */
-                map_write(map, CMD(0x70), adr);
+                map_write(map, CMD(0x70), chip->in_progress_block_addr);
                chip->oldstate = FL_ERASING;
                chip->state = FL_ERASE_SUSPENDING;
                chip->erase_suspended = 1;
                for (;;) {
-                        status = map_read(map, adr);
+                        status = map_read(map, chip->in_progress_block_addr);
                        if (map_word_andequal(map, status, status_OK, status_OK))
                                break;
@@ -1041,8 +1062,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
                   sending the 0x70 (Read Status) command to an erasing
                   chip and expecting it to be ignored, that's what we
                   do. */
-                map_write(map, CMD(0xd0), adr);
+                map_write(map, CMD(0xd0), chip->in_progress_block_addr);
-                map_write(map, CMD(0x70), adr);
+                map_write(map, CMD(0x70), chip->in_progress_block_addr);
                chip->oldstate = FL_READY;
                chip->state = FL_ERASING;
                break;
@@ -1933,6 +1954,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
        map_write(map, CMD(0xD0), adr);
        chip->state = FL_ERASING;
        chip->erase_suspended = 0;
+        chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(len - 1);
        ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                   adr, len,
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 668e2cbc155b..692902df2598 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -816,9 +816,10 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
                        goto sleep;
-                /* We could check to see if we're trying to access the sector
+                /* Do not allow suspend iff read/write to EB address */
-                 * that is currently being erased. However, no user will try
+                if ((adr & chip->in_progress_block_mask) ==
-                 * anything like that so we just wait for the timeout. */
+                    chip->in_progress_block_addr)
+                        goto sleep;
                /* Erase suspend */
                /* It's harmless to issue the Erase-Suspend and Erase-Resume
@@ -2267,6 +2268,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
        chip->state = FL_ERASING;
        chip->erase_suspended = 0;
        chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(map->size - 1);
        INVALIDATE_CACHE_UDELAY(map, chip,
                                adr, map->size,
@@ -2356,6 +2358,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
        chip->state = FL_ERASING;
        chip->erase_suspended = 0;
        chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(len - 1);
        INVALIDATE_CACHE_UDELAY(map, chip,
                                adr, len,
diff --git a/drivers/mtd/nand/core.c b/drivers/mtd/nand/core.c
index d0cd6f8635d7..9c9f8936b63b 100644
--- a/drivers/mtd/nand/core.c
+++ b/drivers/mtd/nand/core.c
@@ -162,7 +162,6 @@ int nanddev_mtd_erase(struct mtd_info *mtd, struct erase_info *einfo)
                ret = nanddev_erase(nand, &pos);
                if (ret) {
                        einfo->fail_addr = nanddev_pos_to_offs(nand, &pos);
-                        einfo->state = MTD_ERASE_FAILED;
                        return ret;
                }
@@ -170,8 +169,6 @@ int nanddev_mtd_erase(struct mtd_info *mtd, struct erase_info *einfo)
                nanddev_pos_next_eraseblock(nand, &pos);
        }
-        einfo->state = MTD_ERASE_DONE;
        return 0;
 }
 EXPORT_SYMBOL_GPL(nanddev_mtd_erase);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 10e953218948..1d779a35ac8e 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2299,29 +2299,20 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
        /*
         * The legacy "num-cs" property indicates the number of CS on the only
         * chip connected to the controller (legacy bindings does not support
-         * more than one chip). CS are only incremented one by one while the RB
+         * more than one chip). The CS and RB pins are always the #0.
-         * pin is always the #0.
         *
         * When not using legacy bindings, a couple of "reg" and "nand-rb"
         * properties must be filled. For each chip, expressed as a subnode,
         * "reg" points to the CS lines and "nand-rb" to the RB line.
         */
-        if (pdata) {
+        if (pdata || nfc->caps->legacy_of_bindings) {
                nsels = 1;
-        } else if (nfc->caps->legacy_of_bindings &&
+        } else {
-                   !of_get_property(np, "num-cs", &nsels)) {
+                nsels = of_property_count_elems_of_size(np, "reg", sizeof(u32));
-                dev_err(dev, "missing num-cs property\n");
+                if (nsels <= 0) {
-                return -EINVAL;
+                        dev_err(dev, "missing/invalid reg property\n");
-        } else if (!of_get_property(np, "reg", &nsels)) {
+                        return -EINVAL;
-                dev_err(dev, "missing reg property\n");
+                }
-                return -EINVAL;
-        }
-        if (!pdata)
-                nsels /= sizeof(u32);
-        if (!nsels) {
-                dev_err(dev, "invalid reg property size\n");
-                return -EINVAL;
        }
        /* Alloc the nand chip structure */
diff --git a/drivers/mtd/nand/raw/tango_nand.c b/drivers/mtd/nand/raw/tango_nand.c
index f54518ffb36a..f2052fae21c7 100644
--- a/drivers/mtd/nand/raw/tango_nand.c
+++ b/drivers/mtd/nand/raw/tango_nand.c
@@ -645,7 +645,7 @@ static int tango_nand_probe(struct platform_device *pdev)
        writel_relaxed(MODE_RAW, nfc->pbus_base + PBUS_PAD_MODE);
-        clk = clk_get(&pdev->dev, NULL);
+        clk = devm_clk_get(&pdev->dev, NULL);
        if (IS_ERR(clk))
                return PTR_ERR(clk);
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index 4b8e9183489a..5872f31eaa60 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -501,7 +501,9 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, u8 *rxbuf,
        void __iomem *reg_base = cqspi->iobase;
        void __iomem *ahb_base = cqspi->ahb_base;
        unsigned int remaining = n_rx;
+        unsigned int mod_bytes = n_rx % 4;
        unsigned int bytes_to_read = 0;
+        u8 *rxbuf_end = rxbuf + n_rx;
        int ret = 0;
        writel(from_addr, reg_base + CQSPI_REG_INDIRECTRDSTARTADDR);
@@ -530,11 +532,24 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, u8 *rxbuf,
                }
                while (bytes_to_read != 0) {
+                        unsigned int word_remain = round_down(remaining, 4);
                        bytes_to_read *= cqspi->fifo_width;
                        bytes_to_read = bytes_to_read > remaining ?
                                        remaining : bytes_to_read;
-                        ioread32_rep(ahb_base, rxbuf,
+                        bytes_to_read = round_down(bytes_to_read, 4);
-                                     DIV_ROUND_UP(bytes_to_read, 4));
+                        /* Read 4 byte word chunks then single bytes */
+                        if (bytes_to_read) {
+                                ioread32_rep(ahb_base, rxbuf,
+                                             (bytes_to_read / 4));
+                        } else if (!word_remain && mod_bytes) {
+                                unsigned int temp = ioread32(ahb_base);
+                                bytes_to_read = mod_bytes;
+                                memcpy(rxbuf, &temp, min((unsigned int)
+                                                         (rxbuf_end - rxbuf),
+                                                         bytes_to_read));
+                        }
                        rxbuf += bytes_to_read;
                        remaining -= bytes_to_read;
                        bytes_to_read = cqspi_get_rd_sram_level(cqspi);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b7b113018853..718e4914e3a0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1660,8 +1660,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
        } /* switch(bond_mode) */
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        slave_dev->npinfo = bond->dev->npinfo;
+        if (bond->dev->npinfo) {
-        if (slave_dev->npinfo) {
                if (slave_enable_netpoll(new_slave)) {
                        netdev_info(bond_dev, "master_dev is using netpoll, but new slave device does not support netpoll\n");
                        res = -EBUSY;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 7ea72ef11a55..d272dc6984ac 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -1321,6 +1321,10 @@
 #define MDIO_VEND2_AN_STAT              0x8002
 #endif
+#ifndef MDIO_VEND2_PMA_CDR_CONTROL
+#define MDIO_VEND2_PMA_CDR_CONTROL      0x8056
+#endif
 #ifndef MDIO_CTRL1_SPEED1G
 #define MDIO_CTRL1_SPEED1G              (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
 #endif
@@ -1369,6 +1373,10 @@
 #define XGBE_AN_CL37_TX_CONFIG_MASK     0x08
 #define XGBE_AN_CL37_MII_CTRL_8BIT      0x0100
+#define XGBE_PMA_CDR_TRACK_EN_MASK      0x01
+#define XGBE_PMA_CDR_TRACK_EN_OFF       0x00
+#define XGBE_PMA_CDR_TRACK_EN_ON        0x01
 /* Bit setting and getting macros
 *  The get macro will extract the current bit field value from within
 *  the variable
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
index 7d128be61310..b91143947ed2 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
@@ -519,6 +519,22 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata)
                                   "debugfs_create_file failed\n");
        }
+        if (pdata->vdata->an_cdr_workaround) {
+                pfile = debugfs_create_bool("an_cdr_workaround", 0600,
+                                            pdata->xgbe_debugfs,
+                                            &pdata->debugfs_an_cdr_workaround);
+                if (!pfile)
+                        netdev_err(pdata->netdev,
+                                   "debugfs_create_bool failed\n");
+                pfile = debugfs_create_bool("an_cdr_track_early", 0600,
+                                            pdata->xgbe_debugfs,
+                                            &pdata->debugfs_an_cdr_track_early);
+                if (!pfile)
+                        netdev_err(pdata->netdev,
+                                   "debugfs_create_bool failed\n");
+        }
        kfree(buf);
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index 795e556d4a3f..441d0973957b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -349,6 +349,7 @@ int xgbe_config_netdev(struct xgbe_prv_data *pdata)
        XGMAC_SET_BITS(pdata->rss_options, MAC_RSSCR, UDP4TE, 1);
        /* Call MDIO/PHY initialization routine */
+        pdata->debugfs_an_cdr_workaround = pdata->vdata->an_cdr_workaround;
        ret = pdata->phy_if.phy_init(pdata);
        if (ret)
                return ret;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 072b9f664597..1b45cd73a258 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -432,11 +432,16 @@ static void xgbe_an73_disable(struct xgbe_prv_data *pdata)
        xgbe_an73_set(pdata, false, false);
        xgbe_an73_disable_interrupts(pdata);
+        pdata->an_start = 0;
        netif_dbg(pdata, link, pdata->netdev, "CL73 AN disabled\n");
 }
 static void xgbe_an_restart(struct xgbe_prv_data *pdata)
 {
+        if (pdata->phy_if.phy_impl.an_pre)
+                pdata->phy_if.phy_impl.an_pre(pdata);
        switch (pdata->an_mode) {
        case XGBE_AN_MODE_CL73:
        case XGBE_AN_MODE_CL73_REDRV:
@@ -453,6 +458,9 @@ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
 static void xgbe_an_disable(struct xgbe_prv_data *pdata)
 {
+        if (pdata->phy_if.phy_impl.an_post)
+                pdata->phy_if.phy_impl.an_post(pdata);
        switch (pdata->an_mode) {
        case XGBE_AN_MODE_CL73:
        case XGBE_AN_MODE_CL73_REDRV:
@@ -505,11 +513,11 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata,
                XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL,
                            reg);
-                if (pdata->phy_if.phy_impl.kr_training_post)
-                        pdata->phy_if.phy_impl.kr_training_post(pdata);
                netif_dbg(pdata, link, pdata->netdev,
                          "KR training initiated\n");
+                if (pdata->phy_if.phy_impl.kr_training_post)
+                        pdata->phy_if.phy_impl.kr_training_post(pdata);
        }
        return XGBE_AN_PAGE_RECEIVED;
@@ -637,11 +645,11 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)
                        return XGBE_AN_NO_LINK;
        }
-        xgbe_an73_disable(pdata);
+        xgbe_an_disable(pdata);
        xgbe_switch_mode(pdata);
-        xgbe_an73_restart(pdata);
+        xgbe_an_restart(pdata);
        return XGBE_AN_INCOMPAT_LINK;
 }
@@ -820,6 +828,9 @@ static void xgbe_an37_state_machine(struct xgbe_prv_data *pdata)
                pdata->an_result = pdata->an_state;
                pdata->an_state = XGBE_AN_READY;
+                if (pdata->phy_if.phy_impl.an_post)
+                        pdata->phy_if.phy_impl.an_post(pdata);
                netif_dbg(pdata, link, pdata->netdev, "CL37 AN result: %s\n",
                          xgbe_state_as_string(pdata->an_result));
        }
@@ -903,6 +914,9 @@ again:
                pdata->kx_state = XGBE_RX_BPA;
                pdata->an_start = 0;
+                if (pdata->phy_if.phy_impl.an_post)
+                        pdata->phy_if.phy_impl.an_post(pdata);
                netif_dbg(pdata, link, pdata->netdev, "CL73 AN result: %s\n",
                          xgbe_state_as_string(pdata->an_result));
        }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
index eb23f9ba1a9a..82d1f416ee2a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
@@ -456,6 +456,7 @@ static const struct xgbe_version_data xgbe_v2a = {
        .irq_reissue_support            = 1,
        .tx_desc_prefetch               = 5,
        .rx_desc_prefetch               = 5,
+        .an_cdr_workaround              = 1,
 };
 static const struct xgbe_version_data xgbe_v2b = {
@@ -470,6 +471,7 @@ static const struct xgbe_version_data xgbe_v2b = {
        .irq_reissue_support            = 1,
        .tx_desc_prefetch               = 5,
        .rx_desc_prefetch               = 5,
+        .an_cdr_workaround              = 1,
 };
 static const struct pci_device_id xgbe_pci_table[] = {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index 3304a291aa96..aac884314000 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -147,6 +147,14 @@
 /* Rate-change complete wait/retry count */
 #define XGBE_RATECHANGE_COUNT           500
+/* CDR delay values for KR support (in usec) */
+#define XGBE_CDR_DELAY_INIT             10000
+#define XGBE_CDR_DELAY_INC              10000
+#define XGBE_CDR_DELAY_MAX              100000
+/* RRC frequency during link status check */
+#define XGBE_RRC_FREQUENCY              10
 enum xgbe_port_mode {
        XGBE_PORT_MODE_RSVD = 0,
        XGBE_PORT_MODE_BACKPLANE,
@@ -245,6 +253,10 @@ enum xgbe_sfp_speed {
 #define XGBE_SFP_BASE_VENDOR_SN                 4
 #define XGBE_SFP_BASE_VENDOR_SN_LEN             16
+#define XGBE_SFP_EXTD_OPT1                      1
+#define XGBE_SFP_EXTD_OPT1_RX_LOS               BIT(1)
+#define XGBE_SFP_EXTD_OPT1_TX_FAULT             BIT(3)
 #define XGBE_SFP_EXTD_DIAG                      28
 #define XGBE_SFP_EXTD_DIAG_ADDR_CHANGE          BIT(2)
@@ -324,6 +336,7 @@ struct xgbe_phy_data {
        unsigned int sfp_gpio_address;
        unsigned int sfp_gpio_mask;
+        unsigned int sfp_gpio_inputs;
        unsigned int sfp_gpio_rx_los;
        unsigned int sfp_gpio_tx_fault;
        unsigned int sfp_gpio_mod_absent;
@@ -355,6 +368,10 @@ struct xgbe_phy_data {
        unsigned int redrv_addr;
        unsigned int redrv_lane;
        unsigned int redrv_model;
+        /* KR AN support */
+        unsigned int phy_cdr_notrack;
+        unsigned int phy_cdr_delay;
 };
 /* I2C, MDIO and GPIO lines are muxed, so only one device at a time */
@@ -974,6 +991,49 @@ static void xgbe_phy_sfp_external_phy(struct xgbe_prv_data *pdata)
        phy_data->sfp_phy_avail = 1;
 }
+static bool xgbe_phy_check_sfp_rx_los(struct xgbe_phy_data *phy_data)
+{
+        u8 *sfp_extd = phy_data->sfp_eeprom.extd;
+        if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_RX_LOS))
+                return false;
+        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS)
+                return false;
+        if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_rx_los))
+                return true;
+        return false;
+}
+static bool xgbe_phy_check_sfp_tx_fault(struct xgbe_phy_data *phy_data)
+{
+        u8 *sfp_extd = phy_data->sfp_eeprom.extd;
+        if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_TX_FAULT))
+                return false;
+        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT)
+                return false;
+        if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_tx_fault))
+                return true;
+        return false;
+}
+static bool xgbe_phy_check_sfp_mod_absent(struct xgbe_phy_data *phy_data)
+{
+        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT)
+                return false;
+        if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_mod_absent))
+                return true;
+        return false;
+}
 static bool xgbe_phy_belfuse_parse_quirks(struct xgbe_prv_data *pdata)
 {
        struct xgbe_phy_data *phy_data = pdata->phy_data;
@@ -1019,6 +1079,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
        if (sfp_base[XGBE_SFP_BASE_EXT_ID] != XGBE_SFP_EXT_ID_SFP)
                return;
+        /* Update transceiver signals (eeprom extd/options) */
+        phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data);
+        phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data);
        if (xgbe_phy_sfp_parse_quirks(pdata))
                return;
@@ -1184,7 +1248,6 @@ put:
 static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
 {
        struct xgbe_phy_data *phy_data = pdata->phy_data;
-        unsigned int gpio_input;
        u8 gpio_reg, gpio_ports[2];
        int ret;
@@ -1199,23 +1262,9 @@ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
                return;
        }
-        gpio_input = (gpio_ports[1] << 8) | gpio_ports[0];
+        phy_data->sfp_gpio_inputs = (gpio_ports[1] << 8) | gpio_ports[0];
-        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) {
-                /* No GPIO, just assume the module is present for now */
-                phy_data->sfp_mod_absent = 0;
-        } else {
-                if (!(gpio_input & (1 << phy_data->sfp_gpio_mod_absent)))
-                        phy_data->sfp_mod_absent = 0;
-        }
-        if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) &&
-            (gpio_input & (1 << phy_data->sfp_gpio_rx_los)))
-                phy_data->sfp_rx_los = 1;
-        if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) &&
+        phy_data->sfp_mod_absent = xgbe_phy_check_sfp_mod_absent(phy_data);
-            (gpio_input & (1 << phy_data->sfp_gpio_tx_fault)))
-                phy_data->sfp_tx_fault = 1;
 }
 static void xgbe_phy_sfp_mod_absent(struct xgbe_prv_data *pdata)
@@ -2361,7 +2410,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
                return 1;
        /* No link, attempt a receiver reset cycle */
-        if (phy_data->rrc_count++) {
+        if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
                phy_data->rrc_count = 0;
                xgbe_phy_rrc(pdata);
        }
@@ -2669,6 +2718,103 @@ static bool xgbe_phy_port_enabled(struct xgbe_prv_data *pdata)
        return true;
 }
+static void xgbe_phy_cdr_track(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+        if (!pdata->debugfs_an_cdr_workaround)
+                return;
+        if (!phy_data->phy_cdr_notrack)
+                return;
+        usleep_range(phy_data->phy_cdr_delay,
+                     phy_data->phy_cdr_delay + 500);
+        XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
+                         XGBE_PMA_CDR_TRACK_EN_MASK,
+                         XGBE_PMA_CDR_TRACK_EN_ON);
+        phy_data->phy_cdr_notrack = 0;
+}
+static void xgbe_phy_cdr_notrack(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+        if (!pdata->debugfs_an_cdr_workaround)
+                return;
+        if (phy_data->phy_cdr_notrack)
+                return;
+        XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
+                         XGBE_PMA_CDR_TRACK_EN_MASK,
+                         XGBE_PMA_CDR_TRACK_EN_OFF);
+        xgbe_phy_rrc(pdata);
+        phy_data->phy_cdr_notrack = 1;
+}
+static void xgbe_phy_kr_training_post(struct xgbe_prv_data *pdata)
+{
+        if (!pdata->debugfs_an_cdr_track_early)
+                xgbe_phy_cdr_track(pdata);
+}
+static void xgbe_phy_kr_training_pre(struct xgbe_prv_data *pdata)
+{
+        if (pdata->debugfs_an_cdr_track_early)
+                xgbe_phy_cdr_track(pdata);
+}
+static void xgbe_phy_an_post(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+        switch (pdata->an_mode) {
+        case XGBE_AN_MODE_CL73:
+        case XGBE_AN_MODE_CL73_REDRV:
+                if (phy_data->cur_mode != XGBE_MODE_KR)
+                        break;
+                xgbe_phy_cdr_track(pdata);
+                switch (pdata->an_result) {
+                case XGBE_AN_READY:
+                case XGBE_AN_COMPLETE:
+                        break;
+                default:
+                        if (phy_data->phy_cdr_delay < XGBE_CDR_DELAY_MAX)
+                                phy_data->phy_cdr_delay += XGBE_CDR_DELAY_INC;
+                        else
+                                phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+}
+static void xgbe_phy_an_pre(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+        switch (pdata->an_mode) {
+        case XGBE_AN_MODE_CL73:
+        case XGBE_AN_MODE_CL73_REDRV:
+                if (phy_data->cur_mode != XGBE_MODE_KR)
+                        break;
+                xgbe_phy_cdr_notrack(pdata);
+                break;
+        default:
+                break;
+        }
+}
 static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
 {
        struct xgbe_phy_data *phy_data = pdata->phy_data;
@@ -2680,6 +2826,9 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
        xgbe_phy_sfp_reset(phy_data);
        xgbe_phy_sfp_mod_absent(pdata);
+        /* Reset CDR support */
+        xgbe_phy_cdr_track(pdata);
        /* Power off the PHY */
        xgbe_phy_power_off(pdata);
@@ -2712,6 +2861,9 @@ static int xgbe_phy_start(struct xgbe_prv_data *pdata)
        /* Start in highest supported mode */
        xgbe_phy_set_mode(pdata, phy_data->start_mode);
+        /* Reset CDR support */
+        xgbe_phy_cdr_track(pdata);
        /* After starting the I2C controller, we can check for an SFP */
        switch (phy_data->port_mode) {
        case XGBE_PORT_MODE_SFP:
@@ -3019,6 +3171,8 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
                }
        }
+        phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
        /* Register for driving external PHYs */
        mii = devm_mdiobus_alloc(pdata->dev);
        if (!mii) {
@@ -3071,4 +3225,10 @@ void xgbe_init_function_ptrs_phy_v2(struct xgbe_phy_if *phy_if)
        phy_impl->an_advertising        = xgbe_phy_an_advertising;
        phy_impl->an_outcome            = xgbe_phy_an_outcome;
+        phy_impl->an_pre                = xgbe_phy_an_pre;
+        phy_impl->an_post               = xgbe_phy_an_post;
+        phy_impl->kr_training_pre       = xgbe_phy_kr_training_pre;
+        phy_impl->kr_training_post      = xgbe_phy_kr_training_post;
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index ad102c8bac7b..95d4b56448c6 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -833,6 +833,7 @@ struct xgbe_hw_if {
 /* This structure represents implementation specific routines for an
 * implementation of a PHY. All routines are required unless noted below.
 *   Optional routines:
+ *     an_pre, an_post
 *     kr_training_pre, kr_training_post
 */
 struct xgbe_phy_impl_if {
@@ -875,6 +876,10 @@ struct xgbe_phy_impl_if {
        /* Process results of auto-negotiation */
        enum xgbe_mode (*an_outcome)(struct xgbe_prv_data *);
+        /* Pre/Post auto-negotiation support */
+        void (*an_pre)(struct xgbe_prv_data *);
+        void (*an_post)(struct xgbe_prv_data *);
        /* Pre/Post KR training enablement support */
        void (*kr_training_pre)(struct xgbe_prv_data *);
        void (*kr_training_post)(struct xgbe_prv_data *);
@@ -989,6 +994,7 @@ struct xgbe_version_data {
        unsigned int irq_reissue_support;
        unsigned int tx_desc_prefetch;
        unsigned int rx_desc_prefetch;
+        unsigned int an_cdr_workaround;
 };
 struct xgbe_vxlan_data {
@@ -1257,6 +1263,9 @@ struct xgbe_prv_data {
        unsigned int debugfs_xprop_reg;
        unsigned int debugfs_xi2c_reg;
+        bool debugfs_an_cdr_workaround;
+        bool debugfs_an_cdr_track_early;
 };
 /* Function prototypes*/
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 2df01ad98df7..6e8d6a6f6aaf 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1128,7 +1128,7 @@ static void clean_rx_pools(struct ibmvnic_adapter *adapter)
        if (!adapter->rx_pool)
                return;
-        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
+        rx_scrqs = adapter->num_active_rx_pools;
        rx_entries = adapter->req_rx_add_entries_per_subcrq;
        /* Free any remaining skbs in the rx buffer pools */
@@ -1177,7 +1177,7 @@ static void clean_tx_pools(struct ibmvnic_adapter *adapter)
        if (!adapter->tx_pool || !adapter->tso_pool)
                return;
-        tx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_txsubm_subcrqs);
+        tx_scrqs = adapter->num_active_tx_pools;
        /* Free any remaining skbs in the tx buffer pools */
        for (i = 0; i < tx_scrqs; i++) {
diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
index 5b13ca1bd85f..7dc5f045e969 100644
--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
@@ -586,7 +586,7 @@ struct ice_sw_rule_lg_act {
 #define ICE_LG_ACT_MIRROR_VSI_ID_S      3
 #define ICE_LG_ACT_MIRROR_VSI_ID_M      (0x3FF << ICE_LG_ACT_MIRROR_VSI_ID_S)
-        /* Action type = 5 - Large Action */
+        /* Action type = 5 - Generic Value */
 #define ICE_LG_ACT_GENERIC              0x5
 #define ICE_LG_ACT_GENERIC_VALUE_S      3
 #define ICE_LG_ACT_GENERIC_VALUE_M      (0xFFFF << ICE_LG_ACT_GENERIC_VALUE_S)
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 21977ec984c4..71d032cc5fa7 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -78,6 +78,7 @@ ice_aq_manage_mac_read(struct ice_hw *hw, void *buf, u16 buf_size,
        struct ice_aq_desc desc;
        enum ice_status status;
        u16 flags;
+        u8 i;
        cmd = &desc.params.mac_read;
@@ -98,8 +99,16 @@ ice_aq_manage_mac_read(struct ice_hw *hw, void *buf, u16 buf_size,
                return ICE_ERR_CFG;
        }
-        ether_addr_copy(hw->port_info->mac.lan_addr, resp->mac_addr);
+        /* A single port can report up to two (LAN and WoL) addresses */
-        ether_addr_copy(hw->port_info->mac.perm_addr, resp->mac_addr);
+        for (i = 0; i < cmd->num_addr; i++)
+                if (resp[i].addr_type == ICE_AQC_MAN_MAC_ADDR_TYPE_LAN) {
+                        ether_addr_copy(hw->port_info->mac.lan_addr,
+                                        resp[i].mac_addr);
+                        ether_addr_copy(hw->port_info->mac.perm_addr,
+                                        resp[i].mac_addr);
+                        break;
+                }
        return 0;
 }
@@ -464,9 +473,12 @@ enum ice_status ice_init_hw(struct ice_hw *hw)
        if (status)
                goto err_unroll_sched;
-        /* Get port MAC information */
+        /* Get MAC information */
-        mac_buf_len = sizeof(struct ice_aqc_manage_mac_read_resp);
+        /* A single port can report up to two (LAN and WoL) addresses */
-        mac_buf = devm_kzalloc(ice_hw_to_dev(hw), mac_buf_len, GFP_KERNEL);
+        mac_buf = devm_kcalloc(ice_hw_to_dev(hw), 2,
+                               sizeof(struct ice_aqc_manage_mac_read_resp),
+                               GFP_KERNEL);
+        mac_buf_len = 2 * sizeof(struct ice_aqc_manage_mac_read_resp);
        if (!mac_buf) {
                status = ICE_ERR_NO_MEMORY;
diff --git a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
index 1b9e2ef48a9d..499904874b3f 100644
--- a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
+++ b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
@@ -121,8 +121,6 @@
 #define PFINT_FW_CTL_CAUSE_ENA_S        30
 #define PFINT_FW_CTL_CAUSE_ENA_M        BIT(PFINT_FW_CTL_CAUSE_ENA_S)
 #define PFINT_OICR                      0x0016CA00
-#define PFINT_OICR_INTEVENT_S           0
-#define PFINT_OICR_INTEVENT_M           BIT(PFINT_OICR_INTEVENT_S)
 #define PFINT_OICR_HLP_RDY_S            14
 #define PFINT_OICR_HLP_RDY_M            BIT(PFINT_OICR_HLP_RDY_S)
 #define PFINT_OICR_CPM_RDY_S            15
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 210b7910f1cd..5299caf55a7f 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -1722,9 +1722,6 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
        oicr = rd32(hw, PFINT_OICR);
        ena_mask = rd32(hw, PFINT_OICR_ENA);
-        if (!(oicr & PFINT_OICR_INTEVENT_M))
-                goto ena_intr;
        if (oicr & PFINT_OICR_GRST_M) {
                u32 reset;
                /* we have a reset warning */
@@ -1782,7 +1779,6 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
        }
        ret = IRQ_HANDLED;
-ena_intr:
        /* re-enable interrupt causes that are not handled during this pass */
        wr32(hw, PFINT_OICR_ENA, ena_mask);
        if (!test_bit(__ICE_DOWN, pf->state)) {
diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index f16ff3e4a840..2e6c1d92cc88 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -751,14 +751,14 @@ ice_sched_add_nodes_to_layer(struct ice_port_info *pi,
        u16 num_added = 0;
        u32 temp;
+        *num_nodes_added = 0;
        if (!num_nodes)
                return status;
        if (!parent || layer < hw->sw_entry_point_layer)
                return ICE_ERR_PARAM;
-        *num_nodes_added = 0;
        /* max children per node per layer */
        max_child_nodes =
            le16_to_cpu(hw->layer_info[parent->tx_sched_layer].max_children);
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index c1c0bc30a16d..cce7ada89255 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1700,7 +1700,22 @@ static void igb_configure_cbs(struct igb_adapter *adapter, int queue,
        WARN_ON(hw->mac.type != e1000_i210);
        WARN_ON(queue < 0 || queue > 1);
-        if (enable) {
+        if (enable || queue == 0) {
+                /* i210 does not allow the queue 0 to be in the Strict
+                 * Priority mode while the Qav mode is enabled, so,
+                 * instead of disabling strict priority mode, we give
+                 * queue 0 the maximum of credits possible.
+                 *
+                 * See section 8.12.19 of the i210 datasheet, "Note:
+                 * Queue0 QueueMode must be set to 1b when
+                 * TransmitMode is set to Qav."
+                 */
+                if (queue == 0 && !enable) {
+                        /* max "linkspeed" idleslope in kbps */
+                        idleslope = 1000000;
+                        hicredit = ETH_FRAME_LEN;
+                }
                set_tx_desc_fetch_prio(hw, queue, TX_QUEUE_PRIO_HIGH);
                set_queue_mode(hw, queue, QUEUE_MODE_STREAM_RESERVATION);
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 3d9033f26eff..e3d04f226d57 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -3420,7 +3420,7 @@ static int ixgbevf_setup_all_tx_resources(struct ixgbevf_adapter *adapter)
                if (!err)
                        continue;
                hw_dbg(&adapter->hw, "Allocation for XDP Queue %u failed\n", j);
-                break;
+                goto err_setup_tx;
        }
        return 0;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 83ce229f4eb7..63036d9bf3e6 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -3999,29 +3999,6 @@ static void efx_ef10_prepare_flr(struct efx_nic *efx)
        atomic_set(&efx->active_queues, 0);
 }
-static bool efx_ef10_filter_equal(const struct efx_filter_spec *left,
-                                  const struct efx_filter_spec *right)
-{
-        if ((left->match_flags ^ right->match_flags) |
-            ((left->flags ^ right->flags) &
-             (EFX_FILTER_FLAG_RX | EFX_FILTER_FLAG_TX)))
-                return false;
-        return memcmp(&left->outer_vid, &right->outer_vid,
-                      sizeof(struct efx_filter_spec) -
-                      offsetof(struct efx_filter_spec, outer_vid)) == 0;
-}
-static unsigned int efx_ef10_filter_hash(const struct efx_filter_spec *spec)
-{
-        BUILD_BUG_ON(offsetof(struct efx_filter_spec, outer_vid) & 3);
-        return jhash2((const u32 *)&spec->outer_vid,
-                      (sizeof(struct efx_filter_spec) -
-                       offsetof(struct efx_filter_spec, outer_vid)) / 4,
-                      0);
-        /* XXX should we randomise the initval? */
-}
 /* Decide whether a filter should be exclusive or else should allow
 * delivery to additional recipients.  Currently we decide that
 * filters for specific local unicast MAC and IP addresses are
@@ -4346,7 +4323,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
                goto out_unlock;
        match_pri = rc;
-        hash = efx_ef10_filter_hash(spec);
+        hash = efx_filter_spec_hash(spec);
        is_mc_recip = efx_filter_is_mc_recipient(spec);
        if (is_mc_recip)
                bitmap_zero(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
@@ -4378,7 +4355,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
                if (!saved_spec) {
                        if (ins_index < 0)
                                ins_index = i;
-                } else if (efx_ef10_filter_equal(spec, saved_spec)) {
+                } else if (efx_filter_spec_equal(spec, saved_spec)) {
                        if (spec->priority < saved_spec->priority &&
                            spec->priority != EFX_FILTER_PRI_AUTO) {
                                rc = -EPERM;
@@ -4762,27 +4739,62 @@ static s32 efx_ef10_filter_get_rx_ids(struct efx_nic *efx,
 static bool efx_ef10_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
                                           unsigned int filter_idx)
 {
+        struct efx_filter_spec *spec, saved_spec;
        struct efx_ef10_filter_table *table;
-        struct efx_filter_spec *spec;
+        struct efx_arfs_rule *rule = NULL;
-        bool ret;
+        bool ret = true, force = false;
+        u16 arfs_id;
        down_read(&efx->filter_sem);
        table = efx->filter_state;
        down_write(&table->lock);
        spec = efx_ef10_filter_entry_spec(table, filter_idx);
-        if (!spec || spec->priority != EFX_FILTER_PRI_HINT) {
+        if (!spec || spec->priority != EFX_FILTER_PRI_HINT)
-                ret = true;
                goto out_unlock;
-        }
-        if (!rps_may_expire_flow(efx->net_dev, spec->dmaq_id, flow_id, 0)) {
+        spin_lock_bh(&efx->rps_hash_lock);
-                ret = false;
+        if (!efx->rps_hash_table) {
-                goto out_unlock;
+                /* In the absence of the table, we always return 0 to ARFS. */
+                arfs_id = 0;
+        } else {
+                rule = efx_rps_hash_find(efx, spec);
+                if (!rule)
+                        /* ARFS table doesn't know of this filter, so remove it */
+                        goto expire;
+                arfs_id = rule->arfs_id;
+                ret = efx_rps_check_rule(rule, filter_idx, &force);
+                if (force)
+                        goto expire;
+                if (!ret) {
+                        spin_unlock_bh(&efx->rps_hash_lock);
+                        goto out_unlock;
+                }
        }
+        if (!rps_may_expire_flow(efx->net_dev, spec->dmaq_id, flow_id, arfs_id))
+                ret = false;
+        else if (rule)
+                rule->filter_id = EFX_ARFS_FILTER_ID_REMOVING;
+expire:
+        saved_spec = *spec; /* remove operation will kfree spec */
+        spin_unlock_bh(&efx->rps_hash_lock);
+        /* At this point (since we dropped the lock), another thread might queue
+         * up a fresh insertion request (but the actual insertion will be held
+         * up by our possession of the filter table lock).  In that case, it
+         * will set rule->filter_id to EFX_ARFS_FILTER_ID_PENDING, meaning that
+         * the rule is not removed by efx_rps_hash_del() below.
+         */
        ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
                                              filter_idx, true) == 0;
+        /* While we can't safely dereference rule (we dropped the lock), we can
+         * still test it for NULL.
+         */
+        if (ret && rule) {
+                /* Expiring, so remove entry from ARFS table */
+                spin_lock_bh(&efx->rps_hash_lock);
+                efx_rps_hash_del(efx, &saved_spec);
+                spin_unlock_bh(&efx->rps_hash_lock);
+        }
 out_unlock:
        up_write(&table->lock);
        up_read(&efx->filter_sem);
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 692dd729ee2a..a4ebd8715494 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -3027,6 +3027,10 @@ static int efx_init_struct(struct efx_nic *efx,
        mutex_init(&efx->mac_lock);
 #ifdef CONFIG_RFS_ACCEL
        mutex_init(&efx->rps_mutex);
+        spin_lock_init(&efx->rps_hash_lock);
+        /* Failure to allocate is not fatal, but may degrade ARFS performance */
+        efx->rps_hash_table = kcalloc(EFX_ARFS_HASH_TABLE_SIZE,
+                                      sizeof(*efx->rps_hash_table), GFP_KERNEL);
 #endif
        efx->phy_op = &efx_dummy_phy_operations;
        efx->mdio.dev = net_dev;
@@ -3070,6 +3074,10 @@ static void efx_fini_struct(struct efx_nic *efx)
 {
        int i;
+#ifdef CONFIG_RFS_ACCEL
+        kfree(efx->rps_hash_table);
+#endif
        for (i = 0; i < EFX_MAX_CHANNELS; i++)
                kfree(efx->channel[i]);
@@ -3092,6 +3100,141 @@ void efx_update_sw_stats(struct efx_nic *efx, u64 *stats)
        stats[GENERIC_STAT_rx_noskb_drops] = atomic_read(&efx->n_rx_noskb_drops);
 }
+bool efx_filter_spec_equal(const struct efx_filter_spec *left,
+                           const struct efx_filter_spec *right)
+{
+        if ((left->match_flags ^ right->match_flags) |
+            ((left->flags ^ right->flags) &
+             (EFX_FILTER_FLAG_RX | EFX_FILTER_FLAG_TX)))
+                return false;
+        return memcmp(&left->outer_vid, &right->outer_vid,
+                      sizeof(struct efx_filter_spec) -
+                      offsetof(struct efx_filter_spec, outer_vid)) == 0;
+}
+u32 efx_filter_spec_hash(const struct efx_filter_spec *spec)
+{
+        BUILD_BUG_ON(offsetof(struct efx_filter_spec, outer_vid) & 3);
+        return jhash2((const u32 *)&spec->outer_vid,
+                      (sizeof(struct efx_filter_spec) -
+                       offsetof(struct efx_filter_spec, outer_vid)) / 4,
+                      0);
+}
+#ifdef CONFIG_RFS_ACCEL
+bool efx_rps_check_rule(struct efx_arfs_rule *rule, unsigned int filter_idx,
+                        bool *force)
+{
+        if (rule->filter_id == EFX_ARFS_FILTER_ID_PENDING) {
+                /* ARFS is currently updating this entry, leave it */
+                return false;
+        }
+        if (rule->filter_id == EFX_ARFS_FILTER_ID_ERROR) {
+                /* ARFS tried and failed to update this, so it's probably out
+                 * of date.  Remove the filter and the ARFS rule entry.
+                 */
+                rule->filter_id = EFX_ARFS_FILTER_ID_REMOVING;
+                *force = true;
+                return true;
+        } else if (WARN_ON(rule->filter_id != filter_idx)) { /* can't happen */
+                /* ARFS has moved on, so old filter is not needed.  Since we did
+                 * not mark the rule with EFX_ARFS_FILTER_ID_REMOVING, it will
+                 * not be removed by efx_rps_hash_del() subsequently.
+                 */
+                *force = true;
+                return true;
+        }
+        /* Remove it iff ARFS wants to. */
+        return true;
+}
+struct hlist_head *efx_rps_hash_bucket(struct efx_nic *efx,
+                                       const struct efx_filter_spec *spec)
+{
+        u32 hash = efx_filter_spec_hash(spec);
+        WARN_ON(!spin_is_locked(&efx->rps_hash_lock));
+        if (!efx->rps_hash_table)
+                return NULL;
+        return &efx->rps_hash_table[hash % EFX_ARFS_HASH_TABLE_SIZE];
+}
+struct efx_arfs_rule *efx_rps_hash_find(struct efx_nic *efx,
+                                        const struct efx_filter_spec *spec)
+{
+        struct efx_arfs_rule *rule;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        head = efx_rps_hash_bucket(efx, spec);
+        if (!head)
+                return NULL;
+        hlist_for_each(node, head) {
+                rule = container_of(node, struct efx_arfs_rule, node);
+                if (efx_filter_spec_equal(spec, &rule->spec))
+                        return rule;
+        }
+        return NULL;
+}
+struct efx_arfs_rule *efx_rps_hash_add(struct efx_nic *efx,
+                                       const struct efx_filter_spec *spec,
+                                       bool *new)
+{
+        struct efx_arfs_rule *rule;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        head = efx_rps_hash_bucket(efx, spec);
+        if (!head)
+                return NULL;
+        hlist_for_each(node, head) {
+                rule = container_of(node, struct efx_arfs_rule, node);
+                if (efx_filter_spec_equal(spec, &rule->spec)) {
+                        *new = false;
+                        return rule;
+                }
+        }
+        rule = kmalloc(sizeof(*rule), GFP_ATOMIC);
+        *new = true;
+        if (rule) {
+                memcpy(&rule->spec, spec, sizeof(rule->spec));
+                hlist_add_head(&rule->node, head);
+        }
+        return rule;
+}
+void efx_rps_hash_del(struct efx_nic *efx, const struct efx_filter_spec *spec)
+{
+        struct efx_arfs_rule *rule;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        head = efx_rps_hash_bucket(efx, spec);
+        if (WARN_ON(!head))
+                return;
+        hlist_for_each(node, head) {
+                rule = container_of(node, struct efx_arfs_rule, node);
+                if (efx_filter_spec_equal(spec, &rule->spec)) {
+                        /* Someone already reused the entry.  We know that if
+                         * this check doesn't fire (i.e. filter_id == REMOVING)
+                         * then the REMOVING mark was put there by our caller,
+                         * because caller is holding a lock on filter table and
+                         * only holders of that lock set REMOVING.
+                         */
+                        if (rule->filter_id != EFX_ARFS_FILTER_ID_REMOVING)
+                                return;
+                        hlist_del(node);
+                        kfree(rule);
+                        return;
+                }
+        }
+        /* We didn't find it. */
+        WARN_ON(1);
+}
+#endif
 /* RSS contexts.  We're using linked lists and crappy O(n) algorithms, because
 * (a) this is an infrequent control-plane operation and (b) n is small (max 64)
 */
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index a3140e16fcef..3f759ebdcf10 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -186,6 +186,27 @@ static inline void efx_filter_rfs_expire(struct work_struct *data) {}
 #endif
 bool efx_filter_is_mc_recipient(const struct efx_filter_spec *spec);
+bool efx_filter_spec_equal(const struct efx_filter_spec *left,
+                           const struct efx_filter_spec *right);
+u32 efx_filter_spec_hash(const struct efx_filter_spec *spec);
+#ifdef CONFIG_RFS_ACCEL
+bool efx_rps_check_rule(struct efx_arfs_rule *rule, unsigned int filter_idx,
+                        bool *force);
+struct efx_arfs_rule *efx_rps_hash_find(struct efx_nic *efx,
+                                        const struct efx_filter_spec *spec);
+/* @new is written to indicate if entry was newly added (true) or if an old
+ * entry was found and returned (false).
+ */
+struct efx_arfs_rule *efx_rps_hash_add(struct efx_nic *efx,
+                                       const struct efx_filter_spec *spec,
+                                       bool *new);
+void efx_rps_hash_del(struct efx_nic *efx, const struct efx_filter_spec *spec);
+#endif
 /* RSS contexts */
 struct efx_rss_context *efx_alloc_rss_context_entry(struct efx_nic *efx);
 struct efx_rss_context *efx_find_rss_context_entry(struct efx_nic *efx, u32 id);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 7174ef5e5c5e..c72adf8b52ea 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2905,18 +2905,45 @@ bool efx_farch_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
 {
        struct efx_farch_filter_state *state = efx->filter_state;
        struct efx_farch_filter_table *table;
-        bool ret = false;
+        bool ret = false, force = false;
+        u16 arfs_id;
        down_write(&state->lock);
+        spin_lock_bh(&efx->rps_hash_lock);
        table = &state->table[EFX_FARCH_FILTER_TABLE_RX_IP];
        if (test_bit(index, table->used_bitmap) &&
-            table->spec[index].priority == EFX_FILTER_PRI_HINT &&
+            table->spec[index].priority == EFX_FILTER_PRI_HINT) {
-            rps_may_expire_flow(efx->net_dev, table->spec[index].dmaq_id,
+                struct efx_arfs_rule *rule = NULL;
-                                flow_id, 0)) {
+                struct efx_filter_spec spec;
-                efx_farch_filter_table_clear_entry(efx, table, index);
-                ret = true;
+                efx_farch_filter_to_gen_spec(&spec, &table->spec[index]);
+                if (!efx->rps_hash_table) {
+                        /* In the absence of the table, we always returned 0 to
+                         * ARFS, so use the same to query it.
+                         */
+                        arfs_id = 0;
+                } else {
+                        rule = efx_rps_hash_find(efx, &spec);
+                        if (!rule) {
+                                /* ARFS table doesn't know of this filter, remove it */
+                                force = true;
+                        } else {
+                                arfs_id = rule->arfs_id;
+                                if (!efx_rps_check_rule(rule, index, &force))
+                                        goto out_unlock;
+                        }
+                }
+                if (force || rps_may_expire_flow(efx->net_dev, spec.dmaq_id,
+                                                 flow_id, arfs_id)) {
+                        if (rule)
+                                rule->filter_id = EFX_ARFS_FILTER_ID_REMOVING;
+                        efx_rps_hash_del(efx, &spec);
+                        efx_farch_filter_table_clear_entry(efx, table, index);
+                        ret = true;
+                }
        }
+out_unlock:
+        spin_unlock_bh(&efx->rps_hash_lock);
        up_write(&state->lock);
        return ret;
 }
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index eea3808b3f25..65568925c3ef 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -734,6 +734,35 @@ struct efx_rss_context {
 };
 #ifdef CONFIG_RFS_ACCEL
+/* Order of these is important, since filter_id >= %EFX_ARFS_FILTER_ID_PENDING
+ * is used to test if filter does or will exist.
+ */
+#define EFX_ARFS_FILTER_ID_PENDING      -1
+#define EFX_ARFS_FILTER_ID_ERROR        -2
+#define EFX_ARFS_FILTER_ID_REMOVING     -3
+/**
+ * struct efx_arfs_rule - record of an ARFS filter and its IDs
+ * @node: linkage into hash table
+ * @spec: details of the filter (used as key for hash table).  Use efx->type to
+ *      determine which member to use.
+ * @rxq_index: channel to which the filter will steer traffic.
+ * @arfs_id: filter ID which was returned to ARFS
+ * @filter_id: index in software filter table.  May be
+ *      %EFX_ARFS_FILTER_ID_PENDING if filter was not inserted yet,
+ *      %EFX_ARFS_FILTER_ID_ERROR if filter insertion failed, or
+ *      %EFX_ARFS_FILTER_ID_REMOVING if expiry is currently removing the filter.
+ */
+struct efx_arfs_rule {
+        struct hlist_node node;
+        struct efx_filter_spec spec;
+        u16 rxq_index;
+        u16 arfs_id;
+        s32 filter_id;
+};
+/* Size chosen so that the table is one page (4kB) */
+#define EFX_ARFS_HASH_TABLE_SIZE        512
 /**
 * struct efx_async_filter_insertion - Request to asynchronously insert a filter
 * @net_dev: Reference to the netdevice
@@ -873,6 +902,10 @@ struct efx_async_filter_insertion {
 *      @rps_expire_channel's @rps_flow_id
 * @rps_slot_map: bitmap of in-flight entries in @rps_slot
 * @rps_slot: array of ARFS insertion requests for efx_filter_rfs_work()
+ * @rps_hash_lock: Protects ARFS filter mapping state (@rps_hash_table and
+ *      @rps_next_id).
+ * @rps_hash_table: Mapping between ARFS filters and their various IDs
+ * @rps_next_id: next arfs_id for an ARFS filter
 * @active_queues: Count of RX and TX queues that haven't been flushed and drained.
 * @rxq_flush_pending: Count of number of receive queues that need to be flushed.
 *      Decremented when the efx_flush_rx_queue() is called.
@@ -1029,6 +1062,9 @@ struct efx_nic {
        unsigned int rps_expire_index;
        unsigned long rps_slot_map;
        struct efx_async_filter_insertion rps_slot[EFX_RPS_MAX_IN_FLIGHT];
+        spinlock_t rps_hash_lock;
+        struct hlist_head *rps_hash_table;
+        u32 rps_next_id;
 #endif
        atomic_t active_queues;
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 9c593c661cbf..64a94f242027 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -834,9 +834,29 @@ static void efx_filter_rfs_work(struct work_struct *data)
        struct efx_nic *efx = netdev_priv(req->net_dev);
        struct efx_channel *channel = efx_get_channel(efx, req->rxq_index);
        int slot_idx = req - efx->rps_slot;
+        struct efx_arfs_rule *rule;
+        u16 arfs_id = 0;
        int rc;
        rc = efx->type->filter_insert(efx, &req->spec, true);
+        if (efx->rps_hash_table) {
+                spin_lock_bh(&efx->rps_hash_lock);
+                rule = efx_rps_hash_find(efx, &req->spec);
+                /* The rule might have already gone, if someone else's request
+                 * for the same spec was already worked and then expired before
+                 * we got around to our work.  In that case we have nothing
+                 * tying us to an arfs_id, meaning that as soon as the filter
+                 * is considered for expiry it will be removed.
+                 */
+                if (rule) {
+                        if (rc < 0)
+                                rule->filter_id = EFX_ARFS_FILTER_ID_ERROR;
+                        else
+                                rule->filter_id = rc;
+                        arfs_id = rule->arfs_id;
+                }
+                spin_unlock_bh(&efx->rps_hash_lock);
+        }
        if (rc >= 0) {
                /* Remember this so we can check whether to expire the filter
                 * later.
@@ -848,18 +868,18 @@ static void efx_filter_rfs_work(struct work_struct *data)
                if (req->spec.ether_type == htons(ETH_P_IP))
                        netif_info(efx, rx_status, efx->net_dev,
-                                   "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d]\n",
+                                   "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d id %u]\n",
                                   (req->spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
                                   req->spec.rem_host, ntohs(req->spec.rem_port),
                                   req->spec.loc_host, ntohs(req->spec.loc_port),
-                                   req->rxq_index, req->flow_id, rc);
+                                   req->rxq_index, req->flow_id, rc, arfs_id);
                else
                        netif_info(efx, rx_status, efx->net_dev,
-                                   "steering %s [%pI6]:%u:[%pI6]:%u to queue %u [flow %u filter %d]\n",
+                                   "steering %s [%pI6]:%u:[%pI6]:%u to queue %u [flow %u filter %d id %u]\n",
                                   (req->spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
                                   req->spec.rem_host, ntohs(req->spec.rem_port),
                                   req->spec.loc_host, ntohs(req->spec.loc_port),
-                                   req->rxq_index, req->flow_id, rc);
+                                   req->rxq_index, req->flow_id, rc, arfs_id);
        }
        /* Release references */
@@ -872,8 +892,10 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
 {
        struct efx_nic *efx = netdev_priv(net_dev);
        struct efx_async_filter_insertion *req;
+        struct efx_arfs_rule *rule;
        struct flow_keys fk;
        int slot_idx;
+        bool new;
        int rc;
        /* find a free slot */
@@ -926,12 +948,42 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
        req->spec.rem_port = fk.ports.src;
        req->spec.loc_port = fk.ports.dst;
+        if (efx->rps_hash_table) {
+                /* Add it to ARFS hash table */
+                spin_lock(&efx->rps_hash_lock);
+                rule = efx_rps_hash_add(efx, &req->spec, &new);
+                if (!rule) {
+                        rc = -ENOMEM;
+                        goto out_unlock;
+                }
+                if (new)
+                        rule->arfs_id = efx->rps_next_id++ % RPS_NO_FILTER;
+                rc = rule->arfs_id;
+                /* Skip if existing or pending filter already does the right thing */
+                if (!new && rule->rxq_index == rxq_index &&
+                    rule->filter_id >= EFX_ARFS_FILTER_ID_PENDING)
+                        goto out_unlock;
+                rule->rxq_index = rxq_index;
+                rule->filter_id = EFX_ARFS_FILTER_ID_PENDING;
+                spin_unlock(&efx->rps_hash_lock);
+        } else {
+                /* Without an ARFS hash table, we just use arfs_id 0 for all
+                 * filters.  This means if multiple flows hash to the same
+                 * flow_id, all but the most recently touched will be eligible
+                 * for expiry.
+                 */
+                rc = 0;
+        }
+        /* Queue the request */
        dev_hold(req->net_dev = net_dev);
        INIT_WORK(&req->work, efx_filter_rfs_work);
        req->rxq_index = rxq_index;
        req->flow_id = flow_id;
        schedule_work(&req->work);
-        return 0;
+        return rc;
+out_unlock:
+        spin_unlock(&efx->rps_hash_lock);
 out_clear:
        clear_bit(slot_idx, &efx->rps_slot_map);
        return rc;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 30371274409d..74f828412055 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -129,7 +129,7 @@ do {								\
 #define RX_PRIORITY_MAPPING     0x76543210
 #define TX_PRIORITY_MAPPING     0x33221100
-#define CPDMA_TX_PRIORITY_MAP   0x01234567
+#define CPDMA_TX_PRIORITY_MAP   0x76543210
 #define CPSW_VLAN_AWARE         BIT(1)
 #define CPSW_RX_VLAN_ENCAP      BIT(2)
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index c22e8e383247..25e2a099b71c 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1393,6 +1393,15 @@ static int m88e1318_set_wol(struct phy_device *phydev,
                if (err < 0)
                        goto error;
+                /* If WOL event happened once, the LED[2] interrupt pin
+                 * will not be cleared unless we reading the interrupt status
+                 * register. If interrupts are in use, the normal interrupt
+                 * handling will clear the WOL event. Clear the WOL event
+                 * before enabling it if !phy_interrupt_is_valid()
+                 */
+                if (!phy_interrupt_is_valid(phydev))
+                        phy_read(phydev, MII_M1011_IEVENT);
                /* Enable the WOL interrupt */
                err = __phy_modify(phydev, MII_88E1318S_PHY_CSIER, 0,
                                   MII_88E1318S_PHY_CSIER_WOL_EIE);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 1483bc7b01e1..7df07337d69c 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
        lock_sock(sk);
        error = -EINVAL;
+        if (sockaddr_len != sizeof(struct sockaddr_pppox))
+                goto end;
        if (sp->sa_protocol != PX_PROTO_OE)
                goto end;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index acbe84967834..ddb6bf85a59c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1072,14 +1072,11 @@ static void team_port_leave(struct team *team, struct team_port *port)
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+static int __team_port_enable_netpoll(struct team_port *port)
 {
        struct netpoll *np;
        int err;
-        if (!team->dev->npinfo)
-                return 0;
        np = kzalloc(sizeof(*np), GFP_KERNEL);
        if (!np)
                return -ENOMEM;
@@ -1093,6 +1090,14 @@ static int team_port_enable_netpoll(struct team *team, struct team_port *port)
        return err;
 }
+static int team_port_enable_netpoll(struct team_port *port)
+{
+        if (!port->team->dev->npinfo)
+                return 0;
+        return __team_port_enable_netpoll(port);
+}
 static void team_port_disable_netpoll(struct team_port *port)
 {
        struct netpoll *np = port->np;
@@ -1107,7 +1112,7 @@ static void team_port_disable_netpoll(struct team_port *port)
        kfree(np);
 }
 #else
-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+static int team_port_enable_netpoll(struct team_port *port)
 {
        return 0;
 }
@@ -1221,7 +1226,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                goto err_vids_add;
        }
-        err = team_port_enable_netpoll(team, port);
+        err = team_port_enable_netpoll(port);
        if (err) {
                netdev_err(dev, "Failed to enable netpoll on device %s\n",
                           portname);
@@ -1918,7 +1923,7 @@ static int team_netpoll_setup(struct net_device *dev,
        mutex_lock(&team->lock);
        list_for_each_entry(port, &team->port_list, list) {
-                err = team_port_enable_netpoll(team, port);
+                err = __team_port_enable_netpoll(port);
                if (err) {
                        __team_netpoll_cleanup(team);
                        break;
diff --git a/drivers/pci/dwc/pcie-kirin.c b/drivers/pci/dwc/pcie-kirin.c
index a6b88c7f6e3e..d2970a009eb5 100644
--- a/drivers/pci/dwc/pcie-kirin.c
+++ b/drivers/pci/dwc/pcie-kirin.c
@@ -486,7 +486,7 @@ static int kirin_pcie_probe(struct platform_device *pdev)
                return ret;
        kirin_pcie->gpio_id_reset = of_get_named_gpio(dev->of_node,
-                                                      "reset-gpio", 0);
+                                                      "reset-gpios", 0);
        if (kirin_pcie->gpio_id_reset < 0)
                return -ENODEV;
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index b04d37b3c5de..9abf549631b4 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -29,6 +29,7 @@
 #define     PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT       5
 #define     PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE              (0 << 11)
 #define     PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT      12
+#define     PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ              0x2
 #define PCIE_CORE_LINK_CTRL_STAT_REG                            0xd0
 #define     PCIE_CORE_LINK_L0S_ENTRY                            BIT(0)
 #define     PCIE_CORE_LINK_TRAINING                             BIT(5)
@@ -100,7 +101,8 @@
 #define PCIE_ISR1_MASK_REG                      (CONTROL_BASE_ADDR + 0x4C)
 #define     PCIE_ISR1_POWER_STATE_CHANGE        BIT(4)
 #define     PCIE_ISR1_FLUSH                     BIT(5)
-#define     PCIE_ISR1_ALL_MASK                  GENMASK(5, 4)
+#define     PCIE_ISR1_INTX_ASSERT(val)          BIT(8 + (val))
+#define     PCIE_ISR1_ALL_MASK                  GENMASK(11, 4)
 #define PCIE_MSI_ADDR_LOW_REG                   (CONTROL_BASE_ADDR + 0x50)
 #define PCIE_MSI_ADDR_HIGH_REG                  (CONTROL_BASE_ADDR + 0x54)
 #define PCIE_MSI_STATUS_REG                     (CONTROL_BASE_ADDR + 0x58)
@@ -172,8 +174,6 @@
 #define PCIE_CONFIG_WR_TYPE0                    0xa
 #define PCIE_CONFIG_WR_TYPE1                    0xb
-/* PCI_BDF shifts 8bit, so we need extra 4bit shift */
-#define PCIE_BDF(dev)                           (dev << 4)
 #define PCIE_CONF_BUS(bus)                      (((bus) & 0xff) << 20)
 #define PCIE_CONF_DEV(dev)                      (((dev) & 0x1f) << 15)
 #define PCIE_CONF_FUNC(fun)                     (((fun) & 0x7)  << 12)
@@ -296,7 +296,8 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
        reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE |
                (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) |
                PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE |
-                PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT;
+                (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ <<
+                 PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT);
        advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG);
        /* Program PCIe Control 2 to disable strict ordering */
@@ -437,7 +438,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
        u32 reg;
        int ret;
-        if (PCI_SLOT(devfn) != 0) {
+        if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) {
                *val = 0xffffffff;
                return PCIBIOS_DEVICE_NOT_FOUND;
        }
@@ -456,7 +457,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
        advk_writel(pcie, reg, PIO_CTRL);
        /* Program the address registers */
-        reg = PCIE_BDF(devfn) | PCIE_CONF_REG(where);
+        reg = PCIE_CONF_ADDR(bus->number, devfn, where);
        advk_writel(pcie, reg, PIO_ADDR_LS);
        advk_writel(pcie, 0, PIO_ADDR_MS);
@@ -491,7 +492,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
        int offset;
        int ret;
-        if (PCI_SLOT(devfn) != 0)
+        if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0)
                return PCIBIOS_DEVICE_NOT_FOUND;
        if (where % size)
@@ -609,9 +610,9 @@ static void advk_pcie_irq_mask(struct irq_data *d)
        irq_hw_number_t hwirq = irqd_to_hwirq(d);
        u32 mask;
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
+        mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
-        mask |= PCIE_ISR0_INTX_ASSERT(hwirq);
+        mask |= PCIE_ISR1_INTX_ASSERT(hwirq);
-        advk_writel(pcie, mask, PCIE_ISR0_MASK_REG);
+        advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
 }
 static void advk_pcie_irq_unmask(struct irq_data *d)
@@ -620,9 +621,9 @@ static void advk_pcie_irq_unmask(struct irq_data *d)
        irq_hw_number_t hwirq = irqd_to_hwirq(d);
        u32 mask;
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
+        mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
-        mask &= ~PCIE_ISR0_INTX_ASSERT(hwirq);
+        mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq);
-        advk_writel(pcie, mask, PCIE_ISR0_MASK_REG);
+        advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
 }
 static int advk_pcie_irq_map(struct irq_domain *h,
@@ -765,29 +766,35 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
 static void advk_pcie_handle_int(struct advk_pcie *pcie)
 {
-        u32 val, mask, status;
+        u32 isr0_val, isr0_mask, isr0_status;
+        u32 isr1_val, isr1_mask, isr1_status;
        int i, virq;
-        val = advk_readl(pcie, PCIE_ISR0_REG);
+        isr0_val = advk_readl(pcie, PCIE_ISR0_REG);
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
+        isr0_mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        status = val & ((~mask) & PCIE_ISR0_ALL_MASK);
+        isr0_status = isr0_val & ((~isr0_mask) & PCIE_ISR0_ALL_MASK);
+        isr1_val = advk_readl(pcie, PCIE_ISR1_REG);
+        isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK);
-        if (!status) {
+        if (!isr0_status && !isr1_status) {
-                advk_writel(pcie, val, PCIE_ISR0_REG);
+                advk_writel(pcie, isr0_val, PCIE_ISR0_REG);
+                advk_writel(pcie, isr1_val, PCIE_ISR1_REG);
                return;
        }
        /* Process MSI interrupts */
-        if (status & PCIE_ISR0_MSI_INT_PENDING)
+        if (isr0_status & PCIE_ISR0_MSI_INT_PENDING)
                advk_pcie_handle_msi(pcie);
        /* Process legacy interrupts */
        for (i = 0; i < PCI_NUM_INTX; i++) {
-                if (!(status & PCIE_ISR0_INTX_ASSERT(i)))
+                if (!(isr1_status & PCIE_ISR1_INTX_ASSERT(i)))
                        continue;
-                advk_writel(pcie, PCIE_ISR0_INTX_ASSERT(i),
+                advk_writel(pcie, PCIE_ISR1_INTX_ASSERT(i),
-                            PCIE_ISR0_REG);
+                            PCIE_ISR1_REG);
                virq = irq_find_mapping(pcie->irq_domain, i);
                generic_handle_irq(virq);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 6ace47099fc5..b9a131137e64 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -958,10 +958,11 @@ static int pci_pm_freeze(struct device *dev)
         * devices should not be touched during freeze/thaw transitions,
         * however.
         */
-        if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND))
+        if (!dev_pm_smart_suspend_and_suspended(dev)) {
                pm_runtime_resume(dev);
+                pci_dev->state_saved = false;
+        }
-        pci_dev->state_saved = false;
        if (pm->freeze) {
                int error;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e597655a5643..a04197ce767d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5273,11 +5273,11 @@ void pcie_print_link_status(struct pci_dev *dev)
        bw_avail = pcie_bandwidth_available(dev, &limiting_dev, &speed, &width);
        if (bw_avail >= bw_cap)
-                pci_info(dev, "%u.%03u Gb/s available bandwidth (%s x%d link)\n",
+                pci_info(dev, "%u.%03u Gb/s available PCIe bandwidth (%s x%d link)\n",
                         bw_cap / 1000, bw_cap % 1000,
                         PCIE_SPEED2STR(speed_cap), width_cap);
        else
-                pci_info(dev, "%u.%03u Gb/s available bandwidth, limited by %s x%d link at %s (capable of %u.%03u Gb/s with %s x%d link)\n",
+                pci_info(dev, "%u.%03u Gb/s available PCIe bandwidth, limited by %s x%d link at %s (capable of %u.%03u Gb/s with %s x%d link)\n",
                         bw_avail / 1000, bw_avail % 1000,
                         PCIE_SPEED2STR(speed), width,
                         limiting_dev ? pci_name(limiting_dev) : "<unknown>",
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 62f5f04d8f61..5e963fe0e38d 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
 int dasd_alias_add_device(struct dasd_device *device)
 {
        struct dasd_eckd_private *private = device->private;
-        struct alias_lcu *lcu;
+        __u8 uaddr = private->uid.real_unit_addr;
+        struct alias_lcu *lcu = private->lcu;
        unsigned long flags;
        int rc;
-        lcu = private->lcu;
        rc = 0;
        spin_lock_irqsave(&lcu->lock, flags);
+        /*
+         * Check if device and lcu type differ. If so, the uac data may be
+         * outdated and needs to be updated.
+         */
+        if (private->uid.type !=  lcu->uac->unit[uaddr].ua_type) {
+                lcu->flags |= UPDATE_PENDING;
+                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
+                              "uid type mismatch - trigger rescan");
+        }
        if (!(lcu->flags & UPDATE_PENDING)) {
                rc = _add_device_to_lcu(lcu, device, device);
                if (rc)
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 6652a49a49b1..9029804dcd22 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area)
 static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
 {
+        struct channel_path *chp;
        struct chp_link link;
        struct chp_id chpid;
        int status;
@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
        chpid.id = sei_area->rsid;
        /* allocate a new channel path structure, if needed */
        status = chp_get_status(chpid);
-        if (status < 0)
+        if (!status)
-                chp_new(chpid);
-        else if (!status)
                return;
+        if (status < 0) {
+                chp_new(chpid);
+        } else {
+                chp = chpid_to_chp(chpid);
+                mutex_lock(&chp->lock);
+                chp_update_desc(chp);
+                mutex_unlock(&chp->lock);
+        }
        memset(&link, 0, sizeof(struct chp_link));
        link.chpid = chpid;
        if ((sei_area->vf & 0xc0) != 0) {
diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c
index ff6963ad6e39..3c800642134e 100644
--- a/drivers/s390/cio/vfio_ccw_fsm.c
+++ b/drivers/s390/cio/vfio_ccw_fsm.c
@@ -20,12 +20,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
        int ccode;
        __u8 lpm;
        unsigned long flags;
+        int ret;
        sch = private->sch;
        spin_lock_irqsave(sch->lock, flags);
        private->state = VFIO_CCW_STATE_BUSY;
-        spin_unlock_irqrestore(sch->lock, flags);
        orb = cp_get_orb(&private->cp, (u32)(addr_t)sch, sch->lpm);
@@ -38,10 +38,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
                 * Initialize device status information
                 */
                sch->schib.scsw.cmd.actl |= SCSW_ACTL_START_PEND;
-                return 0;
+                ret = 0;
+                break;
        case 1:         /* Status pending */
        case 2:         /* Busy */
-                return -EBUSY;
+                ret = -EBUSY;
+                break;
        case 3:         /* Device/path not operational */
        {
                lpm = orb->cmd.lpm;
@@ -51,13 +53,16 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
                        sch->lpm = 0;
                if (cio_update_schib(sch))
-                        return -ENODEV;
+                        ret = -ENODEV;
+                else
-                return sch->lpm ? -EACCES : -ENODEV;
+                        ret = sch->lpm ? -EACCES : -ENODEV;
+                break;
        }
        default:
-                return ccode;
+                ret = ccode;
        }
+        spin_unlock_irqrestore(sch->lock, flags);
+        return ret;
 }
 static void fsm_notoper(struct vfio_ccw_private *private,
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 4326715dc13e..78b98b3e7efa 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -557,7 +557,6 @@ enum qeth_prot_versions {
 enum qeth_cmd_buffer_state {
        BUF_STATE_FREE,
        BUF_STATE_LOCKED,
-        BUF_STATE_PROCESSED,
 };
 enum qeth_cq {
@@ -601,7 +600,6 @@ struct qeth_channel {
        struct qeth_cmd_buffer iob[QETH_CMD_BUFFER_NO];
        atomic_t irq_pending;
        int io_buf_no;
-        int buf_no;
 };
 /**
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 04fefa5bb08d..dffd820731f2 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -706,7 +706,6 @@ void qeth_clear_ipacmd_list(struct qeth_card *card)
                qeth_put_reply(reply);
        }
        spin_unlock_irqrestore(&card->lock, flags);
-        atomic_set(&card->write.irq_pending, 0);
 }
 EXPORT_SYMBOL_GPL(qeth_clear_ipacmd_list);
@@ -818,7 +817,6 @@ void qeth_clear_cmd_buffers(struct qeth_channel *channel)
        for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
                qeth_release_buffer(channel, &channel->iob[cnt]);
-        channel->buf_no = 0;
        channel->io_buf_no = 0;
 }
 EXPORT_SYMBOL_GPL(qeth_clear_cmd_buffers);
@@ -924,7 +922,6 @@ static int qeth_setup_channel(struct qeth_channel *channel)
                        kfree(channel->iob[cnt].data);
                return -ENOMEM;
        }
-        channel->buf_no = 0;
        channel->io_buf_no = 0;
        atomic_set(&channel->irq_pending, 0);
        spin_lock_init(&channel->iob_lock);
@@ -1100,16 +1097,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
 {
        int rc;
        int cstat, dstat;
-        struct qeth_cmd_buffer *buffer;
+        struct qeth_cmd_buffer *iob = NULL;
        struct qeth_channel *channel;
        struct qeth_card *card;
-        struct qeth_cmd_buffer *iob;
-        __u8 index;
-        if (__qeth_check_irb_error(cdev, intparm, irb))
-                return;
-        cstat = irb->scsw.cmd.cstat;
-        dstat = irb->scsw.cmd.dstat;
        card = CARD_FROM_CDEV(cdev);
        if (!card)
@@ -1127,6 +1117,19 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                channel = &card->data;
                QETH_CARD_TEXT(card, 5, "data");
        }
+        if (qeth_intparm_is_iob(intparm))
+                iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
+        if (__qeth_check_irb_error(cdev, intparm, irb)) {
+                /* IO was terminated, free its resources. */
+                if (iob)
+                        qeth_release_buffer(iob->channel, iob);
+                atomic_set(&channel->irq_pending, 0);
+                wake_up(&card->wait_q);
+                return;
+        }
        atomic_set(&channel->irq_pending, 0);
        if (irb->scsw.cmd.fctl & (SCSW_FCTL_CLEAR_FUNC))
@@ -1150,6 +1153,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                /* we don't have to handle this further */
                intparm = 0;
        }
+        cstat = irb->scsw.cmd.cstat;
+        dstat = irb->scsw.cmd.dstat;
        if ((dstat & DEV_STAT_UNIT_EXCEP) ||
            (dstat & DEV_STAT_UNIT_CHECK) ||
            (cstat)) {
@@ -1182,25 +1189,15 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                channel->state = CH_STATE_RCD_DONE;
                goto out;
        }
-        if (intparm) {
-                buffer = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
-                buffer->state = BUF_STATE_PROCESSED;
-        }
        if (channel == &card->data)
                return;
        if (channel == &card->read &&
            channel->state == CH_STATE_UP)
                __qeth_issue_next_read(card);
-        iob = channel->iob;
+        if (iob && iob->callback)
-        index = channel->buf_no;
+                iob->callback(iob->channel, iob);
-        while (iob[index].state == BUF_STATE_PROCESSED) {
-                if (iob[index].callback != NULL)
-                        iob[index].callback(channel, iob + index);
-                index = (index + 1) % QETH_CMD_BUFFER_NO;
-        }
-        channel->buf_no = index;
 out:
        wake_up(&card->wait_q);
        return;
@@ -1870,8 +1867,8 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
                   atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0);
        QETH_DBF_TEXT(SETUP, 6, "noirqpnd");
        spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
-        rc = ccw_device_start(channel->ccwdev,
+        rc = ccw_device_start_timeout(channel->ccwdev, &channel->ccw,
-                              &channel->ccw, (addr_t) iob, 0, 0);
+                                      (addr_t) iob, 0, 0, QETH_TIMEOUT);
        spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
        if (rc) {
@@ -1888,7 +1885,6 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
        if (channel->state != CH_STATE_UP) {
                rc = -ETIME;
                QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc);
-                qeth_clear_cmd_buffers(channel);
        } else
                rc = 0;
        return rc;
@@ -1942,8 +1938,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
                   atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0);
        QETH_DBF_TEXT(SETUP, 6, "noirqpnd");
        spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
-        rc = ccw_device_start(channel->ccwdev,
+        rc = ccw_device_start_timeout(channel->ccwdev, &channel->ccw,
-                              &channel->ccw, (addr_t) iob, 0, 0);
+                                      (addr_t) iob, 0, 0, QETH_TIMEOUT);
        spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
        if (rc) {
@@ -1964,7 +1960,6 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
                QETH_DBF_MESSAGE(2, "%s IDX activate timed out\n",
                        dev_name(&channel->ccwdev->dev));
                QETH_DBF_TEXT_(SETUP, 2, "2err%d", -ETIME);
-                qeth_clear_cmd_buffers(channel);
                return -ETIME;
        }
        return qeth_idx_activate_get_answer(channel, idx_reply_cb);
@@ -2166,8 +2161,8 @@ int qeth_send_control_data(struct qeth_card *card, int len,
        QETH_CARD_TEXT(card, 6, "noirqpnd");
        spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags);
-        rc = ccw_device_start(card->write.ccwdev, &card->write.ccw,
+        rc = ccw_device_start_timeout(CARD_WDEV(card), &card->write.ccw,
-                              (addr_t) iob, 0, 0);
+                                      (addr_t) iob, 0, 0, event_timeout);
        spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
        if (rc) {
                QETH_DBF_MESSAGE(2, "%s qeth_send_control_data: "
@@ -2199,8 +2194,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
                }
        }
-        if (reply->rc == -EIO)
-                goto error;
        rc = reply->rc;
        qeth_put_reply(reply);
        return rc;
@@ -2211,10 +2204,6 @@ time_err:
        list_del_init(&reply->list);
        spin_unlock_irqrestore(&reply->card->lock, flags);
        atomic_inc(&reply->received);
-error:
-        atomic_set(&card->write.irq_pending, 0);
-        qeth_release_buffer(iob->channel, iob);
-        card->write.buf_no = (card->write.buf_no + 1) % QETH_CMD_BUFFER_NO;
        rc = reply->rc;
        qeth_put_reply(reply);
        return rc;
@@ -3033,28 +3022,23 @@ static int qeth_send_startlan(struct qeth_card *card)
        return rc;
 }
-static int qeth_default_setadapterparms_cb(struct qeth_card *card,
+static int qeth_setadpparms_inspect_rc(struct qeth_ipa_cmd *cmd)
-                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        if (!cmd->hdr.return_code)
-        QETH_CARD_TEXT(card, 4, "defadpcb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        if (cmd->hdr.return_code == 0)
                cmd->hdr.return_code =
                        cmd->data.setadapterparms.hdr.return_code;
-        return 0;
+        return cmd->hdr.return_code;
 }
 static int qeth_query_setadapterparms_cb(struct qeth_card *card,
                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
        QETH_CARD_TEXT(card, 3, "quyadpcb");
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
-        cmd = (struct qeth_ipa_cmd *) data;
        if (cmd->data.setadapterparms.data.query_cmds_supp.lan_type & 0x7f) {
                card->info.link_type =
                      cmd->data.setadapterparms.data.query_cmds_supp.lan_type;
@@ -3062,7 +3046,7 @@ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
        }
        card->options.adp.supported_funcs =
                cmd->data.setadapterparms.data.query_cmds_supp.supported_cmds;
-        return qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
+        return 0;
 }
 static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
@@ -3154,22 +3138,20 @@ EXPORT_SYMBOL_GPL(qeth_query_ipassists);
 static int qeth_query_switch_attributes_cb(struct qeth_card *card,
                                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
-        struct qeth_switch_info *sw_info;
        struct qeth_query_switch_attributes *attrs;
+        struct qeth_switch_info *sw_info;
        QETH_CARD_TEXT(card, 2, "qswiatcb");
-        cmd = (struct qeth_ipa_cmd *) data;
+        if (qeth_setadpparms_inspect_rc(cmd))
-        sw_info = (struct qeth_switch_info *)reply->param;
+                return 0;
-        if (cmd->data.setadapterparms.hdr.return_code == 0) {
-                attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
-                sw_info->capabilities = attrs->capabilities;
-                sw_info->settings = attrs->settings;
-                QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
-                                                        sw_info->settings);
-        }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+        sw_info = (struct qeth_switch_info *)reply->param;
+        attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
+        sw_info->capabilities = attrs->capabilities;
+        sw_info->settings = attrs->settings;
+        QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
+                        sw_info->settings);
        return 0;
 }
@@ -4207,16 +4189,13 @@ EXPORT_SYMBOL_GPL(qeth_do_send_packet);
 static int qeth_setadp_promisc_mode_cb(struct qeth_card *card,
                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
        struct qeth_ipacmd_setadpparms *setparms;
        QETH_CARD_TEXT(card, 4, "prmadpcb");
-        cmd = (struct qeth_ipa_cmd *) data;
        setparms = &(cmd->data.setadapterparms);
+        if (qeth_setadpparms_inspect_rc(cmd)) {
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
-        if (cmd->hdr.return_code) {
                QETH_CARD_TEXT_(card, 4, "prmrc%x", cmd->hdr.return_code);
                setparms->data.mode = SET_PROMISC_MODE_OFF;
        }
@@ -4286,18 +4265,18 @@ EXPORT_SYMBOL_GPL(qeth_get_stats);
 static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
        QETH_CARD_TEXT(card, 4, "chgmaccb");
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
-        cmd = (struct qeth_ipa_cmd *) data;
        if (!card->options.layer2 ||
            !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
                ether_addr_copy(card->dev->dev_addr,
                                cmd->data.setadapterparms.data.change_addr.addr);
                card->info.mac_bits |= QETH_LAYER2_MAC_READ;
        }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
        return 0;
 }
@@ -4328,13 +4307,15 @@ EXPORT_SYMBOL_GPL(qeth_setadpparms_change_macaddr);
 static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
        struct qeth_set_access_ctrl *access_ctrl_req;
        int fallback = *(int *)reply->param;
        QETH_CARD_TEXT(card, 4, "setaccb");
+        if (cmd->hdr.return_code)
+                return 0;
+        qeth_setadpparms_inspect_rc(cmd);
-        cmd = (struct qeth_ipa_cmd *) data;
        access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
        QETH_DBF_TEXT_(SETUP, 2, "setaccb");
        QETH_DBF_TEXT_(SETUP, 2, "%s", card->gdev->dev.kobj.name);
@@ -4407,7 +4388,6 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
                        card->options.isolation = card->options.prev_isolation;
                break;
        }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
        return 0;
 }
@@ -4695,14 +4675,15 @@ out:
 static int qeth_setadpparms_query_oat_cb(struct qeth_card *card,
                struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
        struct qeth_qoat_priv *priv;
        char *resdata;
        int resdatalen;
        QETH_CARD_TEXT(card, 3, "qoatcb");
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
-        cmd = (struct qeth_ipa_cmd *)data;
        priv = (struct qeth_qoat_priv *)reply->param;
        resdatalen = cmd->data.setadapterparms.hdr.cmdlength;
        resdata = (char *)data + 28;
@@ -4796,21 +4777,18 @@ out:
 static int qeth_query_card_info_cb(struct qeth_card *card,
                                   struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct carrier_info *carrier_info = (struct carrier_info *)reply->param;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
        struct qeth_query_card_info *card_info;
-        struct carrier_info *carrier_info;
        QETH_CARD_TEXT(card, 2, "qcrdincb");
-        carrier_info = (struct carrier_info *)reply->param;
+        if (qeth_setadpparms_inspect_rc(cmd))
-        cmd = (struct qeth_ipa_cmd *)data;
+                return 0;
-        card_info = &cmd->data.setadapterparms.data.card_info;
-        if (cmd->data.setadapterparms.hdr.return_code == 0) {
-                carrier_info->card_type = card_info->card_type;
-                carrier_info->port_mode = card_info->port_mode;
-                carrier_info->port_speed = card_info->port_speed;
-        }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+        card_info = &cmd->data.setadapterparms.data.card_info;
+        carrier_info->card_type = card_info->card_type;
+        carrier_info->port_mode = card_info->port_mode;
+        carrier_info->port_speed = card_info->port_speed;
        return 0;
 }
@@ -4857,7 +4835,7 @@ int qeth_vm_request_mac(struct qeth_card *card)
                goto out;
        }
-        ccw_device_get_id(CARD_DDEV(card), &id);
+        ccw_device_get_id(CARD_RDEV(card), &id);
        request->resp_buf_len = sizeof(*response);
        request->resp_version = DIAG26C_VERSION2;
        request->op_code = DIAG26C_GET_MAC;
@@ -6563,10 +6541,14 @@ static int __init qeth_core_init(void)
        mutex_init(&qeth_mod_mutex);
        qeth_wq = create_singlethread_workqueue("qeth_wq");
+        if (!qeth_wq) {
+                rc = -ENOMEM;
+                goto out_err;
+        }
        rc = qeth_register_dbf_views();
        if (rc)
-                goto out_err;
+                goto dbf_err;
        qeth_core_root_dev = root_device_register("qeth");
        rc = PTR_ERR_OR_ZERO(qeth_core_root_dev);
        if (rc)
@@ -6603,6 +6585,8 @@ slab_err:
        root_device_unregister(qeth_core_root_dev);
 register_err:
        qeth_unregister_dbf_views();
+dbf_err:
+        destroy_workqueue(qeth_wq);
 out_err:
        pr_err("Initializing the qeth device driver failed\n");
        return rc;
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index 619f897b4bb0..f4d1ec0b8f5a 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -35,6 +35,18 @@ extern unsigned char IPA_PDU_HEADER[];
 #define QETH_HALT_CHANNEL_PARM  -11
 #define QETH_RCD_PARM -12
+static inline bool qeth_intparm_is_iob(unsigned long intparm)
+{
+        switch (intparm) {
+        case QETH_CLEAR_CHANNEL_PARM:
+        case QETH_HALT_CHANNEL_PARM:
+        case QETH_RCD_PARM:
+        case 0:
+                return false;
+        }
+        return true;
+}
 /*****************************************************************************/
 /* IP Assist related definitions                                             */
 /*****************************************************************************/
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2ad6f12f3d49..b8079f2a65b3 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -121,13 +121,10 @@ static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
        QETH_CARD_TEXT(card, 2, "L2Setmac");
        rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC);
        if (rc == 0) {
-                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
-                ether_addr_copy(card->dev->dev_addr, mac);
                dev_info(&card->gdev->dev,
-                        "MAC address %pM successfully registered on device %s\n",
+                         "MAC address %pM successfully registered on device %s\n",
-                        card->dev->dev_addr, card->dev->name);
+                         mac, card->dev->name);
        } else {
-                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
                switch (rc) {
                case -EEXIST:
                        dev_warn(&card->gdev->dev,
@@ -142,19 +139,6 @@ static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
        return rc;
 }
-static int qeth_l2_send_delmac(struct qeth_card *card, __u8 *mac)
-{
-        int rc;
-        QETH_CARD_TEXT(card, 2, "L2Delmac");
-        if (!(card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
-                return 0;
-        rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELVMAC);
-        if (rc == 0)
-                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
-        return rc;
-}
 static int qeth_l2_write_mac(struct qeth_card *card, u8 *mac)
 {
        enum qeth_ipa_cmds cmd = is_multicast_ether_addr_64bits(mac) ?
@@ -519,6 +503,7 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
 {
        struct sockaddr *addr = p;
        struct qeth_card *card = dev->ml_priv;
+        u8 old_addr[ETH_ALEN];
        int rc = 0;
        QETH_CARD_TEXT(card, 3, "setmac");
@@ -530,14 +515,35 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
                return -EOPNOTSUPP;
        }
        QETH_CARD_HEX(card, 3, addr->sa_data, ETH_ALEN);
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
        if (qeth_wait_for_threads(card, QETH_RECOVER_THREAD)) {
                QETH_CARD_TEXT(card, 3, "setmcREC");
                return -ERESTARTSYS;
        }
-        rc = qeth_l2_send_delmac(card, &card->dev->dev_addr[0]);
-        if (!rc || (rc == -ENOENT))
+        if (!qeth_card_hw_is_reachable(card)) {
-                rc = qeth_l2_send_setmac(card, addr->sa_data);
+                ether_addr_copy(dev->dev_addr, addr->sa_data);
-        return rc ? -EINVAL : 0;
+                return 0;
+        }
+        /* don't register the same address twice */
+        if (ether_addr_equal_64bits(dev->dev_addr, addr->sa_data) &&
+            (card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
+                return 0;
+        /* add the new address, switch over, drop the old */
+        rc = qeth_l2_send_setmac(card, addr->sa_data);
+        if (rc)
+                return rc;
+        ether_addr_copy(old_addr, dev->dev_addr);
+        ether_addr_copy(dev->dev_addr, addr->sa_data);
+        if (card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED)
+                qeth_l2_remove_mac(card, old_addr);
+        card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
+        return 0;
 }
 static void qeth_promisc_to_bridge(struct qeth_card *card)
@@ -1067,8 +1073,9 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                goto out_remove;
        }
-        if (card->info.type != QETH_CARD_TYPE_OSN)
+        if (card->info.type != QETH_CARD_TYPE_OSN &&
-                qeth_l2_send_setmac(card, &card->dev->dev_addr[0]);
+            !qeth_l2_send_setmac(card, card->dev->dev_addr))
+                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
        if (qeth_is_diagass_supported(card, QETH_DIAGS_CMD_TRAP)) {
                if (card->info.hwtrap &&
@@ -1338,8 +1345,8 @@ static int qeth_osn_send_control_data(struct qeth_card *card, int len,
        qeth_prepare_control_data(card, len, iob);
        QETH_CARD_TEXT(card, 6, "osnoirqp");
        spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags);
-        rc = ccw_device_start(card->write.ccwdev, &card->write.ccw,
+        rc = ccw_device_start_timeout(CARD_WDEV(card), &card->write.ccw,
-                              (addr_t) iob, 0, 0);
+                                      (addr_t) iob, 0, 0, QETH_IPA_TIMEOUT);
        spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
        if (rc) {
                QETH_DBF_MESSAGE(2, "qeth_osn_send_control_data: "
diff --git a/drivers/scsi/fnic/fnic_trace.c b/drivers/scsi/fnic/fnic_trace.c
index abddde11982b..98597b59c12a 100644
--- a/drivers/scsi/fnic/fnic_trace.c
+++ b/drivers/scsi/fnic/fnic_trace.c
@@ -296,7 +296,7 @@ int fnic_get_stats_data(struct stats_debug_info *debug,
                  "Number of Abort FW Timeouts: %lld\n"
                  "Number of Abort IO NOT Found: %lld\n"
-                  "Abord issued times: \n"
+                  "Abort issued times: \n"
                  "            < 6 sec : %lld\n"
                  "     6 sec - 20 sec : %lld\n"
                  "    20 sec - 30 sec : %lld\n"
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index ce97cde3b41c..f4d988dd1e9d 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -1124,12 +1124,12 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
                goto fail_fw_init;
        }
-        ret = 0;
+        return 0;
 fail_fw_init:
        dev_err(&instance->pdev->dev,
-                "Init cmd return status %s for SCSI host %d\n",
+                "Init cmd return status FAILED for SCSI host %d\n",
-                ret ? "FAILED" : "SUCCESS", instance->host->host_no);
+                instance->host->host_no);
        return ret;
 }
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 9ef5e3b810f6..656c98e116a9 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -234,11 +234,13 @@ static const char *sdebug_version_date = "20180128";
 #define F_INV_OP                0x200
 #define F_FAKE_RW               0x400
 #define F_M_ACCESS              0x800   /* media access */
-#define F_LONG_DELAY            0x1000
+#define F_SSU_DELAY             0x1000
+#define F_SYNC_DELAY            0x2000
 #define FF_RESPOND (F_RL_WLUN_OK | F_SKIP_UA | F_DELAY_OVERR)
 #define FF_MEDIA_IO (F_M_ACCESS | F_FAKE_RW)
 #define FF_SA (F_SA_HIGH | F_SA_LOW)
+#define F_LONG_DELAY            (F_SSU_DELAY | F_SYNC_DELAY)
 #define SDEBUG_MAX_PARTS 4
@@ -510,7 +512,7 @@ static const struct opcode_info_t release_iarr[] = {
 };
 static const struct opcode_info_t sync_cache_iarr[] = {
-        {0, 0x91, 0, F_LONG_DELAY | F_M_ACCESS, resp_sync_cache, NULL,
+        {0, 0x91, 0, F_SYNC_DELAY | F_M_ACCESS, resp_sync_cache, NULL,
            {16,  0x6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
             0xff, 0xff, 0xff, 0xff, 0x3f, 0xc7} },     /* SYNC_CACHE (16) */
 };
@@ -553,7 +555,7 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
            resp_write_dt0, write_iarr,                 /* WRITE(16) */
                {16,  0xfa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                 0xff, 0xff, 0xff, 0xff, 0xff, 0xc7} },
-        {0, 0x1b, 0, F_LONG_DELAY, resp_start_stop, NULL,/* START STOP UNIT */
+        {0, 0x1b, 0, F_SSU_DELAY, resp_start_stop, NULL,/* START STOP UNIT */
            {6,  0x1, 0, 0xf, 0xf7, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
        {ARRAY_SIZE(sa_in_16_iarr), 0x9e, 0x10, F_SA_LOW | F_D_IN,
            resp_readcap16, sa_in_16_iarr, /* SA_IN(16), READ CAPACITY(16) */
@@ -606,7 +608,7 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
            resp_write_same_10, write_same_iarr,        /* WRITE SAME(10) */
                {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, 0xff, 0xff, 0xc7, 0,
                 0, 0, 0, 0, 0} },
-        {ARRAY_SIZE(sync_cache_iarr), 0x35, 0, F_LONG_DELAY | F_M_ACCESS,
+        {ARRAY_SIZE(sync_cache_iarr), 0x35, 0, F_SYNC_DELAY | F_M_ACCESS,
            resp_sync_cache, sync_cache_iarr,
            {10,  0x7, 0xff, 0xff, 0xff, 0xff, 0x3f, 0xff, 0xff, 0xc7, 0, 0,
             0, 0, 0, 0} },                     /* SYNC_CACHE (10) */
@@ -667,6 +669,7 @@ static bool sdebug_strict = DEF_STRICT;
 static bool sdebug_any_injecting_opt;
 static bool sdebug_verbose;
 static bool have_dif_prot;
+static bool write_since_sync;
 static bool sdebug_statistics = DEF_STATISTICS;
 static unsigned int sdebug_store_sectors;
@@ -1607,6 +1610,7 @@ static int resp_start_stop(struct scsi_cmnd *scp,
 {
        unsigned char *cmd = scp->cmnd;
        int power_cond, stop;
+        bool changing;
        power_cond = (cmd[4] & 0xf0) >> 4;
        if (power_cond) {
@@ -1614,8 +1618,12 @@ static int resp_start_stop(struct scsi_cmnd *scp,
                return check_condition_result;
        }
        stop = !(cmd[4] & 1);
+        changing = atomic_read(&devip->stopped) == !stop;
        atomic_xchg(&devip->stopped, stop);
-        return (cmd[1] & 0x1) ? SDEG_RES_IMMED_MASK : 0; /* check IMMED bit */
+        if (!changing || cmd[1] & 0x1)  /* state unchanged or IMMED set */
+                return SDEG_RES_IMMED_MASK;
+        else
+                return 0;
 }
 static sector_t get_sdebug_capacity(void)
@@ -2473,6 +2481,7 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
        if (do_write) {
                sdb = scsi_out(scmd);
                dir = DMA_TO_DEVICE;
+                write_since_sync = true;
        } else {
                sdb = scsi_in(scmd);
                dir = DMA_FROM_DEVICE;
@@ -3583,6 +3592,7 @@ static int resp_get_lba_status(struct scsi_cmnd *scp,
 static int resp_sync_cache(struct scsi_cmnd *scp,
                           struct sdebug_dev_info *devip)
 {
+        int res = 0;
        u64 lba;
        u32 num_blocks;
        u8 *cmd = scp->cmnd;
@@ -3598,7 +3608,11 @@ static int resp_sync_cache(struct scsi_cmnd *scp,
                mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
                return check_condition_result;
        }
-        return (cmd[1] & 0x2) ? SDEG_RES_IMMED_MASK : 0; /* check IMMED bit */
+        if (!write_since_sync || cmd[1] & 0x2)
+                res = SDEG_RES_IMMED_MASK;
+        else            /* delay if write_since_sync and IMMED clear */
+                write_since_sync = false;
+        return res;
 }
 #define RL_BUCKET_ELEMS 8
@@ -5777,13 +5791,14 @@ fini:
                return schedule_resp(scp, devip, errsts, pfp, 0, 0);
        else if ((sdebug_jdelay || sdebug_ndelay) && (flags & F_LONG_DELAY)) {
                /*
-                 * If any delay is active, want F_LONG_DELAY to be at least 1
+                 * If any delay is active, for F_SSU_DELAY want at least 1
                 * second and if sdebug_jdelay>0 want a long delay of that
-                 * many seconds.
+                 * many seconds; for F_SYNC_DELAY want 1/20 of that.
                 */
                int jdelay = (sdebug_jdelay < 2) ? 1 : sdebug_jdelay;
+                int denom = (flags & F_SYNC_DELAY) ? 20 : 1;
-                jdelay = mult_frac(USER_HZ * jdelay, HZ, USER_HZ);
+                jdelay = mult_frac(USER_HZ * jdelay, HZ, denom * USER_HZ);
                return schedule_resp(scp, devip, errsts, pfp, jdelay, 0);
        } else
                return schedule_resp(scp, devip, errsts, pfp, sdebug_jdelay,
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index f4b52b44b966..65f6c94f2e9b 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2322,6 +2322,12 @@ iscsi_multicast_skb(struct sk_buff *skb, uint32_t group, gfp_t gfp)
        return nlmsg_multicast(nls, skb, 0, group, gfp);
 }
+static int
+iscsi_unicast_skb(struct sk_buff *skb, u32 portid)
+{
+        return nlmsg_unicast(nls, skb, portid);
+}
 int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
                   char *data, uint32_t data_size)
 {
@@ -2524,14 +2530,11 @@ void iscsi_ping_comp_event(uint32_t host_no, struct iscsi_transport *transport,
 EXPORT_SYMBOL_GPL(iscsi_ping_comp_event);
 static int
-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
+iscsi_if_send_reply(u32 portid, int type, void *payload, int size)
-                    void *payload, int size)
 {
        struct sk_buff  *skb;
        struct nlmsghdr *nlh;
        int len = nlmsg_total_size(size);
-        int flags = multi ? NLM_F_MULTI : 0;
-        int t = done ? NLMSG_DONE : type;
        skb = alloc_skb(len, GFP_ATOMIC);
        if (!skb) {
@@ -2539,10 +2542,9 @@ iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
                return -ENOMEM;
        }
-        nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0);
+        nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0);
-        nlh->nlmsg_flags = flags;
        memcpy(nlmsg_data(nlh), payload, size);
-        return iscsi_multicast_skb(skb, group, GFP_ATOMIC);
+        return iscsi_unicast_skb(skb, portid);
 }
 static int
@@ -3470,6 +3472,7 @@ static int
 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 {
        int err = 0;
+        u32 portid;
        struct iscsi_uevent *ev = nlmsg_data(nlh);
        struct iscsi_transport *transport = NULL;
        struct iscsi_internal *priv;
@@ -3490,10 +3493,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
        if (!try_module_get(transport->owner))
                return -EINVAL;
+        portid = NETLINK_CB(skb).portid;
        switch (nlh->nlmsg_type) {
        case ISCSI_UEVENT_CREATE_SESSION:
                err = iscsi_if_create_session(priv, ep, ev,
-                                              NETLINK_CB(skb).portid,
+                                              portid,
                                              ev->u.c_session.initial_cmdsn,
                                              ev->u.c_session.cmds_max,
                                              ev->u.c_session.queue_depth);
@@ -3506,7 +3511,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
                }
                err = iscsi_if_create_session(priv, ep, ev,
-                                        NETLINK_CB(skb).portid,
+                                        portid,
                                        ev->u.c_bound_session.initial_cmdsn,
                                        ev->u.c_bound_session.cmds_max,
                                        ev->u.c_bound_session.queue_depth);
@@ -3664,6 +3669,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 static void
 iscsi_if_rx(struct sk_buff *skb)
 {
+        u32 portid = NETLINK_CB(skb).portid;
        mutex_lock(&rx_queue_mutex);
        while (skb->len >= NLMSG_HDRLEN) {
                int err;
@@ -3699,8 +3706,8 @@ iscsi_if_rx(struct sk_buff *skb)
                                break;
                        if (ev->type == ISCSI_UEVENT_GET_CHAP && !err)
                                break;
-                        err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
+                        err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
-                                nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
+                                                  ev, sizeof(*ev));
                } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
                skb_pull(skb, rlen);
        }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a6201e696ab9..9421d9877730 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2121,6 +2121,8 @@ sd_spinup_disk(struct scsi_disk *sdkp)
                                break;  /* standby */
                        if (sshdr.asc == 4 && sshdr.ascq == 0xc)
                                break;  /* unavailable */
+                        if (sshdr.asc == 4 && sshdr.ascq == 0x1b)
+                                break;  /* sanitize in progress */
                        /*
                         * Issue command to spin up drive when not ready
                         */
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 41df75eea57b..210407cd2341 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -400,8 +400,10 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
 *
 * Check that all zones of the device are equal. The last zone can however
 * be smaller. The zone size must also be a power of two number of LBAs.
+ *
+ * Returns the zone size in bytes upon success or an error code upon failure.
 */
-static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
+static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
        u64 zone_blocks = 0;
        sector_t block = 0;
@@ -412,8 +414,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
        int ret;
        u8 same;
-        sdkp->zone_blocks = 0;
        /* Get a buffer */
        buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL);
        if (!buf)
@@ -445,16 +445,17 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
                /* Parse zone descriptors */
                while (rec < buf + buf_len) {
-                        zone_blocks = get_unaligned_be64(&rec[8]);
+                        u64 this_zone_blocks = get_unaligned_be64(&rec[8]);
-                        if (sdkp->zone_blocks == 0) {
-                                sdkp->zone_blocks = zone_blocks;
+                        if (zone_blocks == 0) {
-                        } else if (zone_blocks != sdkp->zone_blocks &&
+                                zone_blocks = this_zone_blocks;
-                                   (block + zone_blocks < sdkp->capacity
+                        } else if (this_zone_blocks != zone_blocks &&
-                                    || zone_blocks > sdkp->zone_blocks)) {
+                                   (block + this_zone_blocks < sdkp->capacity
-                                zone_blocks = 0;
+                                    || this_zone_blocks > zone_blocks)) {
+                                this_zone_blocks = 0;
                                goto out;
                        }
-                        block += zone_blocks;
+                        block += this_zone_blocks;
                        rec += 64;
                }
@@ -467,8 +468,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
        } while (block < sdkp->capacity);
-        zone_blocks = sdkp->zone_blocks;
 out:
        if (!zone_blocks) {
                if (sdkp->first_scan)
@@ -488,8 +487,7 @@ out:
                                  "Zone size too large\n");
                ret = -ENODEV;
        } else {
-                sdkp->zone_blocks = zone_blocks;
+                ret = zone_blocks;
-                sdkp->zone_shift = ilog2(zone_blocks);
        }
 out_free:
@@ -500,15 +498,14 @@ out_free:
 /**
 * sd_zbc_alloc_zone_bitmap - Allocate a zone bitmap (one bit per zone).
- * @sdkp: The disk of the bitmap
+ * @nr_zones: Number of zones to allocate space for.
+ * @numa_node: NUMA node to allocate the memory from.
 */
-static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
+static inline unsigned long *
+sd_zbc_alloc_zone_bitmap(u32 nr_zones, int numa_node)
 {
-        struct request_queue *q = sdkp->disk->queue;
+        return kzalloc_node(BITS_TO_LONGS(nr_zones) * sizeof(unsigned long),
+                            GFP_KERNEL, numa_node);
-        return kzalloc_node(BITS_TO_LONGS(sdkp->nr_zones)
-                            * sizeof(unsigned long),
-                            GFP_KERNEL, q->node);
 }
 /**
@@ -516,6 +513,7 @@ static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
 * @sdkp: disk used
 * @buf: report reply buffer
 * @buflen: length of @buf
+ * @zone_shift: logarithm base 2 of the number of blocks in a zone
 * @seq_zones_bitmap: bitmap of sequential zones to set
 *
 * Parse reported zone descriptors in @buf to identify sequential zones and
@@ -525,7 +523,7 @@ static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
 * Return the LBA after the last zone reported.
 */
 static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
-                                     unsigned int buflen,
+                                     unsigned int buflen, u32 zone_shift,
                                     unsigned long *seq_zones_bitmap)
 {
        sector_t lba, next_lba = sdkp->capacity;
@@ -544,7 +542,7 @@ static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
                if (type != ZBC_ZONE_TYPE_CONV &&
                    cond != ZBC_ZONE_COND_READONLY &&
                    cond != ZBC_ZONE_COND_OFFLINE)
-                        set_bit(lba >> sdkp->zone_shift, seq_zones_bitmap);
+                        set_bit(lba >> zone_shift, seq_zones_bitmap);
                next_lba = lba + get_unaligned_be64(&rec[8]);
                rec += 64;
        }
@@ -553,12 +551,16 @@ static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
 }
 /**
- * sd_zbc_setup_seq_zones_bitmap - Initialize the disk seq zone bitmap.
+ * sd_zbc_setup_seq_zones_bitmap - Initialize a seq zone bitmap.
 * @sdkp: target disk
+ * @zone_shift: logarithm base 2 of the number of blocks in a zone
+ * @nr_zones: number of zones to set up a seq zone bitmap for
 *
 * Allocate a zone bitmap and initialize it by identifying sequential zones.
 */
-static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
+static unsigned long *
+sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp, u32 zone_shift,
+                              u32 nr_zones)
 {
        struct request_queue *q = sdkp->disk->queue;
        unsigned long *seq_zones_bitmap;
@@ -566,9 +568,9 @@ static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
        unsigned char *buf;
        int ret = -ENOMEM;
-        seq_zones_bitmap = sd_zbc_alloc_zone_bitmap(sdkp);
+        seq_zones_bitmap = sd_zbc_alloc_zone_bitmap(nr_zones, q->node);
        if (!seq_zones_bitmap)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
        buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL);
        if (!buf)
@@ -579,7 +581,7 @@ static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
                if (ret)
                        goto out;
                lba = sd_zbc_get_seq_zones(sdkp, buf, SD_ZBC_BUF_SIZE,
-                                           seq_zones_bitmap);
+                                           zone_shift, seq_zones_bitmap);
        }
        if (lba != sdkp->capacity) {
@@ -591,12 +593,9 @@ out:
        kfree(buf);
        if (ret) {
                kfree(seq_zones_bitmap);
-                return ret;
+                return ERR_PTR(ret);
        }
+        return seq_zones_bitmap;
-        q->seq_zones_bitmap = seq_zones_bitmap;
-        return 0;
 }
 static void sd_zbc_cleanup(struct scsi_disk *sdkp)
@@ -612,44 +611,64 @@ static void sd_zbc_cleanup(struct scsi_disk *sdkp)
        q->nr_zones = 0;
 }
-static int sd_zbc_setup(struct scsi_disk *sdkp)
+static int sd_zbc_setup(struct scsi_disk *sdkp, u32 zone_blocks)
 {
        struct request_queue *q = sdkp->disk->queue;
+        u32 zone_shift = ilog2(zone_blocks);
+        u32 nr_zones;
        int ret;
-        /* READ16/WRITE16 is mandatory for ZBC disks */
-        sdkp->device->use_16_for_rw = 1;
-        sdkp->device->use_10_for_rw = 0;
        /* chunk_sectors indicates the zone size */
-        blk_queue_chunk_sectors(sdkp->disk->queue,
+        blk_queue_chunk_sectors(q,
-                        logical_to_sectors(sdkp->device, sdkp->zone_blocks));
+                        logical_to_sectors(sdkp->device, zone_blocks));
-        sdkp->nr_zones =
+        nr_zones = round_up(sdkp->capacity, zone_blocks) >> zone_shift;
-                round_up(sdkp->capacity, sdkp->zone_blocks) >> sdkp->zone_shift;
        /*
         * Initialize the device request queue information if the number
         * of zones changed.
         */
-        if (sdkp->nr_zones != q->nr_zones) {
+        if (nr_zones != sdkp->nr_zones || nr_zones != q->nr_zones) {
+                unsigned long *seq_zones_wlock = NULL, *seq_zones_bitmap = NULL;
-                sd_zbc_cleanup(sdkp);
+                size_t zone_bitmap_size;
-                q->nr_zones = sdkp->nr_zones;
+                if (nr_zones) {
-                if (sdkp->nr_zones) {
+                        seq_zones_wlock = sd_zbc_alloc_zone_bitmap(nr_zones,
-                        q->seq_zones_wlock = sd_zbc_alloc_zone_bitmap(sdkp);
+                                                                   q->node);
-                        if (!q->seq_zones_wlock) {
+                        if (!seq_zones_wlock) {
                                ret = -ENOMEM;
                                goto err;
                        }
-                        ret = sd_zbc_setup_seq_zones_bitmap(sdkp);
+                        seq_zones_bitmap = sd_zbc_setup_seq_zones_bitmap(sdkp,
-                        if (ret) {
+                                                        zone_shift, nr_zones);
-                                sd_zbc_cleanup(sdkp);
+                        if (IS_ERR(seq_zones_bitmap)) {
+                                ret = PTR_ERR(seq_zones_bitmap);
+                                kfree(seq_zones_wlock);
                                goto err;
                        }
                }
+                zone_bitmap_size = BITS_TO_LONGS(nr_zones) *
+                        sizeof(unsigned long);
+                blk_mq_freeze_queue(q);
+                if (q->nr_zones != nr_zones) {
+                        /* READ16/WRITE16 is mandatory for ZBC disks */
+                        sdkp->device->use_16_for_rw = 1;
+                        sdkp->device->use_10_for_rw = 0;
+                        sdkp->zone_blocks = zone_blocks;
+                        sdkp->zone_shift = zone_shift;
+                        sdkp->nr_zones = nr_zones;
+                        q->nr_zones = nr_zones;
+                        swap(q->seq_zones_wlock, seq_zones_wlock);
+                        swap(q->seq_zones_bitmap, seq_zones_bitmap);
+                } else if (memcmp(q->seq_zones_bitmap, seq_zones_bitmap,
+                                  zone_bitmap_size) != 0) {
+                        memcpy(q->seq_zones_bitmap, seq_zones_bitmap,
+                               zone_bitmap_size);
+                }
+                blk_mq_unfreeze_queue(q);
+                kfree(seq_zones_wlock);
+                kfree(seq_zones_bitmap);
        }
        return 0;
@@ -661,6 +680,7 @@ err:
 int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
 {
+        int64_t zone_blocks;
        int ret;
        if (!sd_is_zoned(sdkp))
@@ -697,12 +717,16 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
         * Check zone size: only devices with a constant zone size (except
         * an eventual last runt zone) that is a power of 2 are supported.
         */
-        ret = sd_zbc_check_zone_size(sdkp);
+        zone_blocks = sd_zbc_check_zone_size(sdkp);
-        if (ret)
+        ret = -EFBIG;
+        if (zone_blocks != (u32)zone_blocks)
+                goto err;
+        ret = zone_blocks;
+        if (ret < 0)
                goto err;
        /* The drive satisfies the kernel restrictions: set it up */
-        ret = sd_zbc_setup(sdkp);
+        ret = sd_zbc_setup(sdkp, zone_blocks);
        if (ret)
                goto err;
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index c5b1bf1cadcb..00e79057f870 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -276,6 +276,35 @@ static inline void ufshcd_remove_non_printable(char *val)
                *val = ' ';
 }
+static void ufshcd_add_cmd_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_upiu_req *rq = hba->lrb[tag].ucd_req_ptr;
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &rq->header, &rq->sc.cdb);
+}
+static void ufshcd_add_query_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_upiu_req *rq = hba->lrb[tag].ucd_req_ptr;
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &rq->header, &rq->qr);
+}
+static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_task_req_desc *descp;
+        struct utp_upiu_task_req *task_req;
+        int off = (int)tag - hba->nutrs;
+        descp = &hba->utmrdl_base_addr[off];
+        task_req = (struct utp_upiu_task_req *)descp->task_req_upiu;
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &task_req->header,
+                        &task_req->input_param1);
+}
 static void ufshcd_add_command_trace(struct ufs_hba *hba,
                unsigned int tag, const char *str)
 {
@@ -285,6 +314,9 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba,
        struct ufshcd_lrb *lrbp;
        int transfer_len = -1;
+        /* trace UPIU also */
+        ufshcd_add_cmd_upiu_trace(hba, tag, str);
        if (!trace_ufshcd_command_enabled())
                return;
@@ -2550,6 +2582,7 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
        hba->dev_cmd.complete = &wait;
+        ufshcd_add_query_upiu_trace(hba, tag, "query_send");
        /* Make sure descriptors are ready before ringing the doorbell */
        wmb();
        spin_lock_irqsave(hba->host->host_lock, flags);
@@ -2559,6 +2592,9 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
        err = ufshcd_wait_for_dev_cmd(hba, lrbp, timeout);
+        ufshcd_add_query_upiu_trace(hba, tag,
+                        err ? "query_complete_err" : "query_complete");
 out_put_tag:
        ufshcd_put_dev_cmd_tag(hba, tag);
        wake_up(&hba->dev_cmd.tag_wq);
@@ -5443,11 +5479,14 @@ static int ufshcd_issue_tm_cmd(struct ufs_hba *hba, int lun_id, int task_id,
        spin_unlock_irqrestore(host->host_lock, flags);
+        ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_send");
        /* wait until the task management command is completed */
        err = wait_event_timeout(hba->tm_wq,
                        test_bit(free_slot, &hba->tm_condition),
                        msecs_to_jiffies(TM_CMD_TIMEOUT));
        if (!err) {
+                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete_err");
                dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n",
                                __func__, tm_function);
                if (ufshcd_clear_tm_cmd(hba, free_slot))
@@ -5456,6 +5495,7 @@ static int ufshcd_issue_tm_cmd(struct ufs_hba *hba, int lun_id, int task_id,
                err = -ETIMEDOUT;
        } else {
                err = ufshcd_task_req_compl(hba, free_slot, tm_response);
+                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete");
        }
        clear_bit(free_slot, &hba->tm_condition);
diff --git a/drivers/soc/bcm/raspberrypi-power.c b/drivers/soc/bcm/raspberrypi-power.c
index fe96a8b956fb..f7ed1187518b 100644
--- a/drivers/soc/bcm/raspberrypi-power.c
+++ b/drivers/soc/bcm/raspberrypi-power.c
@@ -45,7 +45,7 @@ struct rpi_power_domains {
 struct rpi_power_domain_packet {
        u32 domain;
        u32 on;
-} __packet;
+};
 /*
 * Asks the firmware to enable or disable power on a specific power
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 0d99b242e82e..6cb933ecc084 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -890,6 +890,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                        bytes = min(bytes, data_len);
                        if (!bio) {
+new_bio:
                                nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages);
                                nr_pages -= nr_vecs;
                                /*
@@ -931,6 +932,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                                 * be allocated with pscsi_get_bio() above.
                                 */
                                bio = NULL;
+                                goto new_bio;
                        }
                        data_len -= bytes;
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index e3986f4b3461..ebc34a5686dc 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -9,6 +9,9 @@
 struct blk_mq_tags;
 struct blk_flush_queue;
+/**
+ * struct blk_mq_hw_ctx - State for a hardware queue facing the hardware block device
+ */
 struct blk_mq_hw_ctx {
        struct {
                spinlock_t              lock;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 9af3e0f430bc..5c4eee043191 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -605,6 +605,11 @@ struct request_queue {
         * initialized by the low level device driver (e.g. scsi/sd.c).
         * Stacking drivers (device mappers) may or may not initialize
         * these fields.
+         *
+         * Reads of this information must be protected with blk_queue_enter() /
+         * blk_queue_exit(). Modifying this information is only allowed while
+         * no requests are being processed. See also blk_mq_freeze_queue() and
+         * blk_mq_unfreeze_queue().
         */
        unsigned int            nr_zones;
        unsigned long           *seq_zones_bitmap;
@@ -737,6 +742,7 @@ bool blk_queue_flag_test_and_clear(unsigned int flag, struct request_queue *q);
 #define blk_queue_quiesced(q)   test_bit(QUEUE_FLAG_QUIESCED, &(q)->queue_flags)
 #define blk_queue_preempt_only(q)                               \
        test_bit(QUEUE_FLAG_PREEMPT_ONLY, &(q)->queue_flags)
+#define blk_queue_fua(q)        test_bit(QUEUE_FLAG_FUA, &(q)->queue_flags)
 extern int blk_set_preempt_only(struct request_queue *q);
 extern void blk_clear_preempt_only(struct request_queue *q);
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 95a7abd0ee92..486e65e3db26 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -339,8 +339,8 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
 void bpf_prog_array_delete_safe(struct bpf_prog_array __rcu *progs,
                                struct bpf_prog *old_prog);
 int bpf_prog_array_copy_info(struct bpf_prog_array __rcu *array,
-                             __u32 __user *prog_ids, u32 request_cnt,
+                             u32 *prog_ids, u32 request_cnt,
-                             __u32 __user *prog_cnt);
+                             u32 *prog_cnt);
 int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
                        struct bpf_prog *exclude_prog,
                        struct bpf_prog *include_prog,
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index ebe41811ed34..b32cd2062f18 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -310,6 +310,8 @@ bool ethtool_convert_link_mode_to_legacy_u32(u32 *legacy_u32,
 *      fields should be ignored (use %__ETHTOOL_LINK_MODE_MASK_NBITS
 *      instead of the latter), any change to them will be overwritten
 *      by kernel. Returns a negative error code or zero.
+ * @get_fecparam: Get the network device Forward Error Correction parameters.
+ * @set_fecparam: Set the network device Forward Error Correction parameters.
 *
 * All operations are optional (i.e. the function pointer may be set
 * to %NULL) and callers must take this into account.  Callers must
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index e0c95c9f1e29..e64c0294f50b 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -217,12 +217,10 @@ struct fsnotify_mark_connector {
        union { /* Object pointer [lock] */
                struct inode *inode;
                struct vfsmount *mnt;
-        };
-        union {
-                struct hlist_head list;
                /* Used listing heads to free after srcu period expires */
                struct fsnotify_mark_connector *destroy_next;
        };
+        struct hlist_head list;
 };
 /*
diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h
index b63fa457febd..3529683f691e 100644
--- a/include/linux/mtd/flashchip.h
+++ b/include/linux/mtd/flashchip.h
@@ -85,6 +85,7 @@ struct flchip {
        unsigned int write_suspended:1;
        unsigned int erase_suspended:1;
        unsigned long in_progress_block_addr;
+        unsigned long in_progress_block_mask;
        struct mutex mutex;
        wait_queue_head_t wq; /* Wait on here when we're waiting for the chip
diff --git a/include/linux/ti-emif-sram.h b/include/linux/ti-emif-sram.h
index 45bc6b376492..53604b087f2c 100644
--- a/include/linux/ti-emif-sram.h
+++ b/include/linux/ti-emif-sram.h
@@ -60,6 +60,81 @@ struct ti_emif_pm_functions {
        u32 abort_sr;
 } __packed __aligned(8);
+static inline void ti_emif_asm_offsets(void)
+{
+        DEFINE(EMIF_SDCFG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_sdcfg_val));
+        DEFINE(EMIF_TIMING1_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing1_val));
+        DEFINE(EMIF_TIMING2_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing2_val));
+        DEFINE(EMIF_TIMING3_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing3_val));
+        DEFINE(EMIF_REF_CTRL_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ref_ctrl_val));
+        DEFINE(EMIF_ZQCFG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_zqcfg_val));
+        DEFINE(EMIF_PMCR_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_pmcr_val));
+        DEFINE(EMIF_PMCR_SHDW_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_pmcr_shdw_val));
+        DEFINE(EMIF_RD_WR_LEVEL_RAMP_CTRL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_rd_wr_level_ramp_ctrl));
+        DEFINE(EMIF_RD_WR_EXEC_THRESH_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_rd_wr_exec_thresh));
+        DEFINE(EMIF_COS_CONFIG_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_cos_config));
+        DEFINE(EMIF_PRIORITY_TO_COS_MAPPING_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_priority_to_cos_mapping));
+        DEFINE(EMIF_CONNECT_ID_SERV_1_MAP_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_connect_id_serv_1_map));
+        DEFINE(EMIF_CONNECT_ID_SERV_2_MAP_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_connect_id_serv_2_map));
+        DEFINE(EMIF_OCP_CONFIG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ocp_config_val));
+        DEFINE(EMIF_LPDDR2_NVM_TIM_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim));
+        DEFINE(EMIF_LPDDR2_NVM_TIM_SHDW_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim_shdw));
+        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val));
+        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_SHDW_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val_shdw));
+        DEFINE(EMIF_DDR_PHY_CTLR_1_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ddr_phy_ctlr_1));
+        DEFINE(EMIF_EXT_PHY_CTRL_VALS_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ext_phy_ctrl_vals));
+        DEFINE(EMIF_REGS_AMX3_SIZE, sizeof(struct emif_regs_amx3));
+        BLANK();
+        DEFINE(EMIF_PM_BASE_ADDR_VIRT_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_virt));
+        DEFINE(EMIF_PM_BASE_ADDR_PHYS_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_phys));
+        DEFINE(EMIF_PM_CONFIG_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_sram_config));
+        DEFINE(EMIF_PM_REGS_VIRT_OFFSET,
+               offsetof(struct ti_emif_pm_data, regs_virt));
+        DEFINE(EMIF_PM_REGS_PHYS_OFFSET,
+               offsetof(struct ti_emif_pm_data, regs_phys));
+        DEFINE(EMIF_PM_DATA_SIZE, sizeof(struct ti_emif_pm_data));
+        BLANK();
+        DEFINE(EMIF_PM_SAVE_CONTEXT_OFFSET,
+               offsetof(struct ti_emif_pm_functions, save_context));
+        DEFINE(EMIF_PM_RESTORE_CONTEXT_OFFSET,
+               offsetof(struct ti_emif_pm_functions, restore_context));
+        DEFINE(EMIF_PM_ENTER_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, enter_sr));
+        DEFINE(EMIF_PM_EXIT_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, exit_sr));
+        DEFINE(EMIF_PM_ABORT_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, abort_sr));
+        DEFINE(EMIF_PM_FUNCTIONS_SIZE, sizeof(struct ti_emif_pm_functions));
+}
 struct gen_pool;
 int ti_emif_copy_pm_function_table(struct gen_pool *sram_pool, void *dst);
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 988c7355bc22..fa1b5da2804e 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -157,6 +157,9 @@ int virtio_device_freeze(struct virtio_device *dev);
 int virtio_device_restore(struct virtio_device *dev);
 #endif
+#define virtio_device_for_each_vq(vdev, vq) \
+        list_for_each_entry(vq, &vdev->vqs, list)
 /**
 * virtio_driver - operations for a virtio I/O driver
 * @driver: underlying device driver (populate name and owner).
diff --git a/include/net/ife.h b/include/net/ife.h
index 44b9c00f7223..e117617e3c34 100644
--- a/include/net/ife.h
+++ b/include/net/ife.h
@@ -12,7 +12,8 @@
 void *ife_encode(struct sk_buff *skb, u16 metalen);
 void *ife_decode(struct sk_buff *skb, u16 *metalen);
-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen);
+void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
+                          u16 *dlen, u16 *totlen);
 int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen,
                        const void *dval);
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index 5c40f118c0fa..df528a623548 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -97,6 +97,7 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb)
 struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority,
                          struct proto *prot, int kern);
+void llc_sk_stop_all_timers(struct sock *sk, bool sync);
 void llc_sk_free(struct sock *sk);
 void llc_sk_reset(struct sock *sk);
diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h
index 04e0679767f6..e03bd9d41fa8 100644
--- a/include/scsi/scsi_dbg.h
+++ b/include/scsi/scsi_dbg.h
@@ -11,8 +11,6 @@ struct scsi_sense_hdr;
 extern void scsi_print_command(struct scsi_cmnd *);
 extern size_t __scsi_format_command(char *, size_t,
                                   const unsigned char *, size_t);
-extern void scsi_show_extd_sense(const struct scsi_device *, const char *,
-                                 unsigned char, unsigned char);
 extern void scsi_print_sense_hdr(const struct scsi_device *, const char *,
                                 const struct scsi_sense_hdr *);
 extern void scsi_print_sense(const struct scsi_cmnd *);
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 50df5b28d2c9..8ee8991aa099 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -143,13 +143,13 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
 static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
                                        void *data, size_t len)
 {
-        return 0;
+        return -ENOSYS;
 }
 static inline int rpi_firmware_property_list(struct rpi_firmware *fw,
                                             void *data, size_t tag_size)
 {
-        return 0;
+        return -ENOSYS;
 }
 static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
diff --git a/include/trace/events/ufs.h b/include/trace/events/ufs.h
index bf6f82673492..f8260e5c79ad 100644
--- a/include/trace/events/ufs.h
+++ b/include/trace/events/ufs.h
@@ -257,6 +257,33 @@ TRACE_EVENT(ufshcd_command,
        )
 );
+TRACE_EVENT(ufshcd_upiu,
+        TP_PROTO(const char *dev_name, const char *str, void *hdr, void *tsf),
+        TP_ARGS(dev_name, str, hdr, tsf),
+        TP_STRUCT__entry(
+                __string(dev_name, dev_name)
+                __string(str, str)
+                __array(unsigned char, hdr, 12)
+                __array(unsigned char, tsf, 16)
+        ),
+        TP_fast_assign(
+                __assign_str(dev_name, dev_name);
+                __assign_str(str, str);
+                memcpy(__entry->hdr, hdr, sizeof(__entry->hdr));
+                memcpy(__entry->tsf, tsf, sizeof(__entry->tsf));
+        ),
+        TP_printk(
+                "%s: %s: HDR:%s, CDB:%s",
+                __get_str(str), __get_str(dev_name),
+                __print_hex(__entry->hdr, sizeof(__entry->hdr)),
+                __print_hex(__entry->tsf, sizeof(__entry->tsf))
+        )
+);
 #endif /* if !defined(_TRACE_UFS_H) || defined(TRACE_HEADER_MULTI_READ) */
 /* This part must be outside protection */
diff --git a/include/trace/events/workqueue.h b/include/trace/events/workqueue.h
index 2f057a494d93..9a761bc6a251 100644
--- a/include/trace/events/workqueue.h
+++ b/include/trace/events/workqueue.h
@@ -25,6 +25,8 @@ DECLARE_EVENT_CLASS(workqueue_work,
        TP_printk("work struct %p", __entry->work)
 );
+struct pool_workqueue;
 /**
 * workqueue_queue_work - called when a work gets queued
 * @req_cpu:    the requested cpu
diff --git a/include/uapi/linux/virtio_balloon.h b/include/uapi/linux/virtio_balloon.h
index 40297a3181ed..13b8cb563892 100644
--- a/include/uapi/linux/virtio_balloon.h
+++ b/include/uapi/linux/virtio_balloon.h
@@ -57,6 +57,21 @@ struct virtio_balloon_config {
 #define VIRTIO_BALLOON_S_HTLB_PGFAIL   9  /* Hugetlb page allocation failures */
 #define VIRTIO_BALLOON_S_NR       10
+#define VIRTIO_BALLOON_S_NAMES_WITH_PREFIX(VIRTIO_BALLOON_S_NAMES_prefix) { \
+        VIRTIO_BALLOON_S_NAMES_prefix "swap-in", \
+        VIRTIO_BALLOON_S_NAMES_prefix "swap-out", \
+        VIRTIO_BALLOON_S_NAMES_prefix "major-faults", \
+        VIRTIO_BALLOON_S_NAMES_prefix "minor-faults", \
+        VIRTIO_BALLOON_S_NAMES_prefix "free-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "total-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "available-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "disk-caches", \
+        VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-allocations", \
+        VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures" \
+}
+#define VIRTIO_BALLOON_S_NAMES VIRTIO_BALLOON_S_NAMES_WITH_PREFIX("")
 /*
 * Memory statistics structure.
 * Driver fills an array of these structures and passes to device.
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d315b393abdd..ba03ec39efb3 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1572,13 +1572,32 @@ int bpf_prog_array_length(struct bpf_prog_array __rcu *progs)
        return cnt;
 }
+static bool bpf_prog_array_copy_core(struct bpf_prog **prog,
+                                     u32 *prog_ids,
+                                     u32 request_cnt)
+{
+        int i = 0;
+        for (; *prog; prog++) {
+                if (*prog == &dummy_bpf_prog.prog)
+                        continue;
+                prog_ids[i] = (*prog)->aux->id;
+                if (++i == request_cnt) {
+                        prog++;
+                        break;
+                }
+        }
+        return !!(*prog);
+}
 int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
                                __u32 __user *prog_ids, u32 cnt)
 {
        struct bpf_prog **prog;
        unsigned long err = 0;
-        u32 i = 0, *ids;
        bool nospc;
+        u32 *ids;
        /* users of this function are doing:
         * cnt = bpf_prog_array_length();
@@ -1595,16 +1614,7 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
                return -ENOMEM;
        rcu_read_lock();
        prog = rcu_dereference(progs)->progs;
-        for (; *prog; prog++) {
+        nospc = bpf_prog_array_copy_core(prog, ids, cnt);
-                if (*prog == &dummy_bpf_prog.prog)
-                        continue;
-                ids[i] = (*prog)->aux->id;
-                if (++i == cnt) {
-                        prog++;
-                        break;
-                }
-        }
-        nospc = !!(*prog);
        rcu_read_unlock();
        err = copy_to_user(prog_ids, ids, cnt * sizeof(u32));
        kfree(ids);
@@ -1683,22 +1693,25 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
 }
 int bpf_prog_array_copy_info(struct bpf_prog_array __rcu *array,
-                             __u32 __user *prog_ids, u32 request_cnt,
+                             u32 *prog_ids, u32 request_cnt,
-                             __u32 __user *prog_cnt)
+                             u32 *prog_cnt)
 {
+        struct bpf_prog **prog;
        u32 cnt = 0;
        if (array)
                cnt = bpf_prog_array_length(array);
-        if (copy_to_user(prog_cnt, &cnt, sizeof(cnt)))
+        *prog_cnt = cnt;
-                return -EFAULT;
        /* return early if user requested only program count or nothing to copy */
        if (!request_cnt || !cnt)
                return 0;
-        return bpf_prog_array_copy_to_user(array, prog_ids, request_cnt);
+        /* this function is called under trace/bpf_trace.c: bpf_event_mutex */
+        prog = rcu_dereference_check(array, 1)->progs;
+        return bpf_prog_array_copy_core(prog, prog_ids, request_cnt) ? -ENOSPC
+                                                                     : 0;
 }
 static void bpf_prog_free_deferred(struct work_struct *work)
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 8dd9210d7db7..a3b21385e947 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1442,9 +1442,6 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
            attr->value_size != 4 || attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
                return ERR_PTR(-EINVAL);
-        if (attr->value_size > KMALLOC_MAX_SIZE)
-                return ERR_PTR(-E2BIG);
        err = bpf_tcp_ulp_register();
        if (err && err != -EEXIST)
                return ERR_PTR(err);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 102160ff5c66..ea619021d901 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
        struct kprobe_blacklist_entry *ent =
                list_entry(v, struct kprobe_blacklist_entry, list);
-        seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr,
+        seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr,
                   (void *)ent->end_addr, (void *)ent->start_addr);
        return 0;
 }
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index d88e96d4e12c..56ba0f2a01db 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -977,6 +977,7 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info)
 {
        struct perf_event_query_bpf __user *uquery = info;
        struct perf_event_query_bpf query = {};
+        u32 *ids, prog_cnt, ids_len;
        int ret;
        if (!capable(CAP_SYS_ADMIN))
@@ -985,16 +986,32 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info)
                return -EINVAL;
        if (copy_from_user(&query, uquery, sizeof(query)))
                return -EFAULT;
-        if (query.ids_len > BPF_TRACE_MAX_PROGS)
+        ids_len = query.ids_len;
+        if (ids_len > BPF_TRACE_MAX_PROGS)
                return -E2BIG;
+        ids = kcalloc(ids_len, sizeof(u32), GFP_USER | __GFP_NOWARN);
+        if (!ids)
+                return -ENOMEM;
+        /*
+         * The above kcalloc returns ZERO_SIZE_PTR when ids_len = 0, which
+         * is required when user only wants to check for uquery->prog_cnt.
+         * There is no need to check for it since the case is handled
+         * gracefully in bpf_prog_array_copy_info.
+         */
        mutex_lock(&bpf_event_mutex);
        ret = bpf_prog_array_copy_info(event->tp_event->prog_array,
-                                       uquery->ids,
+                                       ids,
-                                       query.ids_len,
+                                       ids_len,
-                                       &uquery->prog_cnt);
+                                       &prog_cnt);
        mutex_unlock(&bpf_event_mutex);
+        if (copy_to_user(&uquery->prog_cnt, &prog_cnt, sizeof(prog_cnt)) ||
+            copy_to_user(uquery->ids, ids, ids_len * sizeof(u32)))
+                ret = -EFAULT;
+        kfree(ids);
        return ret;
 }
diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index e954ae3d82c0..e3a658bac10f 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry,
                __field(        unsigned int,           seqnum          )
        ),
-        F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n",
+        F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n",
                 __entry->seqnum,
                 __entry->tv_sec,
                 __entry->tv_nsec,
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 9b4716bb8bb0..1f951b3df60c 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1499,14 +1499,14 @@ static int process_preds(struct trace_event_call *call,
                return ret;
        }
-        if (!nr_preds) {
+        if (!nr_preds)
-                prog = NULL;
+                return -EINVAL;
-        } else {
-                prog = predicate_parse(filter_string, nr_parens, nr_preds,
+        prog = predicate_parse(filter_string, nr_parens, nr_preds,
                               parse_pred, call, pe);
-                if (IS_ERR(prog))
+        if (IS_ERR(prog))
-                        return PTR_ERR(prog);
+                return PTR_ERR(prog);
-        }
        rcu_assign_pointer(filter->prog, prog);
        return 0;
 }
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index c0bba30fef0a..bbfb229aa067 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,7 +84,8 @@ again:
                __free_pages(page, page_order);
                page = NULL;
-                if (dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
+                if (IS_ENABLED(CONFIG_ZONE_DMA) &&
+                    dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
                    !(gfp & GFP_DMA)) {
                        gfp = (gfp & ~GFP_DMA32) | GFP_DMA;
                        goto again;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 032e0fe45940..28a4c3490359 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1825,13 +1825,14 @@ static int compat_table_info(const struct ebt_table_info *info,
 {
        unsigned int size = info->entries_size;
        const void *entries = info->entries;
-        int ret;
        newinfo->entries_size = size;
+        if (info->nentries) {
-        ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
+                int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
-        if (ret)
+                                                 info->nentries);
-                return ret;
+                if (ret)
+                        return ret;
+        }
        return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
                                                        entries, newinfo);
diff --git a/net/ife/ife.c b/net/ife/ife.c
index 7d1ec76e7f43..13bbf8cb6a39 100644
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -69,6 +69,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
        int total_pull;
        u16 ifehdrln;
+        if (!pskb_may_pull(skb, skb->dev->hard_header_len + IFE_METAHDRLEN))
+                return NULL;
        ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);
        ifehdrln = ntohs(ifehdr->metalen);
        total_pull = skb->dev->hard_header_len + ifehdrln;
@@ -92,12 +95,43 @@ struct meta_tlvhdr {
        __be16 len;
 };
+static bool __ife_tlv_meta_valid(const unsigned char *skbdata,
+                                 const unsigned char *ifehdr_end)
+{
+        const struct meta_tlvhdr *tlv;
+        u16 tlvlen;
+        if (unlikely(skbdata + sizeof(*tlv) > ifehdr_end))
+                return false;
+        tlv = (const struct meta_tlvhdr *)skbdata;
+        tlvlen = ntohs(tlv->len);
+        /* tlv length field is inc header, check on minimum */
+        if (tlvlen < NLA_HDRLEN)
+                return false;
+        /* overflow by NLA_ALIGN check */
+        if (NLA_ALIGN(tlvlen) < tlvlen)
+                return false;
+        if (unlikely(skbdata + NLA_ALIGN(tlvlen) > ifehdr_end))
+                return false;
+        return true;
+}
 /* Caller takes care of presenting data in network order
 */
-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen)
+void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
+                          u16 *dlen, u16 *totlen)
 {
-        struct meta_tlvhdr *tlv = (struct meta_tlvhdr *) skbdata;
+        struct meta_tlvhdr *tlv;
+        if (!__ife_tlv_meta_valid(skbdata, ifehdr_end))
+                return NULL;
+        tlv = (struct meta_tlvhdr *)skbdata;
        *dlen = ntohs(tlv->len) - NLA_HDRLEN;
        *attrtype = ntohs(tlv->type);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 367def6ddeda..e51c644484dc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3868,11 +3868,8 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
        int length = (th->doff << 2) - sizeof(*th);
        const u8 *ptr = (const u8 *)(th + 1);
-        /* If the TCP option is too short, we can short cut */
+        /* If not enough data remaining, we can short cut */
-        if (length < TCPOLEN_MD5SIG)
+        while (length >= TCPOLEN_MD5SIG) {
-                return NULL;
-        while (length > 0) {
                int opcode = *ptr++;
                int opsize;
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index ccbfa83e4bb0..ce77bcc2490c 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -48,6 +48,34 @@ config NFT_CHAIN_ROUTE_IPV6
          fields such as the source, destination, flowlabel, hop-limit and
          the packet mark.
+if NF_NAT_IPV6
+config NFT_CHAIN_NAT_IPV6
+        tristate "IPv6 nf_tables nat chain support"
+        help
+          This option enables the "nat" chain for IPv6 in nf_tables. This
+          chain type is used to perform Network Address Translation (NAT)
+          packet transformations such as the source, destination address and
+          source and destination ports.
+config NFT_MASQ_IPV6
+        tristate "IPv6 masquerade support for nf_tables"
+        depends on NFT_MASQ
+        select NF_NAT_MASQUERADE_IPV6
+        help
+          This is the expression that provides IPv4 masquerading support for
+          nf_tables.
+config NFT_REDIR_IPV6
+        tristate "IPv6 redirect support for nf_tables"
+        depends on NFT_REDIR
+        select NF_NAT_REDIRECT
+        help
+          This is the expression that provides IPv4 redirect support for
+          nf_tables.
+endif # NF_NAT_IPV6
 config NFT_REJECT_IPV6
        select NF_REJECT_IPV6
        default NFT_REJECT
@@ -107,39 +135,12 @@ config NF_NAT_IPV6
 if NF_NAT_IPV6
-config NFT_CHAIN_NAT_IPV6
-        depends on NF_TABLES_IPV6
-        tristate "IPv6 nf_tables nat chain support"
-        help
-          This option enables the "nat" chain for IPv6 in nf_tables. This
-          chain type is used to perform Network Address Translation (NAT)
-          packet transformations such as the source, destination address and
-          source and destination ports.
 config NF_NAT_MASQUERADE_IPV6
        tristate "IPv6 masquerade support"
        help
          This is the kernel functionality to provide NAT in the masquerade
          flavour (automatic source address selection) for IPv6.
-config NFT_MASQ_IPV6
-        tristate "IPv6 masquerade support for nf_tables"
-        depends on NF_TABLES_IPV6
-        depends on NFT_MASQ
-        select NF_NAT_MASQUERADE_IPV6
-        help
-          This is the expression that provides IPv4 masquerading support for
-          nf_tables.
-config NFT_REDIR_IPV6
-        tristate "IPv6 redirect support for nf_tables"
-        depends on NF_TABLES_IPV6
-        depends on NFT_REDIR
-        select NF_NAT_REDIRECT
-        help
-          This is the expression that provides IPv4 redirect support for
-          nf_tables.
 endif # NF_NAT_IPV6
 config IP6_NF_IPTABLES
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 49b954d6d0fa..cde7d8251377 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3975,6 +3975,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
 static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
        [RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
+        [RTA_PREFSRC]           = { .len = sizeof(struct in6_addr) },
        [RTA_OIF]               = { .type = NLA_U32 },
        [RTA_IIF]               = { .type = NLA_U32 },
        [RTA_PRIORITY]          = { .type = NLA_U32 },
@@ -3986,6 +3987,7 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
        [RTA_EXPIRES]           = { .type = NLA_U32 },
        [RTA_UID]               = { .type = NLA_U32 },
        [RTA_MARK]              = { .type = NLA_U32 },
+        [RTA_TABLE]             = { .type = NLA_U32 },
 };
 static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index f343e6f0fc95..5fe139484919 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -136,7 +136,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
        isrh->nexthdr = proto;
        hdr->daddr = isrh->segments[isrh->first_segment];
-        set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
+        set_tun_src(net, dst->dev, &hdr->daddr, &hdr->saddr);
 #ifdef CONFIG_IPV6_SEG6_HMAC
        if (sr_has_hmac(isrh)) {
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index b8f9d45bfeb1..7f1e842ef05a 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -106,8 +106,11 @@ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
                return;
        /* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
-        if (pd->tunnel)
+        if (pd->tunnel) {
                l2tp_tunnel_dec_refcount(pd->tunnel);
+                pd->tunnel = NULL;
+                pd->session = NULL;
+        }
 }
 static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 7d0c963680e6..1fd9e145076a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -619,6 +619,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        lock_sock(sk);
        error = -EINVAL;
+        if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
+            sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
+            sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
+            sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
+                goto end;
        if (sp->sa_protocol != PX_PROTO_OL2TP)
                goto end;
@@ -1618,8 +1625,11 @@ static void pppol2tp_seq_stop(struct seq_file *p, void *v)
                return;
        /* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
-        if (pd->tunnel)
+        if (pd->tunnel) {
                l2tp_tunnel_dec_refcount(pd->tunnel);
+                pd->tunnel = NULL;
+                pd->session = NULL;
+        }
 }
 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 6d29b2b94e84..cb80ebb38311 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
        struct llc_sock *llc;
-        struct llc_sap *sap;
        if (unlikely(sk == NULL))
                goto out;
@@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock)
                llc->laddr.lsap, llc->daddr.lsap);
        if (!llc_send_disc(sk))
                llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-        sap = llc->sap;
+        if (!sock_flag(sk, SOCK_ZAPPED)) {
-        /* Hold this for release_sock(), so that llc_backlog_rcv() could still
+                struct llc_sap *sap = llc->sap;
-         * use it.
-         */
+                /* Hold this for release_sock(), so that llc_backlog_rcv()
-        llc_sap_hold(sap);
+                 * could still use it.
-        if (!sock_flag(sk, SOCK_ZAPPED))
+                 */
+                llc_sap_hold(sap);
                llc_sap_remove_socket(llc->sap, sk);
-        release_sock(sk);
+                release_sock(sk);
-        llc_sap_put(sap);
+                llc_sap_put(sap);
+        } else {
+                release_sock(sk);
+        }
        if (llc->dev)
                dev_put(llc->dev);
        sock_put(sk);
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 163121192aca..4d78375f9872 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -1099,14 +1099,7 @@ int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_sock *llc = llc_sk(sk);
+        llc_sk_stop_all_timers(sk, false);
-        del_timer(&llc->pf_cycle_timer.timer);
-        del_timer(&llc->ack_timer.timer);
-        del_timer(&llc->rej_sent_timer.timer);
-        del_timer(&llc->busy_state_timer.timer);
-        llc->ack_must_be_send = 0;
-        llc->ack_pf = 0;
        return 0;
 }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 110e32bcb399..c0ac522b48a1 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -961,6 +961,26 @@ out:
        return sk;
 }
+void llc_sk_stop_all_timers(struct sock *sk, bool sync)
+{
+        struct llc_sock *llc = llc_sk(sk);
+        if (sync) {
+                del_timer_sync(&llc->pf_cycle_timer.timer);
+                del_timer_sync(&llc->ack_timer.timer);
+                del_timer_sync(&llc->rej_sent_timer.timer);
+                del_timer_sync(&llc->busy_state_timer.timer);
+        } else {
+                del_timer(&llc->pf_cycle_timer.timer);
+                del_timer(&llc->ack_timer.timer);
+                del_timer(&llc->rej_sent_timer.timer);
+                del_timer(&llc->busy_state_timer.timer);
+        }
+        llc->ack_must_be_send = 0;
+        llc->ack_pf = 0;
+}
 /**
 *      llc_sk_free - Frees a LLC socket
 *      @sk - socket to free
@@ -973,7 +993,7 @@ void llc_sk_free(struct sock *sk)
        llc->state = LLC_CONN_OUT_OF_SVC;
        /* Stop all (possibly) running timers */
-        llc_conn_ac_stop_all_timers(sk, NULL);
+        llc_sk_stop_all_timers(sk, true);
 #ifdef DEBUG_LLC_CONN_ALLOC
        printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__,
                skb_queue_len(&llc->pdu_unack_q),
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 704b3832dbad..44d8a55e9721 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -594,6 +594,7 @@ config NFT_QUOTA
 config NFT_REJECT
        default m if NETFILTER_ADVANCED=n
        tristate "Netfilter nf_tables reject support"
+        depends on !NF_TABLES_INET || (IPV6!=m || m)
        help
          This option adds the "reject" expression that you can use to
          explicitly deny and notify via TCP reset/ICMP informational errors
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 5ebde4b15810..f36098887ad0 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2384,11 +2384,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                        strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
                                sizeof(cfg.mcast_ifn));
                        cfg.syncid = dm->syncid;
-                        rtnl_lock();
-                        mutex_lock(&ipvs->sync_mutex);
                        ret = start_sync_thread(ipvs, &cfg, dm->state);
-                        mutex_unlock(&ipvs->sync_mutex);
-                        rtnl_unlock();
                } else {
                        mutex_lock(&ipvs->sync_mutex);
                        ret = stop_sync_thread(ipvs, dm->state);
@@ -3481,12 +3477,8 @@ static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
        if (ipvs->mixed_address_family_dests > 0)
                return -EINVAL;
-        rtnl_lock();
-        mutex_lock(&ipvs->sync_mutex);
        ret = start_sync_thread(ipvs, &c,
                                nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
-        mutex_unlock(&ipvs->sync_mutex);
-        rtnl_unlock();
        return ret;
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index fbaf3bd05b2e..001501e25625 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -49,6 +49,7 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/kernel.h>
+#include <linux/sched/signal.h>
 #include <asm/unaligned.h>              /* Used for ntoh_seq and hton_seq */
@@ -1360,15 +1361,9 @@ static void set_mcast_pmtudisc(struct sock *sk, int val)
 /*
 *      Specifiy default interface for outgoing multicasts
 */
-static int set_mcast_if(struct sock *sk, char *ifname)
+static int set_mcast_if(struct sock *sk, struct net_device *dev)
 {
-        struct net_device *dev;
        struct inet_sock *inet = inet_sk(sk);
-        struct net *net = sock_net(sk);
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
        if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
                return -EINVAL;
@@ -1396,19 +1391,14 @@ static int set_mcast_if(struct sock *sk, char *ifname)
 *      in the in_addr structure passed in as a parameter.
 */
 static int
-join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname)
+join_mcast_group(struct sock *sk, struct in_addr *addr, struct net_device *dev)
 {
-        struct net *net = sock_net(sk);
        struct ip_mreqn mreq;
-        struct net_device *dev;
        int ret;
        memset(&mreq, 0, sizeof(mreq));
        memcpy(&mreq.imr_multiaddr, addr, sizeof(struct in_addr));
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
        if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
                return -EINVAL;
@@ -1423,15 +1413,10 @@ join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname)
 #ifdef CONFIG_IP_VS_IPV6
 static int join_mcast_group6(struct sock *sk, struct in6_addr *addr,
-                             char *ifname)
+                             struct net_device *dev)
 {
-        struct net *net = sock_net(sk);
-        struct net_device *dev;
        int ret;
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
        if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
                return -EINVAL;
@@ -1443,24 +1428,18 @@ static int join_mcast_group6(struct sock *sk, struct in6_addr *addr,
 }
 #endif
-static int bind_mcastif_addr(struct socket *sock, char *ifname)
+static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
 {
-        struct net *net = sock_net(sock->sk);
-        struct net_device *dev;
        __be32 addr;
        struct sockaddr_in sin;
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
        addr = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
        if (!addr)
                pr_err("You probably need to specify IP address on "
                       "multicast interface.\n");
        IP_VS_DBG(7, "binding socket with (%s) %pI4\n",
-                  ifname, &addr);
+                  dev->name, &addr);
        /* Now bind the socket with the address of multicast interface */
        sin.sin_family       = AF_INET;
@@ -1493,7 +1472,8 @@ static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,
 /*
 *      Set up sending multicast socket over UDP
 */
-static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
+static int make_send_sock(struct netns_ipvs *ipvs, int id,
+                          struct net_device *dev, struct socket **sock_ret)
 {
        /* multicast addr */
        union ipvs_sockaddr mcast_addr;
@@ -1505,9 +1485,10 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
                                  IPPROTO_UDP, &sock);
        if (result < 0) {
                pr_err("Error during creation of socket; terminating\n");
-                return ERR_PTR(result);
+                goto error;
        }
-        result = set_mcast_if(sock->sk, ipvs->mcfg.mcast_ifn);
+        *sock_ret = sock;
+        result = set_mcast_if(sock->sk, dev);
        if (result < 0) {
                pr_err("Error setting outbound mcast interface\n");
                goto error;
@@ -1522,7 +1503,7 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
                set_sock_size(sock->sk, 1, result);
        if (AF_INET == ipvs->mcfg.mcast_af)
-                result = bind_mcastif_addr(sock, ipvs->mcfg.mcast_ifn);
+                result = bind_mcastif_addr(sock, dev);
        else
                result = 0;
        if (result < 0) {
@@ -1538,19 +1519,18 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
                goto error;
        }
-        return sock;
+        return 0;
 error:
-        sock_release(sock);
+        return result;
-        return ERR_PTR(result);
 }
 /*
 *      Set up receiving multicast socket over UDP
 */
-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
+static int make_receive_sock(struct netns_ipvs *ipvs, int id,
-                                        int ifindex)
+                             struct net_device *dev, struct socket **sock_ret)
 {
        /* multicast addr */
        union ipvs_sockaddr mcast_addr;
@@ -1562,8 +1542,9 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
                                  IPPROTO_UDP, &sock);
        if (result < 0) {
                pr_err("Error during creation of socket; terminating\n");
-                return ERR_PTR(result);
+                goto error;
        }
+        *sock_ret = sock;
        /* it is equivalent to the REUSEADDR option in user-space */
        sock->sk->sk_reuse = SK_CAN_REUSE;
        result = sysctl_sync_sock_size(ipvs);
@@ -1571,7 +1552,7 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
                set_sock_size(sock->sk, 0, result);
        get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
-        sock->sk->sk_bound_dev_if = ifindex;
+        sock->sk->sk_bound_dev_if = dev->ifindex;
        result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
        if (result < 0) {
                pr_err("Error binding to the multicast addr\n");
@@ -1582,21 +1563,20 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
 #ifdef CONFIG_IP_VS_IPV6
        if (ipvs->bcfg.mcast_af == AF_INET6)
                result = join_mcast_group6(sock->sk, &mcast_addr.in6.sin6_addr,
-                                           ipvs->bcfg.mcast_ifn);
+                                           dev);
        else
 #endif
                result = join_mcast_group(sock->sk, &mcast_addr.in.sin_addr,
-                                          ipvs->bcfg.mcast_ifn);
+                                          dev);
        if (result < 0) {
                pr_err("Error joining to the multicast group\n");
                goto error;
        }
-        return sock;
+        return 0;
 error:
-        sock_release(sock);
+        return result;
-        return ERR_PTR(result);
 }
@@ -1778,13 +1758,12 @@ static int sync_thread_backup(void *data)
 int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
                      int state)
 {
-        struct ip_vs_sync_thread_data *tinfo;
+        struct ip_vs_sync_thread_data *tinfo = NULL;
        struct task_struct **array = NULL, *task;
-        struct socket *sock;
        struct net_device *dev;
        char *name;
        int (*threadfn)(void *data);
-        int id, count, hlen;
+        int id = 0, count, hlen;
        int result = -ENOMEM;
        u16 mtu, min_mtu;
@@ -1792,6 +1771,18 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
        IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
                  sizeof(struct ip_vs_sync_conn_v0));
+        /* Do not hold one mutex and then to block on another */
+        for (;;) {
+                rtnl_lock();
+                if (mutex_trylock(&ipvs->sync_mutex))
+                        break;
+                rtnl_unlock();
+                mutex_lock(&ipvs->sync_mutex);
+                if (rtnl_trylock())
+                        break;
+                mutex_unlock(&ipvs->sync_mutex);
+        }
        if (!ipvs->sync_state) {
                count = clamp(sysctl_sync_ports(ipvs), 1, IPVS_SYNC_PORTS_MAX);
                ipvs->threads_mask = count - 1;
@@ -1810,7 +1801,8 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
        dev = __dev_get_by_name(ipvs->net, c->mcast_ifn);
        if (!dev) {
                pr_err("Unknown mcast interface: %s\n", c->mcast_ifn);
-                return -ENODEV;
+                result = -ENODEV;
+                goto out_early;
        }
        hlen = (AF_INET6 == c->mcast_af) ?
               sizeof(struct ipv6hdr) + sizeof(struct udphdr) :
@@ -1827,26 +1819,30 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
                c->sync_maxlen = mtu - hlen;
        if (state == IP_VS_STATE_MASTER) {
+                result = -EEXIST;
                if (ipvs->ms)
-                        return -EEXIST;
+                        goto out_early;
                ipvs->mcfg = *c;
                name = "ipvs-m:%d:%d";
                threadfn = sync_thread_master;
        } else if (state == IP_VS_STATE_BACKUP) {
+                result = -EEXIST;
                if (ipvs->backup_threads)
-                        return -EEXIST;
+                        goto out_early;
                ipvs->bcfg = *c;
                name = "ipvs-b:%d:%d";
                threadfn = sync_thread_backup;
        } else {
-                return -EINVAL;
+                result = -EINVAL;
+                goto out_early;
        }
        if (state == IP_VS_STATE_MASTER) {
                struct ipvs_master_sync_state *ms;
+                result = -ENOMEM;
                ipvs->ms = kcalloc(count, sizeof(ipvs->ms[0]), GFP_KERNEL);
                if (!ipvs->ms)
                        goto out;
@@ -1862,39 +1858,38 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
        } else {
                array = kcalloc(count, sizeof(struct task_struct *),
                                GFP_KERNEL);
+                result = -ENOMEM;
                if (!array)
                        goto out;
        }
-        tinfo = NULL;
        for (id = 0; id < count; id++) {
-                if (state == IP_VS_STATE_MASTER)
+                result = -ENOMEM;
-                        sock = make_send_sock(ipvs, id);
-                else
-                        sock = make_receive_sock(ipvs, id, dev->ifindex);
-                if (IS_ERR(sock)) {
-                        result = PTR_ERR(sock);
-                        goto outtinfo;
-                }
                tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
                if (!tinfo)
-                        goto outsocket;
+                        goto out;
                tinfo->ipvs = ipvs;
-                tinfo->sock = sock;
+                tinfo->sock = NULL;
                if (state == IP_VS_STATE_BACKUP) {
                        tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen,
                                             GFP_KERNEL);
                        if (!tinfo->buf)
-                                goto outtinfo;
+                                goto out;
                } else {
                        tinfo->buf = NULL;
                }
                tinfo->id = id;
+                if (state == IP_VS_STATE_MASTER)
+                        result = make_send_sock(ipvs, id, dev, &tinfo->sock);
+                else
+                        result = make_receive_sock(ipvs, id, dev, &tinfo->sock);
+                if (result < 0)
+                        goto out;
                task = kthread_run(threadfn, tinfo, name, ipvs->gen, id);
                if (IS_ERR(task)) {
                        result = PTR_ERR(task);
-                        goto outtinfo;
+                        goto out;
                }
                tinfo = NULL;
                if (state == IP_VS_STATE_MASTER)
@@ -1911,20 +1906,20 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
        ipvs->sync_state |= state;
        spin_unlock_bh(&ipvs->sync_buff_lock);
+        mutex_unlock(&ipvs->sync_mutex);
+        rtnl_unlock();
        /* increase the module use count */
        ip_vs_use_count_inc();
        return 0;
-outsocket:
+out:
-        sock_release(sock);
+        /* We do not need RTNL lock anymore, release it here so that
+         * sock_release below and in the kthreads can use rtnl_lock
-outtinfo:
+         * to leave the mcast group.
-        if (tinfo) {
+         */
-                sock_release(tinfo->sock);
+        rtnl_unlock();
-                kfree(tinfo->buf);
-                kfree(tinfo);
-        }
        count = id;
        while (count-- > 0) {
                if (state == IP_VS_STATE_MASTER)
@@ -1932,13 +1927,23 @@ outtinfo:
                else
                        kthread_stop(array[count]);
        }
-        kfree(array);
-out:
        if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
                kfree(ipvs->ms);
                ipvs->ms = NULL;
        }
+        mutex_unlock(&ipvs->sync_mutex);
+        if (tinfo) {
+                if (tinfo->sock)
+                        sock_release(tinfo->sock);
+                kfree(tinfo->buf);
+                kfree(tinfo);
+        }
+        kfree(array);
+        return result;
+out_early:
+        mutex_unlock(&ipvs->sync_mutex);
+        rtnl_unlock();
        return result;
 }
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 8ef21d9f9a00..4b2b3d53acfc 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -252,7 +252,7 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
 static inline int expect_matches(const struct nf_conntrack_expect *a,
                                 const struct nf_conntrack_expect *b)
 {
-        return a->master == b->master && a->class == b->class &&
+        return a->master == b->master &&
               nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
               nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
               net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) &&
@@ -421,6 +421,9 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
        h = nf_ct_expect_dst_hash(net, &expect->tuple);
        hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
                if (expect_matches(i, expect)) {
+                        if (i->class != expect->class)
+                                return -EALREADY;
                        if (nf_ct_remove_expect(i))
                                break;
                } else if (expect_clash(i, expect)) {
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 9fe0ddc333fb..277bbfe26478 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -9,6 +9,7 @@
 *      2 of the License, or (at your option) any later version.
 */
 #include <linux/kernel.h>
+#include <linux/kmemleak.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
@@ -71,6 +72,7 @@ void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
        rcu_read_unlock();
        alloc = max(newlen, NF_CT_EXT_PREALLOC);
+        kmemleak_not_leak(old);
        new = __krealloc(old, alloc, gfp);
        if (!new)
                return NULL;
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 4dbb5bad4363..908e51e2dc2b 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -938,11 +938,19 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
                                       datalen, rtp_exp, rtcp_exp,
                                       mediaoff, medialen, daddr);
        else {
-                if (nf_ct_expect_related(rtp_exp) == 0) {
+                /* -EALREADY handling works around end-points that send
-                        if (nf_ct_expect_related(rtcp_exp) != 0)
+                 * SDP messages with identical port but different media type,
-                                nf_ct_unexpect_related(rtp_exp);
+                 * we pretend expectation was set up.
-                        else
+                 */
+                int errp = nf_ct_expect_related(rtp_exp);
+                if (errp == 0 || errp == -EALREADY) {
+                        int errcp = nf_ct_expect_related(rtcp_exp);
+                        if (errcp == 0 || errcp == -EALREADY)
                                ret = NF_ACCEPT;
+                        else if (errp == 0)
+                                nf_ct_unexpect_related(rtp_exp);
                }
        }
        nf_ct_expect_put(rtcp_exp);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 9134cc429ad4..04d4e3772584 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2361,41 +2361,46 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
        }
        if (nlh->nlmsg_flags & NLM_F_REPLACE) {
-                if (nft_is_active_next(net, old_rule)) {
+                if (!nft_is_active_next(net, old_rule)) {
-                        trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
-                                                   old_rule);
-                        if (trans == NULL) {
-                                err = -ENOMEM;
-                                goto err2;
-                        }
-                        nft_deactivate_next(net, old_rule);
-                        chain->use--;
-                        list_add_tail_rcu(&rule->list, &old_rule->list);
-                } else {
                        err = -ENOENT;
                        goto err2;
                }
-        } else if (nlh->nlmsg_flags & NLM_F_APPEND)
+                trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
-                if (old_rule)
+                                           old_rule);
-                        list_add_rcu(&rule->list, &old_rule->list);
+                if (trans == NULL) {
-                else
+                        err = -ENOMEM;
-                        list_add_tail_rcu(&rule->list, &chain->rules);
+                        goto err2;
-        else {
+                }
-                if (old_rule)
+                nft_deactivate_next(net, old_rule);
-                        list_add_tail_rcu(&rule->list, &old_rule->list);
+                chain->use--;
-                else
-                        list_add_rcu(&rule->list, &chain->rules);
-        }
-        if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
+                if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
-                err = -ENOMEM;
+                        err = -ENOMEM;
-                goto err3;
+                        goto err2;
+                }
+                list_add_tail_rcu(&rule->list, &old_rule->list);
+        } else {
+                if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
+                        err = -ENOMEM;
+                        goto err2;
+                }
+                if (nlh->nlmsg_flags & NLM_F_APPEND) {
+                        if (old_rule)
+                                list_add_rcu(&rule->list, &old_rule->list);
+                        else
+                                list_add_tail_rcu(&rule->list, &chain->rules);
+                 } else {
+                        if (old_rule)
+                                list_add_tail_rcu(&rule->list, &old_rule->list);
+                        else
+                                list_add_rcu(&rule->list, &chain->rules);
+                }
        }
        chain->use++;
        return 0;
-err3:
-        list_del_rcu(&rule->list);
 err2:
        nf_tables_rule_destroy(&ctx, rule);
 err1:
@@ -3207,18 +3212,20 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
        err = ops->init(set, &desc, nla);
        if (err < 0)
-                goto err2;
+                goto err3;
        err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
        if (err < 0)
-                goto err3;
+                goto err4;
        list_add_tail_rcu(&set->list, &table->sets);
        table->use++;
        return 0;
-err3:
+err4:
        ops->destroy(set);
+err3:
+        kfree(set->name);
 err2:
        kvfree(set);
 err1:
@@ -5738,7 +5745,7 @@ static void nft_chain_commit_update(struct nft_trans *trans)
        struct nft_base_chain *basechain;
        if (nft_trans_chain_name(trans))
-                strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
+                swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
        if (!nft_is_base_chain(trans->ctx.chain))
                return;
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 773da82190dc..94df000abb92 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -36,11 +36,10 @@ MODULE_ALIAS("ipt_connmark");
 MODULE_ALIAS("ip6t_connmark");
 static unsigned int
-connmark_tg_shift(struct sk_buff *skb,
+connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
-                const struct xt_connmark_tginfo1 *info,
-                u8 shift_bits, u8 shift_dir)
 {
        enum ip_conntrack_info ctinfo;
+        u_int32_t new_targetmark;
        struct nf_conn *ct;
        u_int32_t newmark;
@@ -51,34 +50,39 @@ connmark_tg_shift(struct sk_buff *skb,
        switch (info->mode) {
        case XT_CONNMARK_SET:
                newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
-                if (shift_dir == D_SHIFT_RIGHT)
+                if (info->shift_dir == D_SHIFT_RIGHT)
-                        newmark >>= shift_bits;
+                        newmark >>= info->shift_bits;
                else
-                        newmark <<= shift_bits;
+                        newmark <<= info->shift_bits;
                if (ct->mark != newmark) {
                        ct->mark = newmark;
                        nf_conntrack_event_cache(IPCT_MARK, ct);
                }
                break;
        case XT_CONNMARK_SAVE:
-                newmark = (ct->mark & ~info->ctmask) ^
+                new_targetmark = (skb->mark & info->nfmask);
-                          (skb->mark & info->nfmask);
+                if (info->shift_dir == D_SHIFT_RIGHT)
-                if (shift_dir == D_SHIFT_RIGHT)
+                        new_targetmark >>= info->shift_bits;
-                        newmark >>= shift_bits;
                else
-                        newmark <<= shift_bits;
+                        new_targetmark <<= info->shift_bits;
+                newmark = (ct->mark & ~info->ctmask) ^
+                          new_targetmark;
                if (ct->mark != newmark) {
                        ct->mark = newmark;
                        nf_conntrack_event_cache(IPCT_MARK, ct);
                }
                break;
        case XT_CONNMARK_RESTORE:
-                newmark = (skb->mark & ~info->nfmask) ^
+                new_targetmark = (ct->mark & info->ctmask);
-                          (ct->mark & info->ctmask);
+                if (info->shift_dir == D_SHIFT_RIGHT)
-                if (shift_dir == D_SHIFT_RIGHT)
+                        new_targetmark >>= info->shift_bits;
-                        newmark >>= shift_bits;
                else
-                        newmark <<= shift_bits;
+                        new_targetmark <<= info->shift_bits;
+                newmark = (skb->mark & ~info->nfmask) ^
+                          new_targetmark;
                skb->mark = newmark;
                break;
        }
@@ -89,8 +93,14 @@ static unsigned int
 connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct xt_connmark_tginfo1 *info = par->targinfo;
+        const struct xt_connmark_tginfo2 info2 = {
-        return connmark_tg_shift(skb, info, 0, 0);
+                .ctmark = info->ctmark,
+                .ctmask = info->ctmask,
+                .nfmask = info->nfmask,
+                .mode   = info->mode,
+        };
+        return connmark_tg_shift(skb, &info2);
 }
 static unsigned int
@@ -98,8 +108,7 @@ connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct xt_connmark_tginfo2 *info = par->targinfo;
-        return connmark_tg_shift(skb, (const struct xt_connmark_tginfo1 *)info,
+        return connmark_tg_shift(skb, info);
-                                 info->shift_bits, info->shift_dir);
 }
 static int connmark_tg_check(const struct xt_tgchk_param *par)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c31b0687396a..01f3515cada0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -329,11 +329,11 @@ static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
        skb_set_queue_mapping(skb, queue_index);
 }
-/* register_prot_hook must be invoked with the po->bind_lock held,
+/* __register_prot_hook must be invoked through register_prot_hook
 * or from a context in which asynchronous accesses to the packet
 * socket is not possible (packet_create()).
 */
-static void register_prot_hook(struct sock *sk)
+static void __register_prot_hook(struct sock *sk)
 {
        struct packet_sock *po = pkt_sk(sk);
@@ -348,8 +348,13 @@ static void register_prot_hook(struct sock *sk)
        }
 }
-/* {,__}unregister_prot_hook() must be invoked with the po->bind_lock
+static void register_prot_hook(struct sock *sk)
- * held.   If the sync parameter is true, we will temporarily drop
+{
+        lockdep_assert_held_once(&pkt_sk(sk)->bind_lock);
+        __register_prot_hook(sk);
+}
+/* If the sync parameter is true, we will temporarily drop
 * the po->bind_lock and do a synchronize_net to make sure no
 * asynchronous packet processing paths still refer to the elements
 * of po->prot_hook.  If the sync parameter is false, it is the
@@ -359,6 +364,8 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
 {
        struct packet_sock *po = pkt_sk(sk);
+        lockdep_assert_held_once(&po->bind_lock);
        po->running = 0;
        if (po->fanout)
@@ -3252,7 +3259,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
        if (proto) {
                po->prot_hook.type = proto;
-                register_prot_hook(sk);
+                __register_prot_hook(sk);
        }
        mutex_lock(&net->packet.sklist_lock);
@@ -3732,12 +3739,18 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (optlen != sizeof(val))
                        return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
-                po->tp_loss = !!val;
-                return 0;
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_loss = !!val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
        }
        case PACKET_AUXDATA:
        {
@@ -3748,7 +3761,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
+                lock_sock(sk);
                po->auxdata = !!val;
+                release_sock(sk);
                return 0;
        }
        case PACKET_ORIGDEV:
@@ -3760,7 +3775,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
+                lock_sock(sk);
                po->origdev = !!val;
+                release_sock(sk);
                return 0;
        }
        case PACKET_VNET_HDR:
@@ -3769,15 +3786,20 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (sock->type != SOCK_RAW)
                        return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                if (optlen < sizeof(val))
                        return -EINVAL;
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
-                po->has_vnet_hdr = !!val;
+                lock_sock(sk);
-                return 0;
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->has_vnet_hdr = !!val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
        }
        case PACKET_TIMESTAMP:
        {
@@ -3815,11 +3837,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (optlen != sizeof(val))
                        return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
-                po->tp_tx_has_off = !!val;
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_tx_has_off = !!val;
+                        ret = 0;
+                }
+                release_sock(sk);
                return 0;
        }
        case PACKET_QDISC_BYPASS:
diff --git a/net/packet/internal.h b/net/packet/internal.h
index a1d2b2319ae9..3bb7c5fb3bff 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -112,10 +112,12 @@ struct packet_sock {
        int                     copy_thresh;
        spinlock_t              bind_lock;
        struct mutex            pg_vec_lock;
-        unsigned int            running:1,      /* prot_hook is attached*/
+        unsigned int            running;        /* bind_lock must be held */
-                                auxdata:1,
+        unsigned int            auxdata:1,      /* writer must hold sock lock */
                                origdev:1,
-                                has_vnet_hdr:1;
+                                has_vnet_hdr:1,
+                                tp_loss:1,
+                                tp_tx_has_off:1;
        int                     pressure;
        int                     ifindex;        /* bound device         */
        __be16                  num;
@@ -125,8 +127,6 @@ struct packet_sock {
        enum tpacket_versions   tp_version;
        unsigned int            tp_hdrlen;
        unsigned int            tp_reserve;
-        unsigned int            tp_loss:1;
-        unsigned int            tp_tx_has_off:1;
        unsigned int            tp_tstamp;
        struct net_device __rcu *cached_dev;
        int                     (*xmit)(struct sk_buff *skb);
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index a5994cf0512b..8527cfdc446d 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -652,7 +652,7 @@ static int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife,
                }
        }
-        return 0;
+        return -ENOENT;
 }
 static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
@@ -682,7 +682,12 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                u16 mtype;
                u16 dlen;
-                curr_data = ife_tlv_meta_decode(tlv_data, &mtype, &dlen, NULL);
+                curr_data = ife_tlv_meta_decode(tlv_data, ifehdr_end, &mtype,
+                                                &dlen, NULL);
+                if (!curr_data) {
+                        qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
+                        return TC_ACT_SHOT;
+                }
                if (find_decode_metaid(skb, ife, mtype, dlen, curr_data)) {
                        /* abuse overlimits to count when we receive metadata
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 805b139756db..092bebc70048 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -67,7 +67,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
 static void strp_start_timer(struct strparser *strp, long timeo)
 {
-        if (timeo)
+        if (timeo && timeo != LONG_MAX)
                mod_delayed_work(strp_wq, &strp->msg_timer_work, timeo);
 }
diff --git a/security/commoncap.c b/security/commoncap.c
index 48620c93d697..1ce701fcb3f3 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
                                magic |= VFS_CAP_FLAGS_EFFECTIVE;
                        memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
                        cap->magic_etc = cpu_to_le32(magic);
+                } else {
+                        size = -ENOMEM;
                }
        }
        kfree(tmpbuf);
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index 9cf83f895d98..5e1ab2f0eb79 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -12,3 +12,6 @@ test_tcpbpf_user
 test_verifier_log
 feature
 test_libbpf_open
+test_sock
+test_sock_addr
+urandom_read
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 73bb20cfb9b7..f4d99fabc56d 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -13,6 +13,7 @@
 #include <bpf/bpf.h>
 #include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
 #ifndef ARRAY_SIZE
 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
index d488f20926e8..2950f80ba7fb 100644
--- a/tools/testing/selftests/bpf/test_sock_addr.c
+++ b/tools/testing/selftests/bpf/test_sock_addr.c
@@ -15,6 +15,7 @@
 #include <bpf/libbpf.h>
 #include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
 #define CG_PATH "/foo"
 #define CONNECT4_PROG_PATH      "./connect4_prog.o"
diff --git a/tools/testing/selftests/bpf/test_sock_addr.sh b/tools/testing/selftests/bpf/test_sock_addr.sh
index c6e1dcf992c4..9832a875a828 100755
--- a/tools/testing/selftests/bpf/test_sock_addr.sh
+++ b/tools/testing/selftests/bpf/test_sock_addr.sh
@@ -4,7 +4,7 @@ set -eu
 ping_once()
 {
-        ping -q -c 1 -W 1 ${1%%/*} >/dev/null 2>&1
+        ping -${1} -q -c 1 -W 1 ${2%%/*} >/dev/null 2>&1
 }
 wait_for_ip()
@@ -13,7 +13,7 @@ wait_for_ip()
        echo -n "Wait for testing IPv4/IPv6 to become available "
        for _i in $(seq ${MAX_PING_TRIES}); do
                echo -n "."
-                if ping_once ${TEST_IPv4} && ping_once ${TEST_IPv6}; then
+                if ping_once 4 ${TEST_IPv4} && ping_once 6 ${TEST_IPv6}; then
                        echo " OK"
                        return
                fi
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
index 786dce7e48be..2aabab363cfb 100644
--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
@@ -29,7 +29,7 @@ do_reset
 echo "Test extended error support"
 echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_wakeup/trigger
-echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger &>/dev/null
+! echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger 2> /dev/null
 if ! grep -q "ERROR:" events/sched/sched_wakeup/hist; then
    fail "Failed to generate extended error in histogram"
 fi
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
new file mode 100644
index 000000000000..c193dce611a2
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
@@ -0,0 +1,44 @@
+#!/bin/sh
+# description: event trigger - test multiple actions on hist trigger
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+clear_synthetic_events
+reset_tracer
+do_reset
+echo "Test multiple actions on hist trigger"
+echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events
+TRIGGER1=events/sched/sched_wakeup/trigger
+TRIGGER2=events/sched/sched_switch/trigger
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2
+do_reset
+exit 0