374 files changed, 4052 insertions, 2241 deletions

diff --git a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt
index 8ff65fa632fd..c06c045126fc 100644
--- a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt
+++ b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt
@@ -21,7 +21,7 @@ Required properties:
 - interrupts : identifier to the device interrupt
 - clocks : a list of phandle + clock-specifier pairs, one for each
            entry in clock names.
-- clocks-names :
+- clock-names :
    * "xtal" for external xtal clock identifier
    * "pclk" for the bus core clock, either the clk81 clock or the gate clock
    * "baud" for the source of the baudrate generator, can be either the xtal
diff --git a/Documentation/devicetree/bindings/serial/mvebu-uart.txt b/Documentation/devicetree/bindings/serial/mvebu-uart.txt
index 2ae2fee7e023..b7e0e32b9ac6 100644
--- a/Documentation/devicetree/bindings/serial/mvebu-uart.txt
+++ b/Documentation/devicetree/bindings/serial/mvebu-uart.txt
@@ -24,7 +24,7 @@ Required properties:
     - Must contain two elements for the extended variant of the IP
       (marvell,armada-3700-uart-ext): "uart-tx" and "uart-rx",
       respectively the UART TX interrupt and the UART RX interrupt. A
-      corresponding interrupts-names property must be defined.
+      corresponding interrupt-names property must be defined.
     - For backward compatibility reasons, a single element interrupts
       property is also supported for the standard variant of the IP,
       containing only the UART sum interrupt. This form is deprecated
diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
index ad962f4ec3aa..a006ea4d065f 100644
--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
+++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
@@ -17,6 +17,8 @@ Required properties:
     - "renesas,scifa-r8a7745" for R8A7745 (RZ/G1E) SCIFA compatible UART.
     - "renesas,scifb-r8a7745" for R8A7745 (RZ/G1E) SCIFB compatible UART.
     - "renesas,hscif-r8a7745" for R8A7745 (RZ/G1E) HSCIF compatible UART.
+    - "renesas,scif-r8a77470" for R8A77470 (RZ/G1C) SCIF compatible UART.
+    - "renesas,hscif-r8a77470" for R8A77470 (RZ/G1C) HSCIF compatible UART.
     - "renesas,scif-r8a7778" for R8A7778 (R-Car M1) SCIF compatible UART.
     - "renesas,scif-r8a7779" for R8A7779 (R-Car H1) SCIF compatible UART.
     - "renesas,scif-r8a7790" for R8A7790 (R-Car H2) SCIF compatible UART.
diff --git a/Documentation/devicetree/bindings/usb/usb-xhci.txt b/Documentation/devicetree/bindings/usb/usb-xhci.txt
index c4c00dff4b56..bd1dd316fb23 100644
--- a/Documentation/devicetree/bindings/usb/usb-xhci.txt
+++ b/Documentation/devicetree/bindings/usb/usb-xhci.txt
@@ -28,7 +28,10 @@ Required properties:
   - interrupts: one XHCI interrupt should be described here.
 
 Optional properties:
-  - clocks: reference to a clock
+  - clocks: reference to the clocks
+  - clock-names: mandatory if there is a second clock, in this case
+    the name must be "core" for the first clock and "reg" for the
+    second one
   - usb2-lpm-disable: indicate if we don't want to enable USB2 HW LPM
   - usb3-lpm-capable: determines if platform is USB3 LPM capable
   - quirk-broken-port-ped: set if the controller has broken port disable mechanism
diff --git a/Documentation/driver-api/firmware/request_firmware.rst b/Documentation/driver-api/firmware/request_firmware.rst
index cf4516dfbf96..d5ec95a7195b 100644
--- a/Documentation/driver-api/firmware/request_firmware.rst
+++ b/Documentation/driver-api/firmware/request_firmware.rst
@@ -17,17 +17,17 @@ an error is returned.
 
 request_firmware
 ----------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware
 
 request_firmware_direct
 -----------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware_direct
 
 request_firmware_into_buf
 -------------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware_into_buf
 
 Asynchronous firmware requests
@@ -41,7 +41,7 @@ in atomic contexts.
 
 request_firmware_nowait
 -----------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware_nowait
 
 Special optimizations on reboot
@@ -50,12 +50,12 @@ Special optimizations on reboot
 Some devices have an optimization in place to enable the firmware to be
 retained during system reboot. When such optimizations are used the driver
 author must ensure the firmware is still available on resume from suspend,
-this can be done with firmware_request_cache() insted of requesting for the
-firmare to be loaded.
+this can be done with firmware_request_cache() instead of requesting for the
+firmware to be loaded.
 
 firmware_request_cache()
------------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+------------------------
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: firmware_request_cache
 
 request firmware API expected driver use
diff --git a/Documentation/driver-api/infrastructure.rst b/Documentation/driver-api/infrastructure.rst
index 6d9ff316b608..bee1b9a1702f 100644
--- a/Documentation/driver-api/infrastructure.rst
+++ b/Documentation/driver-api/infrastructure.rst
@@ -28,7 +28,7 @@ Device Drivers Base
 .. kernel-doc:: drivers/base/node.c
    :internal:
 
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :export:
 
 .. kernel-doc:: drivers/base/transport_class.c
diff --git a/Documentation/driver-api/usb/typec.rst b/Documentation/driver-api/usb/typec.rst
index feb31946490b..48ff58095f11 100644
--- a/Documentation/driver-api/usb/typec.rst
+++ b/Documentation/driver-api/usb/typec.rst
@@ -210,7 +210,7 @@ If the connector is dual-role capable, there may also be a switch for the data
 role. USB Type-C Connector Class does not supply separate API for them. The
 port drivers can use USB Role Class API with those.
 
-Illustration of the muxes behind a connector that supports an alternate mode:
+Illustration of the muxes behind a connector that supports an alternate mode::
 
                      ------------------------
                      |       Connector      |
diff --git a/Documentation/i2c/dev-interface b/Documentation/i2c/dev-interface
index d04e6e4964ee..fbed645ccd75 100644
--- a/Documentation/i2c/dev-interface
+++ b/Documentation/i2c/dev-interface
@@ -9,8 +9,8 @@ i2c adapters present on your system at a given time. i2cdetect is part of
 the i2c-tools package.
 
 I2C device files are character device files with major device number 89
-and a minor device number corresponding to the number assigned as 
-explained above. They should be called "i2c-%d" (i2c-0, i2c-1, ..., 
+and a minor device number corresponding to the number assigned as
+explained above. They should be called "i2c-%d" (i2c-0, i2c-1, ...,
 i2c-10, ...). All 256 minor device numbers are reserved for i2c.
 
 
@@ -23,11 +23,6 @@ First, you need to include these two headers:
   #include <linux/i2c-dev.h>
   #include <i2c/smbus.h>
 
-(Please note that there are two files named "i2c-dev.h" out there. One is
-distributed with the Linux kernel and the other one is included in the
-source tree of i2c-tools. They used to be different in content but since 2012
-they're identical. You should use "linux/i2c-dev.h").
-
 Now, you have to decide which adapter you want to access. You should
 inspect /sys/class/i2c-dev/ or run "i2cdetect -l" to decide this.
 Adapter numbers are assigned somewhat dynamically, so you can not
@@ -38,7 +33,7 @@ Next thing, open the device file, as follows:
   int file;
   int adapter_nr = 2; /* probably dynamically determined */
   char filename[20];
-  
+
   snprintf(filename, 19, "/dev/i2c-%d", adapter_nr);
   file = open(filename, O_RDWR);
   if (file < 0) {
@@ -72,8 +67,10 @@ the device supports them. Both are illustrated below.
     /* res contains the read word */
   }
 
-  /* Using I2C Write, equivalent of 
-     i2c_smbus_write_word_data(file, reg, 0x6543) */
+  /*
+   * Using I2C Write, equivalent of
+   * i2c_smbus_write_word_data(file, reg, 0x6543)
+   */
   buf[0] = reg;
   buf[1] = 0x43;
   buf[2] = 0x65;
@@ -140,14 +137,14 @@ ioctl(file, I2C_RDWR, struct i2c_rdwr_ioctl_data *msgset)
   set in each message, overriding the values set with the above ioctl's.
 
 ioctl(file, I2C_SMBUS, struct i2c_smbus_ioctl_data *args)
-  Not meant to be called  directly; instead, use the access functions
-  below.
+  If possible, use the provided i2c_smbus_* methods described below instead
+  of issuing direct ioctls.
 
 You can do plain i2c transactions by using read(2) and write(2) calls.
 You do not need to pass the address byte; instead, set it through
 ioctl I2C_SLAVE before you try to access the device.
 
-You can do SMBus level transactions (see documentation file smbus-protocol 
+You can do SMBus level transactions (see documentation file smbus-protocol
 for details) through the following functions:
   __s32 i2c_smbus_write_quick(int file, __u8 value);
   __s32 i2c_smbus_read_byte(int file);
@@ -158,7 +155,7 @@ for details) through the following functions:
   __s32 i2c_smbus_write_word_data(int file, __u8 command, __u16 value);
   __s32 i2c_smbus_process_call(int file, __u8 command, __u16 value);
   __s32 i2c_smbus_read_block_data(int file, __u8 command, __u8 *values);
-  __s32 i2c_smbus_write_block_data(int file, __u8 command, __u8 length, 
+  __s32 i2c_smbus_write_block_data(int file, __u8 command, __u8 length,
                                    __u8 *values);
 All these transactions return -1 on failure; you can read errno to see
 what happened. The 'write' transactions return 0 on success; the
@@ -166,10 +163,9 @@ what happened. The 'write' transactions return 0 on success; the
 returns the number of values read. The block buffers need not be longer
 than 32 bytes.
 
-The above functions are all inline functions, that resolve to calls to
-the i2c_smbus_access function, that on its turn calls a specific ioctl
-with the data in a specific format. Read the source code if you
-want to know what happens behind the screens.
+The above functions are made available by linking against the libi2c library,
+which is provided by the i2c-tools project.  See:
+https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/.
 
 
 Implementation details
diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index 84bb74dcae12..7f7413e597f3 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -217,7 +217,6 @@ Code  Seq#(hex)	Include File		Comments
 'd'     02-40   pcmcia/ds.h             conflict!
 'd'     F0-FF   linux/digi1.h
 'e'     all     linux/digi1.h           conflict!
-'e'     00-1F   drivers/net/irda/irtty-sir.h    conflict!
 'f'     00-1F   linux/ext2_fs.h         conflict!
 'f'     00-1F   linux/ext3_fs.h         conflict!
 'f'     00-0F   fs/jfs/jfs_dinode.h     conflict!
@@ -247,7 +246,6 @@ Code  Seq#(hex)	Include File		Comments
 'm'     all     linux/synclink.h        conflict!
 'm'     00-19   drivers/message/fusion/mptctl.h conflict!
 'm'     00      drivers/scsi/megaraid/megaraid_ioctl.h  conflict!
-'m'     00-1F   net/irda/irmod.h        conflict!
 'n'     00-7F   linux/ncp_fs.h and fs/ncpfs/ioctl.c
 'n'     80-8F   uapi/linux/nilfs2_api.h NILFS2
 'n'     E0-FF   linux/matroxfb.h        matroxfb
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index b583a73cf95f..35ffaa281b26 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -2126,18 +2126,3 @@ max_dgram_qlen - INTEGER
 
         Default: 10
 
-
-UNDOCUMENTED:
-
-/proc/sys/net/irda/*
-        fast_poll_increase FIXME
-        warn_noreply_time FIXME
-        discovery_slots FIXME
-        slot_timeout FIXME
-        max_baud_rate FIXME
-        discovery_timeout FIXME
-        lap_keepalive_time FIXME
-        max_noreply_time FIXME
-        max_tx_data_size FIXME
-        max_tx_window FIXME
-        min_tx_turn_time FIXME
diff --git a/Documentation/power/suspend-and-cpuhotplug.txt b/Documentation/power/suspend-and-cpuhotplug.txt
index 31abd04b9572..6f55eb960a6d 100644
--- a/Documentation/power/suspend-and-cpuhotplug.txt
+++ b/Documentation/power/suspend-and-cpuhotplug.txt
@@ -168,7 +168,7 @@ update on the CPUs, as discussed below:
 
 [Please bear in mind that the kernel requests the microcode images from
 userspace, using the request_firmware() function defined in
-drivers/base/firmware_class.c]
+drivers/base/firmware_loader/main.c]
 
 
 a. When all the CPUs are identical:
diff --git a/Documentation/process/magic-number.rst b/Documentation/process/magic-number.rst
index 00cecf1fcba9..633be1043690 100644
--- a/Documentation/process/magic-number.rst
+++ b/Documentation/process/magic-number.rst
@@ -157,8 +157,5 @@ memory management. See ``include/sound/sndmagic.h`` for complete list of them. M
 OSS sound drivers have their magic numbers constructed from the soundcard PCI
 ID - these are not listed here as well.
 
-IrDA subsystem also uses large number of own magic numbers, see
-``include/net/irda/irda.h`` for a complete list of them.
-
 HFS is another larger user of magic numbers - you can find them in
 ``fs/hfs/hfs.h``.
diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
index e45f0786f3f9..67d9c38e95eb 100644
--- a/Documentation/trace/ftrace.rst
+++ b/Documentation/trace/ftrace.rst
@@ -461,9 +461,17 @@ of ftrace. Here is a list of some of the key files:
                 and ticks at the same rate as the hardware clocksource.
 
         boot:
-                Same as mono. Used to be a separate clock which accounted
-                for the time spent in suspend while CLOCK_MONOTONIC did
-                not.
+                This is the boot clock (CLOCK_BOOTTIME) and is based on the
+                fast monotonic clock, but also accounts for time spent in
+                suspend. Since the clock access is designed for use in
+                tracing in the suspend path, some side effects are possible
+                if clock is accessed after the suspend time is accounted before
+                the fast mono clock is updated. In this case, the clock update
+                appears to happen slightly sooner than it normally would have.
+                Also on 32-bit systems, it's possible that the 64-bit boot offset
+                sees a partial update. These effects are rare and post
+                processing should be able to handle them. See comments in the
+                ktime_get_boot_fast_ns() function for more information.
 
         To set a clock, simply echo the clock name into this file::
 
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 1c7958b57fe9..758bf403a169 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -1960,6 +1960,9 @@ ARM 32-bit VFP control registers have the following id bit patterns:
 ARM 64-bit FP registers have the following id bit patterns:
   0x4030 0000 0012 0 <regno:12>
 
+ARM firmware pseudo-registers have the following bit pattern:
+  0x4030 0000 0014 <regno:16>
+
 
 arm64 registers are mapped using the lower 32 bits. The upper 16 of
 that is the register group type, or coprocessor number:
@@ -1976,6 +1979,9 @@ arm64 CCSIDR registers are demultiplexed by CSSELR value:
 arm64 system registers have the following id bit patterns:
   0x6030 0000 0013 <op0:2> <op1:3> <crn:4> <crm:4> <op2:3>
 
+arm64 firmware pseudo-registers have the following bit pattern:
+  0x6030 0000 0014 <regno:16>
+
 
 MIPS registers are mapped using the lower 32 bits.  The upper 16 of that is
 the register group type:
@@ -2510,7 +2516,8 @@ Possible features:
           and execute guest code when KVM_RUN is called.
         - KVM_ARM_VCPU_EL1_32BIT: Starts the CPU in a 32bit mode.
           Depends on KVM_CAP_ARM_EL1_32BIT (arm64 only).
-        - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 for the CPU.
+        - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 (or a future revision
+          backward compatible with v0.2) for the CPU.
           Depends on KVM_CAP_ARM_PSCI_0_2.
         - KVM_ARM_VCPU_PMU_V3: Emulate PMUv3 for the CPU.
           Depends on KVM_CAP_ARM_PMU_V3.
diff --git a/Documentation/virtual/kvm/arm/psci.txt b/Documentation/virtual/kvm/arm/psci.txt
new file mode 100644
index 000000000000..aafdab887b04
--- /dev/null
+++ b/Documentation/virtual/kvm/arm/psci.txt
@@ -0,0 +1,30 @@
+KVM implements the PSCI (Power State Coordination Interface)
+specification in order to provide services such as CPU on/off, reset
+and power-off to the guest.
+
+The PSCI specification is regularly updated to provide new features,
+and KVM implements these updates if they make sense from a virtualization
+point of view.
+
+This means that a guest booted on two different versions of KVM can
+observe two different "firmware" revisions. This could cause issues if
+a given guest is tied to a particular PSCI revision (unlikely), or if
+a migration causes a different PSCI version to be exposed out of the
+blue to an unsuspecting guest.
+
+In order to remedy this situation, KVM exposes a set of "firmware
+pseudo-registers" that can be manipulated using the GET/SET_ONE_REG
+interface. These registers can be saved/restored by userspace, and set
+to a convenient value if required.
+
+The following register is defined:
+
+* KVM_REG_ARM_PSCI_VERSION:
+
+  - Only valid if the vcpu has the KVM_ARM_VCPU_PSCI_0_2 feature set
+    (and thus has already been initialized)
+  - Returns the current PSCI version on GET_ONE_REG (defaulting to the
+    highest PSCI version implemented by KVM and compatible with v0.2)
+  - Allows any PSCI version implemented by KVM and compatible with
+    v0.2 to be set with SET_ONE_REG
+  - Affects the whole VM (even if the register view is per-vcpu)
diff --git a/MAINTAINERS b/MAINTAINERS
index 92be777d060a..79bb02ff812f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -564,8 +564,9 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/af9033*
 
 AFFS FILE SYSTEM
+M:      David Sterba <dsterba@suse.com>
 L:      linux-fsdevel@vger.kernel.org
-S:      Orphan
+S:      Odd Fixes
 F:      Documentation/filesystems/affs.txt
 F:      fs/affs/
 
@@ -905,6 +906,8 @@ ANDROID ION DRIVER
 M:      Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
+L:      dri-devel@lists.freedesktop.org
+L:      linaro-mm-sig@lists.linaro.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
@@ -1208,7 +1211,6 @@ F:	drivers/*/*alpine*
 ARM/ARTPEC MACHINE SUPPORT
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
 M:      Lars Persson <lars.persson@axis.com>
-M:      Niklas Cassel <niklas.cassel@axis.com>
 S:      Maintained
 L:      linux-arm-kernel@axis.com
 F:      arch/arm/mach-artpec
@@ -2617,7 +2619,7 @@ S:	Maintained
 F:      drivers/net/hamradio/baycom*
 
 BCACHE (BLOCK LAYER CACHE)
-M:      Michael Lyle <mlyle@lyle.org>
+M:      Coly Li <colyli@suse.de>
 M:      Kent Overstreet <kent.overstreet@gmail.com>
 L:      linux-bcache@vger.kernel.org
 W:      http://bcache.evilpiepirate.org
@@ -7411,16 +7413,6 @@ S:	Obsolete
 F:      include/uapi/linux/ipx.h
 F:      drivers/staging/ipx/
 
-IRDA SUBSYSTEM
-M:      Samuel Ortiz <samuel@sortiz.org>
-L:      irda-users@lists.sourceforge.net (subscribers-only)
-L:      netdev@vger.kernel.org
-W:      http://irda.sourceforge.net/
-S:      Obsolete
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sameo/irda-2.6.git
-F:      Documentation/networking/irda.txt
-F:      drivers/staging/irda/
-
 IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
 M:      Marc Zyngier <marc.zyngier@arm.com>
 S:      Maintained
@@ -7753,7 +7745,7 @@ F:	arch/x86/include/asm/svm.h
 F:      arch/x86/kvm/svm.c
 
 KERNEL VIRTUAL MACHINE FOR ARM (KVM/arm)
-M:      Christoffer Dall <christoffer.dall@linaro.org>
+M:      Christoffer Dall <christoffer.dall@arm.com>
 M:      Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
@@ -7767,7 +7759,7 @@ F:	virt/kvm/arm/
 F:      include/kvm/arm_*
 
 KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)
-M:      Christoffer Dall <christoffer.dall@linaro.org>
+M:      Christoffer Dall <christoffer.dall@arm.com>
 M:      Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
@@ -10909,7 +10901,6 @@ F:	drivers/pci/host/
 F:      drivers/pci/dwc/
 
 PCIE DRIVER FOR AXIS ARTPEC
-M:      Niklas Cassel <niklas.cassel@axis.com>
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
 L:      linux-arm-kernel@axis.com
 L:      linux-pci@vger.kernel.org
@@ -13965,7 +13956,7 @@ THUNDERBOLT DRIVER
 M:      Andreas Noever <andreas.noever@gmail.com>
 M:      Michael Jamet <michael.jamet@intel.com>
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+M:      Yehezkel Bernat <YehezkelShB@gmail.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git
 S:      Maintained
 F:      Documentation/admin-guide/thunderbolt.rst
@@ -13975,7 +13966,7 @@ F:	include/linux/thunderbolt.h
 THUNDERBOLT NETWORK DRIVER
 M:      Michael Jamet <michael.jamet@intel.com>
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+M:      Yehezkel Bernat <YehezkelShB@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/thunderbolt.c
diff --git a/Makefile b/Makefile
index 83b6c541565a..619a85ad716b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 17
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/gemini-nas4220b.dts b/arch/arm/boot/dts/gemini-nas4220b.dts
index 8bbb6f85d161..4785fbcc41ed 100644
--- a/arch/arm/boot/dts/gemini-nas4220b.dts
+++ b/arch/arm/boot/dts/gemini-nas4220b.dts
@@ -134,37 +134,37 @@
                                                 function = "gmii";
                                                 groups = "gmii_gmac0_grp";
                                         };
-                                        /* Settings come from OpenWRT */
+                                        /* Settings come from OpenWRT, pins on SL3516 */
                                         conf0 {
-                                                pins = "R8 GMAC0 RXDV", "U11 GMAC1 RXDV";
+                                                pins = "V8 GMAC0 RXDV", "T10 GMAC1 RXDV";
                                                 skew-delay = <0>;
                                         };
                                         conf1 {
-                                                pins = "T8 GMAC0 RXC", "T11 GMAC1 RXC";
+                                                pins = "Y7 GMAC0 RXC", "Y11 GMAC1 RXC";
                                                 skew-delay = <15>;
                                         };
                                         conf2 {
-                                                pins = "P8 GMAC0 TXEN", "V11 GMAC1 TXEN";
+                                                pins = "T8 GMAC0 TXEN", "W11 GMAC1 TXEN";
                                                 skew-delay = <7>;
                                         };
                                         conf3 {
-                                                pins = "V7 GMAC0 TXC";
+                                                pins = "U8 GMAC0 TXC";
                                                 skew-delay = <11>;
                                         };
                                         conf4 {
-                                                pins = "P10 GMAC1 TXC";
+                                                pins = "V11 GMAC1 TXC";
                                                 skew-delay = <10>;
                                         };
                                         conf5 {
                                                 /* The data lines all have default skew */
-                                                pins = "U8 GMAC0 RXD0", "V8 GMAC0 RXD1",
-                                                       "P9 GMAC0 RXD2", "R9 GMAC0 RXD3",
-                                                       "U7 GMAC0 TXD0", "T7 GMAC0 TXD1",
-                                                       "R7 GMAC0 TXD2", "P7 GMAC0 TXD3",
-                                                       "R11 GMAC1 RXD0", "P11 GMAC1 RXD1",
-                                                       "V12 GMAC1 RXD2", "U12 GMAC1 RXD3",
-                                                       "R10 GMAC1 TXD0", "T10 GMAC1 TXD1",
-                                                       "U10 GMAC1 TXD2", "V10 GMAC1 TXD3";
+                                                pins = "W8 GMAC0 RXD0", "V9 GMAC0 RXD1",
+                                                       "Y8 GMAC0 RXD2", "U9 GMAC0 RXD3",
+                                                       "T7 GMAC0 TXD0", "U6 GMAC0 TXD1",
+                                                       "V7 GMAC0 TXD2", "U7 GMAC0 TXD3",
+                                                       "Y12 GMAC1 RXD0", "V12 GMAC1 RXD1",
+                                                       "T11 GMAC1 RXD2", "W12 GMAC1 RXD3",
+                                                       "U10 GMAC1 TXD0", "Y10 GMAC1 TXD1",
+                                                       "W10 GMAC1 TXD2", "T9 GMAC1 TXD3";
                                                 skew-delay = <7>;
                                         };
                                         /* Set up drive strength on GMAC0 to 16 mA */
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 475904894b86..e554b6e039f3 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -163,10 +163,10 @@
 
                         cm2: cm2@8000 {
                                 compatible = "ti,omap4-cm2", "simple-bus";
-                                reg = <0x8000 0x3000>;
+                                reg = <0x8000 0x2000>;
                                 #address-cells = <1>;
                                 #size-cells = <1>;
-                                ranges = <0 0x8000 0x3000>;
+                                ranges = <0 0x8000 0x2000>;
 
                                 cm2_clocks: clocks {
                                         #address-cells = <1>;
@@ -250,11 +250,11 @@
 
                                 prm: prm@6000 {
                                         compatible = "ti,omap4-prm";
-                                        reg = <0x6000 0x3000>;
+                                        reg = <0x6000 0x2000>;
                                         interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
                                         #address-cells = <1>;
                                         #size-cells = <1>;
-                                        ranges = <0 0x6000 0x3000>;
+                                        ranges = <0 0x6000 0x2000>;
 
                                         prm_clocks: clocks {
                                                 #address-cells = <1>;
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
index 2a63fa10c813..553777ac2814 100644
--- a/arch/arm/configs/gemini_defconfig
+++ b/arch/arm/configs/gemini_defconfig
@@ -1,6 +1,7 @@
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_USER_NS=y
 CONFIG_RELAY=y
@@ -12,15 +13,21 @@ CONFIG_ARCH_GEMINI=y
 CONFIG_PCI=y
 CONFIG_PREEMPT=y
 CONFIG_AEABI=y
+CONFIG_HIGHMEM=y
+CONFIG_CMA=y
 CONFIG_CMDLINE="console=ttyS0,115200n8"
 CONFIG_KEXEC=y
 CONFIG_BINFMT_MISC=y
 CONFIG_PM=y
+CONFIG_NET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_CFI_AMDSTD=y
 CONFIG_MTD_CFI_STAA=y
@@ -33,6 +40,11 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=y
 CONFIG_PATA_FTIDE010=y
+CONFIG_NETDEVICES=y
+CONFIG_GEMINI_ETHERNET=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_GPIO=y
+CONFIG_REALTEK_PHY=y
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
@@ -43,9 +55,19 @@ CONFIG_SERIAL_8250_NR_UARTS=1
 CONFIG_SERIAL_8250_RUNTIME_UARTS=1
 CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HW_RANDOM is not set
-# CONFIG_HWMON is not set
+CONFIG_I2C_GPIO=y
+CONFIG_SPI=y
+CONFIG_SPI_GPIO=y
+CONFIG_SENSORS_GPIO_FAN=y
+CONFIG_SENSORS_LM75=y
+CONFIG_THERMAL=y
 CONFIG_WATCHDOG=y
-CONFIG_GEMINI_WATCHDOG=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_DRM=y
+CONFIG_DRM_PANEL_ILITEK_IL9322=y
+CONFIG_DRM_TVE200=y
+CONFIG_LOGO=y
 CONFIG_USB=y
 CONFIG_USB_MON=y
 CONFIG_USB_FOTG210_HCD=y
@@ -54,6 +76,7 @@ CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_DISK=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
 CONFIG_DMADEVICES=y
diff --git a/arch/arm/configs/socfpga_defconfig b/arch/arm/configs/socfpga_defconfig
index 2620ce790db0..371fca4e1ab7 100644
--- a/arch/arm/configs/socfpga_defconfig
+++ b/arch/arm/configs/socfpga_defconfig
@@ -57,6 +57,7 @@ CONFIG_MTD_M25P80=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_DENALI_DT=y
 CONFIG_MTD_SPI_NOR=y
+# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
 CONFIG_SPI_CADENCE_QUADSPI=y
 CONFIG_OF_OVERLAY=y
 CONFIG_OF_CONFIGFS=y
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index c6a749568dd6..c7c28c885a19 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -77,6 +77,9 @@ struct kvm_arch {
         /* Interrupt controller */
         struct vgic_dist        vgic;
         int max_vcpus;
+
+        /* Mandated version of PSCI */
+        u32 psci_version;
 };
 
 #define KVM_NR_MEM_OBJS     40
diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h
index 2ba95d6fe852..caae4843cb70 100644
--- a/arch/arm/include/uapi/asm/kvm.h
+++ b/arch/arm/include/uapi/asm/kvm.h
@@ -195,6 +195,12 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_VFP_FPINST          0x1009
 #define KVM_REG_ARM_VFP_FPINST2         0x100A
 
+/* KVM-as-firmware specific pseudo-registers */
+#define KVM_REG_ARM_FW                  (0x0014 << KVM_REG_ARM_COPROC_SHIFT)
+#define KVM_REG_ARM_FW_REG(r)           (KVM_REG_ARM | KVM_REG_SIZE_U64 | \
+                                         KVM_REG_ARM_FW | ((r) & 0xffff))
+#define KVM_REG_ARM_PSCI_VERSION        KVM_REG_ARM_FW_REG(0)
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR       0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c
index 1e0784ebbfd6..a18f33edc471 100644
--- a/arch/arm/kvm/guest.c
+++ b/arch/arm/kvm/guest.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
+#include <kvm/arm_psci.h>
 #include <asm/cputype.h>
 #include <linux/uaccess.h>
 #include <asm/kvm.h>
@@ -176,6 +177,7 @@ static unsigned long num_core_regs(void)
 unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu)
 {
         return num_core_regs() + kvm_arm_num_coproc_regs(vcpu)
+                + kvm_arm_get_fw_num_regs(vcpu)
                 + NUM_TIMER_REGS;
 }
 
@@ -196,6 +198,11 @@ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
                 uindices++;
         }
 
+        ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices);
+        if (ret)
+                return ret;
+        uindices += kvm_arm_get_fw_num_regs(vcpu);
+
         ret = copy_timer_indices(vcpu, uindices);
         if (ret)
                 return ret;
@@ -214,6 +221,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return get_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_get_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return get_timer_reg(vcpu, reg);
 
@@ -230,6 +240,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return set_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_set_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return set_timer_reg(vcpu, reg);
 
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 4603c30fef73..0d9ce58bc464 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -243,8 +243,4 @@ arch/arm/mach-omap2/pm-asm-offsets.s: arch/arm/mach-omap2/pm-asm-offsets.c
 include/generated/ti-pm-asm-offsets.h: arch/arm/mach-omap2/pm-asm-offsets.s FORCE
         $(call filechk,offsets,__TI_PM_ASM_OFFSETS_H__)
 
-# For rule to generate ti-emif-asm-offsets.h dependency
-include drivers/memory/Makefile.asm-offsets
-
-arch/arm/mach-omap2/sleep33xx.o: include/generated/ti-pm-asm-offsets.h include/generated/ti-emif-asm-offsets.h
-arch/arm/mach-omap2/sleep43xx.o: include/generated/ti-pm-asm-offsets.h include/generated/ti-emif-asm-offsets.h
+$(obj)/sleep33xx.o $(obj)/sleep43xx.o: include/generated/ti-pm-asm-offsets.h
diff --git a/arch/arm/mach-omap2/pm-asm-offsets.c b/arch/arm/mach-omap2/pm-asm-offsets.c
index 6d4392da7c11..b9846b19e5e2 100644
--- a/arch/arm/mach-omap2/pm-asm-offsets.c
+++ b/arch/arm/mach-omap2/pm-asm-offsets.c
@@ -7,9 +7,12 @@
 
 #include <linux/kbuild.h>
 #include <linux/platform_data/pm33xx.h>
+#include <linux/ti-emif-sram.h>
 
 int main(void)
 {
+        ti_emif_asm_offsets();
+
         DEFINE(AMX3_PM_WFI_FLAGS_OFFSET,
                offsetof(struct am33xx_pm_sram_data, wfi_flags));
         DEFINE(AMX3_PM_L2_AUX_CTRL_VAL_OFFSET,
diff --git a/arch/arm/mach-omap2/sleep33xx.S b/arch/arm/mach-omap2/sleep33xx.S
index 218d79930b04..322b3bb868b4 100644
--- a/arch/arm/mach-omap2/sleep33xx.S
+++ b/arch/arm/mach-omap2/sleep33xx.S
@@ -6,7 +6,6 @@
  *      Dave Gerlach, Vaibhav Bedia
  */
 
-#include <generated/ti-emif-asm-offsets.h>
 #include <generated/ti-pm-asm-offsets.h>
 #include <linux/linkage.h>
 #include <linux/ti-emif-sram.h>
diff --git a/arch/arm/mach-omap2/sleep43xx.S b/arch/arm/mach-omap2/sleep43xx.S
index b24be624e8b9..8903814a6677 100644
--- a/arch/arm/mach-omap2/sleep43xx.S
+++ b/arch/arm/mach-omap2/sleep43xx.S
@@ -6,7 +6,6 @@
  *      Dave Gerlach, Vaibhav Bedia
  */
 
-#include <generated/ti-emif-asm-offsets.h>
 #include <generated/ti-pm-asm-offsets.h>
 #include <linux/linkage.h>
 #include <linux/ti-emif-sram.h>
diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c
index 59589a4a0d4b..885e8f12e4b9 100644
--- a/arch/arm/mach-s3c24xx/mach-jive.c
+++ b/arch/arm/mach-s3c24xx/mach-jive.c
@@ -427,9 +427,9 @@ static struct gpiod_lookup_table jive_wm8750_gpiod_table = {
         .dev_id         = "spi_gpio",
         .table          = {
                 GPIO_LOOKUP("GPIOB", 4,
-                            "gpio-sck", GPIO_ACTIVE_HIGH),
+                            "sck", GPIO_ACTIVE_HIGH),
                 GPIO_LOOKUP("GPIOB", 9,
-                            "gpio-mosi", GPIO_ACTIVE_HIGH),
+                            "mosi", GPIO_ACTIVE_HIGH),
                 GPIO_LOOKUP("GPIOH", 10,
                             "cs", GPIO_ACTIVE_HIGH),
                 { },
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 15402861bb59..87f7d2f9f17c 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -56,7 +56,11 @@ KBUILD_AFLAGS	+= $(lseinstr) $(brokengasinst)
 KBUILD_CFLAGS   += $(call cc-option,-mabi=lp64)
 KBUILD_AFLAGS   += $(call cc-option,-mabi=lp64)
 
+ifeq ($(cc-name),clang)
+KBUILD_CFLAGS   += -DCONFIG_ARCH_SUPPORTS_INT128
+else
 KBUILD_CFLAGS   += $(call cc-ifversion, -ge, 0500, -DCONFIG_ARCH_SUPPORTS_INT128)
+endif
 
 ifeq ($(CONFIG_CPU_BIG_ENDIAN), y)
 KBUILD_CPPFLAGS += -mbig-endian
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index 4eef36b22538..88e712ea757a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -212,3 +212,7 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index 22bf37404ff1..3e3eb31748a3 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -271,3 +271,15 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
+
+&usb2_phy0 {
+        /*
+         * even though the schematics don't show it:
+         * HDMI_5V is also used as supply for the USB VBUS.
+         */
+        phy-supply = <&hdmi_5v>;
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 69c721a70e44..6739697be1de 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -215,3 +215,7 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index 0a0953fbc7d4..0cfd701809de 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -185,3 +185,7 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index e1a39cbed8c9..dba365ed4bd5 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -20,6 +20,67 @@
                         no-map;
                 };
         };
+
+        soc {
+                usb0: usb@c9000000 {
+                        status = "disabled";
+                        compatible = "amlogic,meson-gxl-dwc3";
+                        #address-cells = <2>;
+                        #size-cells = <2>;
+                        ranges;
+
+                        clocks = <&clkc CLKID_USB>;
+                        clock-names = "usb_general";
+                        resets = <&reset RESET_USB_OTG>;
+                        reset-names = "usb_otg";
+
+                        dwc3: dwc3@c9000000 {
+                                compatible = "snps,dwc3";
+                                reg = <0x0 0xc9000000 0x0 0x100000>;
+                                interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+                                dr_mode = "host";
+                                maximum-speed = "high-speed";
+                                snps,dis_u2_susphy_quirk;
+                                phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>;
+                        };
+                };
+        };
+};
+
+&apb {
+        usb2_phy0: phy@78000 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78000 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+
+        usb2_phy1: phy@78020 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78020 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+
+        usb3_phy: phy@78080 {
+                compatible = "amlogic,meson-gxl-usb3-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78080 0x0 0x20>;
+                interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>;
+                clocks = <&clkc CLKID_USB>, <&clkc_AO CLKID_AO_CEC_32K>;
+                clock-names = "phy", "peripheral";
+                resets = <&reset RESET_USB_OTG>, <&reset RESET_USB_OTG>;
+                reset-names = "phy", "peripheral";
+                status = "okay";
+        };
 };
 
 &ethmac {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 4fd46c1546a7..0868da476e41 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -406,3 +406,7 @@
         status = "okay";
         vref-supply = <&vddio_ao18>;
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
index d076a7c425dd..247888d68a3a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
@@ -80,6 +80,19 @@
         };
 };
 
+&apb {
+        usb2_phy2: phy@78040 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78040 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+};
+
 &clkc_AO {
         compatible = "amlogic,meson-gxm-aoclkc", "amlogic,meson-gx-aoclkc";
 };
@@ -100,3 +113,7 @@
 &hdmi_tx {
         compatible = "amlogic,meson-gxm-dw-hdmi", "amlogic,meson-gx-dw-hdmi";
 };
+
+&dwc3 {
+        phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>, <&usb2_phy2>;
+};
diff --git a/arch/arm64/boot/dts/arm/juno-motherboard.dtsi b/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
index 2ac43221ddb6..69804c5f1197 100644
--- a/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
@@ -56,8 +56,6 @@
 
                         gpio_keys {
                                 compatible = "gpio-keys";
-                                #address-cells = <1>;
-                                #size-cells = <0>;
 
                                 power-button {
                                         debounce_interval = <50>;
diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
index 4b5465da81d8..8c68e0c26f1b 100644
--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
+++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
@@ -36,11 +36,11 @@
                 #size-cells = <1>;
                 ranges = <0x0 0x0 0x67d00000 0x00800000>;
 
-                sata0: ahci@210000 {
+                sata0: ahci@0 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00210000 0x1000>;
+                        reg = <0x00000000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -52,9 +52,9 @@
                         };
                 };
 
-                sata_phy0: sata_phy@212100 {
+                sata_phy0: sata_phy@2100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00212100 0x1000>;
+                        reg = <0x00002100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -66,11 +66,11 @@
                         };
                 };
 
-                sata1: ahci@310000 {
+                sata1: ahci@10000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00310000 0x1000>;
+                        reg = <0x00010000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 347 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -82,9 +82,9 @@
                         };
                 };
 
-                sata_phy1: sata_phy@312100 {
+                sata_phy1: sata_phy@12100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00312100 0x1000>;
+                        reg = <0x00012100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -96,11 +96,11 @@
                         };
                 };
 
-                sata2: ahci@120000 {
+                sata2: ahci@20000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00120000 0x1000>;
+                        reg = <0x00020000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -112,9 +112,9 @@
                         };
                 };
 
-                sata_phy2: sata_phy@122100 {
+                sata_phy2: sata_phy@22100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00122100 0x1000>;
+                        reg = <0x00022100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -126,11 +126,11 @@
                         };
                 };
 
-                sata3: ahci@130000 {
+                sata3: ahci@30000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00130000 0x1000>;
+                        reg = <0x00030000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -142,9 +142,9 @@
                         };
                 };
 
-                sata_phy3: sata_phy@132100 {
+                sata_phy3: sata_phy@32100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00132100 0x1000>;
+                        reg = <0x00032100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -156,11 +156,11 @@
                         };
                 };
 
-                sata4: ahci@330000 {
+                sata4: ahci@100000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00330000 0x1000>;
+                        reg = <0x00100000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 351 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -172,9 +172,9 @@
                         };
                 };
 
-                sata_phy4: sata_phy@332100 {
+                sata_phy4: sata_phy@102100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00332100 0x1000>;
+                        reg = <0x00102100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -186,11 +186,11 @@
                         };
                 };
 
-                sata5: ahci@400000 {
+                sata5: ahci@110000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00400000 0x1000>;
+                        reg = <0x00110000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -202,9 +202,9 @@
                         };
                 };
 
-                sata_phy5: sata_phy@402100 {
+                sata_phy5: sata_phy@112100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00402100 0x1000>;
+                        reg = <0x00112100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -216,11 +216,11 @@
                         };
                 };
 
-                sata6: ahci@410000 {
+                sata6: ahci@120000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00410000 0x1000>;
+                        reg = <0x00120000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -232,9 +232,9 @@
                         };
                 };
 
-                sata_phy6: sata_phy@412100 {
+                sata_phy6: sata_phy@122100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00412100 0x1000>;
+                        reg = <0x00122100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -246,11 +246,11 @@
                         };
                 };
 
-                sata7: ahci@420000 {
+                sata7: ahci@130000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00420000 0x1000>;
+                        reg = <0x00130000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -262,9 +262,9 @@
                         };
                 };
 
-                sata_phy7: sata_phy@422100 {
+                sata_phy7: sata_phy@132100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00422100 0x1000>;
+                        reg = <0x00132100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index ab46bc70add6..469de8acd06f 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -75,6 +75,9 @@ struct kvm_arch {
 
         /* Interrupt controller */
         struct vgic_dist        vgic;
+
+        /* Mandated version of PSCI */
+        u32 psci_version;
 };
 
 #define KVM_NR_MEM_OBJS     40
diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
index b6dbbe3123a9..97d0ef12e2ff 100644
--- a/arch/arm64/include/asm/module.h
+++ b/arch/arm64/include/asm/module.h
@@ -39,7 +39,7 @@ struct mod_arch_specific {
 u64 module_emit_plt_entry(struct module *mod, void *loc, const Elf64_Rela *rela,
                           Elf64_Sym *sym);
 
-u64 module_emit_adrp_veneer(struct module *mod, void *loc, u64 val);
+u64 module_emit_veneer_for_adrp(struct module *mod, void *loc, u64 val);
 
 #ifdef CONFIG_RANDOMIZE_BASE
 extern u64 module_alloc_base;
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 7e2c27e63cd8..7c4c8f318ba9 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -230,7 +230,7 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
         }
 }
 
-extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
+extern void __sync_icache_dcache(pte_t pteval);
 
 /*
  * PTE bits configuration in the presence of hardware Dirty Bit Management
@@ -253,7 +253,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
         pte_t old_pte;
 
         if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
-                __sync_icache_dcache(pte, addr);
+                __sync_icache_dcache(pte);
 
         /*
          * If the existing pte is valid, check for potential race with
diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h
index 9abbf3044654..04b3256f8e6d 100644
--- a/arch/arm64/include/uapi/asm/kvm.h
+++ b/arch/arm64/include/uapi/asm/kvm.h
@@ -206,6 +206,12 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_TIMER_CNT           ARM64_SYS_REG(3, 3, 14, 3, 2)
 #define KVM_REG_ARM_TIMER_CVAL          ARM64_SYS_REG(3, 3, 14, 0, 2)
 
+/* KVM-as-firmware specific pseudo-registers */
+#define KVM_REG_ARM_FW                  (0x0014 << KVM_REG_ARM_COPROC_SHIFT)
+#define KVM_REG_ARM_FW_REG(r)           (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
+                                         KVM_REG_ARM_FW | ((r) & 0xffff))
+#define KVM_REG_ARM_PSCI_VERSION        KVM_REG_ARM_FW_REG(0)
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR       0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 536d572e5596..9d1b06d67c53 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -868,6 +868,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
         static const struct midr_range kpti_safe_list[] = {
                 MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
                 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+                { /* sentinel */ }
         };
         char const *str = "command line option";
 
diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
index fa3637284a3d..f0690c2ca3e0 100644
--- a/arch/arm64/kernel/module-plts.c
+++ b/arch/arm64/kernel/module-plts.c
@@ -43,7 +43,7 @@ u64 module_emit_plt_entry(struct module *mod, void *loc, const Elf64_Rela *rela,
 }
 
 #ifdef CONFIG_ARM64_ERRATUM_843419
-u64 module_emit_adrp_veneer(struct module *mod, void *loc, u64 val)
+u64 module_emit_veneer_for_adrp(struct module *mod, void *loc, u64 val)
 {
         struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core :
                                                           &mod->arch.init;
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index 719fde8dcc19..155fd91e78f4 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -215,7 +215,7 @@ static int reloc_insn_adrp(struct module *mod, __le32 *place, u64 val)
                 insn &= ~BIT(31);
         } else {
                 /* out of range for ADR -> emit a veneer */
-                val = module_emit_adrp_veneer(mod, place, val & ~0xfff);
+                val = module_emit_veneer_for_adrp(mod, place, val & ~0xfff);
                 if (!val)
                         return -ENOEXEC;
                 insn = aarch64_insn_gen_branch_imm((u64)place, val,
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 71d99af24ef2..7ff81fed46e1 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -25,6 +25,7 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/task_stack.h>
 #include <linux/mm.h>
+#include <linux/nospec.h>
 #include <linux/smp.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
@@ -249,15 +250,20 @@ static struct perf_event *ptrace_hbp_get_event(unsigned int note_type,
 
         switch (note_type) {
         case NT_ARM_HW_BREAK:
-                if (idx < ARM_MAX_BRP)
-                        bp = tsk->thread.debug.hbp_break[idx];
+                if (idx >= ARM_MAX_BRP)
+                        goto out;
+                idx = array_index_nospec(idx, ARM_MAX_BRP);
+                bp = tsk->thread.debug.hbp_break[idx];
                 break;
         case NT_ARM_HW_WATCH:
-                if (idx < ARM_MAX_WRP)
-                        bp = tsk->thread.debug.hbp_watch[idx];
+                if (idx >= ARM_MAX_WRP)
+                        goto out;
+                idx = array_index_nospec(idx, ARM_MAX_WRP);
+                bp = tsk->thread.debug.hbp_watch[idx];
                 break;
         }
 
+out:
         return bp;
 }
 
@@ -1458,9 +1464,7 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num,
 {
         int ret;
         u32 kdata;
-        mm_segment_t old_fs = get_fs();
 
-        set_fs(KERNEL_DS);
         /* Watchpoint */
         if (num < 0) {
                 ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata);
@@ -1471,7 +1475,6 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num,
         } else {
                 ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata);
         }
-        set_fs(old_fs);
 
         if (!ret)
                 ret = put_user(kdata, data);
@@ -1484,7 +1487,6 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num,
 {
         int ret;
         u32 kdata = 0;
-        mm_segment_t old_fs = get_fs();
 
         if (num == 0)
                 return 0;
@@ -1493,12 +1495,10 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num,
         if (ret)
                 return ret;
 
-        set_fs(KERNEL_DS);
         if (num < 0)
                 ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata);
         else
                 ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata);
-        set_fs(old_fs);
 
         return ret;
 }
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 1cb2749a72bf..8bbdc17e49df 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -277,7 +277,8 @@ void arm64_skip_faulting_instruction(struct pt_regs *regs, unsigned long size)
          * If we were single stepping, we want to get the step exception after
          * we return from the trap.
          */
-        user_fastforward_single_step(current);
+        if (user_mode(regs))
+                user_fastforward_single_step(current);
 }
 
 static LIST_HEAD(undef_hook);
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index 959e50d2588c..56a0260ceb11 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
+#include <kvm/arm_psci.h>
 #include <asm/cputype.h>
 #include <linux/uaccess.h>
 #include <asm/kvm.h>
@@ -205,7 +206,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu)
 {
         return num_core_regs() + kvm_arm_num_sys_reg_descs(vcpu)
-                + NUM_TIMER_REGS;
+                + kvm_arm_get_fw_num_regs(vcpu) + NUM_TIMER_REGS;
 }
 
 /**
@@ -225,6 +226,11 @@ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
                 uindices++;
         }
 
+        ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices);
+        if (ret)
+                return ret;
+        uindices += kvm_arm_get_fw_num_regs(vcpu);
+
         ret = copy_timer_indices(vcpu, uindices);
         if (ret)
                 return ret;
@@ -243,6 +249,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return get_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_get_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return get_timer_reg(vcpu, reg);
 
@@ -259,6 +268,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return set_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_set_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return set_timer_reg(vcpu, reg);
 
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 806b0b126a64..6e3b969391fd 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -996,14 +996,12 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz)
 
         if (id == SYS_ID_AA64PFR0_EL1) {
                 if (val & (0xfUL << ID_AA64PFR0_SVE_SHIFT))
-                        pr_err_once("kvm [%i]: SVE unsupported for guests, suppressing\n",
-                                    task_pid_nr(current));
+                        kvm_debug("SVE unsupported for guests, suppressing\n");
 
                 val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT);
         } else if (id == SYS_ID_AA64MMFR1_EL1) {
                 if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT))
-                        pr_err_once("kvm [%i]: LORegions unsupported for guests, suppressing\n",
-                                    task_pid_nr(current));
+                        kvm_debug("LORegions unsupported for guests, suppressing\n");
 
                 val &= ~(0xfUL << ID_AA64MMFR1_LOR_SHIFT);
         }
diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
index 0ead8a1d1679..137710f4dac3 100644
--- a/arch/arm64/lib/Makefile
+++ b/arch/arm64/lib/Makefile
@@ -19,5 +19,9 @@ CFLAGS_atomic_ll_sc.o	:= -fcall-used-x0 -ffixed-x1 -ffixed-x2		\
                    -fcall-saved-x13 -fcall-saved-x14 -fcall-saved-x15   \
                    -fcall-saved-x18 -fomit-frame-pointer
 CFLAGS_REMOVE_atomic_ll_sc.o := -pg
+GCOV_PROFILE_atomic_ll_sc.o     := n
+KASAN_SANITIZE_atomic_ll_sc.o   := n
+KCOV_INSTRUMENT_atomic_ll_sc.o  := n
+UBSAN_SANITIZE_atomic_ll_sc.o   := n
 
 lib-$(CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE) += uaccess_flushcache.o
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index e36ed5087b5c..1059884f9a6f 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -58,7 +58,7 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
         flush_ptrace_access(vma, page, uaddr, dst, len);
 }
 
-void __sync_icache_dcache(pte_t pte, unsigned long addr)
+void __sync_icache_dcache(pte_t pte)
 {
         struct page *page = pte_page(pte);
 
diff --git a/arch/powerpc/include/asm/powernv.h b/arch/powerpc/include/asm/powernv.h
index d1c2d2e658cf..2f3ff7a27881 100644
--- a/arch/powerpc/include/asm/powernv.h
+++ b/arch/powerpc/include/asm/powernv.h
@@ -15,7 +15,7 @@
 extern void powernv_set_nmmu_ptcr(unsigned long ptcr);
 extern struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                         unsigned long flags,
-                        struct npu_context *(*cb)(struct npu_context *, void *),
+                        void (*cb)(struct npu_context *, void *),
                         void *priv);
 extern void pnv_npu2_destroy_context(struct npu_context *context,
                                 struct pci_dev *gpdev);
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index fe6fc63251fe..38c5b4764bfe 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -441,7 +441,6 @@ static int mce_handle_ierror(struct pt_regs *regs,
                                         if (pfn != ULONG_MAX) {
                                                 *phys_addr =
                                                         (pfn << PAGE_SHIFT);
-                                                handled = 1;
                                         }
                                 }
                         }
@@ -532,9 +531,7 @@ static int mce_handle_derror(struct pt_regs *regs,
                          * kernel/exception-64s.h
                          */
                         if (get_paca()->in_mce < MAX_MCE_DEPTH)
-                                if (!mce_find_instr_ea_and_pfn(regs, addr,
-                                                                phys_addr))
-                                        handled = 1;
+                                mce_find_instr_ea_and_pfn(regs, addr, phys_addr);
                 }
                 found = 1;
         }
@@ -572,7 +569,7 @@ static long mce_handle_error(struct pt_regs *regs,
                 const struct mce_ierror_table itable[])
 {
         struct mce_error_info mce_err = { 0 };
-        uint64_t addr, phys_addr;
+        uint64_t addr, phys_addr = ULONG_MAX;
         uint64_t srr1 = regs->msr;
         long handled;
 
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index e16ec7b3b427..9ca7148b5881 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -566,10 +566,35 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
 #endif
 
 #ifdef CONFIG_NMI_IPI
-static void stop_this_cpu(struct pt_regs *regs)
-#else
+static void nmi_stop_this_cpu(struct pt_regs *regs)
+{
+        /*
+         * This is a special case because it never returns, so the NMI IPI
+         * handling would never mark it as done, which makes any later
+         * smp_send_nmi_ipi() call spin forever. Mark it done now.
+         *
+         * IRQs are already hard disabled by the smp_handle_nmi_ipi.
+         */
+        nmi_ipi_lock();
+        nmi_ipi_busy_count--;
+        nmi_ipi_unlock();
+
+        /* Remove this CPU */
+        set_cpu_online(smp_processor_id(), false);
+
+        spin_begin();
+        while (1)
+                spin_cpu_relax();
+}
+
+void smp_send_stop(void)
+{
+        smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, nmi_stop_this_cpu, 1000000);
+}
+
+#else /* CONFIG_NMI_IPI */
+
 static void stop_this_cpu(void *dummy)
-#endif
 {
         /* Remove this CPU */
         set_cpu_online(smp_processor_id(), false);
@@ -582,12 +607,22 @@ static void stop_this_cpu(void *dummy)
 
 void smp_send_stop(void)
 {
-#ifdef CONFIG_NMI_IPI
-        smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, stop_this_cpu, 1000000);
-#else
+        static bool stopped = false;
+
+        /*
+         * Prevent waiting on csd lock from a previous smp_send_stop.
+         * This is racy, but in general callers try to do the right
+         * thing and only fire off one smp_send_stop (e.g., see
+         * kernel/panic.c)
+         */
+        if (stopped)
+                return;
+
+        stopped = true;
+
         smp_call_function(stop_this_cpu, NULL, 0);
-#endif
 }
+#endif /* CONFIG_NMI_IPI */
 
 struct thread_info *current_set[NR_CPUS];
 
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index 6038e2e7aee0..876d4f294fdd 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -305,6 +305,13 @@ void kvmppc_core_queue_fpunavail(struct kvm_vcpu *vcpu)
         kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_FP_UNAVAIL);
 }
 
+#ifdef CONFIG_ALTIVEC
+void kvmppc_core_queue_vec_unavail(struct kvm_vcpu *vcpu)
+{
+        kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_ALTIVEC_UNAVAIL);
+}
+#endif
+
 void kvmppc_core_queue_dec(struct kvm_vcpu *vcpu)
 {
         kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_DECREMENTER);
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 737f8a4632cc..c3c39b02b2ba 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -133,6 +133,7 @@ int __meminit arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *
                         start, start + size, rc);
                 return -EFAULT;
         }
+        flush_inval_dcache_range(start, start + size);
 
         return __add_pages(nid, start_pfn, nr_pages, altmap, want_memblock);
 }
@@ -159,6 +160,7 @@ int __meminit arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap
 
         /* Remove htab bolted mappings for this section of memory */
         start = (unsigned long)__va(start);
+        flush_inval_dcache_range(start, start + size);
         ret = remove_section_mapping(start, start + size);
 
         /* Ensure all vmalloc mappings are flushed in case they also
diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
index de470caf0784..fc222a0c2ac4 100644
--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -82,19 +82,6 @@ static const struct file_operations memtrace_fops = {
         .open   = simple_open,
 };
 
-static void flush_memory_region(u64 base, u64 size)
-{
-        unsigned long line_size = ppc64_caches.l1d.size;
-        u64 end = base + size;
-        u64 addr;
-
-        base = round_down(base, line_size);
-        end = round_up(end, line_size);
-
-        for (addr = base; addr < end; addr += line_size)
-                asm volatile("dcbf 0,%0" : "=r" (addr) :: "memory");
-}
-
 static int check_memblock_online(struct memory_block *mem, void *arg)
 {
         if (mem->state != MEM_ONLINE)
@@ -132,10 +119,6 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
         walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE,
                           change_memblock_state);
 
-        /* RCU grace period? */
-        flush_memory_region((u64)__va(start_pfn << PAGE_SHIFT),
-                            nr_pages << PAGE_SHIFT);
-
         lock_device_hotplug();
         remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT);
         unlock_device_hotplug();
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 69a4f9e8bd55..525e966dce34 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -34,6 +34,19 @@
 #define npu_to_phb(x) container_of(x, struct pnv_phb, npu)
 
 /*
+ * spinlock to protect initialisation of an npu_context for a particular
+ * mm_struct.
+ */
+static DEFINE_SPINLOCK(npu_context_lock);
+
+/*
+ * When an address shootdown range exceeds this threshold we invalidate the
+ * entire TLB on the GPU for the given PID rather than each specific address in
+ * the range.
+ */
+#define ATSD_THRESHOLD (2*1024*1024)
+
+/*
  * Other types of TCE cache invalidation are not functional in the
  * hardware.
  */
@@ -401,7 +414,7 @@ struct npu_context {
         bool nmmu_flush;
 
         /* Callback to stop translation requests on a given GPU */
-        struct npu_context *(*release_cb)(struct npu_context *, void *);
+        void (*release_cb)(struct npu_context *context, void *priv);
 
         /*
          * Private pointer passed to the above callback for usage by
@@ -671,11 +684,19 @@ static void pnv_npu2_mn_invalidate_range(struct mmu_notifier *mn,
         struct npu_context *npu_context = mn_to_npu_context(mn);
         unsigned long address;
 
-        for (address = start; address < end; address += PAGE_SIZE)
-                mmio_invalidate(npu_context, 1, address, false);
+        if (end - start > ATSD_THRESHOLD) {
+                /*
+                 * Just invalidate the entire PID if the address range is too
+                 * large.
+                 */
+                mmio_invalidate(npu_context, 0, 0, true);
+        } else {
+                for (address = start; address < end; address += PAGE_SIZE)
+                        mmio_invalidate(npu_context, 1, address, false);
 
-        /* Do the flush only on the final addess == end */
-        mmio_invalidate(npu_context, 1, address, true);
+                /* Do the flush only on the final addess == end */
+                mmio_invalidate(npu_context, 1, address, true);
+        }
 }
 
 static const struct mmu_notifier_ops nv_nmmu_notifier_ops = {
@@ -696,11 +717,12 @@ static const struct mmu_notifier_ops nv_nmmu_notifier_ops = {
  * Returns an error if there no contexts are currently available or a
  * npu_context which should be passed to pnv_npu2_handle_fault().
  *
- * mmap_sem must be held in write mode.
+ * mmap_sem must be held in write mode and must not be called from interrupt
+ * context.
  */
 struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                         unsigned long flags,
-                        struct npu_context *(*cb)(struct npu_context *, void *),
+                        void (*cb)(struct npu_context *, void *),
                         void *priv)
 {
         int rc;
@@ -743,7 +765,9 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
         /*
          * Setup the NPU context table for a particular GPU. These need to be
          * per-GPU as we need the tables to filter ATSDs when there are no
-         * active contexts on a particular GPU.
+         * active contexts on a particular GPU. It is safe for these to be
+         * called concurrently with destroy as the OPAL call takes appropriate
+         * locks and refcounts on init/destroy.
          */
         rc = opal_npu_init_context(nphb->opal_id, mm->context.id, flags,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
@@ -754,8 +778,29 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
          * We store the npu pci device so we can more easily get at the
          * associated npus.
          */
+        spin_lock(&npu_context_lock);
         npu_context = mm->context.npu_context;
+        if (npu_context) {
+                if (npu_context->release_cb != cb ||
+                        npu_context->priv != priv) {
+                        spin_unlock(&npu_context_lock);
+                        opal_npu_destroy_context(nphb->opal_id, mm->context.id,
+                                                PCI_DEVID(gpdev->bus->number,
+                                                        gpdev->devfn));
+                        return ERR_PTR(-EINVAL);
+                }
+
+                WARN_ON(!kref_get_unless_zero(&npu_context->kref));
+        }
+        spin_unlock(&npu_context_lock);
+
         if (!npu_context) {
+                /*
+                 * We can set up these fields without holding the
+                 * npu_context_lock as the npu_context hasn't been returned to
+                 * the caller meaning it can't be destroyed. Parallel allocation
+                 * is protected against by mmap_sem.
+                 */
                 rc = -ENOMEM;
                 npu_context = kzalloc(sizeof(struct npu_context), GFP_KERNEL);
                 if (npu_context) {
@@ -774,8 +819,6 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                 }
 
                 mm->context.npu_context = npu_context;
-        } else {
-                WARN_ON(!kref_get_unless_zero(&npu_context->kref));
         }
 
         npu_context->release_cb = cb;
@@ -814,15 +857,16 @@ static void pnv_npu2_release_context(struct kref *kref)
                 mm_context_remove_copro(npu_context->mm);
 
         npu_context->mm->context.npu_context = NULL;
-        mmu_notifier_unregister(&npu_context->mn,
-                                npu_context->mm);
-
-        kfree(npu_context);
 }
 
+/*
+ * Destroy a context on the given GPU. May free the npu_context if it is no
+ * longer active on any GPUs. Must not be called from interrupt context.
+ */
 void pnv_npu2_destroy_context(struct npu_context *npu_context,
                         struct pci_dev *gpdev)
 {
+        int removed;
         struct pnv_phb *nphb;
         struct npu *npu;
         struct pci_dev *npdev = pnv_pci_get_npu_dev(gpdev, 0);
@@ -844,7 +888,21 @@ void pnv_npu2_destroy_context(struct npu_context *npu_context,
         WRITE_ONCE(npu_context->npdev[npu->index][nvlink_index], NULL);
         opal_npu_destroy_context(nphb->opal_id, npu_context->mm->context.id,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
-        kref_put(&npu_context->kref, pnv_npu2_release_context);
+        spin_lock(&npu_context_lock);
+        removed = kref_put(&npu_context->kref, pnv_npu2_release_context);
+        spin_unlock(&npu_context_lock);
+
+        /*
+         * We need to do this outside of pnv_npu2_release_context so that it is
+         * outside the spinlock as mmu_notifier_destroy uses SRCU.
+         */
+        if (removed) {
+                mmu_notifier_unregister(&npu_context->mn,
+                                        npu_context->mm);
+
+                kfree(npu_context);
+        }
+
 }
 EXPORT_SYMBOL(pnv_npu2_destroy_context);
 
diff --git a/arch/powerpc/platforms/powernv/opal-rtc.c b/arch/powerpc/platforms/powernv/opal-rtc.c
index f8868864f373..aa2a5139462e 100644
--- a/arch/powerpc/platforms/powernv/opal-rtc.c
+++ b/arch/powerpc/platforms/powernv/opal-rtc.c
@@ -48,10 +48,12 @@ unsigned long __init opal_get_boot_time(void)
 
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
+                if (rc == OPAL_BUSY_EVENT) {
+                        mdelay(OPAL_BUSY_DELAY_MS);
                         opal_poll_events(NULL);
-                else if (rc == OPAL_BUSY)
-                        mdelay(10);
+                } else if (rc == OPAL_BUSY) {
+                        mdelay(OPAL_BUSY_DELAY_MS);
+                }
         }
         if (rc != OPAL_SUCCESS)
                 return 0;
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index 23d8acca5c90..cd4fd85fde84 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -11,6 +11,7 @@ config RISCV
         select ARCH_WANT_FRAME_POINTERS
         select CLONE_BACKWARDS
         select COMMON_CLK
+        select DMA_DIRECT_OPS
         select GENERIC_CLOCKEVENTS
         select GENERIC_CPU_DEVICES
         select GENERIC_IRQ_SHOW
@@ -89,9 +90,6 @@ config PGTABLE_LEVELS
 config HAVE_KPROBES
         def_bool n
 
-config DMA_DIRECT_OPS
-        def_bool y
-
 menu "Platform type"
 
 choice
diff --git a/arch/riscv/include/asm/Kbuild b/arch/riscv/include/asm/Kbuild
index 1e5fd280fb4d..4286a5f83876 100644
--- a/arch/riscv/include/asm/Kbuild
+++ b/arch/riscv/include/asm/Kbuild
@@ -15,7 +15,6 @@ generic-y += fcntl.h
 generic-y += futex.h
 generic-y += hardirq.h
 generic-y += hash.h
-generic-y += handle_irq.h
 generic-y += hw_irq.h
 generic-y += ioctl.h
 generic-y += ioctls.h
diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
index 324568d33921..f6561b783b61 100644
--- a/arch/riscv/kernel/vdso/Makefile
+++ b/arch/riscv/kernel/vdso/Makefile
@@ -52,7 +52,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
 # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions.
 # Make sure only to export the intended __vdso_xxx symbol offsets.
 quiet_cmd_vdsold = VDSOLD  $@
-      cmd_vdsold = $(CC) $(KCFLAGS) -nostdlib $(SYSCFLAGS_$(@F)) \
+      cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \
                            -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \
                    $(CROSS_COMPILE)objcopy \
                            $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 83ba57533ce6..3c883c368eb0 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -45,6 +45,9 @@ struct thread_info {
 void arch_release_task_struct(struct task_struct *tsk);
 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
 
+void arch_setup_new_exec(void);
+#define arch_setup_new_exec arch_setup_new_exec
+
 #endif
 
 /*
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 5a83be955c70..0dc8ac8548ee 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -465,11 +465,11 @@ int module_finalize(const Elf_Ehdr *hdr,
                         apply_alternatives(aseg, aseg + s->sh_size);
 
                 if (IS_ENABLED(CONFIG_EXPOLINE) &&
-                    (!strcmp(".nospec_call_table", secname)))
+                    (!strncmp(".s390_indirect", secname, 14)))
                         nospec_revert(aseg, aseg + s->sh_size);
 
                 if (IS_ENABLED(CONFIG_EXPOLINE) &&
-                    (!strcmp(".nospec_return_table", secname)))
+                    (!strncmp(".s390_return", secname, 12)))
                         nospec_revert(aseg, aseg + s->sh_size);
         }
 
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
index 5ee27dc9a10c..feebb2944882 100644
--- a/arch/s390/kernel/perf_cpum_cf_events.c
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
 CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
 CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
 CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
+CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_SPECIAL, 0x00db);
 CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
 CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
 CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
+CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
 };
 
 static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
-        CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
+        CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
         CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
         CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
         CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
 };
 
 static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
-        CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
+        CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
         CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
         CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
         CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 70576a2f69cf..6e758bb6cd29 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -29,6 +29,7 @@
 #include <linux/random.h>
 #include <linux/export.h>
 #include <linux/init_task.h>
+#include <asm/cpu_mf.h>
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/vtimer.h>
@@ -48,6 +49,15 @@ void flush_thread(void)
 {
 }
 
+void arch_setup_new_exec(void)
+{
+        if (S390_lowcore.current_pid != current->pid) {
+                S390_lowcore.current_pid = current->pid;
+                if (test_facility(40))
+                        lpp(&S390_lowcore.lpp);
+        }
+}
+
 void arch_release_task_struct(struct task_struct *tsk)
 {
         runtime_instr_release(tsk);
diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
index d9d1f512f019..5007fac01bb5 100644
--- a/arch/s390/kernel/uprobes.c
+++ b/arch/s390/kernel/uprobes.c
@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
         return orig;
 }
 
+bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
+                             struct pt_regs *regs)
+{
+        if (ctx == RP_CHECK_CHAIN_CALL)
+                return user_stack_pointer(regs) <= ret->stack;
+        else
+                return user_stack_pointer(regs) < ret->stack;
+}
+
 /* Instruction Emulation */
 
 static void adjust_psw_addr(psw_t *psw, unsigned long len)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 00fcf81f2c56..c07f492b871a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -52,6 +52,7 @@ config X86
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_FAST_MULTIPLIER
+        select ARCH_HAS_FILTER_PGPROT
         select ARCH_HAS_FORTIFY_SOURCE
         select ARCH_HAS_GCOV_PROFILE_ALL
         select ARCH_HAS_KCOV                    if X86_64
@@ -273,6 +274,9 @@ config ARCH_HAS_CPU_RELAX
 config ARCH_HAS_CACHE_LINE_SIZE
         def_bool y
 
+config ARCH_HAS_FILTER_PGPROT
+        def_bool y
+
 config HAVE_SETUP_PER_CPU_AREA
         def_bool y
 
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 9af927e59d49..9de7f1e1dede 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -84,13 +84,13 @@ ENTRY(entry_SYSENTER_compat)
         pushq   %rdx                    /* pt_regs->dx */
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
-        pushq   $0                      /* pt_regs->r8  = 0 */
+        pushq   %r8                     /* pt_regs->r8 */
         xorl    %r8d, %r8d              /* nospec   r8 */
-        pushq   $0                      /* pt_regs->r9  = 0 */
+        pushq   %r9                     /* pt_regs->r9 */
         xorl    %r9d, %r9d              /* nospec   r9 */
-        pushq   $0                      /* pt_regs->r10 = 0 */
+        pushq   %r10                    /* pt_regs->r10 */
         xorl    %r10d, %r10d            /* nospec   r10 */
-        pushq   $0                      /* pt_regs->r11 = 0 */
+        pushq   %r11                    /* pt_regs->r11 */
         xorl    %r11d, %r11d            /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
         xorl    %ebx, %ebx              /* nospec   rbx */
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 607bf565a90c..707b2a96e516 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3339,7 +3339,8 @@ static void intel_pmu_cpu_starting(int cpu)
 
         cpuc->lbr_sel = NULL;
 
-        flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
+        if (x86_pmu.version > 1)
+                flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
 
         if (!cpuc->shared_regs)
                 return;
@@ -3502,6 +3503,8 @@ static __initconst const struct x86_pmu core_pmu = {
         .cpu_dying              = intel_pmu_cpu_dying,
 };
 
+static struct attribute *intel_pmu_attrs[];
+
 static __initconst const struct x86_pmu intel_pmu = {
         .name                   = "Intel",
         .handle_irq             = intel_pmu_handle_irq,
@@ -3533,6 +3536,8 @@ static __initconst const struct x86_pmu intel_pmu = {
         .format_attrs           = intel_arch3_formats_attr,
         .events_sysfs_show      = intel_event_sysfs_show,
 
+        .attrs                  = intel_pmu_attrs,
+
         .cpu_prepare            = intel_pmu_cpu_prepare,
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
@@ -3911,8 +3916,6 @@ __init int intel_pmu_init(void)
 
         x86_pmu.max_pebs_events         = min_t(unsigned, MAX_PEBS_EVENTS, x86_pmu.num_counters);
 
-
-        x86_pmu.attrs                   = intel_pmu_attrs;
         /*
          * Quirk: v2 perfmon does not report fixed-purpose events, so
          * assume at least 3 events, when not running in a hypervisor:
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index d554c11e01ff..578793e97431 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -320,6 +320,7 @@
 #define X86_FEATURE_AVX512_VPOPCNTDQ    (16*32+14) /* POPCNT for vectors of DW/QW */
 #define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
 #define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
+#define X86_FEATURE_CLDEMOTE            (16*32+25) /* CLDEMOTE instruction */
 
 /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
 #define X86_FEATURE_OVERFLOW_RECOV      (17*32+ 0) /* MCA overflow recovery support */
diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
index 09ad88572746..cc8f8fcf9b4a 100644
--- a/arch/x86/include/asm/ftrace.h
+++ b/arch/x86/include/asm/ftrace.h
@@ -46,7 +46,21 @@ int ftrace_int3_handler(struct pt_regs *regs);
 #endif /* CONFIG_FUNCTION_TRACER */
 
 
-#if !defined(__ASSEMBLY__) && !defined(COMPILE_OFFSETS)
+#ifndef __ASSEMBLY__
+
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+{
+        /*
+         * Compare the symbol name with the system call name. Skip the
+         * "__x64_sys", "__ia32_sys" or simple "sys" prefix.
+         */
+        return !strcmp(sym + 3, name + 3) ||
+                (!strncmp(sym, "__x64_", 6) && !strcmp(sym + 9, name + 3)) ||
+                (!strncmp(sym, "__ia32_", 7) && !strcmp(sym + 10, name + 3));
+}
+
+#ifndef COMPILE_OFFSETS
 
 #if defined(CONFIG_FTRACE_SYSCALLS) && defined(CONFIG_IA32_EMULATION)
 #include <asm/compat.h>
@@ -67,6 +81,7 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
         return false;
 }
 #endif /* CONFIG_FTRACE_SYSCALLS && CONFIG_IA32_EMULATION */
-#endif /* !__ASSEMBLY__  && !COMPILE_OFFSETS */
+#endif /* !COMPILE_OFFSETS */
+#endif /* !__ASSEMBLY__ */
 
 #endif /* _ASM_X86_FTRACE_H */
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index 404c5fdff859..548d90bbf919 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -34,11 +34,6 @@
  * (0x80 is the syscall vector, 0x30-0x3f are for ISA)
  */
 #define FIRST_EXTERNAL_VECTOR           0x20
-/*
- * We start allocating at 0x21 to spread out vectors evenly between
- * priority levels. (0x80 is the syscall vector)
- */
-#define VECTOR_OFFSET_START             1
 
 /*
  * Reserve the lowest usable vector (and hence lowest priority)  0x20 for
@@ -119,8 +114,6 @@
 #define FIRST_SYSTEM_VECTOR             NR_VECTORS
 #endif
 
-#define FPU_IRQ                           13
-
 /*
  * Size the maximum number of interrupts.
  *
diff --git a/arch/x86/include/asm/jailhouse_para.h b/arch/x86/include/asm/jailhouse_para.h
index b885a961a150..a34897aef2c2 100644
--- a/arch/x86/include/asm/jailhouse_para.h
+++ b/arch/x86/include/asm/jailhouse_para.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL2.0 */
+/* SPDX-License-Identifier: GPL-2.0 */
 
 /*
  * Jailhouse paravirt detection
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 5f49b4ff0c24..f1633de5a675 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -601,6 +601,11 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 
 #define canon_pgprot(p) __pgprot(massage_pgprot(p))
 
+static inline pgprot_t arch_filter_pgprot(pgprot_t prot)
+{
+        return canon_pgprot(prot);
+}
+
 static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,
                                          enum page_cache_mode pcm,
                                          enum page_cache_mode new_pcm)
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index d5c21a382475..adb47552e6bb 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -105,14 +105,14 @@ extern unsigned int ptrs_per_p4d;
 #define LDT_PGD_ENTRY           (pgtable_l5_enabled ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4)
 #define LDT_BASE_ADDR           (LDT_PGD_ENTRY << PGDIR_SHIFT)
 
-#define __VMALLOC_BASE_L4       0xffffc90000000000
-#define __VMALLOC_BASE_L5       0xffa0000000000000
+#define __VMALLOC_BASE_L4       0xffffc90000000000UL
+#define __VMALLOC_BASE_L5       0xffa0000000000000UL
 
 #define VMALLOC_SIZE_TB_L4      32UL
 #define VMALLOC_SIZE_TB_L5      12800UL
 
-#define __VMEMMAP_BASE_L4       0xffffea0000000000
-#define __VMEMMAP_BASE_L5       0xffd4000000000000
+#define __VMEMMAP_BASE_L4       0xffffea0000000000UL
+#define __VMEMMAP_BASE_L5       0xffd4000000000000UL
 
 #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT
 # define VMALLOC_START          vmalloc_base
diff --git a/arch/x86/include/uapi/asm/msgbuf.h b/arch/x86/include/uapi/asm/msgbuf.h
index 809134c644a6..90ab9a795b49 100644
--- a/arch/x86/include/uapi/asm/msgbuf.h
+++ b/arch/x86/include/uapi/asm/msgbuf.h
@@ -1 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_X64_MSGBUF_H
+#define __ASM_X64_MSGBUF_H
+
+#if !defined(__x86_64__) || !defined(__ILP32__)
 #include <asm-generic/msgbuf.h>
+#else
+/*
+ * The msqid64_ds structure for x86 architecture with x32 ABI.
+ *
+ * On x86-32 and x86-64 we can just use the generic definition, but
+ * x32 uses the same binary layout as x86_64, which is differnet
+ * from other 32-bit architectures.
+ */
+
+struct msqid64_ds {
+        struct ipc64_perm msg_perm;
+        __kernel_time_t msg_stime;      /* last msgsnd time */
+        __kernel_time_t msg_rtime;      /* last msgrcv time */
+        __kernel_time_t msg_ctime;      /* last change time */
+        __kernel_ulong_t msg_cbytes;    /* current number of bytes on queue */
+        __kernel_ulong_t msg_qnum;      /* number of messages in queue */
+        __kernel_ulong_t msg_qbytes;    /* max number of bytes on queue */
+        __kernel_pid_t msg_lspid;       /* pid of last msgsnd */
+        __kernel_pid_t msg_lrpid;       /* last receive pid */
+        __kernel_ulong_t __unused4;
+        __kernel_ulong_t __unused5;
+};
+
+#endif
+
+#endif /* __ASM_GENERIC_MSGBUF_H */
diff --git a/arch/x86/include/uapi/asm/shmbuf.h b/arch/x86/include/uapi/asm/shmbuf.h
index 83c05fc2de38..644421f3823b 100644
--- a/arch/x86/include/uapi/asm/shmbuf.h
+++ b/arch/x86/include/uapi/asm/shmbuf.h
@@ -1 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_X86_SHMBUF_H
+#define __ASM_X86_SHMBUF_H
+
+#if !defined(__x86_64__) || !defined(__ILP32__)
 #include <asm-generic/shmbuf.h>
+#else
+/*
+ * The shmid64_ds structure for x86 architecture with x32 ABI.
+ *
+ * On x86-32 and x86-64 we can just use the generic definition, but
+ * x32 uses the same binary layout as x86_64, which is differnet
+ * from other 32-bit architectures.
+ */
+
+struct shmid64_ds {
+        struct ipc64_perm       shm_perm;       /* operation perms */
+        size_t                  shm_segsz;      /* size of segment (bytes) */
+        __kernel_time_t         shm_atime;      /* last attach time */
+        __kernel_time_t         shm_dtime;      /* last detach time */
+        __kernel_time_t         shm_ctime;      /* last change time */
+        __kernel_pid_t          shm_cpid;       /* pid of creator */
+        __kernel_pid_t          shm_lpid;       /* pid of last operator */
+        __kernel_ulong_t        shm_nattch;     /* no. of current attaches */
+        __kernel_ulong_t        __unused4;
+        __kernel_ulong_t        __unused5;
+};
+
+struct shminfo64 {
+        __kernel_ulong_t        shmmax;
+        __kernel_ulong_t        shmmin;
+        __kernel_ulong_t        shmmni;
+        __kernel_ulong_t        shmseg;
+        __kernel_ulong_t        shmall;
+        __kernel_ulong_t        __unused1;
+        __kernel_ulong_t        __unused2;
+        __kernel_ulong_t        __unused3;
+        __kernel_ulong_t        __unused4;
+};
+
+#endif
+
+#endif /* __ASM_X86_SHMBUF_H */
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index b9693b80fc21..60d1897041da 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -835,6 +835,9 @@ static const struct _tlb_table intel_tlb_table[] = {
         { 0x5d, TLB_DATA_4K_4M,         256,    " TLB_DATA 4 KByte and 4 MByte pages" },
         { 0x61, TLB_INST_4K,            48,     " TLB_INST 4 KByte pages, full associative" },
         { 0x63, TLB_DATA_1G,            4,      " TLB_DATA 1 GByte pages, 4-way set associative" },
+        { 0x6b, TLB_DATA_4K,            256,    " TLB_DATA 4 KByte pages, 8-way associative" },
+        { 0x6c, TLB_DATA_2M_4M,         128,    " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" },
+        { 0x6d, TLB_DATA_1G,            16,     " TLB_DATA 1 GByte pages, fully associative" },
         { 0x76, TLB_INST_2M_4M,         8,      " TLB_INST 2-MByte or 4-MByte pages, fully associative" },
         { 0xb0, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 4-way set associative" },
         { 0xb1, TLB_INST_2M_4M,         4,      " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" },
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 10c4fc2c91f8..77e201301528 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -564,14 +564,12 @@ static int __reload_late(void *info)
         apply_microcode_local(&err);
         spin_unlock(&update_lock);
 
+        /* siblings return UCODE_OK because their engine got updated already */
         if (err > UCODE_NFOUND) {
                 pr_warn("Error reloading microcode on CPU %d\n", cpu);
-                return -1;
-        /* siblings return UCODE_OK because their engine got updated already */
+                ret = -1;
         } else if (err == UCODE_UPDATED || err == UCODE_OK) {
                 ret = 1;
-        } else {
-                return ret;
         }
 
         /*
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 32b8e5724f96..1c2cfa0644aa 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -485,7 +485,6 @@ static void show_saved_mc(void)
  */
 static void save_mc_for_early(u8 *mc, unsigned int size)
 {
-#ifdef CONFIG_HOTPLUG_CPU
         /* Synchronization during CPU hotplug. */
         static DEFINE_MUTEX(x86_cpu_microcode_mutex);
 
@@ -495,7 +494,6 @@ static void save_mc_for_early(u8 *mc, unsigned int size)
         show_saved_mc();
 
         mutex_unlock(&x86_cpu_microcode_mutex);
-#endif
 }
 
 static bool load_builtin_intel_microcode(struct cpio_data *cp)
diff --git a/arch/x86/kernel/jailhouse.c b/arch/x86/kernel/jailhouse.c
index fa183a131edc..a15fe0e92cf9 100644
--- a/arch/x86/kernel/jailhouse.c
+++ b/arch/x86/kernel/jailhouse.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL2.0
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Jailhouse paravirt_ops implementation
  *
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 6285697b6e56..5c623dfe39d1 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -50,6 +50,7 @@
 #include <linux/init_ohci1394_dma.h>
 #include <linux/kvm_para.h>
 #include <linux/dma-contiguous.h>
+#include <xen/xen.h>
 
 #include <linux/errno.h>
 #include <linux/kernel.h>
@@ -534,6 +535,11 @@ static void __init reserve_crashkernel(void)
                 high = true;
         }
 
+        if (xen_pv_domain()) {
+                pr_info("Ignoring crashkernel for a Xen PV domain\n");
+                return;
+        }
+
         /* 0 means: find the address automatically */
         if (crash_base <= 0) {
                 /*
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 45175b81dd5b..0f1cbb042f49 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1571,6 +1571,8 @@ static inline void mwait_play_dead(void)
         void *mwait_ptr;
         int i;
 
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+                return;
         if (!this_cpu_has(X86_FEATURE_MWAIT))
                 return;
         if (!this_cpu_has(X86_FEATURE_CLFLUSH))
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index aa66ccd6ed6c..c7668806163f 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4544,12 +4544,6 @@ static void vmx_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
         __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid, invalidate_gpa);
 }
 
-static void vmx_flush_tlb_ept_only(struct kvm_vcpu *vcpu)
-{
-        if (enable_ept)
-                vmx_flush_tlb(vcpu, true);
-}
-
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 {
         ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
@@ -9278,7 +9272,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
         } else {
                 sec_exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
                 sec_exec_control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
         vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
 
@@ -9306,7 +9300,7 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
             !nested_cpu_has2(get_vmcs12(&vmx->vcpu),
                              SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
                 vmcs_write64(APIC_ACCESS_ADDR, hpa);
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
 }
 
@@ -11220,7 +11214,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
                 }
         } else if (nested_cpu_has2(vmcs12,
                                    SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
 
         /*
@@ -12073,7 +12067,7 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
         } else if (!nested_cpu_has_ept(vmcs12) &&
                    nested_cpu_has2(vmcs12,
                                    SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 7d35ce672989..c9492f764902 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -302,13 +302,6 @@ static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
             __rem;                                              \
          })
 
-#define KVM_X86_DISABLE_EXITS_MWAIT          (1 << 0)
-#define KVM_X86_DISABLE_EXITS_HTL            (1 << 1)
-#define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
-#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
-                                              KVM_X86_DISABLE_EXITS_HTL | \
-                                              KVM_X86_DISABLE_EXITS_PAUSE)
-
 static inline bool kvm_mwait_in_guest(struct kvm *kvm)
 {
         return kvm->arch.mwait_in_guest;
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 0f3d50f4c48c..3bded76e8d5c 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -93,6 +93,18 @@ void arch_report_meminfo(struct seq_file *m)
 static inline void split_page_count(int level) { }
 #endif
 
+static inline int
+within(unsigned long addr, unsigned long start, unsigned long end)
+{
+        return addr >= start && addr < end;
+}
+
+static inline int
+within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
+{
+        return addr >= start && addr <= end;
+}
+
 #ifdef CONFIG_X86_64
 
 static inline unsigned long highmap_start_pfn(void)
@@ -106,20 +118,25 @@ static inline unsigned long highmap_end_pfn(void)
         return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT;
 }
 
-#endif
-
-static inline int
-within(unsigned long addr, unsigned long start, unsigned long end)
+static bool __cpa_pfn_in_highmap(unsigned long pfn)
 {
-        return addr >= start && addr < end;
+        /*
+         * Kernel text has an alias mapping at a high address, known
+         * here as "highmap".
+         */
+        return within_inclusive(pfn, highmap_start_pfn(), highmap_end_pfn());
 }
 
-static inline int
-within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
+#else
+
+static bool __cpa_pfn_in_highmap(unsigned long pfn)
 {
-        return addr >= start && addr <= end;
+        /* There is no highmap on 32-bit */
+        return false;
 }
 
+#endif
+
 /*
  * Flushing functions
  */
@@ -172,7 +189,7 @@ static void __cpa_flush_all(void *arg)
 
 static void cpa_flush_all(unsigned long cache)
 {
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
 
         on_each_cpu(__cpa_flush_all, (void *) cache, 1);
 }
@@ -236,7 +253,7 @@ static void cpa_flush_array(unsigned long *start, int numpages, int cache,
         unsigned long do_wbinvd = cache && numpages >= 1024; /* 4M threshold */
 #endif
 
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
 
         on_each_cpu(__cpa_flush_all, (void *) do_wbinvd, 1);
 
@@ -1183,6 +1200,10 @@ static int __cpa_process_fault(struct cpa_data *cpa, unsigned long vaddr,
                 cpa->numpages = 1;
                 cpa->pfn = __pa(vaddr) >> PAGE_SHIFT;
                 return 0;
+
+        } else if (__cpa_pfn_in_highmap(cpa->pfn)) {
+                /* Faults in the highmap are OK, so do not warn: */
+                return -EFAULT;
         } else {
                 WARN(1, KERN_WARNING "CPA: called for zero pte. "
                         "vaddr = %lx cpa->vaddr = %lx\n", vaddr,
@@ -1335,8 +1356,7 @@ static int cpa_process_alias(struct cpa_data *cpa)
          * to touch the high mapped kernel as well:
          */
         if (!within(vaddr, (unsigned long)_text, _brk_end) &&
-            within_inclusive(cpa->pfn, highmap_start_pfn(),
-                             highmap_end_pfn())) {
+            __cpa_pfn_in_highmap(cpa->pfn)) {
                 unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
                                                __START_KERNEL_map - phys_base;
                 alias_cpa = *cpa;
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index f1fd52f449e0..4d418e705878 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -421,6 +421,16 @@ static inline bool pti_kernel_image_global_ok(void)
         if (boot_cpu_has(X86_FEATURE_K8))
                 return false;
 
+        /*
+         * RANDSTRUCT derives its hardening benefits from the
+         * attacker's lack of knowledge about the layout of kernel
+         * data structures.  Keep the kernel image non-global in
+         * cases where RANDSTRUCT is in use to help keep the layout a
+         * secret.
+         */
+        if (IS_ENABLED(CONFIG_GCC_PLUGIN_RANDSTRUCT))
+                return false;
+
         return true;
 }
 
@@ -430,12 +440,24 @@ static inline bool pti_kernel_image_global_ok(void)
  */
 void pti_clone_kernel_text(void)
 {
+        /*
+         * rodata is part of the kernel image and is normally
+         * readable on the filesystem or on the web.  But, do not
+         * clone the areas past rodata, they might contain secrets.
+         */
         unsigned long start = PFN_ALIGN(_text);
-        unsigned long end = ALIGN((unsigned long)_end, PMD_PAGE_SIZE);
+        unsigned long end = (unsigned long)__end_rodata_hpage_align;
 
         if (!pti_kernel_image_global_ok())
                 return;
 
+        pr_debug("mapping partial kernel image into user address space\n");
+
+        /*
+         * Note that this will undo _some_ of the work that
+         * pti_set_kernel_image_nonglobal() did to clear the
+         * global bit.
+         */
         pti_clone_pmds(start, end, _PAGE_RW);
 }
 
@@ -458,8 +480,6 @@ void pti_set_kernel_image_nonglobal(void)
         if (pti_kernel_image_global_ok())
                 return;
 
-        pr_debug("set kernel image non-global\n");
-
         set_memory_nonglobal(start, (end - start) >> PAGE_SHIFT);
 }
 
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index f0ecd98509d8..771ae9730ac6 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -4934,8 +4934,16 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio)
         bool new_queue = false;
         bool bfqq_already_existing = false, split = false;
 
-        if (!rq->elv.icq)
+        /*
+         * Even if we don't have an icq attached, we should still clear
+         * the scheduler pointers, as they might point to previously
+         * allocated bic/bfqq structs.
+         */
+        if (!rq->elv.icq) {
+                rq->elv.priv[0] = rq->elv.priv[1] = NULL;
                 return;
+        }
+
         bic = icq_to_bic(rq->elv.icq);
 
         spin_lock_irq(&bfqd->lock);
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 1c16694ae145..eb85cb87c40f 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1177,26 +1177,20 @@ int blkcg_init_queue(struct request_queue *q)
 
         preloaded = !radix_tree_preload(GFP_KERNEL);
 
-        /*
-         * Make sure the root blkg exists and count the existing blkgs.  As
-         * @q is bypassing at this point, blkg_lookup_create() can't be
-         * used.  Open code insertion.
-         */
+        /* Make sure the root blkg exists. */
         rcu_read_lock();
         spin_lock_irq(q->queue_lock);
         blkg = blkg_create(&blkcg_root, q, new_blkg);
+        if (IS_ERR(blkg))
+                goto err_unlock;
+        q->root_blkg = blkg;
+        q->root_rl.blkg = blkg;
         spin_unlock_irq(q->queue_lock);
         rcu_read_unlock();
 
         if (preloaded)
                 radix_tree_preload_end();
 
-        if (IS_ERR(blkg))
-                return PTR_ERR(blkg);
-
-        q->root_blkg = blkg;
-        q->root_rl.blkg = blkg;
-
         ret = blk_throtl_init(q);
         if (ret) {
                 spin_lock_irq(q->queue_lock);
@@ -1204,6 +1198,13 @@ int blkcg_init_queue(struct request_queue *q)
                 spin_unlock_irq(q->queue_lock);
         }
         return ret;
+
+err_unlock:
+        spin_unlock_irq(q->queue_lock);
+        rcu_read_unlock();
+        if (preloaded)
+                radix_tree_preload_end();
+        return PTR_ERR(blkg);
 }
 
 /**
@@ -1410,9 +1411,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
         __clear_bit(pol->plid, q->blkcg_pols);
 
         list_for_each_entry(blkg, &q->blkg_list, q_node) {
-                /* grab blkcg lock too while removing @pd from @blkg */
-                spin_lock(&blkg->blkcg->lock);
-
                 if (blkg->pd[pol->plid]) {
                         if (!blkg->pd[pol->plid]->offline &&
                             pol->pd_offline_fn) {
@@ -1422,8 +1420,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
                         pol->pd_free_fn(blkg->pd[pol->plid]);
                         blkg->pd[pol->plid] = NULL;
                 }
-
-                spin_unlock(&blkg->blkcg->lock);
         }
 
         spin_unlock_irq(q->queue_lock);
diff --git a/block/blk-core.c b/block/blk-core.c
index 806ce2442819..85909b431eb0 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -201,6 +201,10 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
         rq->part = NULL;
         seqcount_init(&rq->gstate_seq);
         u64_stats_init(&rq->aborted_gstate_sync);
+        /*
+         * See comment of blk_mq_init_request
+         */
+        WRITE_ONCE(rq->gstate, MQ_RQ_GEN_INC);
 }
 EXPORT_SYMBOL(blk_rq_init);
 
@@ -915,7 +919,6 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 
         while (true) {
                 bool success = false;
-                int ret;
 
                 rcu_read_lock();
                 if (percpu_ref_tryget_live(&q->q_usage_counter)) {
@@ -947,14 +950,12 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
                  */
                 smp_rmb();
 
-                ret = wait_event_interruptible(q->mq_freeze_wq,
-                                (atomic_read(&q->mq_freeze_depth) == 0 &&
-                                 (preempt || !blk_queue_preempt_only(q))) ||
-                                blk_queue_dying(q));
+                wait_event(q->mq_freeze_wq,
+                           (atomic_read(&q->mq_freeze_depth) == 0 &&
+                            (preempt || !blk_queue_preempt_only(q))) ||
+                           blk_queue_dying(q));
                 if (blk_queue_dying(q))
                         return -ENODEV;
-                if (ret)
-                        return ret;
         }
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0dc9e341c2a7..c3621453ad87 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2042,6 +2042,13 @@ static int blk_mq_init_request(struct blk_mq_tag_set *set, struct request *rq,
 
         seqcount_init(&rq->gstate_seq);
         u64_stats_init(&rq->aborted_gstate_sync);
+        /*
+         * start gstate with gen 1 instead of 0, otherwise it will be equal
+         * to aborted_gstate, and be identified timed out by
+         * blk_mq_terminate_expired.
+         */
+        WRITE_ONCE(rq->gstate, MQ_RQ_GEN_INC);
+
         return 0;
 }
 
@@ -2329,7 +2336,7 @@ static void blk_mq_free_map_and_requests(struct blk_mq_tag_set *set,
 
 static void blk_mq_map_swqueue(struct request_queue *q)
 {
-        unsigned int i;
+        unsigned int i, hctx_idx;
         struct blk_mq_hw_ctx *hctx;
         struct blk_mq_ctx *ctx;
         struct blk_mq_tag_set *set = q->tag_set;
@@ -2346,8 +2353,23 @@ static void blk_mq_map_swqueue(struct request_queue *q)
 
         /*
          * Map software to hardware queues.
+         *
+         * If the cpu isn't present, the cpu is mapped to first hctx.
          */
         for_each_possible_cpu(i) {
+                hctx_idx = q->mq_map[i];
+                /* unmapped hw queue can be remapped after CPU topo changed */
+                if (!set->tags[hctx_idx] &&
+                    !__blk_mq_alloc_rq_map(set, hctx_idx)) {
+                        /*
+                         * If tags initialization fail for some hctx,
+                         * that hctx won't be brought online.  In this
+                         * case, remap the current ctx to hctx[0] which
+                         * is guaranteed to always have tags allocated
+                         */
+                        q->mq_map[i] = 0;
+                }
+
                 ctx = per_cpu_ptr(q->queue_ctx, i);
                 hctx = blk_mq_map_queue(q, i);
 
@@ -2359,8 +2381,21 @@ static void blk_mq_map_swqueue(struct request_queue *q)
         mutex_unlock(&q->sysfs_lock);
 
         queue_for_each_hw_ctx(q, hctx, i) {
-                /* every hctx should get mapped by at least one CPU */
-                WARN_ON(!hctx->nr_ctx);
+                /*
+                 * If no software queues are mapped to this hardware queue,
+                 * disable it and free the request entries.
+                 */
+                if (!hctx->nr_ctx) {
+                        /* Never unmap queue 0.  We need it as a
+                         * fallback in case of a new remap fails
+                         * allocation
+                         */
+                        if (i && set->tags[i])
+                                blk_mq_free_map_and_requests(set, i);
+
+                        hctx->tags = NULL;
+                        continue;
+                }
 
                 hctx->tags = set->tags[i];
                 WARN_ON(!hctx->tags);
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 88c558f71819..89b5cd3a6c70 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -7,6 +7,9 @@
 
 struct blk_mq_tag_set;
 
+/**
+ * struct blk_mq_ctx - State for a software queue facing the submitting CPUs
+ */
 struct blk_mq_ctx {
         struct {
                 spinlock_t              lock;
diff --git a/crypto/api.c b/crypto/api.c
index 1d5290c67108..0ee632bba064 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -204,9 +204,14 @@ static struct crypto_alg *crypto_alg_lookup(const char *name, u32 type,
 
         down_read(&crypto_alg_sem);
         alg = __crypto_alg_lookup(name, type | test, mask | test);
-        if (!alg && test)
-                alg = __crypto_alg_lookup(name, type, mask) ?
-                      ERR_PTR(-ELIBBAD) : NULL;
+        if (!alg && test) {
+                alg = __crypto_alg_lookup(name, type, mask);
+                if (alg && !crypto_is_larval(alg)) {
+                        /* Test failed */
+                        crypto_mod_put(alg);
+                        alg = ERR_PTR(-ELIBBAD);
+                }
+        }
         up_read(&crypto_alg_sem);
 
         return alg;
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 4faa2781c964..466a112a4446 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1134,8 +1134,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
         if (!drbg)
                 return;
         kzfree(drbg->Vbuf);
+        drbg->Vbuf = NULL;
         drbg->V = NULL;
         kzfree(drbg->Cbuf);
+        drbg->Cbuf = NULL;
         drbg->C = NULL;
         kzfree(drbg->scratchpadbuf);
         drbg->scratchpadbuf = NULL;
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 76fb96966f7b..2f2e737be0f8 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
         return opregion;
 }
 
+static bool dmi_is_desktop(void)
+{
+        const char *chassis_type;
+
+        chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+        if (!chassis_type)
+                return false;
+
+        if (!strcmp(chassis_type, "3") || /*  3: Desktop */
+            !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
+            !strcmp(chassis_type, "5") || /*  5: Pizza Box */
+            !strcmp(chassis_type, "6") || /*  6: Mini Tower */
+            !strcmp(chassis_type, "7") || /*  7: Tower */
+            !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
+                return true;
+
+        return false;
+}
+
 int acpi_video_register(void)
 {
         int ret = 0;
@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
          * win8 ready (where we also prefer the native backlight driver, so
          * normally the acpi_video code should not register there anyways).
          */
-        if (only_lcd == -1)
-                only_lcd = acpi_osi_is_win8();
+        if (only_lcd == -1) {
+                if (dmi_is_desktop() && acpi_osi_is_win8())
+                        only_lcd = true;
+                else
+                        only_lcd = false;
+        }
 
         dmi_check_system(video_dmi_table);
 
diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index ebb626ffb5fa..4bde16fb97d8 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -12,23 +12,64 @@
 #define pr_fmt(fmt) "ACPI: watchdog: " fmt
 
 #include <linux/acpi.h>
+#include <linux/dmi.h>
 #include <linux/ioport.h>
 #include <linux/platform_device.h>
 
 #include "internal.h"
 
+static const struct dmi_system_id acpi_watchdog_skip[] = {
+        {
+                /*
+                 * On Lenovo Z50-70 there are two issues with the WDAT
+                 * table. First some of the instructions use RTC SRAM
+                 * to store persistent information. This does not work well
+                 * with Linux RTC driver. Second, more important thing is
+                 * that the instructions do not actually reset the system.
+                 *
+                 * On this particular system iTCO_wdt seems to work just
+                 * fine so we prefer that over WDAT for now.
+                 *
+                 * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033.
+                 */
+                .ident = "Lenovo Z50-70",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "20354"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"),
+                },
+        },
+        {}
+};
+
+static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void)
+{
+        const struct acpi_table_wdat *wdat = NULL;
+        acpi_status status;
+
+        if (acpi_disabled)
+                return NULL;
+
+        if (dmi_check_system(acpi_watchdog_skip))
+                return NULL;
+
+        status = acpi_get_table(ACPI_SIG_WDAT, 0,
+                                (struct acpi_table_header **)&wdat);
+        if (ACPI_FAILURE(status)) {
+                /* It is fine if there is no WDAT */
+                return NULL;
+        }
+
+        return wdat;
+}
+
 /**
  * Returns true if this system should prefer ACPI based watchdog instead of
  * the native one (which are typically the same hardware).
  */
 bool acpi_has_watchdog(void)
 {
-        struct acpi_table_header hdr;
-
-        if (acpi_disabled)
-                return false;
-
-        return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr));
+        return !!acpi_watchdog_get_wdat();
 }
 EXPORT_SYMBOL_GPL(acpi_has_watchdog);
 
@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void)
         struct platform_device *pdev;
         struct resource *resources;
         size_t nresources = 0;
-        acpi_status status;
         int i;
 
-        status = acpi_get_table(ACPI_SIG_WDAT, 0,
-                                (struct acpi_table_header **)&wdat);
-        if (ACPI_FAILURE(status)) {
+        wdat = acpi_watchdog_get_wdat();
+        if (!wdat) {
                 /* It is fine if there is no WDAT */
                 return;
         }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index e1eee7a60fad..f1cc4f9d31cd 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -635,4 +635,26 @@ module_param_call(lid_init_state,
                   NULL, 0644);
 MODULE_PARM_DESC(lid_init_state, "Behavior for reporting LID initial state");
 
-module_acpi_driver(acpi_button_driver);
+static int acpi_button_register_driver(struct acpi_driver *driver)
+{
+        /*
+         * Modules such as nouveau.ko and i915.ko have a link time dependency
+         * on acpi_lid_open(), and would therefore not be loadable on ACPI
+         * capable kernels booted in non-ACPI mode if the return value of
+         * acpi_bus_register_driver() is returned from here with ACPI disabled
+         * when this driver is built as a module.
+         */
+        if (acpi_disabled)
+                return 0;
+
+        return acpi_bus_register_driver(driver);
+}
+
+static void acpi_button_unregister_driver(struct acpi_driver *driver)
+{
+        if (!acpi_disabled)
+                acpi_bus_unregister_driver(driver);
+}
+
+module_driver(acpi_button_driver, acpi_button_register_driver,
+               acpi_button_unregister_driver);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index cc234e6a6297..970dd87d347c 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2166,10 +2166,10 @@ int __init acpi_scan_init(void)
         acpi_cmos_rtc_init();
         acpi_container_init();
         acpi_memory_hotplug_init();
+        acpi_watchdog_init();
         acpi_pnp_init();
         acpi_int340x_thermal_init();
         acpi_amba_init();
-        acpi_watchdog_init();
         acpi_init_lpit();
 
         acpi_scan_add_handler(&generic_device_handler);
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 99a1a650326d..974e58457697 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -364,6 +364,19 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
                 },
         },
+        /*
+         * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using
+         * the Low Power S0 Idle firmware interface (see
+         * https://bugzilla.kernel.org/show_bug.cgi?id=199057).
+         */
+        {
+        .callback = init_no_lps0,
+        .ident = "ThinkPad X1 Tablet(2016)",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"),
+                },
+        },
         {},
 };
 
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 594c228d2f02..4a3ac31c07d0 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -69,11 +69,12 @@ static ssize_t driver_override_show(struct device *_dev,
                                     struct device_attribute *attr, char *buf)
 {
         struct amba_device *dev = to_amba_device(_dev);
+        ssize_t len;
 
-        if (!dev->driver_override)
-                return 0;
-
-        return sprintf(buf, "%s\n", dev->driver_override);
+        device_lock(_dev);
+        len = sprintf(buf, "%s\n", dev->driver_override);
+        device_unlock(_dev);
+        return len;
 }
 
 static ssize_t driver_override_store(struct device *_dev,
@@ -81,9 +82,10 @@ static ssize_t driver_override_store(struct device *_dev,
                                      const char *buf, size_t count)
 {
         struct amba_device *dev = to_amba_device(_dev);
-        char *driver_override, *old = dev->driver_override, *cp;
+        char *driver_override, *old, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -94,12 +96,15 @@ static ssize_t driver_override_store(struct device *_dev,
         if (cp)
                 *cp = '\0';
 
+        device_lock(_dev);
+        old = dev->driver_override;
         if (strlen(driver_override)) {
                 dev->driver_override = driver_override;
         } else {
                kfree(driver_override);
                dev->driver_override = NULL;
         }
+        device_unlock(_dev);
 
         kfree(old);
 
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 764b63a5aade..e578eee31589 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2839,6 +2839,14 @@ static void binder_transaction(struct binder_proc *proc,
                         else
                                 return_error = BR_DEAD_REPLY;
                         mutex_unlock(&context->context_mgr_node_lock);
+                        if (target_node && target_proc == proc) {
+                                binder_user_error("%d:%d got transaction to context manager from process owning it\n",
+                                                  proc->pid, thread->pid);
+                                return_error = BR_FAILED_REPLY;
+                                return_error_param = -EINVAL;
+                                return_error_line = __LINE__;
+                                goto err_invalid_target_handle;
+                        }
                 }
                 if (!target_node) {
                         /*
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index 1e6396bb807b..597d40893862 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -312,8 +312,9 @@ static int __dma_mmap_from_coherent(struct dma_coherent_mem *mem,
  * This checks whether the memory was allocated from the per-device
  * coherent memory pool and if so, maps that memory to the provided vma.
  *
- * Returns 1 if we correctly mapped the memory, or 0 if the caller should
- * proceed with mapping memory from generic pools.
+ * Returns 1 if @vaddr belongs to the device coherent pool and the caller
+ * should return @ret, or 0 if they should proceed with mapping memory from
+ * generic areas.
  */
 int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma,
                            void *vaddr, size_t size, int *ret)
diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
index 3b118353ea17..d82566d6e237 100644
--- a/drivers/base/dma-mapping.c
+++ b/drivers/base/dma-mapping.c
@@ -226,7 +226,6 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
 #ifndef CONFIG_ARCH_NO_COHERENT_DMA_MMAP
         unsigned long user_count = vma_pages(vma);
         unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
-        unsigned long pfn = page_to_pfn(virt_to_page(cpu_addr));
         unsigned long off = vma->vm_pgoff;
 
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
@@ -234,12 +233,11 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
         if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                 return ret;
 
-        if (off < count && user_count <= (count - off)) {
+        if (off < count && user_count <= (count - off))
                 ret = remap_pfn_range(vma, vma->vm_start,
-                                      pfn + off,
+                                      page_to_pfn(virt_to_page(cpu_addr)) + off,
                                       user_count << PAGE_SHIFT,
                                       vma->vm_page_prot);
-        }
 #endif  /* !CONFIG_ARCH_NO_COHERENT_DMA_MMAP */
 
         return ret;
diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index 31b5015b59fe..358354148dec 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -537,8 +537,8 @@ exit:
 }
 
 /**
- * fw_load_sysfs_fallback - load a firmware via the syfs fallback mechanism
- * @fw_sysfs: firmware syfs information for the firmware to load
+ * fw_load_sysfs_fallback - load a firmware via the sysfs fallback mechanism
+ * @fw_sysfs: firmware sysfs information for the firmware to load
  * @opt_flags: flags of options, FW_OPT_*
  * @timeout: timeout to wait for the load
  *
diff --git a/drivers/base/firmware_loader/fallback.h b/drivers/base/firmware_loader/fallback.h
index dfebc644ed35..f8255670a663 100644
--- a/drivers/base/firmware_loader/fallback.h
+++ b/drivers/base/firmware_loader/fallback.h
@@ -6,7 +6,7 @@
 #include <linux/device.h>
 
 /**
- * struct firmware_fallback_config - firmware fallback configuratioon settings
+ * struct firmware_fallback_config - firmware fallback configuration settings
  *
  * Helps describe and fine tune the fallback mechanism.
  *
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index c9d04497a415..5d4e31655d96 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -451,25 +451,47 @@ static int lo_req_flush(struct loop_device *lo, struct request *rq)
 static void lo_complete_rq(struct request *rq)
 {
         struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+        blk_status_t ret = BLK_STS_OK;
 
-        if (unlikely(req_op(cmd->rq) == REQ_OP_READ && cmd->use_aio &&
-                     cmd->ret >= 0 && cmd->ret < blk_rq_bytes(cmd->rq))) {
-                struct bio *bio = cmd->rq->bio;
-
-                bio_advance(bio, cmd->ret);
-                zero_fill_bio(bio);
+        if (!cmd->use_aio || cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) ||
+            req_op(rq) != REQ_OP_READ) {
+                if (cmd->ret < 0)
+                        ret = BLK_STS_IOERR;
+                goto end_io;
         }
 
-        blk_mq_end_request(rq, cmd->ret < 0 ? BLK_STS_IOERR : BLK_STS_OK);
+        /*
+         * Short READ - if we got some data, advance our request and
+         * retry it. If we got no data, end the rest with EIO.
+         */
+        if (cmd->ret) {
+                blk_update_request(rq, BLK_STS_OK, cmd->ret);
+                cmd->ret = 0;
+                blk_mq_requeue_request(rq, true);
+        } else {
+                if (cmd->use_aio) {
+                        struct bio *bio = rq->bio;
+
+                        while (bio) {
+                                zero_fill_bio(bio);
+                                bio = bio->bi_next;
+                        }
+                }
+                ret = BLK_STS_IOERR;
+end_io:
+                blk_mq_end_request(rq, ret);
+        }
 }
 
 static void lo_rw_aio_do_completion(struct loop_cmd *cmd)
 {
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
+
         if (!atomic_dec_and_test(&cmd->ref))
                 return;
         kfree(cmd->bvec);
         cmd->bvec = NULL;
-        blk_mq_complete_request(cmd->rq);
+        blk_mq_complete_request(rq);
 }
 
 static void lo_rw_aio_complete(struct kiocb *iocb, long ret, long ret2)
@@ -487,7 +509,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
 {
         struct iov_iter iter;
         struct bio_vec *bvec;
-        struct request *rq = cmd->rq;
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
         struct bio *bio = rq->bio;
         struct file *file = lo->lo_backing_file;
         unsigned int offset;
@@ -1702,15 +1724,16 @@ EXPORT_SYMBOL(loop_unregister_transfer);
 static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
                 const struct blk_mq_queue_data *bd)
 {
-        struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
-        struct loop_device *lo = cmd->rq->q->queuedata;
+        struct request *rq = bd->rq;
+        struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+        struct loop_device *lo = rq->q->queuedata;
 
-        blk_mq_start_request(bd->rq);
+        blk_mq_start_request(rq);
 
         if (lo->lo_state != Lo_bound)
                 return BLK_STS_IOERR;
 
-        switch (req_op(cmd->rq)) {
+        switch (req_op(rq)) {
         case REQ_OP_FLUSH:
         case REQ_OP_DISCARD:
         case REQ_OP_WRITE_ZEROES:
@@ -1723,8 +1746,8 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         /* always use the first bio's css */
 #ifdef CONFIG_BLK_CGROUP
-        if (cmd->use_aio && cmd->rq->bio && cmd->rq->bio->bi_css) {
-                cmd->css = cmd->rq->bio->bi_css;
+        if (cmd->use_aio && rq->bio && rq->bio->bi_css) {
+                cmd->css = rq->bio->bi_css;
                 css_get(cmd->css);
         } else
 #endif
@@ -1736,8 +1759,9 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 
 static void loop_handle_cmd(struct loop_cmd *cmd)
 {
-        const bool write = op_is_write(req_op(cmd->rq));
-        struct loop_device *lo = cmd->rq->q->queuedata;
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
+        const bool write = op_is_write(req_op(rq));
+        struct loop_device *lo = rq->q->queuedata;
         int ret = 0;
 
         if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) {
@@ -1745,12 +1769,12 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
                 goto failed;
         }
 
-        ret = do_req_filebacked(lo, cmd->rq);
+        ret = do_req_filebacked(lo, rq);
  failed:
         /* complete non-aio request */
         if (!cmd->use_aio || ret) {
                 cmd->ret = ret ? -EIO : 0;
-                blk_mq_complete_request(cmd->rq);
+                blk_mq_complete_request(rq);
         }
 }
 
@@ -1767,9 +1791,7 @@ static int loop_init_request(struct blk_mq_tag_set *set, struct request *rq,
 {
         struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
 
-        cmd->rq = rq;
         kthread_init_work(&cmd->work, loop_queue_work);
-
         return 0;
 }
 
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 0f45416e4fcf..b78de9879f4f 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -66,7 +66,6 @@ struct loop_device {
 
 struct loop_cmd {
         struct kthread_work work;
-        struct request *rq;
         bool use_aio; /* use AIO interface to handle I/O */
         atomic_t ref; /* only for aio */
         long ret;
diff --git a/drivers/block/swim.c b/drivers/block/swim.c
index 64e066eba72e..0e31884a9519 100644
--- a/drivers/block/swim.c
+++ b/drivers/block/swim.c
@@ -110,7 +110,7 @@ struct iwm {
 /* Select values for swim_select and swim_readbit */
 
 #define READ_DATA_0     0x074
-#define TWOMEG_DRIVE    0x075
+#define ONEMEG_DRIVE    0x075
 #define SINGLE_SIDED    0x076
 #define DRIVE_PRESENT   0x077
 #define DISK_IN         0x170
@@ -118,9 +118,9 @@ struct iwm {
 #define TRACK_ZERO      0x172
 #define TACHO           0x173
 #define READ_DATA_1     0x174
-#define MFM_MODE        0x175
+#define GCR_MODE        0x175
 #define SEEK_COMPLETE   0x176
-#define ONEMEG_MEDIA    0x177
+#define TWOMEG_MEDIA    0x177
 
 /* Bits in handshake register */
 
@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
                 struct floppy_struct *g;
                 fs->disk_in = 1;
                 fs->write_protected = swim_readbit(base, WRITE_PROT);
-                fs->type = swim_readbit(base, ONEMEG_MEDIA);
 
                 if (swim_track00(base))
                         printk(KERN_ERR
@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
 
                 swim_track00(base);
 
+                fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
+                        HD_MEDIA : DD_MEDIA;
+                fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
                 get_floppy_geometry(fs, 0, &g);
                 fs->total_secs = g->size;
                 fs->secpercyl = g->head * g->sect;
@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
 
         swim_write(base, setup, S_IBM_DRIVE  | S_FCLK_DIV2);
         udelay(10);
-        swim_drive(base, INTERNAL_DRIVE);
+        swim_drive(base, fs->location);
         swim_motor(base, ON);
         swim_action(base, SETMFM);
         if (fs->ejected)
@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
                 goto out;
         }
 
+        set_capacity(fs->disk, fs->total_secs);
+
         if (mode & FMODE_NDELAY)
                 return 0;
 
@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
                 if (copy_to_user((void __user *) param, (void *) &floppy_type,
                                  sizeof(struct floppy_struct)))
                         return -EFAULT;
-                break;
-
-        default:
-                printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
-                       cmd);
-                return -ENOSYS;
+                return 0;
         }
-        return 0;
+        return -ENOTTY;
 }
 
 static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         struct swim_priv *swd = data;
         int drive = (*part & 3);
 
-        if (drive > swd->floppy_count)
+        if (drive >= swd->floppy_count)
                 return NULL;
 
         *part = 0;
@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
 
         swim_motor(base, OFF);
 
-        if (swim_readbit(base, SINGLE_SIDED))
-                fs->head_number = 1;
-        else
-                fs->head_number = 2;
+        fs->type = HD_MEDIA;
+        fs->head_number = 2;
+
         fs->ref_count = 0;
         fs->ejected = 1;
 
@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
         /* scan floppy drives */
 
         swim_drive(base, INTERNAL_DRIVE);
-        if (swim_readbit(base, DRIVE_PRESENT))
+        if (swim_readbit(base, DRIVE_PRESENT) &&
+            !swim_readbit(base, ONEMEG_DRIVE))
                 swim_add_floppy(swd, INTERNAL_DRIVE);
         swim_drive(base, EXTERNAL_DRIVE);
-        if (swim_readbit(base, DRIVE_PRESENT))
+        if (swim_readbit(base, DRIVE_PRESENT) &&
+            !swim_readbit(base, ONEMEG_DRIVE))
                 swim_add_floppy(swd, EXTERNAL_DRIVE);
 
         /* register floppy drives */
@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
                                                               &swd->lock);
                 if (!swd->unit[drive].disk->queue) {
                         err = -ENOMEM;
-                        put_disk(swd->unit[drive].disk);
                         goto exit_put_disks;
                 }
                 blk_queue_bounce_limit(swd->unit[drive].disk->queue,
@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
                 goto out;
         }
 
-        swim_base = ioremap(res->start, resource_size(res));
+        swim_base = (struct swim __iomem *)res->start;
         if (!swim_base) {
                 ret = -ENOMEM;
                 goto out_release_io;
@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
         if (!get_swim_mode(swim_base)) {
                 printk(KERN_INFO "SWIM device not found !\n");
                 ret = -ENODEV;
-                goto out_iounmap;
+                goto out_release_io;
         }
 
         /* set platform driver data */
@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
         swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
         if (!swd) {
                 ret = -ENOMEM;
-                goto out_iounmap;
+                goto out_release_io;
         }
         platform_set_drvdata(dev, swd);
 
@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
 
 out_kfree:
         kfree(swd);
-out_iounmap:
-        iounmap(swim_base);
 out_release_io:
         release_mem_region(res->start, resource_size(res));
 out:
@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
         for (drive = 0; drive < swd->floppy_count; drive++)
                 floppy_eject(&swd->unit[drive]);
 
-        iounmap(swd->base);
-
         res = platform_get_resource(dev, IORESOURCE_MEM, 0);
         if (res)
                 release_mem_region(res->start, resource_size(res));
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index af51015d056e..469541c1e51e 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -148,7 +148,7 @@ struct swim3 {
 #define MOTOR_ON        2
 #define RELAX           3       /* also eject in progress */
 #define READ_DATA_0     4
-#define TWOMEG_DRIVE    5
+#define ONEMEG_DRIVE    5
 #define SINGLE_SIDED    6       /* drive or diskette is 4MB type? */
 #define DRIVE_PRESENT   7
 #define DISK_IN         8
@@ -156,9 +156,9 @@ struct swim3 {
 #define TRACK_ZERO      10
 #define TACHO           11
 #define READ_DATA_1     12
-#define MFM_MODE        13
+#define GCR_MODE        13
 #define SEEK_COMPLETE   14
-#define ONEMEG_MEDIA    15
+#define TWOMEG_MEDIA    15
 
 /* Definitions of values used in writing and formatting */
 #define DATA_ESCAPE     0x99
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index d1c0b60e9326..6dc177bf4c42 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -33,6 +33,7 @@ config HISILICON_LPC
         bool "Support for ISA I/O space on HiSilicon Hip06/7"
         depends on ARM64 && (ARCH_HISI || COMPILE_TEST)
         select INDIRECT_PIO
+        select MFD_CORE if ACPI
         help
           Driver to enable I/O access to devices attached to the Low Pin
           Count bus on the HiSilicon Hip06/7 SoC.
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 8327478effd0..bfc566d3f31a 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2371,7 +2371,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
         if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
                 return media_changed(cdi, 1);
 
-        if ((unsigned int)arg >= cdi->capacity)
+        if (arg >= cdi->capacity)
                 return -EINVAL;
 
         info = kmalloc(sizeof(*info), GFP_KERNEL);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 3cd3aae24d6d..cd888d4ee605 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -261,6 +261,7 @@
 #include <linux/ptrace.h>
 #include <linux/workqueue.h>
 #include <linux/irq.h>
+#include <linux/ratelimit.h>
 #include <linux/syscalls.h>
 #include <linux/completion.h>
 #include <linux/uuid.h>
@@ -438,6 +439,16 @@ static void _crng_backtrack_protect(struct crng_state *crng,
 static void process_random_ready_list(void);
 static void _get_random_bytes(void *buf, int nbytes);
 
+static struct ratelimit_state unseeded_warning =
+        RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
+static struct ratelimit_state urandom_warning =
+        RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
+
+static int ratelimit_disable __read_mostly;
+
+module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
+MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
+
 /**********************************************************************
  *
  * OS independent entropy store.   Here are the functions which handle
@@ -789,7 +800,7 @@ static void crng_initialize(struct crng_state *crng)
 }
 
 #ifdef CONFIG_NUMA
-static void numa_crng_init(void)
+static void do_numa_crng_init(struct work_struct *work)
 {
         int i;
         struct crng_state *crng;
@@ -810,6 +821,13 @@ static void numa_crng_init(void)
                 kfree(pool);
         }
 }
+
+static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init);
+
+static void numa_crng_init(void)
+{
+        schedule_work(&numa_crng_init_work);
+}
 #else
 static void numa_crng_init(void) {}
 #endif
@@ -925,6 +943,18 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
                 process_random_ready_list();
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: crng init done\n");
+                if (unseeded_warning.missed) {
+                        pr_notice("random: %d get_random_xx warning(s) missed "
+                                  "due to ratelimiting\n",
+                                  unseeded_warning.missed);
+                        unseeded_warning.missed = 0;
+                }
+                if (urandom_warning.missed) {
+                        pr_notice("random: %d urandom warning(s) missed "
+                                  "due to ratelimiting\n",
+                                  urandom_warning.missed);
+                        urandom_warning.missed = 0;
+                }
         }
 }
 
@@ -1565,8 +1595,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
 #ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
         print_once = true;
 #endif
-        pr_notice("random: %s called from %pS with crng_init=%d\n",
-                  func_name, caller, crng_init);
+        if (__ratelimit(&unseeded_warning))
+                pr_notice("random: %s called from %pS with crng_init=%d\n",
+                          func_name, caller, crng_init);
 }
 
 /*
@@ -1760,6 +1791,10 @@ static int rand_initialize(void)
         init_std_data(&blocking_pool);
         crng_initialize(&primary_crng);
         crng_global_init_time = jiffies;
+        if (ratelimit_disable) {
+                urandom_warning.interval = 0;
+                unseeded_warning.interval = 0;
+        }
         return 0;
 }
 early_initcall(rand_initialize);
@@ -1827,9 +1862,10 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
 
         if (!crng_ready() && maxwarn > 0) {
                 maxwarn--;
-                printk(KERN_NOTICE "random: %s: uninitialized urandom read "
-                       "(%zd bytes read)\n",
-                       current->comm, nbytes);
+                if (__ratelimit(&urandom_warning))
+                        printk(KERN_NOTICE "random: %s: uninitialized "
+                               "urandom read (%zd bytes read)\n",
+                               current->comm, nbytes);
                 spin_lock_irqsave(&primary_crng.lock, flags);
                 crng_init_cnt = 0;
                 spin_unlock_irqrestore(&primary_crng.lock, flags);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 468f06134012..21085515814f 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -422,7 +422,7 @@ static void reclaim_dma_bufs(void)
         }
 }
 
-static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
+static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size,
                                      int pages)
 {
         struct port_buffer *buf;
@@ -445,16 +445,16 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
                 return buf;
         }
 
-        if (is_rproc_serial(vq->vdev)) {
+        if (is_rproc_serial(vdev)) {
                 /*
                  * Allocate DMA memory from ancestor. When a virtio
                  * device is created by remoteproc, the DMA memory is
                  * associated with the grandparent device:
                  * vdev => rproc => platform-dev.
                  */
-                if (!vq->vdev->dev.parent || !vq->vdev->dev.parent->parent)
+                if (!vdev->dev.parent || !vdev->dev.parent->parent)
                         goto free_buf;
-                buf->dev = vq->vdev->dev.parent->parent;
+                buf->dev = vdev->dev.parent->parent;
 
                 /* Increase device refcnt to avoid freeing it */
                 get_device(buf->dev);
@@ -838,7 +838,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
 
         count = min((size_t)(32 * 1024), count);
 
-        buf = alloc_buf(port->out_vq, count, 0);
+        buf = alloc_buf(port->portdev->vdev, count, 0);
         if (!buf)
                 return -ENOMEM;
 
@@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
         if (ret < 0)
                 goto error_out;
 
-        buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
+        buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs);
         if (!buf) {
                 ret = -ENOMEM;
                 goto error_out;
@@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
 
         nr_added_bufs = 0;
         do {
-                buf = alloc_buf(vq, PAGE_SIZE, 0);
+                buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
                 if (!buf)
                         break;
 
@@ -1402,7 +1402,6 @@ static int add_port(struct ports_device *portdev, u32 id)
 {
         char debugfs_name[16];
         struct port *port;
-        struct port_buffer *buf;
         dev_t devt;
         unsigned int nr_added_bufs;
         int err;
@@ -1513,8 +1512,6 @@ static int add_port(struct ports_device *portdev, u32 id)
         return 0;
 
 free_inbufs:
-        while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
-                free_buf(buf, true);
 free_device:
         device_destroy(pdrvdata.class, port->dev->devt);
 free_cdev:
@@ -1539,34 +1536,14 @@ static void remove_port(struct kref *kref)
 
 static void remove_port_data(struct port *port)
 {
-        struct port_buffer *buf;
-
         spin_lock_irq(&port->inbuf_lock);
         /* Remove unused data this port might have received. */
         discard_port_data(port);
         spin_unlock_irq(&port->inbuf_lock);
 
-        /* Remove buffers we queued up for the Host to send us data in. */
-        do {
-                spin_lock_irq(&port->inbuf_lock);
-                buf = virtqueue_detach_unused_buf(port->in_vq);
-                spin_unlock_irq(&port->inbuf_lock);
-                if (buf)
-                        free_buf(buf, true);
-        } while (buf);
-
         spin_lock_irq(&port->outvq_lock);
         reclaim_consumed_buffers(port);
         spin_unlock_irq(&port->outvq_lock);
-
-        /* Free pending buffers from the out-queue. */
-        do {
-                spin_lock_irq(&port->outvq_lock);
-                buf = virtqueue_detach_unused_buf(port->out_vq);
-                spin_unlock_irq(&port->outvq_lock);
-                if (buf)
-                        free_buf(buf, true);
-        } while (buf);
 }
 
 /*
@@ -1791,13 +1768,24 @@ static void control_work_handler(struct work_struct *work)
         spin_unlock(&portdev->c_ivq_lock);
 }
 
+static void flush_bufs(struct virtqueue *vq, bool can_sleep)
+{
+        struct port_buffer *buf;
+        unsigned int len;
+
+        while ((buf = virtqueue_get_buf(vq, &len)))
+                free_buf(buf, can_sleep);
+}
+
 static void out_intr(struct virtqueue *vq)
 {
         struct port *port;
 
         port = find_port_by_vq(vq->vdev->priv, vq);
-        if (!port)
+        if (!port) {
+                flush_bufs(vq, false);
                 return;
+        }
 
         wake_up_interruptible(&port->waitqueue);
 }
@@ -1808,8 +1796,10 @@ static void in_intr(struct virtqueue *vq)
         unsigned long flags;
 
         port = find_port_by_vq(vq->vdev->priv, vq);
-        if (!port)
+        if (!port) {
+                flush_bufs(vq, false);
                 return;
+        }
 
         spin_lock_irqsave(&port->inbuf_lock, flags);
         port->inbuf = get_inbuf(port);
@@ -1984,24 +1974,54 @@ static const struct file_operations portdev_fops = {
 
 static void remove_vqs(struct ports_device *portdev)
 {
+        struct virtqueue *vq;
+
+        virtio_device_for_each_vq(portdev->vdev, vq) {
+                struct port_buffer *buf;
+
+                flush_bufs(vq, true);
+                while ((buf = virtqueue_detach_unused_buf(vq)))
+                        free_buf(buf, true);
+        }
         portdev->vdev->config->del_vqs(portdev->vdev);
         kfree(portdev->in_vqs);
         kfree(portdev->out_vqs);
 }
 
-static void remove_controlq_data(struct ports_device *portdev)
+static void virtcons_remove(struct virtio_device *vdev)
 {
-        struct port_buffer *buf;
-        unsigned int len;
+        struct ports_device *portdev;
+        struct port *port, *port2;
 
-        if (!use_multiport(portdev))
-                return;
+        portdev = vdev->priv;
 
-        while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
-                free_buf(buf, true);
+        spin_lock_irq(&pdrvdata_lock);
+        list_del(&portdev->list);
+        spin_unlock_irq(&pdrvdata_lock);
 
-        while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
-                free_buf(buf, true);
+        /* Disable interrupts for vqs */
+        vdev->config->reset(vdev);
+        /* Finish up work that's lined up */
+        if (use_multiport(portdev))
+                cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
+
+        list_for_each_entry_safe(port, port2, &portdev->ports, list)
+                unplug_port(port);
+
+        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
+
+        /*
+         * When yanking out a device, we immediately lose the
+         * (device-side) queues.  So there's no point in keeping the
+         * guest side around till we drop our final reference.  This
+         * also means that any ports which are in an open state will
+         * have to just stop using the port, as the vqs are going
+         * away.
+         */
+        remove_vqs(portdev);
+        kfree(portdev);
 }
 
 /*
@@ -2070,6 +2090,7 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         spin_lock_init(&portdev->ports_lock);
         INIT_LIST_HEAD(&portdev->ports);
+        INIT_LIST_HEAD(&portdev->list);
 
         virtio_device_ready(portdev->vdev);
 
@@ -2087,8 +2108,15 @@ static int virtcons_probe(struct virtio_device *vdev)
                 if (!nr_added_bufs) {
                         dev_err(&vdev->dev,
                                 "Error allocating buffers for control queue\n");
-                        err = -ENOMEM;
-                        goto free_vqs;
+                        /*
+                         * The host might want to notify mgmt sw about device
+                         * add failure.
+                         */
+                        __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
+                                           VIRTIO_CONSOLE_DEVICE_READY, 0);
+                        /* Device was functional: we need full cleanup. */
+                        virtcons_remove(vdev);
+                        return -ENOMEM;
                 }
         } else {
                 /*
@@ -2119,11 +2147,6 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         return 0;
 
-free_vqs:
-        /* The host might want to notify mgmt sw about device add failure */
-        __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
-                           VIRTIO_CONSOLE_DEVICE_READY, 0);
-        remove_vqs(portdev);
 free_chrdev:
         unregister_chrdev(portdev->chr_major, "virtio-portsdev");
 free:
@@ -2132,43 +2155,6 @@ fail:
         return err;
 }
 
-static void virtcons_remove(struct virtio_device *vdev)
-{
-        struct ports_device *portdev;
-        struct port *port, *port2;
-
-        portdev = vdev->priv;
-
-        spin_lock_irq(&pdrvdata_lock);
-        list_del(&portdev->list);
-        spin_unlock_irq(&pdrvdata_lock);
-
-        /* Disable interrupts for vqs */
-        vdev->config->reset(vdev);
-        /* Finish up work that's lined up */
-        if (use_multiport(portdev))
-                cancel_work_sync(&portdev->control_work);
-        else
-                cancel_work_sync(&portdev->config_work);
-
-        list_for_each_entry_safe(port, port2, &portdev->ports, list)
-                unplug_port(port);
-
-        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
-
-        /*
-         * When yanking out a device, we immediately lose the
-         * (device-side) queues.  So there's no point in keeping the
-         * guest side around till we drop our final reference.  This
-         * also means that any ports which are in an open state will
-         * have to just stop using the port, as the vqs are going
-         * away.
-         */
-        remove_controlq_data(portdev);
-        remove_vqs(portdev);
-        kfree(portdev);
-}
-
 static struct virtio_device_id id_table[] = {
         { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
         { 0 },
@@ -2209,7 +2195,6 @@ static int virtcons_freeze(struct virtio_device *vdev)
          */
         if (use_multiport(portdev))
                 virtqueue_disable_cb(portdev->c_ivq);
-        remove_controlq_data(portdev);
 
         list_for_each_entry(port, &portdev->ports, list) {
                 virtqueue_disable_cb(port->in_vq);
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 7f56fe5183f2..de55c7d57438 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,16 +71,6 @@ config ARM_BRCMSTB_AVS_CPUFREQ
 
           Say Y, if you have a Broadcom SoC with AVS support for DFS or DVFS.
 
-config ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-        bool "Broadcom STB AVS CPUfreq driver sysfs debug capability"
-        depends on ARM_BRCMSTB_AVS_CPUFREQ
-        help
-          Enabling this option turns on debug support via sysfs under
-          /sys/kernel/debug/brcmstb-avs-cpufreq. It is possible to read all and
-          write some AVS mailbox registers through sysfs entries.
-
-          If in doubt, say N.
-
 config ARM_EXYNOS5440_CPUFREQ
         tristate "SAMSUNG EXYNOS5440"
         depends on SOC_EXYNOS5440
diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 6cdac1aaf23c..b07559b9ed99 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -49,13 +49,6 @@
 #include <linux/platform_device.h>
 #include <linux/semaphore.h>
 
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-#include <linux/ctype.h>
-#include <linux/debugfs.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-#endif
-
 /* Max number of arguments AVS calls take */
 #define AVS_MAX_CMD_ARGS        4
 /*
@@ -182,88 +175,11 @@ struct private_data {
         void __iomem *base;
         void __iomem *avs_intr_base;
         struct device *dev;
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-        struct dentry *debugfs;
-#endif
         struct completion done;
         struct semaphore sem;
         struct pmap pmap;
 };
 
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-
-enum debugfs_format {
-        DEBUGFS_NORMAL,
-        DEBUGFS_FLOAT,
-        DEBUGFS_REV,
-};
-
-struct debugfs_data {
-        struct debugfs_entry *entry;
-        struct private_data *priv;
-};
-
-struct debugfs_entry {
-        char *name;
-        u32 offset;
-        fmode_t mode;
-        enum debugfs_format format;
-};
-
-#define DEBUGFS_ENTRY(name, mode, format)       { \
-        #name, AVS_MBOX_##name, mode, format \
-}
-
-/*
- * These are used for debugfs only. Otherwise we use AVS_MBOX_PARAM() directly.
- */
-#define AVS_MBOX_PARAM1         AVS_MBOX_PARAM(0)
-#define AVS_MBOX_PARAM2         AVS_MBOX_PARAM(1)
-#define AVS_MBOX_PARAM3         AVS_MBOX_PARAM(2)
-#define AVS_MBOX_PARAM4         AVS_MBOX_PARAM(3)
-
-/*
- * This table stores the name, access permissions and offset for each hardware
- * register and is used to generate debugfs entries.
- */
-static struct debugfs_entry debugfs_entries[] = {
-        DEBUGFS_ENTRY(COMMAND, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(STATUS, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(VOLTAGE0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(TEMP0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PV0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(MV0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PARAM1, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM2, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM3, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM4, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(REVISION, 0, DEBUGFS_REV),
-        DEBUGFS_ENTRY(PSTATE, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(HEARTBEAT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(MAGIC, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(SIGMA_HVT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(SIGMA_SVT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(VOLTAGE1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(TEMP1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PV1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(MV1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(FREQUENCY, 0, DEBUGFS_NORMAL),
-};
-
-static int brcm_avs_target_index(struct cpufreq_policy *, unsigned int);
-
-static char *__strtolower(char *s)
-{
-        char *p;
-
-        for (p = s; *p; p++)
-                *p = tolower(*p);
-
-        return s;
-}
-
-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */
-
 static void __iomem *__map_region(const char *name)
 {
         struct device_node *np;
@@ -516,238 +432,6 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv)
         return table;
 }
 
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-
-#define MANT(x) (unsigned int)(abs((x)) / 1000)
-#define FRAC(x) (unsigned int)(abs((x)) - abs((x)) / 1000 * 1000)
-
-static int brcm_avs_debug_show(struct seq_file *s, void *data)
-{
-        struct debugfs_data *dbgfs = s->private;
-        void __iomem *base;
-        u32 val, offset;
-
-        if (!dbgfs) {
-                seq_puts(s, "No device pointer\n");
-                return 0;
-        }
-
-        base = dbgfs->priv->base;
-        offset = dbgfs->entry->offset;
-        val = readl(base + offset);
-        switch (dbgfs->entry->format) {
-        case DEBUGFS_NORMAL:
-                seq_printf(s, "%u\n", val);
-                break;
-        case DEBUGFS_FLOAT:
-                seq_printf(s, "%d.%03d\n", MANT(val), FRAC(val));
-                break;
-        case DEBUGFS_REV:
-                seq_printf(s, "%c.%c.%c.%c\n", (val >> 24 & 0xff),
-                           (val >> 16 & 0xff), (val >> 8 & 0xff),
-                           val & 0xff);
-                break;
-        }
-        seq_printf(s, "0x%08x\n", val);
-
-        return 0;
-}
-
-#undef MANT
-#undef FRAC
-
-static ssize_t brcm_avs_seq_write(struct file *file, const char __user *buf,
-                                  size_t size, loff_t *ppos)
-{
-        struct seq_file *s = file->private_data;
-        struct debugfs_data *dbgfs = s->private;
-        struct private_data *priv = dbgfs->priv;
-        void __iomem *base, *avs_intr_base;
-        bool use_issue_command = false;
-        unsigned long val, offset;
-        char str[128];
-        int ret;
-        char *str_ptr = str;
-
-        if (size >= sizeof(str))
-                return -E2BIG;
-
-        memset(str, 0, sizeof(str));
-        ret = copy_from_user(str, buf, size);
-        if (ret)
-                return ret;
-
-        base = priv->base;
-        avs_intr_base = priv->avs_intr_base;
-        offset = dbgfs->entry->offset;
-        /*
-         * Special case writing to "command" entry only: if the string starts
-         * with a 'c', we use the driver's __issue_avs_command() function.
-         * Otherwise, we perform a raw write. This should allow testing of raw
-         * access as well as using the higher level function. (Raw access
-         * doesn't clear the firmware return status after issuing the command.)
-         */
-        if (str_ptr[0] == 'c' && offset == AVS_MBOX_COMMAND) {
-                use_issue_command = true;
-                str_ptr++;
-        }
-        if (kstrtoul(str_ptr, 0, &val) != 0)
-                return -EINVAL;
-
-        /*
-         * Setting the P-state is a special case. We need to update the CPU
-         * frequency we report.
-         */
-        if (val == AVS_CMD_SET_PSTATE) {
-                struct cpufreq_policy *policy;
-                unsigned int pstate;
-
-                policy = cpufreq_cpu_get(smp_processor_id());
-                /* Read back the P-state we are about to set */
-                pstate = readl(base + AVS_MBOX_PARAM(0));
-                if (use_issue_command) {
-                        ret = brcm_avs_target_index(policy, pstate);
-                        return ret ? ret : size;
-                }
-                policy->cur = policy->freq_table[pstate].frequency;
-        }
-
-        if (use_issue_command) {
-                ret = __issue_avs_command(priv, val, false, NULL);
-        } else {
-                /* Locking here is not perfect, but is only for debug. */
-                ret = down_interruptible(&priv->sem);
-                if (ret)
-                        return ret;
-
-                writel(val, base + offset);
-                /* We have to wake up the firmware to process a command. */
-                if (offset == AVS_MBOX_COMMAND)
-                        writel(AVS_CPU_L2_INT_MASK,
-                               avs_intr_base + AVS_CPU_L2_SET0);
-                up(&priv->sem);
-        }
-
-        return ret ? ret : size;
-}
-
-static struct debugfs_entry *__find_debugfs_entry(const char *name)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++)
-                if (strcasecmp(debugfs_entries[i].name, name) == 0)
-                        return &debugfs_entries[i];
-
-        return NULL;
-}
-
-static int brcm_avs_debug_open(struct inode *inode, struct file *file)
-{
-        struct debugfs_data *data;
-        fmode_t fmode;
-        int ret;
-
-        /*
-         * seq_open(), which is called by single_open(), clears "write" access.
-         * We need write access to some files, so we preserve our access mode
-         * and restore it.
-         */
-        fmode = file->f_mode;
-        /*
-         * Check access permissions even for root. We don't want to be writing
-         * to read-only registers. Access for regular users has already been
-         * checked by the VFS layer.
-         */
-        if ((fmode & FMODE_WRITER) && !(inode->i_mode & S_IWUSR))
-                return -EACCES;
-
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-        /*
-         * We use the same file system operations for all our debug files. To
-         * produce specific output, we look up the file name upon opening a
-         * debugfs entry and map it to a memory offset. This offset is then used
-         * in the generic "show" function to read a specific register.
-         */
-        data->entry = __find_debugfs_entry(file->f_path.dentry->d_iname);
-        data->priv = inode->i_private;
-
-        ret = single_open(file, brcm_avs_debug_show, data);
-        if (ret)
-                kfree(data);
-        file->f_mode = fmode;
-
-        return ret;
-}
-
-static int brcm_avs_debug_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq_priv = file->private_data;
-        struct debugfs_data *data = seq_priv->private;
-
-        kfree(data);
-        return single_release(inode, file);
-}
-
-static const struct file_operations brcm_avs_debug_ops = {
-        .open           = brcm_avs_debug_open,
-        .read           = seq_read,
-        .write          = brcm_avs_seq_write,
-        .llseek         = seq_lseek,
-        .release        = brcm_avs_debug_release,
-};
-
-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev)
-{
-        struct private_data *priv = platform_get_drvdata(pdev);
-        struct dentry *dir;
-        int i;
-
-        if (!priv)
-                return;
-
-        dir = debugfs_create_dir(BRCM_AVS_CPUFREQ_NAME, NULL);
-        if (IS_ERR_OR_NULL(dir))
-                return;
-        priv->debugfs = dir;
-
-        for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++) {
-                /*
-                 * The DEBUGFS_ENTRY macro generates uppercase strings. We
-                 * convert them to lowercase before creating the debugfs
-                 * entries.
-                 */
-                char *entry = __strtolower(debugfs_entries[i].name);
-                fmode_t mode = debugfs_entries[i].mode;
-
-                if (!debugfs_create_file(entry, S_IFREG | S_IRUGO | mode,
-                                         dir, priv, &brcm_avs_debug_ops)) {
-                        priv->debugfs = NULL;
-                        debugfs_remove_recursive(dir);
-                        break;
-                }
-        }
-}
-
-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev)
-{
-        struct private_data *priv = platform_get_drvdata(pdev);
-
-        if (priv && priv->debugfs) {
-                debugfs_remove_recursive(priv->debugfs);
-                priv->debugfs = NULL;
-        }
-}
-
-#else
-
-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev) {}
-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev) {}
-
-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */
-
 /*
  * To ensure the right firmware is running we need to
  *    - check the MAGIC matches what we expect
@@ -1016,11 +700,8 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
                 return ret;
 
         brcm_avs_driver.driver_data = pdev;
-        ret = cpufreq_register_driver(&brcm_avs_driver);
-        if (!ret)
-                brcm_avs_cpufreq_debug_init(pdev);
 
-        return ret;
+        return cpufreq_register_driver(&brcm_avs_driver);
 }
 
 static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
@@ -1032,8 +713,6 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        brcm_avs_cpufreq_debug_exit(pdev);
-
         priv = platform_get_drvdata(pdev);
         iounmap(priv->base);
         iounmap(priv->avs_intr_base);
diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index 0591874856d3..54edaec1e608 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -679,6 +679,16 @@ void gpstate_timer_handler(struct timer_list *t)
 
         if (!spin_trylock(&gpstates->gpstate_lock))
                 return;
+        /*
+         * If the timer has migrated to the different cpu then bring
+         * it back to one of the policy->cpus
+         */
+        if (!cpumask_test_cpu(raw_smp_processor_id(), policy->cpus)) {
+                gpstates->timer.expires = jiffies + msecs_to_jiffies(1);
+                add_timer_on(&gpstates->timer, cpumask_first(policy->cpus));
+                spin_unlock(&gpstates->gpstate_lock);
+                return;
+        }
 
         /*
          * If PMCR was last updated was using fast_swtich then
@@ -718,10 +728,8 @@ void gpstate_timer_handler(struct timer_list *t)
         if (gpstate_idx != gpstates->last_lpstate_idx)
                 queue_gpstate_timer(gpstates);
 
+        set_pstate(&freq_data);
         spin_unlock(&gpstates->gpstate_lock);
-
-        /* Timer may get migrated to a different cpu on cpu hot unplug */
-        smp_call_function_any(policy->cpus, set_pstate, &freq_data, 1);
 }
 
 /*
diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
index e6f17825db79..2b90606452a2 100644
--- a/drivers/firmware/arm_scmi/clock.c
+++ b/drivers/firmware/arm_scmi/clock.c
@@ -284,7 +284,7 @@ scmi_clock_info_get(const struct scmi_handle *handle, u32 clk_id)
         struct clock_info *ci = handle->clk_priv;
         struct scmi_clock_info *clk = ci->clk + clk_id;
 
-        if (!clk->name || !clk->name[0])
+        if (!clk->name[0])
                 return NULL;
 
         return clk;
diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
index 14f14efdf0d5..06d212a3d49d 100644
--- a/drivers/fpga/altera-ps-spi.c
+++ b/drivers/fpga/altera-ps-spi.c
@@ -249,7 +249,7 @@ static int altera_ps_probe(struct spi_device *spi)
 
         conf->data = of_id->data;
         conf->spi = spi;
-        conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_HIGH);
+        conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_LOW);
         if (IS_ERR(conf->config)) {
                 dev_err(&spi->dev, "Failed to get config gpio: %ld\n",
                         PTR_ERR(conf->config));
diff --git a/drivers/gpu/drm/bridge/dumb-vga-dac.c b/drivers/gpu/drm/bridge/dumb-vga-dac.c
index 498d5948d1a8..9837c8d69e69 100644
--- a/drivers/gpu/drm/bridge/dumb-vga-dac.c
+++ b/drivers/gpu/drm/bridge/dumb-vga-dac.c
@@ -56,7 +56,9 @@ static int dumb_vga_get_modes(struct drm_connector *connector)
         }
 
         drm_mode_connector_update_edid_property(connector, edid);
-        return drm_add_edid_modes(connector, edid);
+        ret = drm_add_edid_modes(connector, edid);
+        kfree(edid);
+        return ret;
 
 fallback:
         /*
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index fc8b2c6e3508..32d24c69da3c 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -2140,10 +2140,22 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
                 }
         }
 
-        /* According to BSpec, "The CD clock frequency must be at least twice
+        /*
+         * According to BSpec, "The CD clock frequency must be at least twice
          * the frequency of the Azalia BCLK." and BCLK is 96 MHz by default.
+         *
+         * FIXME: Check the actual, not default, BCLK being used.
+         *
+         * FIXME: This does not depend on ->has_audio because the higher CDCLK
+         * is required for audio probe, also when there are no audio capable
+         * displays connected at probe time. This leads to unnecessarily high
+         * CDCLK when audio is not required.
+         *
+         * FIXME: This limit is only applied when there are displays connected
+         * at probe time. If we probe without displays, we'll still end up using
+         * the platform minimum CDCLK, failing audio probe.
          */
-        if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
+        if (INTEL_GEN(dev_priv) >= 9)
                 min_cdclk = max(2 * 96000, min_cdclk);
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 41e6c75a7f3c..f9550ea46c26 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -35,6 +35,7 @@
  */
 
 #define I915_CSR_GLK "i915/glk_dmc_ver1_04.bin"
+MODULE_FIRMWARE(I915_CSR_GLK);
 #define GLK_CSR_VERSION_REQUIRED        CSR_VERSION(1, 4)
 
 #define I915_CSR_CNL "i915/cnl_dmc_ver1_07.bin"
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index d4368589b355..a80fbad9be0f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -49,12 +49,12 @@
  * check the condition before the timeout.
  */
 #define __wait_for(OP, COND, US, Wmin, Wmax) ({ \
-        unsigned long timeout__ = jiffies + usecs_to_jiffies(US) + 1;   \
+        const ktime_t end__ = ktime_add_ns(ktime_get_raw(), 1000ll * (US)); \
         long wait__ = (Wmin); /* recommended min for usleep is 10 us */ \
         int ret__;                                                      \
         might_sleep();                                                  \
         for (;;) {                                                      \
-                bool expired__ = time_after(jiffies, timeout__);        \
+                const bool expired__ = ktime_after(ktime_get_raw(), end__); \
                 OP;                                                     \
                 if (COND) {                                             \
                         ret__ = 0;                                      \
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 6f12adc06365..6467a5cc2ca3 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -806,7 +806,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
                 return;
 
         intel_fbdev_sync(ifbdev);
-        if (ifbdev->vma)
+        if (ifbdev->vma || ifbdev->helper.deferred_setup)
                 drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 53ea564f971e..66de4b2dc8b7 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -641,19 +641,18 @@ void skl_enable_dc6(struct drm_i915_private *dev_priv)
 
         DRM_DEBUG_KMS("Enabling DC6\n");
 
-        gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6);
+        /* Wa Display #1183: skl,kbl,cfl */
+        if (IS_GEN9_BC(dev_priv))
+                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
+                           SKL_SELECT_ALTERNATE_DC_EXIT);
 
+        gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6);
 }
 
 void skl_disable_dc6(struct drm_i915_private *dev_priv)
 {
         DRM_DEBUG_KMS("Disabling DC6\n");
 
-        /* Wa Display #1183: skl,kbl,cfl */
-        if (IS_GEN9_BC(dev_priv))
-                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
-                           SKL_SELECT_ALTERNATE_DC_EXIT);
-
         gen9_set_dc_state(dev_priv, DC_STATE_DISABLE);
 }
 
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index bf4667481935..c61dff594195 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -760,6 +760,7 @@ static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 struct vc4_async_flip_state {
         struct drm_crtc *crtc;
         struct drm_framebuffer *fb;
+        struct drm_framebuffer *old_fb;
         struct drm_pending_vblank_event *event;
 
         struct vc4_seqno_cb cb;
@@ -789,6 +790,23 @@ vc4_async_page_flip_complete(struct vc4_seqno_cb *cb)
 
         drm_crtc_vblank_put(crtc);
         drm_framebuffer_put(flip_state->fb);
+
+        /* Decrement the BO usecnt in order to keep the inc/dec calls balanced
+         * when the planes are updated through the async update path.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made cleanup_fb()
+         * logic.
+         */
+        if (flip_state->old_fb) {
+                struct drm_gem_cma_object *cma_bo;
+                struct vc4_bo *bo;
+
+                cma_bo = drm_fb_cma_get_gem_obj(flip_state->old_fb, 0);
+                bo = to_vc4_bo(&cma_bo->base);
+                vc4_bo_dec_usecnt(bo);
+                drm_framebuffer_put(flip_state->old_fb);
+        }
+
         kfree(flip_state);
 
         up(&vc4->async_modeset);
@@ -813,9 +831,22 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
         struct drm_gem_cma_object *cma_bo = drm_fb_cma_get_gem_obj(fb, 0);
         struct vc4_bo *bo = to_vc4_bo(&cma_bo->base);
 
+        /* Increment the BO usecnt here, so that we never end up with an
+         * unbalanced number of vc4_bo_{dec,inc}_usecnt() calls when the
+         * plane is later updated through the non-async path.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made prepare_fb()
+         * logic.
+         */
+        ret = vc4_bo_inc_usecnt(bo);
+        if (ret)
+                return ret;
+
         flip_state = kzalloc(sizeof(*flip_state), GFP_KERNEL);
-        if (!flip_state)
+        if (!flip_state) {
+                vc4_bo_dec_usecnt(bo);
                 return -ENOMEM;
+        }
 
         drm_framebuffer_get(fb);
         flip_state->fb = fb;
@@ -826,10 +857,23 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
         ret = down_interruptible(&vc4->async_modeset);
         if (ret) {
                 drm_framebuffer_put(fb);
+                vc4_bo_dec_usecnt(bo);
                 kfree(flip_state);
                 return ret;
         }
 
+        /* Save the current FB before it's replaced by the new one in
+         * drm_atomic_set_fb_for_plane(). We'll need the old FB in
+         * vc4_async_page_flip_complete() to decrement the BO usecnt and keep
+         * it consistent.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made cleanup_fb()
+         * logic.
+         */
+        flip_state->old_fb = plane->state->fb;
+        if (flip_state->old_fb)
+                drm_framebuffer_get(flip_state->old_fb);
+
         WARN_ON(drm_crtc_vblank_get(crtc) != 0);
 
         /* Immediately update the plane's legacy fb pointer, so that later
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 051a72eecb24..d2cc55e21374 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
 #define PCI_DEVICE_ID_AMD_17H_DF_F3     0x1463
 #endif
 
+#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
+#define PCI_DEVICE_ID_AMD_17H_RR_NB     0x15d0
+#endif
+
 /* CPUID function 0x80000001, ebx */
 #define CPUID_PKGTYPE_MASK      0xf0000000
 #define CPUID_PKGTYPE_F         0x00000000
@@ -72,6 +76,7 @@ struct k10temp_data {
         struct pci_dev *pdev;
         void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
         int temp_offset;
+        u32 temp_adjust_mask;
 };
 
 struct tctl_offset {
@@ -84,6 +89,7 @@ static const struct tctl_offset tctl_offset_table[] = {
         { 0x17, "AMD Ryzen 5 1600X", 20000 },
         { 0x17, "AMD Ryzen 7 1700X", 20000 },
         { 0x17, "AMD Ryzen 7 1800X", 20000 },
+        { 0x17, "AMD Ryzen 7 2700X", 10000 },
         { 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
         { 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
         { 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
@@ -129,6 +135,8 @@ static ssize_t temp1_input_show(struct device *dev,
 
         data->read_tempreg(data->pdev, &regval);
         temp = (regval >> 21) * 125;
+        if (regval & data->temp_adjust_mask)
+                temp -= 49000;
         if (temp > data->temp_offset)
                 temp -= data->temp_offset;
         else
@@ -259,12 +267,14 @@ static int k10temp_probe(struct pci_dev *pdev,
         data->pdev = pdev;
 
         if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
-                                          boot_cpu_data.x86_model == 0x70))
+                                          boot_cpu_data.x86_model == 0x70)) {
                 data->read_tempreg = read_tempreg_nb_f15;
-        else if (boot_cpu_data.x86 == 0x17)
+        } else if (boot_cpu_data.x86 == 0x17) {
+                data->temp_adjust_mask = 0x80000;
                 data->read_tempreg = read_tempreg_nb_f17;
-        else
+        } else {
                 data->read_tempreg = read_tempreg_pci;
+        }
 
         for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
                 const struct tctl_offset *entry = &tctl_offset_table[i];
@@ -292,6 +302,7 @@ static const struct pci_device_id k10temp_id_table[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
         {}
 };
 MODULE_DEVICE_TABLE(pci, k10temp_id_table);
diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
index 8b0bc4fc06e8..b0bc77bf2cd9 100644
--- a/drivers/hwmon/nct6683.c
+++ b/drivers/hwmon/nct6683.c
@@ -1380,8 +1380,8 @@ static int __init nct6683_find(int sioaddr, struct nct6683_sio_data *sio_data)
         /* Activate logical device if needed */
         val = superio_inb(sioaddr, SIO_REG_ENABLE);
         if (!(val & 0x01)) {
-                pr_err("EC is disabled\n");
-                goto fail;
+                pr_warn("Forcibly enabling EC access. Data may be unusable.\n");
+                superio_outb(sioaddr, SIO_REG_ENABLE, val | 0x01);
         }
 
         superio_exit(sioaddr);
diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
index 363bf56eb0f2..91976b6ca300 100644
--- a/drivers/hwmon/scmi-hwmon.c
+++ b/drivers/hwmon/scmi-hwmon.c
@@ -170,7 +170,10 @@ static int scmi_hwmon_probe(struct scmi_device *sdev)
         scmi_chip_info.info = ptr_scmi_ci;
         chip_info = &scmi_chip_info;
 
-        for (type = 0; type < hwmon_max && nr_count[type]; type++) {
+        for (type = 0; type < hwmon_max; type++) {
+                if (!nr_count[type])
+                        continue;
+
                 scmi_hwmon_add_chan_info(scmi_hwmon_chan, dev, nr_count[type],
                                          type, hwmon_attributes[type]);
                 *ptr_scmi_ci++ = scmi_hwmon_chan++;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index c4865b08d7fb..8d21b9825d71 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -707,7 +707,6 @@ config I2C_MPC
 config I2C_MT65XX
         tristate "MediaTek I2C adapter"
         depends on ARCH_MEDIATEK || COMPILE_TEST
-        depends on HAS_DMA
         help
           This selects the MediaTek(R) Integrated Inter Circuit bus driver
           for MT65xx and MT81xx.
@@ -885,7 +884,6 @@ config I2C_SH7760
 
 config I2C_SH_MOBILE
         tristate "SuperH Mobile I2C Controller"
-        depends on HAS_DMA
         depends on ARCH_SHMOBILE || ARCH_RENESAS || COMPILE_TEST
         help
           If you say yes to this option, support will be included for the
@@ -1098,7 +1096,6 @@ config I2C_XLP9XX
 
 config I2C_RCAR
         tristate "Renesas R-Car I2C Controller"
-        depends on HAS_DMA
         depends on ARCH_RENESAS || COMPILE_TEST
         select I2C_SLAVE
         help
diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
index 25fcc3c1e32b..4053259bccb8 100644
--- a/drivers/i2c/busses/i2c-sprd.c
+++ b/drivers/i2c/busses/i2c-sprd.c
@@ -86,6 +86,7 @@ struct sprd_i2c {
         u32 count;
         int irq;
         int err;
+        bool is_suspended;
 };
 
 static void sprd_i2c_set_count(struct sprd_i2c *i2c_dev, u32 count)
@@ -283,6 +284,9 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap,
         struct sprd_i2c *i2c_dev = i2c_adap->algo_data;
         int im, ret;
 
+        if (i2c_dev->is_suspended)
+                return -EBUSY;
+
         ret = pm_runtime_get_sync(i2c_dev->dev);
         if (ret < 0)
                 return ret;
@@ -364,13 +368,12 @@ static irqreturn_t sprd_i2c_isr_thread(int irq, void *dev_id)
         struct sprd_i2c *i2c_dev = dev_id;
         struct i2c_msg *msg = i2c_dev->msg;
         bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK);
-        u32 i2c_count = readl(i2c_dev->base + I2C_COUNT);
         u32 i2c_tran;
 
         if (msg->flags & I2C_M_RD)
                 i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD;
         else
-                i2c_tran = i2c_count;
+                i2c_tran = i2c_dev->count;
 
         /*
          * If we got one ACK from slave when writing data, and we did not
@@ -408,14 +411,13 @@ static irqreturn_t sprd_i2c_isr(int irq, void *dev_id)
 {
         struct sprd_i2c *i2c_dev = dev_id;
         struct i2c_msg *msg = i2c_dev->msg;
-        u32 i2c_count = readl(i2c_dev->base + I2C_COUNT);
         bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK);
         u32 i2c_tran;
 
         if (msg->flags & I2C_M_RD)
                 i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD;
         else
-                i2c_tran = i2c_count;
+                i2c_tran = i2c_dev->count;
 
         /*
          * If we did not get one ACK from slave when writing data, then we
@@ -586,11 +588,23 @@ static int sprd_i2c_remove(struct platform_device *pdev)
 
 static int __maybe_unused sprd_i2c_suspend_noirq(struct device *pdev)
 {
+        struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev);
+
+        i2c_lock_adapter(&i2c_dev->adap);
+        i2c_dev->is_suspended = true;
+        i2c_unlock_adapter(&i2c_dev->adap);
+
         return pm_runtime_force_suspend(pdev);
 }
 
 static int __maybe_unused sprd_i2c_resume_noirq(struct device *pdev)
 {
+        struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev);
+
+        i2c_lock_adapter(&i2c_dev->adap);
+        i2c_dev->is_suspended = false;
+        i2c_unlock_adapter(&i2c_dev->adap);
+
         return pm_runtime_force_resume(pdev);
 }
 
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 036a03f0d0a6..1667b6e7674f 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -280,7 +280,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
                  */
                 if (msgs[i].flags & I2C_M_RECV_LEN) {
                         if (!(msgs[i].flags & I2C_M_RD) ||
-                            msgs[i].buf[0] < 1 ||
+                            msgs[i].len < 1 || msgs[i].buf[0] < 1 ||
                             msgs[i].len < msgs[i].buf[0] +
                                              I2C_SMBUS_BLOCK_MAX) {
                                 res = -EINVAL;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 46115a392098..c81c79d01d93 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -31,6 +31,7 @@
 enum evdev_clock_type {
         EV_CLK_REAL = 0,
         EV_CLK_MONO,
+        EV_CLK_BOOT,
         EV_CLK_MAX
 };
 
@@ -197,10 +198,12 @@ static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid)
         case CLOCK_REALTIME:
                 clk_type = EV_CLK_REAL;
                 break;
-        case CLOCK_BOOTTIME:
         case CLOCK_MONOTONIC:
                 clk_type = EV_CLK_MONO;
                 break;
+        case CLOCK_BOOTTIME:
+                clk_type = EV_CLK_BOOT;
+                break;
         default:
                 return -EINVAL;
         }
@@ -311,6 +314,8 @@ static void evdev_events(struct input_handle *handle,
 
         ev_time[EV_CLK_MONO] = ktime_get();
         ev_time[EV_CLK_REAL] = ktime_mono_to_real(ev_time[EV_CLK_MONO]);
+        ev_time[EV_CLK_BOOT] = ktime_mono_to_any(ev_time[EV_CLK_MONO],
+                                                 TK_OFFS_BOOT);
 
         rcu_read_lock();
 
diff --git a/drivers/memory/emif-asm-offsets.c b/drivers/memory/emif-asm-offsets.c
index 71a89d5d3efd..db8043019ec6 100644
--- a/drivers/memory/emif-asm-offsets.c
+++ b/drivers/memory/emif-asm-offsets.c
@@ -16,77 +16,7 @@
 
 int main(void)
 {
-        DEFINE(EMIF_SDCFG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_sdcfg_val));
-        DEFINE(EMIF_TIMING1_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing1_val));
-        DEFINE(EMIF_TIMING2_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing2_val));
-        DEFINE(EMIF_TIMING3_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing3_val));
-        DEFINE(EMIF_REF_CTRL_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ref_ctrl_val));
-        DEFINE(EMIF_ZQCFG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_zqcfg_val));
-        DEFINE(EMIF_PMCR_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_pmcr_val));
-        DEFINE(EMIF_PMCR_SHDW_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_pmcr_shdw_val));
-        DEFINE(EMIF_RD_WR_LEVEL_RAMP_CTRL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_rd_wr_level_ramp_ctrl));
-        DEFINE(EMIF_RD_WR_EXEC_THRESH_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_rd_wr_exec_thresh));
-        DEFINE(EMIF_COS_CONFIG_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_cos_config));
-        DEFINE(EMIF_PRIORITY_TO_COS_MAPPING_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_priority_to_cos_mapping));
-        DEFINE(EMIF_CONNECT_ID_SERV_1_MAP_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_connect_id_serv_1_map));
-        DEFINE(EMIF_CONNECT_ID_SERV_2_MAP_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_connect_id_serv_2_map));
-        DEFINE(EMIF_OCP_CONFIG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ocp_config_val));
-        DEFINE(EMIF_LPDDR2_NVM_TIM_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim));
-        DEFINE(EMIF_LPDDR2_NVM_TIM_SHDW_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim_shdw));
-        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val));
-        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_SHDW_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val_shdw));
-        DEFINE(EMIF_DDR_PHY_CTLR_1_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ddr_phy_ctlr_1));
-        DEFINE(EMIF_EXT_PHY_CTRL_VALS_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ext_phy_ctrl_vals));
-        DEFINE(EMIF_REGS_AMX3_SIZE, sizeof(struct emif_regs_amx3));
-
-        BLANK();
-
-        DEFINE(EMIF_PM_BASE_ADDR_VIRT_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_virt));
-        DEFINE(EMIF_PM_BASE_ADDR_PHYS_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_phys));
-        DEFINE(EMIF_PM_CONFIG_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_sram_config));
-        DEFINE(EMIF_PM_REGS_VIRT_OFFSET,
-               offsetof(struct ti_emif_pm_data, regs_virt));
-        DEFINE(EMIF_PM_REGS_PHYS_OFFSET,
-               offsetof(struct ti_emif_pm_data, regs_phys));
-        DEFINE(EMIF_PM_DATA_SIZE, sizeof(struct ti_emif_pm_data));
-
-        BLANK();
-
-        DEFINE(EMIF_PM_SAVE_CONTEXT_OFFSET,
-               offsetof(struct ti_emif_pm_functions, save_context));
-        DEFINE(EMIF_PM_RESTORE_CONTEXT_OFFSET,
-               offsetof(struct ti_emif_pm_functions, restore_context));
-        DEFINE(EMIF_PM_ENTER_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, enter_sr));
-        DEFINE(EMIF_PM_EXIT_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, exit_sr));
-        DEFINE(EMIF_PM_ABORT_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, abort_sr));
-        DEFINE(EMIF_PM_FUNCTIONS_SIZE, sizeof(struct ti_emif_pm_functions));
+        ti_emif_asm_offsets();
 
         return 0;
 }
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 231f3a1e27bf..86503f60468f 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_driver_template = {
         .cmd_per_lun                    = 7,
         .use_clustering                 = ENABLE_CLUSTERING,
         .shost_attrs                    = mptscsih_host_attrs,
+        .no_write_same                  = 1,
 };
 
 static int mptsas_get_linkerrors(struct sas_phy *phy)
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index d4c07b85f18e..f5695be14499 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -45,6 +45,7 @@
 #define I82802AB        0x00ad
 #define I82802AC        0x00ac
 #define PF38F4476       0x881c
+#define M28F00AP30      0x8963
 /* STMicroelectronics chips */
 #define M50LPW080       0x002F
 #define M50FLW080A      0x0080
@@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi,
                 extp->MinorVersion = '1';
 }
 
+static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
+{
+        /*
+         * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
+         * Erase Supend for their small Erase Blocks(0x8000)
+         */
+        if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
+                return 1;
+        return 0;
+}
+
 static inline struct cfi_pri_intelext *
 read_pri_intelext(struct map_info *map, __u16 adr)
 {
@@ -831,21 +843,30 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
                      (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
                         goto sleep;
 
+                /* Do not allow suspend iff read/write to EB address */
+                if ((adr & chip->in_progress_block_mask) ==
+                    chip->in_progress_block_addr)
+                        goto sleep;
+
+                /* do not suspend small EBs, buggy Micron Chips */
+                if (cfi_is_micron_28F00AP30(cfi, chip) &&
+                    (chip->in_progress_block_mask == ~(0x8000-1)))
+                        goto sleep;
 
                 /* Erase suspend */
-                map_write(map, CMD(0xB0), adr);
+                map_write(map, CMD(0xB0), chip->in_progress_block_addr);
 
                 /* If the flash has finished erasing, then 'erase suspend'
                  * appears to make some (28F320) flash devices switch to
                  * 'read' mode.  Make sure that we switch to 'read status'
                  * mode so we get the right data. --rmk
                  */
-                map_write(map, CMD(0x70), adr);
+                map_write(map, CMD(0x70), chip->in_progress_block_addr);
                 chip->oldstate = FL_ERASING;
                 chip->state = FL_ERASE_SUSPENDING;
                 chip->erase_suspended = 1;
                 for (;;) {
-                        status = map_read(map, adr);
+                        status = map_read(map, chip->in_progress_block_addr);
                         if (map_word_andequal(map, status, status_OK, status_OK))
                                 break;
 
@@ -1041,8 +1062,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
                    sending the 0x70 (Read Status) command to an erasing
                    chip and expecting it to be ignored, that's what we
                    do. */
-                map_write(map, CMD(0xd0), adr);
-                map_write(map, CMD(0x70), adr);
+                map_write(map, CMD(0xd0), chip->in_progress_block_addr);
+                map_write(map, CMD(0x70), chip->in_progress_block_addr);
                 chip->oldstate = FL_READY;
                 chip->state = FL_ERASING;
                 break;
@@ -1933,6 +1954,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         map_write(map, CMD(0xD0), adr);
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
+        chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(len - 1);
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                    adr, len,
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 668e2cbc155b..692902df2598 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -816,9 +816,10 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                     (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
                         goto sleep;
 
-                /* We could check to see if we're trying to access the sector
-                 * that is currently being erased. However, no user will try
-                 * anything like that so we just wait for the timeout. */
+                /* Do not allow suspend iff read/write to EB address */
+                if ((adr & chip->in_progress_block_mask) ==
+                    chip->in_progress_block_addr)
+                        goto sleep;
 
                 /* Erase suspend */
                 /* It's harmless to issue the Erase-Suspend and Erase-Resume
@@ -2267,6 +2268,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
         chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(map->size - 1);
 
         INVALIDATE_CACHE_UDELAY(map, chip,
                                 adr, map->size,
@@ -2356,6 +2358,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
         chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(len - 1);
 
         INVALIDATE_CACHE_UDELAY(map, chip,
                                 adr, len,
diff --git a/drivers/mtd/nand/core.c b/drivers/mtd/nand/core.c
index d0cd6f8635d7..9c9f8936b63b 100644
--- a/drivers/mtd/nand/core.c
+++ b/drivers/mtd/nand/core.c
@@ -162,7 +162,6 @@ int nanddev_mtd_erase(struct mtd_info *mtd, struct erase_info *einfo)
                 ret = nanddev_erase(nand, &pos);
                 if (ret) {
                         einfo->fail_addr = nanddev_pos_to_offs(nand, &pos);
-                        einfo->state = MTD_ERASE_FAILED;
 
                         return ret;
                 }
@@ -170,8 +169,6 @@ int nanddev_mtd_erase(struct mtd_info *mtd, struct erase_info *einfo)
                 nanddev_pos_next_eraseblock(nand, &pos);
         }
 
-        einfo->state = MTD_ERASE_DONE;
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(nanddev_mtd_erase);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 10e953218948..1d779a35ac8e 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2299,29 +2299,20 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
         /*
          * The legacy "num-cs" property indicates the number of CS on the only
          * chip connected to the controller (legacy bindings does not support
-         * more than one chip). CS are only incremented one by one while the RB
-         * pin is always the #0.
+         * more than one chip). The CS and RB pins are always the #0.
          *
          * When not using legacy bindings, a couple of "reg" and "nand-rb"
          * properties must be filled. For each chip, expressed as a subnode,
          * "reg" points to the CS lines and "nand-rb" to the RB line.
          */
-        if (pdata) {
+        if (pdata || nfc->caps->legacy_of_bindings) {
                 nsels = 1;
-        } else if (nfc->caps->legacy_of_bindings &&
-                   !of_get_property(np, "num-cs", &nsels)) {
-                dev_err(dev, "missing num-cs property\n");
-                return -EINVAL;
-        } else if (!of_get_property(np, "reg", &nsels)) {
-                dev_err(dev, "missing reg property\n");
-                return -EINVAL;
-        }
-
-        if (!pdata)
-                nsels /= sizeof(u32);
-        if (!nsels) {
-                dev_err(dev, "invalid reg property size\n");
-                return -EINVAL;
+        } else {
+                nsels = of_property_count_elems_of_size(np, "reg", sizeof(u32));
+                if (nsels <= 0) {
+                        dev_err(dev, "missing/invalid reg property\n");
+                        return -EINVAL;
+                }
         }
 
         /* Alloc the nand chip structure */
diff --git a/drivers/mtd/nand/raw/tango_nand.c b/drivers/mtd/nand/raw/tango_nand.c
index f54518ffb36a..f2052fae21c7 100644
--- a/drivers/mtd/nand/raw/tango_nand.c
+++ b/drivers/mtd/nand/raw/tango_nand.c
@@ -645,7 +645,7 @@ static int tango_nand_probe(struct platform_device *pdev)
 
         writel_relaxed(MODE_RAW, nfc->pbus_base + PBUS_PAD_MODE);
 
-        clk = clk_get(&pdev->dev, NULL);
+        clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(clk))
                 return PTR_ERR(clk);
 
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index 4b8e9183489a..5872f31eaa60 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -501,7 +501,9 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, u8 *rxbuf,
         void __iomem *reg_base = cqspi->iobase;
         void __iomem *ahb_base = cqspi->ahb_base;
         unsigned int remaining = n_rx;
+        unsigned int mod_bytes = n_rx % 4;
         unsigned int bytes_to_read = 0;
+        u8 *rxbuf_end = rxbuf + n_rx;
         int ret = 0;
 
         writel(from_addr, reg_base + CQSPI_REG_INDIRECTRDSTARTADDR);
@@ -530,11 +532,24 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, u8 *rxbuf,
                 }
 
                 while (bytes_to_read != 0) {
+                        unsigned int word_remain = round_down(remaining, 4);
+
                         bytes_to_read *= cqspi->fifo_width;
                         bytes_to_read = bytes_to_read > remaining ?
                                         remaining : bytes_to_read;
-                        ioread32_rep(ahb_base, rxbuf,
-                                     DIV_ROUND_UP(bytes_to_read, 4));
+                        bytes_to_read = round_down(bytes_to_read, 4);
+                        /* Read 4 byte word chunks then single bytes */
+                        if (bytes_to_read) {
+                                ioread32_rep(ahb_base, rxbuf,
+                                             (bytes_to_read / 4));
+                        } else if (!word_remain && mod_bytes) {
+                                unsigned int temp = ioread32(ahb_base);
+
+                                bytes_to_read = mod_bytes;
+                                memcpy(rxbuf, &temp, min((unsigned int)
+                                                         (rxbuf_end - rxbuf),
+                                                         bytes_to_read));
+                        }
                         rxbuf += bytes_to_read;
                         remaining -= bytes_to_read;
                         bytes_to_read = cqspi_get_rd_sram_level(cqspi);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b7b113018853..718e4914e3a0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1660,8 +1660,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
         } /* switch(bond_mode) */
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        slave_dev->npinfo = bond->dev->npinfo;
-        if (slave_dev->npinfo) {
+        if (bond->dev->npinfo) {
                 if (slave_enable_netpoll(new_slave)) {
                         netdev_info(bond_dev, "master_dev is using netpoll, but new slave device does not support netpoll\n");
                         res = -EBUSY;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 7ea72ef11a55..d272dc6984ac 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -1321,6 +1321,10 @@
 #define MDIO_VEND2_AN_STAT              0x8002
 #endif
 
+#ifndef MDIO_VEND2_PMA_CDR_CONTROL
+#define MDIO_VEND2_PMA_CDR_CONTROL      0x8056
+#endif
+
 #ifndef MDIO_CTRL1_SPEED1G
 #define MDIO_CTRL1_SPEED1G              (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
 #endif
@@ -1369,6 +1373,10 @@
 #define XGBE_AN_CL37_TX_CONFIG_MASK     0x08
 #define XGBE_AN_CL37_MII_CTRL_8BIT      0x0100
 
+#define XGBE_PMA_CDR_TRACK_EN_MASK      0x01
+#define XGBE_PMA_CDR_TRACK_EN_OFF       0x00
+#define XGBE_PMA_CDR_TRACK_EN_ON        0x01
+
 /* Bit setting and getting macros
  *  The get macro will extract the current bit field value from within
  *  the variable
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
index 7d128be61310..b91143947ed2 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
@@ -519,6 +519,22 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata)
                                    "debugfs_create_file failed\n");
         }
 
+        if (pdata->vdata->an_cdr_workaround) {
+                pfile = debugfs_create_bool("an_cdr_workaround", 0600,
+                                            pdata->xgbe_debugfs,
+                                            &pdata->debugfs_an_cdr_workaround);
+                if (!pfile)
+                        netdev_err(pdata->netdev,
+                                   "debugfs_create_bool failed\n");
+
+                pfile = debugfs_create_bool("an_cdr_track_early", 0600,
+                                            pdata->xgbe_debugfs,
+                                            &pdata->debugfs_an_cdr_track_early);
+                if (!pfile)
+                        netdev_err(pdata->netdev,
+                                   "debugfs_create_bool failed\n");
+        }
+
         kfree(buf);
 }
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index 795e556d4a3f..441d0973957b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -349,6 +349,7 @@ int xgbe_config_netdev(struct xgbe_prv_data *pdata)
         XGMAC_SET_BITS(pdata->rss_options, MAC_RSSCR, UDP4TE, 1);
 
         /* Call MDIO/PHY initialization routine */
+        pdata->debugfs_an_cdr_workaround = pdata->vdata->an_cdr_workaround;
         ret = pdata->phy_if.phy_init(pdata);
         if (ret)
                 return ret;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 072b9f664597..1b45cd73a258 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -432,11 +432,16 @@ static void xgbe_an73_disable(struct xgbe_prv_data *pdata)
         xgbe_an73_set(pdata, false, false);
         xgbe_an73_disable_interrupts(pdata);
 
+        pdata->an_start = 0;
+
         netif_dbg(pdata, link, pdata->netdev, "CL73 AN disabled\n");
 }
 
 static void xgbe_an_restart(struct xgbe_prv_data *pdata)
 {
+        if (pdata->phy_if.phy_impl.an_pre)
+                pdata->phy_if.phy_impl.an_pre(pdata);
+
         switch (pdata->an_mode) {
         case XGBE_AN_MODE_CL73:
         case XGBE_AN_MODE_CL73_REDRV:
@@ -453,6 +458,9 @@ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
 
 static void xgbe_an_disable(struct xgbe_prv_data *pdata)
 {
+        if (pdata->phy_if.phy_impl.an_post)
+                pdata->phy_if.phy_impl.an_post(pdata);
+
         switch (pdata->an_mode) {
         case XGBE_AN_MODE_CL73:
         case XGBE_AN_MODE_CL73_REDRV:
@@ -505,11 +513,11 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata,
                 XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL,
                             reg);
 
-                if (pdata->phy_if.phy_impl.kr_training_post)
-                        pdata->phy_if.phy_impl.kr_training_post(pdata);
-
                 netif_dbg(pdata, link, pdata->netdev,
                           "KR training initiated\n");
+
+                if (pdata->phy_if.phy_impl.kr_training_post)
+                        pdata->phy_if.phy_impl.kr_training_post(pdata);
         }
 
         return XGBE_AN_PAGE_RECEIVED;
@@ -637,11 +645,11 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)
                         return XGBE_AN_NO_LINK;
         }
 
-        xgbe_an73_disable(pdata);
+        xgbe_an_disable(pdata);
 
         xgbe_switch_mode(pdata);
 
-        xgbe_an73_restart(pdata);
+        xgbe_an_restart(pdata);
 
         return XGBE_AN_INCOMPAT_LINK;
 }
@@ -820,6 +828,9 @@ static void xgbe_an37_state_machine(struct xgbe_prv_data *pdata)
                 pdata->an_result = pdata->an_state;
                 pdata->an_state = XGBE_AN_READY;
 
+                if (pdata->phy_if.phy_impl.an_post)
+                        pdata->phy_if.phy_impl.an_post(pdata);
+
                 netif_dbg(pdata, link, pdata->netdev, "CL37 AN result: %s\n",
                           xgbe_state_as_string(pdata->an_result));
         }
@@ -903,6 +914,9 @@ again:
                 pdata->kx_state = XGBE_RX_BPA;
                 pdata->an_start = 0;
 
+                if (pdata->phy_if.phy_impl.an_post)
+                        pdata->phy_if.phy_impl.an_post(pdata);
+
                 netif_dbg(pdata, link, pdata->netdev, "CL73 AN result: %s\n",
                           xgbe_state_as_string(pdata->an_result));
         }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
index eb23f9ba1a9a..82d1f416ee2a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
@@ -456,6 +456,7 @@ static const struct xgbe_version_data xgbe_v2a = {
         .irq_reissue_support            = 1,
         .tx_desc_prefetch               = 5,
         .rx_desc_prefetch               = 5,
+        .an_cdr_workaround              = 1,
 };
 
 static const struct xgbe_version_data xgbe_v2b = {
@@ -470,6 +471,7 @@ static const struct xgbe_version_data xgbe_v2b = {
         .irq_reissue_support            = 1,
         .tx_desc_prefetch               = 5,
         .rx_desc_prefetch               = 5,
+        .an_cdr_workaround              = 1,
 };
 
 static const struct pci_device_id xgbe_pci_table[] = {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index 3304a291aa96..aac884314000 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -147,6 +147,14 @@
 /* Rate-change complete wait/retry count */
 #define XGBE_RATECHANGE_COUNT           500
 
+/* CDR delay values for KR support (in usec) */
+#define XGBE_CDR_DELAY_INIT             10000
+#define XGBE_CDR_DELAY_INC              10000
+#define XGBE_CDR_DELAY_MAX              100000
+
+/* RRC frequency during link status check */
+#define XGBE_RRC_FREQUENCY              10
+
 enum xgbe_port_mode {
         XGBE_PORT_MODE_RSVD = 0,
         XGBE_PORT_MODE_BACKPLANE,
@@ -245,6 +253,10 @@ enum xgbe_sfp_speed {
 #define XGBE_SFP_BASE_VENDOR_SN                 4
 #define XGBE_SFP_BASE_VENDOR_SN_LEN             16
 
+#define XGBE_SFP_EXTD_OPT1                      1
+#define XGBE_SFP_EXTD_OPT1_RX_LOS               BIT(1)
+#define XGBE_SFP_EXTD_OPT1_TX_FAULT             BIT(3)
+
 #define XGBE_SFP_EXTD_DIAG                      28
 #define XGBE_SFP_EXTD_DIAG_ADDR_CHANGE          BIT(2)
 
@@ -324,6 +336,7 @@ struct xgbe_phy_data {
 
         unsigned int sfp_gpio_address;
         unsigned int sfp_gpio_mask;
+        unsigned int sfp_gpio_inputs;
         unsigned int sfp_gpio_rx_los;
         unsigned int sfp_gpio_tx_fault;
         unsigned int sfp_gpio_mod_absent;
@@ -355,6 +368,10 @@ struct xgbe_phy_data {
         unsigned int redrv_addr;
         unsigned int redrv_lane;
         unsigned int redrv_model;
+
+        /* KR AN support */
+        unsigned int phy_cdr_notrack;
+        unsigned int phy_cdr_delay;
 };
 
 /* I2C, MDIO and GPIO lines are muxed, so only one device at a time */
@@ -974,6 +991,49 @@ static void xgbe_phy_sfp_external_phy(struct xgbe_prv_data *pdata)
         phy_data->sfp_phy_avail = 1;
 }
 
+static bool xgbe_phy_check_sfp_rx_los(struct xgbe_phy_data *phy_data)
+{
+        u8 *sfp_extd = phy_data->sfp_eeprom.extd;
+
+        if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_RX_LOS))
+                return false;
+
+        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS)
+                return false;
+
+        if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_rx_los))
+                return true;
+
+        return false;
+}
+
+static bool xgbe_phy_check_sfp_tx_fault(struct xgbe_phy_data *phy_data)
+{
+        u8 *sfp_extd = phy_data->sfp_eeprom.extd;
+
+        if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_TX_FAULT))
+                return false;
+
+        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT)
+                return false;
+
+        if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_tx_fault))
+                return true;
+
+        return false;
+}
+
+static bool xgbe_phy_check_sfp_mod_absent(struct xgbe_phy_data *phy_data)
+{
+        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT)
+                return false;
+
+        if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_mod_absent))
+                return true;
+
+        return false;
+}
+
 static bool xgbe_phy_belfuse_parse_quirks(struct xgbe_prv_data *pdata)
 {
         struct xgbe_phy_data *phy_data = pdata->phy_data;
@@ -1019,6 +1079,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
         if (sfp_base[XGBE_SFP_BASE_EXT_ID] != XGBE_SFP_EXT_ID_SFP)
                 return;
 
+        /* Update transceiver signals (eeprom extd/options) */
+        phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data);
+        phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data);
+
         if (xgbe_phy_sfp_parse_quirks(pdata))
                 return;
 
@@ -1184,7 +1248,6 @@ put:
 static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
 {
         struct xgbe_phy_data *phy_data = pdata->phy_data;
-        unsigned int gpio_input;
         u8 gpio_reg, gpio_ports[2];
         int ret;
 
@@ -1199,23 +1262,9 @@ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
                 return;
         }
 
-        gpio_input = (gpio_ports[1] << 8) | gpio_ports[0];
-
-        if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) {
-                /* No GPIO, just assume the module is present for now */
-                phy_data->sfp_mod_absent = 0;
-        } else {
-                if (!(gpio_input & (1 << phy_data->sfp_gpio_mod_absent)))
-                        phy_data->sfp_mod_absent = 0;
-        }
-
-        if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) &&
-            (gpio_input & (1 << phy_data->sfp_gpio_rx_los)))
-                phy_data->sfp_rx_los = 1;
+        phy_data->sfp_gpio_inputs = (gpio_ports[1] << 8) | gpio_ports[0];
 
-        if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) &&
-            (gpio_input & (1 << phy_data->sfp_gpio_tx_fault)))
-                phy_data->sfp_tx_fault = 1;
+        phy_data->sfp_mod_absent = xgbe_phy_check_sfp_mod_absent(phy_data);
 }
 
 static void xgbe_phy_sfp_mod_absent(struct xgbe_prv_data *pdata)
@@ -2361,7 +2410,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
                 return 1;
 
         /* No link, attempt a receiver reset cycle */
-        if (phy_data->rrc_count++) {
+        if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
                 phy_data->rrc_count = 0;
                 xgbe_phy_rrc(pdata);
         }
@@ -2669,6 +2718,103 @@ static bool xgbe_phy_port_enabled(struct xgbe_prv_data *pdata)
         return true;
 }
 
+static void xgbe_phy_cdr_track(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+
+        if (!pdata->debugfs_an_cdr_workaround)
+                return;
+
+        if (!phy_data->phy_cdr_notrack)
+                return;
+
+        usleep_range(phy_data->phy_cdr_delay,
+                     phy_data->phy_cdr_delay + 500);
+
+        XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
+                         XGBE_PMA_CDR_TRACK_EN_MASK,
+                         XGBE_PMA_CDR_TRACK_EN_ON);
+
+        phy_data->phy_cdr_notrack = 0;
+}
+
+static void xgbe_phy_cdr_notrack(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+
+        if (!pdata->debugfs_an_cdr_workaround)
+                return;
+
+        if (phy_data->phy_cdr_notrack)
+                return;
+
+        XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
+                         XGBE_PMA_CDR_TRACK_EN_MASK,
+                         XGBE_PMA_CDR_TRACK_EN_OFF);
+
+        xgbe_phy_rrc(pdata);
+
+        phy_data->phy_cdr_notrack = 1;
+}
+
+static void xgbe_phy_kr_training_post(struct xgbe_prv_data *pdata)
+{
+        if (!pdata->debugfs_an_cdr_track_early)
+                xgbe_phy_cdr_track(pdata);
+}
+
+static void xgbe_phy_kr_training_pre(struct xgbe_prv_data *pdata)
+{
+        if (pdata->debugfs_an_cdr_track_early)
+                xgbe_phy_cdr_track(pdata);
+}
+
+static void xgbe_phy_an_post(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+
+        switch (pdata->an_mode) {
+        case XGBE_AN_MODE_CL73:
+        case XGBE_AN_MODE_CL73_REDRV:
+                if (phy_data->cur_mode != XGBE_MODE_KR)
+                        break;
+
+                xgbe_phy_cdr_track(pdata);
+
+                switch (pdata->an_result) {
+                case XGBE_AN_READY:
+                case XGBE_AN_COMPLETE:
+                        break;
+                default:
+                        if (phy_data->phy_cdr_delay < XGBE_CDR_DELAY_MAX)
+                                phy_data->phy_cdr_delay += XGBE_CDR_DELAY_INC;
+                        else
+                                phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static void xgbe_phy_an_pre(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_phy_data *phy_data = pdata->phy_data;
+
+        switch (pdata->an_mode) {
+        case XGBE_AN_MODE_CL73:
+        case XGBE_AN_MODE_CL73_REDRV:
+                if (phy_data->cur_mode != XGBE_MODE_KR)
+                        break;
+
+                xgbe_phy_cdr_notrack(pdata);
+                break;
+        default:
+                break;
+        }
+}
+
 static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
 {
         struct xgbe_phy_data *phy_data = pdata->phy_data;
@@ -2680,6 +2826,9 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
         xgbe_phy_sfp_reset(phy_data);
         xgbe_phy_sfp_mod_absent(pdata);
 
+        /* Reset CDR support */
+        xgbe_phy_cdr_track(pdata);
+
         /* Power off the PHY */
         xgbe_phy_power_off(pdata);
 
@@ -2712,6 +2861,9 @@ static int xgbe_phy_start(struct xgbe_prv_data *pdata)
         /* Start in highest supported mode */
         xgbe_phy_set_mode(pdata, phy_data->start_mode);
 
+        /* Reset CDR support */
+        xgbe_phy_cdr_track(pdata);
+
         /* After starting the I2C controller, we can check for an SFP */
         switch (phy_data->port_mode) {
         case XGBE_PORT_MODE_SFP:
@@ -3019,6 +3171,8 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
                 }
         }
 
+        phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
+
         /* Register for driving external PHYs */
         mii = devm_mdiobus_alloc(pdata->dev);
         if (!mii) {
@@ -3071,4 +3225,10 @@ void xgbe_init_function_ptrs_phy_v2(struct xgbe_phy_if *phy_if)
         phy_impl->an_advertising        = xgbe_phy_an_advertising;
 
         phy_impl->an_outcome            = xgbe_phy_an_outcome;
+
+        phy_impl->an_pre                = xgbe_phy_an_pre;
+        phy_impl->an_post               = xgbe_phy_an_post;
+
+        phy_impl->kr_training_pre       = xgbe_phy_kr_training_pre;
+        phy_impl->kr_training_post      = xgbe_phy_kr_training_post;
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index ad102c8bac7b..95d4b56448c6 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -833,6 +833,7 @@ struct xgbe_hw_if {
 /* This structure represents implementation specific routines for an
  * implementation of a PHY. All routines are required unless noted below.
  *   Optional routines:
+ *     an_pre, an_post
  *     kr_training_pre, kr_training_post
  */
 struct xgbe_phy_impl_if {
@@ -875,6 +876,10 @@ struct xgbe_phy_impl_if {
         /* Process results of auto-negotiation */
         enum xgbe_mode (*an_outcome)(struct xgbe_prv_data *);
 
+        /* Pre/Post auto-negotiation support */
+        void (*an_pre)(struct xgbe_prv_data *);
+        void (*an_post)(struct xgbe_prv_data *);
+
         /* Pre/Post KR training enablement support */
         void (*kr_training_pre)(struct xgbe_prv_data *);
         void (*kr_training_post)(struct xgbe_prv_data *);
@@ -989,6 +994,7 @@ struct xgbe_version_data {
         unsigned int irq_reissue_support;
         unsigned int tx_desc_prefetch;
         unsigned int rx_desc_prefetch;
+        unsigned int an_cdr_workaround;
 };
 
 struct xgbe_vxlan_data {
@@ -1257,6 +1263,9 @@ struct xgbe_prv_data {
         unsigned int debugfs_xprop_reg;
 
         unsigned int debugfs_xi2c_reg;
+
+        bool debugfs_an_cdr_workaround;
+        bool debugfs_an_cdr_track_early;
 };
 
 /* Function prototypes*/
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 2df01ad98df7..6e8d6a6f6aaf 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1128,7 +1128,7 @@ static void clean_rx_pools(struct ibmvnic_adapter *adapter)
         if (!adapter->rx_pool)
                 return;
 
-        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
+        rx_scrqs = adapter->num_active_rx_pools;
         rx_entries = adapter->req_rx_add_entries_per_subcrq;
 
         /* Free any remaining skbs in the rx buffer pools */
@@ -1177,7 +1177,7 @@ static void clean_tx_pools(struct ibmvnic_adapter *adapter)
         if (!adapter->tx_pool || !adapter->tso_pool)
                 return;
 
-        tx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_txsubm_subcrqs);
+        tx_scrqs = adapter->num_active_tx_pools;
 
         /* Free any remaining skbs in the tx buffer pools */
         for (i = 0; i < tx_scrqs; i++) {
diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
index 5b13ca1bd85f..7dc5f045e969 100644
--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
@@ -586,7 +586,7 @@ struct ice_sw_rule_lg_act {
 #define ICE_LG_ACT_MIRROR_VSI_ID_S      3
 #define ICE_LG_ACT_MIRROR_VSI_ID_M      (0x3FF << ICE_LG_ACT_MIRROR_VSI_ID_S)
 
-        /* Action type = 5 - Large Action */
+        /* Action type = 5 - Generic Value */
 #define ICE_LG_ACT_GENERIC              0x5
 #define ICE_LG_ACT_GENERIC_VALUE_S      3
 #define ICE_LG_ACT_GENERIC_VALUE_M      (0xFFFF << ICE_LG_ACT_GENERIC_VALUE_S)
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 21977ec984c4..71d032cc5fa7 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -78,6 +78,7 @@ ice_aq_manage_mac_read(struct ice_hw *hw, void *buf, u16 buf_size,
         struct ice_aq_desc desc;
         enum ice_status status;
         u16 flags;
+        u8 i;
 
         cmd = &desc.params.mac_read;
 
@@ -98,8 +99,16 @@ ice_aq_manage_mac_read(struct ice_hw *hw, void *buf, u16 buf_size,
                 return ICE_ERR_CFG;
         }
 
-        ether_addr_copy(hw->port_info->mac.lan_addr, resp->mac_addr);
-        ether_addr_copy(hw->port_info->mac.perm_addr, resp->mac_addr);
+        /* A single port can report up to two (LAN and WoL) addresses */
+        for (i = 0; i < cmd->num_addr; i++)
+                if (resp[i].addr_type == ICE_AQC_MAN_MAC_ADDR_TYPE_LAN) {
+                        ether_addr_copy(hw->port_info->mac.lan_addr,
+                                        resp[i].mac_addr);
+                        ether_addr_copy(hw->port_info->mac.perm_addr,
+                                        resp[i].mac_addr);
+                        break;
+                }
+
         return 0;
 }
 
@@ -464,9 +473,12 @@ enum ice_status ice_init_hw(struct ice_hw *hw)
         if (status)
                 goto err_unroll_sched;
 
-        /* Get port MAC information */
-        mac_buf_len = sizeof(struct ice_aqc_manage_mac_read_resp);
-        mac_buf = devm_kzalloc(ice_hw_to_dev(hw), mac_buf_len, GFP_KERNEL);
+        /* Get MAC information */
+        /* A single port can report up to two (LAN and WoL) addresses */
+        mac_buf = devm_kcalloc(ice_hw_to_dev(hw), 2,
+                               sizeof(struct ice_aqc_manage_mac_read_resp),
+                               GFP_KERNEL);
+        mac_buf_len = 2 * sizeof(struct ice_aqc_manage_mac_read_resp);
 
         if (!mac_buf) {
                 status = ICE_ERR_NO_MEMORY;
diff --git a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
index 1b9e2ef48a9d..499904874b3f 100644
--- a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
+++ b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
@@ -121,8 +121,6 @@
 #define PFINT_FW_CTL_CAUSE_ENA_S        30
 #define PFINT_FW_CTL_CAUSE_ENA_M        BIT(PFINT_FW_CTL_CAUSE_ENA_S)
 #define PFINT_OICR                      0x0016CA00
-#define PFINT_OICR_INTEVENT_S           0
-#define PFINT_OICR_INTEVENT_M           BIT(PFINT_OICR_INTEVENT_S)
 #define PFINT_OICR_HLP_RDY_S            14
 #define PFINT_OICR_HLP_RDY_M            BIT(PFINT_OICR_HLP_RDY_S)
 #define PFINT_OICR_CPM_RDY_S            15
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 210b7910f1cd..5299caf55a7f 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -1722,9 +1722,6 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
         oicr = rd32(hw, PFINT_OICR);
         ena_mask = rd32(hw, PFINT_OICR_ENA);
 
-        if (!(oicr & PFINT_OICR_INTEVENT_M))
-                goto ena_intr;
-
         if (oicr & PFINT_OICR_GRST_M) {
                 u32 reset;
                 /* we have a reset warning */
@@ -1782,7 +1779,6 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
         }
         ret = IRQ_HANDLED;
 
-ena_intr:
         /* re-enable interrupt causes that are not handled during this pass */
         wr32(hw, PFINT_OICR_ENA, ena_mask);
         if (!test_bit(__ICE_DOWN, pf->state)) {
diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index f16ff3e4a840..2e6c1d92cc88 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -751,14 +751,14 @@ ice_sched_add_nodes_to_layer(struct ice_port_info *pi,
         u16 num_added = 0;
         u32 temp;
 
+        *num_nodes_added = 0;
+
         if (!num_nodes)
                 return status;
 
         if (!parent || layer < hw->sw_entry_point_layer)
                 return ICE_ERR_PARAM;
 
-        *num_nodes_added = 0;
-
         /* max children per node per layer */
         max_child_nodes =
             le16_to_cpu(hw->layer_info[parent->tx_sched_layer].max_children);
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index c1c0bc30a16d..cce7ada89255 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1700,7 +1700,22 @@ static void igb_configure_cbs(struct igb_adapter *adapter, int queue,
         WARN_ON(hw->mac.type != e1000_i210);
         WARN_ON(queue < 0 || queue > 1);
 
-        if (enable) {
+        if (enable || queue == 0) {
+                /* i210 does not allow the queue 0 to be in the Strict
+                 * Priority mode while the Qav mode is enabled, so,
+                 * instead of disabling strict priority mode, we give
+                 * queue 0 the maximum of credits possible.
+                 *
+                 * See section 8.12.19 of the i210 datasheet, "Note:
+                 * Queue0 QueueMode must be set to 1b when
+                 * TransmitMode is set to Qav."
+                 */
+                if (queue == 0 && !enable) {
+                        /* max "linkspeed" idleslope in kbps */
+                        idleslope = 1000000;
+                        hicredit = ETH_FRAME_LEN;
+                }
+
                 set_tx_desc_fetch_prio(hw, queue, TX_QUEUE_PRIO_HIGH);
                 set_queue_mode(hw, queue, QUEUE_MODE_STREAM_RESERVATION);
 
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 3d9033f26eff..e3d04f226d57 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -3420,7 +3420,7 @@ static int ixgbevf_setup_all_tx_resources(struct ixgbevf_adapter *adapter)
                 if (!err)
                         continue;
                 hw_dbg(&adapter->hw, "Allocation for XDP Queue %u failed\n", j);
-                break;
+                goto err_setup_tx;
         }
 
         return 0;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 83ce229f4eb7..63036d9bf3e6 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -3999,29 +3999,6 @@ static void efx_ef10_prepare_flr(struct efx_nic *efx)
         atomic_set(&efx->active_queues, 0);
 }
 
-static bool efx_ef10_filter_equal(const struct efx_filter_spec *left,
-                                  const struct efx_filter_spec *right)
-{
-        if ((left->match_flags ^ right->match_flags) |
-            ((left->flags ^ right->flags) &
-             (EFX_FILTER_FLAG_RX | EFX_FILTER_FLAG_TX)))
-                return false;
-
-        return memcmp(&left->outer_vid, &right->outer_vid,
-                      sizeof(struct efx_filter_spec) -
-                      offsetof(struct efx_filter_spec, outer_vid)) == 0;
-}
-
-static unsigned int efx_ef10_filter_hash(const struct efx_filter_spec *spec)
-{
-        BUILD_BUG_ON(offsetof(struct efx_filter_spec, outer_vid) & 3);
-        return jhash2((const u32 *)&spec->outer_vid,
-                      (sizeof(struct efx_filter_spec) -
-                       offsetof(struct efx_filter_spec, outer_vid)) / 4,
-                      0);
-        /* XXX should we randomise the initval? */
-}
-
 /* Decide whether a filter should be exclusive or else should allow
  * delivery to additional recipients.  Currently we decide that
  * filters for specific local unicast MAC and IP addresses are
@@ -4346,7 +4323,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
                 goto out_unlock;
         match_pri = rc;
 
-        hash = efx_ef10_filter_hash(spec);
+        hash = efx_filter_spec_hash(spec);
         is_mc_recip = efx_filter_is_mc_recipient(spec);
         if (is_mc_recip)
                 bitmap_zero(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
@@ -4378,7 +4355,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
                 if (!saved_spec) {
                         if (ins_index < 0)
                                 ins_index = i;
-                } else if (efx_ef10_filter_equal(spec, saved_spec)) {
+                } else if (efx_filter_spec_equal(spec, saved_spec)) {
                         if (spec->priority < saved_spec->priority &&
                             spec->priority != EFX_FILTER_PRI_AUTO) {
                                 rc = -EPERM;
@@ -4762,27 +4739,62 @@ static s32 efx_ef10_filter_get_rx_ids(struct efx_nic *efx,
 static bool efx_ef10_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
                                            unsigned int filter_idx)
 {
+        struct efx_filter_spec *spec, saved_spec;
         struct efx_ef10_filter_table *table;
-        struct efx_filter_spec *spec;
-        bool ret;
+        struct efx_arfs_rule *rule = NULL;
+        bool ret = true, force = false;
+        u16 arfs_id;
 
         down_read(&efx->filter_sem);
         table = efx->filter_state;
         down_write(&table->lock);
         spec = efx_ef10_filter_entry_spec(table, filter_idx);
 
-        if (!spec || spec->priority != EFX_FILTER_PRI_HINT) {
-                ret = true;
+        if (!spec || spec->priority != EFX_FILTER_PRI_HINT)
                 goto out_unlock;
-        }
 
-        if (!rps_may_expire_flow(efx->net_dev, spec->dmaq_id, flow_id, 0)) {
-                ret = false;
-                goto out_unlock;
+        spin_lock_bh(&efx->rps_hash_lock);
+        if (!efx->rps_hash_table) {
+                /* In the absence of the table, we always return 0 to ARFS. */
+                arfs_id = 0;
+        } else {
+                rule = efx_rps_hash_find(efx, spec);
+                if (!rule)
+                        /* ARFS table doesn't know of this filter, so remove it */
+                        goto expire;
+                arfs_id = rule->arfs_id;
+                ret = efx_rps_check_rule(rule, filter_idx, &force);
+                if (force)
+                        goto expire;
+                if (!ret) {
+                        spin_unlock_bh(&efx->rps_hash_lock);
+                        goto out_unlock;
+                }
         }
-
+        if (!rps_may_expire_flow(efx->net_dev, spec->dmaq_id, flow_id, arfs_id))
+                ret = false;
+        else if (rule)
+                rule->filter_id = EFX_ARFS_FILTER_ID_REMOVING;
+expire:
+        saved_spec = *spec; /* remove operation will kfree spec */
+        spin_unlock_bh(&efx->rps_hash_lock);
+        /* At this point (since we dropped the lock), another thread might queue
+         * up a fresh insertion request (but the actual insertion will be held
+         * up by our possession of the filter table lock).  In that case, it
+         * will set rule->filter_id to EFX_ARFS_FILTER_ID_PENDING, meaning that
+         * the rule is not removed by efx_rps_hash_del() below.
+         */
         ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
                                               filter_idx, true) == 0;
+        /* While we can't safely dereference rule (we dropped the lock), we can
+         * still test it for NULL.
+         */
+        if (ret && rule) {
+                /* Expiring, so remove entry from ARFS table */
+                spin_lock_bh(&efx->rps_hash_lock);
+                efx_rps_hash_del(efx, &saved_spec);
+                spin_unlock_bh(&efx->rps_hash_lock);
+        }
 out_unlock:
         up_write(&table->lock);
         up_read(&efx->filter_sem);
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 692dd729ee2a..a4ebd8715494 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -3027,6 +3027,10 @@ static int efx_init_struct(struct efx_nic *efx,
         mutex_init(&efx->mac_lock);
 #ifdef CONFIG_RFS_ACCEL
         mutex_init(&efx->rps_mutex);
+        spin_lock_init(&efx->rps_hash_lock);
+        /* Failure to allocate is not fatal, but may degrade ARFS performance */
+        efx->rps_hash_table = kcalloc(EFX_ARFS_HASH_TABLE_SIZE,
+                                      sizeof(*efx->rps_hash_table), GFP_KERNEL);
 #endif
         efx->phy_op = &efx_dummy_phy_operations;
         efx->mdio.dev = net_dev;
@@ -3070,6 +3074,10 @@ static void efx_fini_struct(struct efx_nic *efx)
 {
         int i;
 
+#ifdef CONFIG_RFS_ACCEL
+        kfree(efx->rps_hash_table);
+#endif
+
         for (i = 0; i < EFX_MAX_CHANNELS; i++)
                 kfree(efx->channel[i]);
 
@@ -3092,6 +3100,141 @@ void efx_update_sw_stats(struct efx_nic *efx, u64 *stats)
         stats[GENERIC_STAT_rx_noskb_drops] = atomic_read(&efx->n_rx_noskb_drops);
 }
 
+bool efx_filter_spec_equal(const struct efx_filter_spec *left,
+                           const struct efx_filter_spec *right)
+{
+        if ((left->match_flags ^ right->match_flags) |
+            ((left->flags ^ right->flags) &
+             (EFX_FILTER_FLAG_RX | EFX_FILTER_FLAG_TX)))
+                return false;
+
+        return memcmp(&left->outer_vid, &right->outer_vid,
+                      sizeof(struct efx_filter_spec) -
+                      offsetof(struct efx_filter_spec, outer_vid)) == 0;
+}
+
+u32 efx_filter_spec_hash(const struct efx_filter_spec *spec)
+{
+        BUILD_BUG_ON(offsetof(struct efx_filter_spec, outer_vid) & 3);
+        return jhash2((const u32 *)&spec->outer_vid,
+                      (sizeof(struct efx_filter_spec) -
+                       offsetof(struct efx_filter_spec, outer_vid)) / 4,
+                      0);
+}
+
+#ifdef CONFIG_RFS_ACCEL
+bool efx_rps_check_rule(struct efx_arfs_rule *rule, unsigned int filter_idx,
+                        bool *force)
+{
+        if (rule->filter_id == EFX_ARFS_FILTER_ID_PENDING) {
+                /* ARFS is currently updating this entry, leave it */
+                return false;
+        }
+        if (rule->filter_id == EFX_ARFS_FILTER_ID_ERROR) {
+                /* ARFS tried and failed to update this, so it's probably out
+                 * of date.  Remove the filter and the ARFS rule entry.
+                 */
+                rule->filter_id = EFX_ARFS_FILTER_ID_REMOVING;
+                *force = true;
+                return true;
+        } else if (WARN_ON(rule->filter_id != filter_idx)) { /* can't happen */
+                /* ARFS has moved on, so old filter is not needed.  Since we did
+                 * not mark the rule with EFX_ARFS_FILTER_ID_REMOVING, it will
+                 * not be removed by efx_rps_hash_del() subsequently.
+                 */
+                *force = true;
+                return true;
+        }
+        /* Remove it iff ARFS wants to. */
+        return true;
+}
+
+struct hlist_head *efx_rps_hash_bucket(struct efx_nic *efx,
+                                       const struct efx_filter_spec *spec)
+{
+        u32 hash = efx_filter_spec_hash(spec);
+
+        WARN_ON(!spin_is_locked(&efx->rps_hash_lock));
+        if (!efx->rps_hash_table)
+                return NULL;
+        return &efx->rps_hash_table[hash % EFX_ARFS_HASH_TABLE_SIZE];
+}
+
+struct efx_arfs_rule *efx_rps_hash_find(struct efx_nic *efx,
+                                        const struct efx_filter_spec *spec)
+{
+        struct efx_arfs_rule *rule;
+        struct hlist_head *head;
+        struct hlist_node *node;
+
+        head = efx_rps_hash_bucket(efx, spec);
+        if (!head)
+                return NULL;
+        hlist_for_each(node, head) {
+                rule = container_of(node, struct efx_arfs_rule, node);
+                if (efx_filter_spec_equal(spec, &rule->spec))
+                        return rule;
+        }
+        return NULL;
+}
+
+struct efx_arfs_rule *efx_rps_hash_add(struct efx_nic *efx,
+                                       const struct efx_filter_spec *spec,
+                                       bool *new)
+{
+        struct efx_arfs_rule *rule;
+        struct hlist_head *head;
+        struct hlist_node *node;
+
+        head = efx_rps_hash_bucket(efx, spec);
+        if (!head)
+                return NULL;
+        hlist_for_each(node, head) {
+                rule = container_of(node, struct efx_arfs_rule, node);
+                if (efx_filter_spec_equal(spec, &rule->spec)) {
+                        *new = false;
+                        return rule;
+                }
+        }
+        rule = kmalloc(sizeof(*rule), GFP_ATOMIC);
+        *new = true;
+        if (rule) {
+                memcpy(&rule->spec, spec, sizeof(rule->spec));
+                hlist_add_head(&rule->node, head);
+        }
+        return rule;
+}
+
+void efx_rps_hash_del(struct efx_nic *efx, const struct efx_filter_spec *spec)
+{
+        struct efx_arfs_rule *rule;
+        struct hlist_head *head;
+        struct hlist_node *node;
+
+        head = efx_rps_hash_bucket(efx, spec);
+        if (WARN_ON(!head))
+                return;
+        hlist_for_each(node, head) {
+                rule = container_of(node, struct efx_arfs_rule, node);
+                if (efx_filter_spec_equal(spec, &rule->spec)) {
+                        /* Someone already reused the entry.  We know that if
+                         * this check doesn't fire (i.e. filter_id == REMOVING)
+                         * then the REMOVING mark was put there by our caller,
+                         * because caller is holding a lock on filter table and
+                         * only holders of that lock set REMOVING.
+                         */
+                        if (rule->filter_id != EFX_ARFS_FILTER_ID_REMOVING)
+                                return;
+                        hlist_del(node);
+                        kfree(rule);
+                        return;
+                }
+        }
+        /* We didn't find it. */
+        WARN_ON(1);
+}
+#endif
+
 /* RSS contexts.  We're using linked lists and crappy O(n) algorithms, because
  * (a) this is an infrequent control-plane operation and (b) n is small (max 64)
  */
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index a3140e16fcef..3f759ebdcf10 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -186,6 +186,27 @@ static inline void efx_filter_rfs_expire(struct work_struct *data) {}
 #endif
 bool efx_filter_is_mc_recipient(const struct efx_filter_spec *spec);
 
+bool efx_filter_spec_equal(const struct efx_filter_spec *left,
+                           const struct efx_filter_spec *right);
+u32 efx_filter_spec_hash(const struct efx_filter_spec *spec);
+
+#ifdef CONFIG_RFS_ACCEL
+bool efx_rps_check_rule(struct efx_arfs_rule *rule, unsigned int filter_idx,
+                        bool *force);
+
+struct efx_arfs_rule *efx_rps_hash_find(struct efx_nic *efx,
+                                        const struct efx_filter_spec *spec);
+
+/* @new is written to indicate if entry was newly added (true) or if an old
+ * entry was found and returned (false).
+ */
+struct efx_arfs_rule *efx_rps_hash_add(struct efx_nic *efx,
+                                       const struct efx_filter_spec *spec,
+                                       bool *new);
+
+void efx_rps_hash_del(struct efx_nic *efx, const struct efx_filter_spec *spec);
+#endif
+
 /* RSS contexts */
 struct efx_rss_context *efx_alloc_rss_context_entry(struct efx_nic *efx);
 struct efx_rss_context *efx_find_rss_context_entry(struct efx_nic *efx, u32 id);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 7174ef5e5c5e..c72adf8b52ea 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2905,18 +2905,45 @@ bool efx_farch_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
 {
         struct efx_farch_filter_state *state = efx->filter_state;
         struct efx_farch_filter_table *table;
-        bool ret = false;
+        bool ret = false, force = false;
+        u16 arfs_id;
 
         down_write(&state->lock);
+        spin_lock_bh(&efx->rps_hash_lock);
         table = &state->table[EFX_FARCH_FILTER_TABLE_RX_IP];
         if (test_bit(index, table->used_bitmap) &&
-            table->spec[index].priority == EFX_FILTER_PRI_HINT &&
-            rps_may_expire_flow(efx->net_dev, table->spec[index].dmaq_id,
-                                flow_id, 0)) {
-                efx_farch_filter_table_clear_entry(efx, table, index);
-                ret = true;
+            table->spec[index].priority == EFX_FILTER_PRI_HINT) {
+                struct efx_arfs_rule *rule = NULL;
+                struct efx_filter_spec spec;
+
+                efx_farch_filter_to_gen_spec(&spec, &table->spec[index]);
+                if (!efx->rps_hash_table) {
+                        /* In the absence of the table, we always returned 0 to
+                         * ARFS, so use the same to query it.
+                         */
+                        arfs_id = 0;
+                } else {
+                        rule = efx_rps_hash_find(efx, &spec);
+                        if (!rule) {
+                                /* ARFS table doesn't know of this filter, remove it */
+                                force = true;
+                        } else {
+                                arfs_id = rule->arfs_id;
+                                if (!efx_rps_check_rule(rule, index, &force))
+                                        goto out_unlock;
+                        }
+                }
+                if (force || rps_may_expire_flow(efx->net_dev, spec.dmaq_id,
+                                                 flow_id, arfs_id)) {
+                        if (rule)
+                                rule->filter_id = EFX_ARFS_FILTER_ID_REMOVING;
+                        efx_rps_hash_del(efx, &spec);
+                        efx_farch_filter_table_clear_entry(efx, table, index);
+                        ret = true;
+                }
         }
-
+out_unlock:
+        spin_unlock_bh(&efx->rps_hash_lock);
         up_write(&state->lock);
         return ret;
 }
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index eea3808b3f25..65568925c3ef 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -734,6 +734,35 @@ struct efx_rss_context {
 };
 
 #ifdef CONFIG_RFS_ACCEL
+/* Order of these is important, since filter_id >= %EFX_ARFS_FILTER_ID_PENDING
+ * is used to test if filter does or will exist.
+ */
+#define EFX_ARFS_FILTER_ID_PENDING      -1
+#define EFX_ARFS_FILTER_ID_ERROR        -2
+#define EFX_ARFS_FILTER_ID_REMOVING     -3
+/**
+ * struct efx_arfs_rule - record of an ARFS filter and its IDs
+ * @node: linkage into hash table
+ * @spec: details of the filter (used as key for hash table).  Use efx->type to
+ *      determine which member to use.
+ * @rxq_index: channel to which the filter will steer traffic.
+ * @arfs_id: filter ID which was returned to ARFS
+ * @filter_id: index in software filter table.  May be
+ *      %EFX_ARFS_FILTER_ID_PENDING if filter was not inserted yet,
+ *      %EFX_ARFS_FILTER_ID_ERROR if filter insertion failed, or
+ *      %EFX_ARFS_FILTER_ID_REMOVING if expiry is currently removing the filter.
+ */
+struct efx_arfs_rule {
+        struct hlist_node node;
+        struct efx_filter_spec spec;
+        u16 rxq_index;
+        u16 arfs_id;
+        s32 filter_id;
+};
+
+/* Size chosen so that the table is one page (4kB) */
+#define EFX_ARFS_HASH_TABLE_SIZE        512
+
 /**
  * struct efx_async_filter_insertion - Request to asynchronously insert a filter
  * @net_dev: Reference to the netdevice
@@ -873,6 +902,10 @@ struct efx_async_filter_insertion {
  *      @rps_expire_channel's @rps_flow_id
  * @rps_slot_map: bitmap of in-flight entries in @rps_slot
  * @rps_slot: array of ARFS insertion requests for efx_filter_rfs_work()
+ * @rps_hash_lock: Protects ARFS filter mapping state (@rps_hash_table and
+ *      @rps_next_id).
+ * @rps_hash_table: Mapping between ARFS filters and their various IDs
+ * @rps_next_id: next arfs_id for an ARFS filter
  * @active_queues: Count of RX and TX queues that haven't been flushed and drained.
  * @rxq_flush_pending: Count of number of receive queues that need to be flushed.
  *      Decremented when the efx_flush_rx_queue() is called.
@@ -1029,6 +1062,9 @@ struct efx_nic {
         unsigned int rps_expire_index;
         unsigned long rps_slot_map;
         struct efx_async_filter_insertion rps_slot[EFX_RPS_MAX_IN_FLIGHT];
+        spinlock_t rps_hash_lock;
+        struct hlist_head *rps_hash_table;
+        u32 rps_next_id;
 #endif
 
         atomic_t active_queues;
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 9c593c661cbf..64a94f242027 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -834,9 +834,29 @@ static void efx_filter_rfs_work(struct work_struct *data)
         struct efx_nic *efx = netdev_priv(req->net_dev);
         struct efx_channel *channel = efx_get_channel(efx, req->rxq_index);
         int slot_idx = req - efx->rps_slot;
+        struct efx_arfs_rule *rule;
+        u16 arfs_id = 0;
         int rc;
 
         rc = efx->type->filter_insert(efx, &req->spec, true);
+        if (efx->rps_hash_table) {
+                spin_lock_bh(&efx->rps_hash_lock);
+                rule = efx_rps_hash_find(efx, &req->spec);
+                /* The rule might have already gone, if someone else's request
+                 * for the same spec was already worked and then expired before
+                 * we got around to our work.  In that case we have nothing
+                 * tying us to an arfs_id, meaning that as soon as the filter
+                 * is considered for expiry it will be removed.
+                 */
+                if (rule) {
+                        if (rc < 0)
+                                rule->filter_id = EFX_ARFS_FILTER_ID_ERROR;
+                        else
+                                rule->filter_id = rc;
+                        arfs_id = rule->arfs_id;
+                }
+                spin_unlock_bh(&efx->rps_hash_lock);
+        }
         if (rc >= 0) {
                 /* Remember this so we can check whether to expire the filter
                  * later.
@@ -848,18 +868,18 @@ static void efx_filter_rfs_work(struct work_struct *data)
 
                 if (req->spec.ether_type == htons(ETH_P_IP))
                         netif_info(efx, rx_status, efx->net_dev,
-                                   "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d]\n",
+                                   "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d id %u]\n",
                                    (req->spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
                                    req->spec.rem_host, ntohs(req->spec.rem_port),
                                    req->spec.loc_host, ntohs(req->spec.loc_port),
-                                   req->rxq_index, req->flow_id, rc);
+                                   req->rxq_index, req->flow_id, rc, arfs_id);
                 else
                         netif_info(efx, rx_status, efx->net_dev,
-                                   "steering %s [%pI6]:%u:[%pI6]:%u to queue %u [flow %u filter %d]\n",
+                                   "steering %s [%pI6]:%u:[%pI6]:%u to queue %u [flow %u filter %d id %u]\n",
                                    (req->spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
                                    req->spec.rem_host, ntohs(req->spec.rem_port),
                                    req->spec.loc_host, ntohs(req->spec.loc_port),
-                                   req->rxq_index, req->flow_id, rc);
+                                   req->rxq_index, req->flow_id, rc, arfs_id);
         }
 
         /* Release references */
@@ -872,8 +892,10 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
 {
         struct efx_nic *efx = netdev_priv(net_dev);
         struct efx_async_filter_insertion *req;
+        struct efx_arfs_rule *rule;
         struct flow_keys fk;
         int slot_idx;
+        bool new;
         int rc;
 
         /* find a free slot */
@@ -926,12 +948,42 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         req->spec.rem_port = fk.ports.src;
         req->spec.loc_port = fk.ports.dst;
 
+        if (efx->rps_hash_table) {
+                /* Add it to ARFS hash table */
+                spin_lock(&efx->rps_hash_lock);
+                rule = efx_rps_hash_add(efx, &req->spec, &new);
+                if (!rule) {
+                        rc = -ENOMEM;
+                        goto out_unlock;
+                }
+                if (new)
+                        rule->arfs_id = efx->rps_next_id++ % RPS_NO_FILTER;
+                rc = rule->arfs_id;
+                /* Skip if existing or pending filter already does the right thing */
+                if (!new && rule->rxq_index == rxq_index &&
+                    rule->filter_id >= EFX_ARFS_FILTER_ID_PENDING)
+                        goto out_unlock;
+                rule->rxq_index = rxq_index;
+                rule->filter_id = EFX_ARFS_FILTER_ID_PENDING;
+                spin_unlock(&efx->rps_hash_lock);
+        } else {
+                /* Without an ARFS hash table, we just use arfs_id 0 for all
+                 * filters.  This means if multiple flows hash to the same
+                 * flow_id, all but the most recently touched will be eligible
+                 * for expiry.
+                 */
+                rc = 0;
+        }
+
+        /* Queue the request */
         dev_hold(req->net_dev = net_dev);
         INIT_WORK(&req->work, efx_filter_rfs_work);
         req->rxq_index = rxq_index;
         req->flow_id = flow_id;
         schedule_work(&req->work);
-        return 0;
+        return rc;
+out_unlock:
+        spin_unlock(&efx->rps_hash_lock);
 out_clear:
         clear_bit(slot_idx, &efx->rps_slot_map);
         return rc;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 30371274409d..74f828412055 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -129,7 +129,7 @@ do {								\
 
 #define RX_PRIORITY_MAPPING     0x76543210
 #define TX_PRIORITY_MAPPING     0x33221100
-#define CPDMA_TX_PRIORITY_MAP   0x01234567
+#define CPDMA_TX_PRIORITY_MAP   0x76543210
 
 #define CPSW_VLAN_AWARE         BIT(1)
 #define CPSW_RX_VLAN_ENCAP      BIT(2)
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index c22e8e383247..25e2a099b71c 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1393,6 +1393,15 @@ static int m88e1318_set_wol(struct phy_device *phydev,
                 if (err < 0)
                         goto error;
 
+                /* If WOL event happened once, the LED[2] interrupt pin
+                 * will not be cleared unless we reading the interrupt status
+                 * register. If interrupts are in use, the normal interrupt
+                 * handling will clear the WOL event. Clear the WOL event
+                 * before enabling it if !phy_interrupt_is_valid()
+                 */
+                if (!phy_interrupt_is_valid(phydev))
+                        phy_read(phydev, MII_M1011_IEVENT);
+
                 /* Enable the WOL interrupt */
                 err = __phy_modify(phydev, MII_88E1318S_PHY_CSIER, 0,
                                    MII_88E1318S_PHY_CSIER_WOL_EIE);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 1483bc7b01e1..7df07337d69c 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
         lock_sock(sk);
 
         error = -EINVAL;
+
+        if (sockaddr_len != sizeof(struct sockaddr_pppox))
+                goto end;
+
         if (sp->sa_protocol != PX_PROTO_OE)
                 goto end;
 
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index acbe84967834..ddb6bf85a59c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1072,14 +1072,11 @@ static void team_port_leave(struct team *team, struct team_port *port)
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+static int __team_port_enable_netpoll(struct team_port *port)
 {
         struct netpoll *np;
         int err;
 
-        if (!team->dev->npinfo)
-                return 0;
-
         np = kzalloc(sizeof(*np), GFP_KERNEL);
         if (!np)
                 return -ENOMEM;
@@ -1093,6 +1090,14 @@ static int team_port_enable_netpoll(struct team *team, struct team_port *port)
         return err;
 }
 
+static int team_port_enable_netpoll(struct team_port *port)
+{
+        if (!port->team->dev->npinfo)
+                return 0;
+
+        return __team_port_enable_netpoll(port);
+}
+
 static void team_port_disable_netpoll(struct team_port *port)
 {
         struct netpoll *np = port->np;
@@ -1107,7 +1112,7 @@ static void team_port_disable_netpoll(struct team_port *port)
         kfree(np);
 }
 #else
-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+static int team_port_enable_netpoll(struct team_port *port)
 {
         return 0;
 }
@@ -1221,7 +1226,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                 goto err_vids_add;
         }
 
-        err = team_port_enable_netpoll(team, port);
+        err = team_port_enable_netpoll(port);
         if (err) {
                 netdev_err(dev, "Failed to enable netpoll on device %s\n",
                            portname);
@@ -1918,7 +1923,7 @@ static int team_netpoll_setup(struct net_device *dev,
 
         mutex_lock(&team->lock);
         list_for_each_entry(port, &team->port_list, list) {
-                err = team_port_enable_netpoll(team, port);
+                err = __team_port_enable_netpoll(port);
                 if (err) {
                         __team_netpoll_cleanup(team);
                         break;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 84aa9d676375..6da20b9688f7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -942,7 +942,7 @@ int __init early_init_dt_scan_chosen_stdout(void)
         int offset;
         const char *p, *q, *options = NULL;
         int l;
-        const struct earlycon_id *match;
+        const struct earlycon_id **p_match;
         const void *fdt = initial_boot_params;
 
         offset = fdt_path_offset(fdt, "/chosen");
@@ -969,7 +969,10 @@ int __init early_init_dt_scan_chosen_stdout(void)
                 return 0;
         }
 
-        for (match = __earlycon_table; match < __earlycon_table_end; match++) {
+        for (p_match = __earlycon_table; p_match < __earlycon_table_end;
+             p_match++) {
+                const struct earlycon_id *match = *p_match;
+
                 if (!match->compatible[0])
                         continue;
 
diff --git a/drivers/pci/dwc/pcie-kirin.c b/drivers/pci/dwc/pcie-kirin.c
index a6b88c7f6e3e..d2970a009eb5 100644
--- a/drivers/pci/dwc/pcie-kirin.c
+++ b/drivers/pci/dwc/pcie-kirin.c
@@ -486,7 +486,7 @@ static int kirin_pcie_probe(struct platform_device *pdev)
                 return ret;
 
         kirin_pcie->gpio_id_reset = of_get_named_gpio(dev->of_node,
-                                                      "reset-gpio", 0);
+                                                      "reset-gpios", 0);
         if (kirin_pcie->gpio_id_reset < 0)
                 return -ENODEV;
 
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index b04d37b3c5de..9abf549631b4 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -29,6 +29,7 @@
 #define     PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT       5
 #define     PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE              (0 << 11)
 #define     PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT      12
+#define     PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ              0x2
 #define PCIE_CORE_LINK_CTRL_STAT_REG                            0xd0
 #define     PCIE_CORE_LINK_L0S_ENTRY                            BIT(0)
 #define     PCIE_CORE_LINK_TRAINING                             BIT(5)
@@ -100,7 +101,8 @@
 #define PCIE_ISR1_MASK_REG                      (CONTROL_BASE_ADDR + 0x4C)
 #define     PCIE_ISR1_POWER_STATE_CHANGE        BIT(4)
 #define     PCIE_ISR1_FLUSH                     BIT(5)
-#define     PCIE_ISR1_ALL_MASK                  GENMASK(5, 4)
+#define     PCIE_ISR1_INTX_ASSERT(val)          BIT(8 + (val))
+#define     PCIE_ISR1_ALL_MASK                  GENMASK(11, 4)
 #define PCIE_MSI_ADDR_LOW_REG                   (CONTROL_BASE_ADDR + 0x50)
 #define PCIE_MSI_ADDR_HIGH_REG                  (CONTROL_BASE_ADDR + 0x54)
 #define PCIE_MSI_STATUS_REG                     (CONTROL_BASE_ADDR + 0x58)
@@ -172,8 +174,6 @@
 #define PCIE_CONFIG_WR_TYPE0                    0xa
 #define PCIE_CONFIG_WR_TYPE1                    0xb
 
-/* PCI_BDF shifts 8bit, so we need extra 4bit shift */
-#define PCIE_BDF(dev)                           (dev << 4)
 #define PCIE_CONF_BUS(bus)                      (((bus) & 0xff) << 20)
 #define PCIE_CONF_DEV(dev)                      (((dev) & 0x1f) << 15)
 #define PCIE_CONF_FUNC(fun)                     (((fun) & 0x7)  << 12)
@@ -296,7 +296,8 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
         reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE |
                 (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) |
                 PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE |
-                PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT;
+                (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ <<
+                 PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT);
         advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG);
 
         /* Program PCIe Control 2 to disable strict ordering */
@@ -437,7 +438,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
         u32 reg;
         int ret;
 
-        if (PCI_SLOT(devfn) != 0) {
+        if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) {
                 *val = 0xffffffff;
                 return PCIBIOS_DEVICE_NOT_FOUND;
         }
@@ -456,7 +457,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
         advk_writel(pcie, reg, PIO_CTRL);
 
         /* Program the address registers */
-        reg = PCIE_BDF(devfn) | PCIE_CONF_REG(where);
+        reg = PCIE_CONF_ADDR(bus->number, devfn, where);
         advk_writel(pcie, reg, PIO_ADDR_LS);
         advk_writel(pcie, 0, PIO_ADDR_MS);
 
@@ -491,7 +492,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
         int offset;
         int ret;
 
-        if (PCI_SLOT(devfn) != 0)
+        if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0)
                 return PCIBIOS_DEVICE_NOT_FOUND;
 
         if (where % size)
@@ -609,9 +610,9 @@ static void advk_pcie_irq_mask(struct irq_data *d)
         irq_hw_number_t hwirq = irqd_to_hwirq(d);
         u32 mask;
 
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        mask |= PCIE_ISR0_INTX_ASSERT(hwirq);
-        advk_writel(pcie, mask, PCIE_ISR0_MASK_REG);
+        mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        mask |= PCIE_ISR1_INTX_ASSERT(hwirq);
+        advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
 }
 
 static void advk_pcie_irq_unmask(struct irq_data *d)
@@ -620,9 +621,9 @@ static void advk_pcie_irq_unmask(struct irq_data *d)
         irq_hw_number_t hwirq = irqd_to_hwirq(d);
         u32 mask;
 
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        mask &= ~PCIE_ISR0_INTX_ASSERT(hwirq);
-        advk_writel(pcie, mask, PCIE_ISR0_MASK_REG);
+        mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq);
+        advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
 }
 
 static int advk_pcie_irq_map(struct irq_domain *h,
@@ -765,29 +766,35 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
 
 static void advk_pcie_handle_int(struct advk_pcie *pcie)
 {
-        u32 val, mask, status;
+        u32 isr0_val, isr0_mask, isr0_status;
+        u32 isr1_val, isr1_mask, isr1_status;
         int i, virq;
 
-        val = advk_readl(pcie, PCIE_ISR0_REG);
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        status = val & ((~mask) & PCIE_ISR0_ALL_MASK);
+        isr0_val = advk_readl(pcie, PCIE_ISR0_REG);
+        isr0_mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
+        isr0_status = isr0_val & ((~isr0_mask) & PCIE_ISR0_ALL_MASK);
+
+        isr1_val = advk_readl(pcie, PCIE_ISR1_REG);
+        isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK);
 
-        if (!status) {
-                advk_writel(pcie, val, PCIE_ISR0_REG);
+        if (!isr0_status && !isr1_status) {
+                advk_writel(pcie, isr0_val, PCIE_ISR0_REG);
+                advk_writel(pcie, isr1_val, PCIE_ISR1_REG);
                 return;
         }
 
         /* Process MSI interrupts */
-        if (status & PCIE_ISR0_MSI_INT_PENDING)
+        if (isr0_status & PCIE_ISR0_MSI_INT_PENDING)
                 advk_pcie_handle_msi(pcie);
 
         /* Process legacy interrupts */
         for (i = 0; i < PCI_NUM_INTX; i++) {
-                if (!(status & PCIE_ISR0_INTX_ASSERT(i)))
+                if (!(isr1_status & PCIE_ISR1_INTX_ASSERT(i)))
                         continue;
 
-                advk_writel(pcie, PCIE_ISR0_INTX_ASSERT(i),
-                            PCIE_ISR0_REG);
+                advk_writel(pcie, PCIE_ISR1_INTX_ASSERT(i),
+                            PCIE_ISR1_REG);
 
                 virq = irq_find_mapping(pcie->irq_domain, i);
                 generic_handle_irq(virq);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 6ace47099fc5..b9a131137e64 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -958,10 +958,11 @@ static int pci_pm_freeze(struct device *dev)
          * devices should not be touched during freeze/thaw transitions,
          * however.
          */
-        if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND))
+        if (!dev_pm_smart_suspend_and_suspended(dev)) {
                 pm_runtime_resume(dev);
+                pci_dev->state_saved = false;
+        }
 
-        pci_dev->state_saved = false;
         if (pm->freeze) {
                 int error;
 
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e597655a5643..a04197ce767d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5273,11 +5273,11 @@ void pcie_print_link_status(struct pci_dev *dev)
         bw_avail = pcie_bandwidth_available(dev, &limiting_dev, &speed, &width);
 
         if (bw_avail >= bw_cap)
-                pci_info(dev, "%u.%03u Gb/s available bandwidth (%s x%d link)\n",
+                pci_info(dev, "%u.%03u Gb/s available PCIe bandwidth (%s x%d link)\n",
                          bw_cap / 1000, bw_cap % 1000,
                          PCIE_SPEED2STR(speed_cap), width_cap);
         else
-                pci_info(dev, "%u.%03u Gb/s available bandwidth, limited by %s x%d link at %s (capable of %u.%03u Gb/s with %s x%d link)\n",
+                pci_info(dev, "%u.%03u Gb/s available PCIe bandwidth, limited by %s x%d link at %s (capable of %u.%03u Gb/s with %s x%d link)\n",
                          bw_avail / 1000, bw_avail % 1000,
                          PCIE_SPEED2STR(speed), width,
                          limiting_dev ? pci_name(limiting_dev) : "<unknown>",
diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c
index 304e891e35fc..60f2250fd96b 100644
--- a/drivers/rtc/rtc-opal.c
+++ b/drivers/rtc/rtc-opal.c
@@ -57,7 +57,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms)
 
 static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
 {
-        long rc = OPAL_BUSY;
+        s64 rc = OPAL_BUSY;
         int retries = 10;
         u32 y_m_d;
         u64 h_m_s_ms;
@@ -66,13 +66,17 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
 
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
+                if (rc == OPAL_BUSY_EVENT) {
+                        msleep(OPAL_BUSY_DELAY_MS);
                         opal_poll_events(NULL);
-                else if (retries-- && (rc == OPAL_HARDWARE
-                                       || rc == OPAL_INTERNAL_ERROR))
-                        msleep(10);
-                else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
-                        break;
+                } else if (rc == OPAL_BUSY) {
+                        msleep(OPAL_BUSY_DELAY_MS);
+                } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) {
+                        if (retries--) {
+                                msleep(10); /* Wait 10ms before retry */
+                                rc = OPAL_BUSY; /* go around again */
+                        }
+                }
         }
 
         if (rc != OPAL_SUCCESS)
@@ -87,21 +91,26 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
 
 static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm)
 {
-        long rc = OPAL_BUSY;
+        s64 rc = OPAL_BUSY;
         int retries = 10;
         u32 y_m_d = 0;
         u64 h_m_s_ms = 0;
 
         tm_to_opal(tm, &y_m_d, &h_m_s_ms);
+
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_write(y_m_d, h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
+                if (rc == OPAL_BUSY_EVENT) {
+                        msleep(OPAL_BUSY_DELAY_MS);
                         opal_poll_events(NULL);
-                else if (retries-- && (rc == OPAL_HARDWARE
-                                       || rc == OPAL_INTERNAL_ERROR))
-                        msleep(10);
-                else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
-                        break;
+                } else if (rc == OPAL_BUSY) {
+                        msleep(OPAL_BUSY_DELAY_MS);
+                } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) {
+                        if (retries--) {
+                                msleep(10); /* Wait 10ms before retry */
+                                rc = OPAL_BUSY; /* go around again */
+                        }
+                }
         }
 
         return rc == OPAL_SUCCESS ? 0 : -EIO;
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 62f5f04d8f61..5e963fe0e38d 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
 int dasd_alias_add_device(struct dasd_device *device)
 {
         struct dasd_eckd_private *private = device->private;
-        struct alias_lcu *lcu;
+        __u8 uaddr = private->uid.real_unit_addr;
+        struct alias_lcu *lcu = private->lcu;
         unsigned long flags;
         int rc;
 
-        lcu = private->lcu;
         rc = 0;
         spin_lock_irqsave(&lcu->lock, flags);
+        /*
+         * Check if device and lcu type differ. If so, the uac data may be
+         * outdated and needs to be updated.
+         */
+        if (private->uid.type !=  lcu->uac->unit[uaddr].ua_type) {
+                lcu->flags |= UPDATE_PENDING;
+                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
+                              "uid type mismatch - trigger rescan");
+        }
         if (!(lcu->flags & UPDATE_PENDING)) {
                 rc = _add_device_to_lcu(lcu, device, device);
                 if (rc)
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 6652a49a49b1..9029804dcd22 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area)
 
 static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
 {
+        struct channel_path *chp;
         struct chp_link link;
         struct chp_id chpid;
         int status;
@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
         chpid.id = sei_area->rsid;
         /* allocate a new channel path structure, if needed */
         status = chp_get_status(chpid);
-        if (status < 0)
-                chp_new(chpid);
-        else if (!status)
+        if (!status)
                 return;
+
+        if (status < 0) {
+                chp_new(chpid);
+        } else {
+                chp = chpid_to_chp(chpid);
+                mutex_lock(&chp->lock);
+                chp_update_desc(chp);
+                mutex_unlock(&chp->lock);
+        }
         memset(&link, 0, sizeof(struct chp_link));
         link.chpid = chpid;
         if ((sei_area->vf & 0xc0) != 0) {
diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c
index ff6963ad6e39..3c800642134e 100644
--- a/drivers/s390/cio/vfio_ccw_fsm.c
+++ b/drivers/s390/cio/vfio_ccw_fsm.c
@@ -20,12 +20,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
         int ccode;
         __u8 lpm;
         unsigned long flags;
+        int ret;
 
         sch = private->sch;
 
         spin_lock_irqsave(sch->lock, flags);
         private->state = VFIO_CCW_STATE_BUSY;
-        spin_unlock_irqrestore(sch->lock, flags);
 
         orb = cp_get_orb(&private->cp, (u32)(addr_t)sch, sch->lpm);
 
@@ -38,10 +38,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
                  * Initialize device status information
                  */
                 sch->schib.scsw.cmd.actl |= SCSW_ACTL_START_PEND;
-                return 0;
+                ret = 0;
+                break;
         case 1:         /* Status pending */
         case 2:         /* Busy */
-                return -EBUSY;
+                ret = -EBUSY;
+                break;
         case 3:         /* Device/path not operational */
         {
                 lpm = orb->cmd.lpm;
@@ -51,13 +53,16 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
                         sch->lpm = 0;
 
                 if (cio_update_schib(sch))
-                        return -ENODEV;
-
-                return sch->lpm ? -EACCES : -ENODEV;
+                        ret = -ENODEV;
+                else
+                        ret = sch->lpm ? -EACCES : -ENODEV;
+                break;
         }
         default:
-                return ccode;
+                ret = ccode;
         }
+        spin_unlock_irqrestore(sch->lock, flags);
+        return ret;
 }
 
 static void fsm_notoper(struct vfio_ccw_private *private,
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 4326715dc13e..78b98b3e7efa 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -557,7 +557,6 @@ enum qeth_prot_versions {
 enum qeth_cmd_buffer_state {
         BUF_STATE_FREE,
         BUF_STATE_LOCKED,
-        BUF_STATE_PROCESSED,
 };
 
 enum qeth_cq {
@@ -601,7 +600,6 @@ struct qeth_channel {
         struct qeth_cmd_buffer iob[QETH_CMD_BUFFER_NO];
         atomic_t irq_pending;
         int io_buf_no;
-        int buf_no;
 };
 
 /**
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 04fefa5bb08d..dffd820731f2 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -706,7 +706,6 @@ void qeth_clear_ipacmd_list(struct qeth_card *card)
                 qeth_put_reply(reply);
         }
         spin_unlock_irqrestore(&card->lock, flags);
-        atomic_set(&card->write.irq_pending, 0);
 }
 EXPORT_SYMBOL_GPL(qeth_clear_ipacmd_list);
 
@@ -818,7 +817,6 @@ void qeth_clear_cmd_buffers(struct qeth_channel *channel)
 
         for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
                 qeth_release_buffer(channel, &channel->iob[cnt]);
-        channel->buf_no = 0;
         channel->io_buf_no = 0;
 }
 EXPORT_SYMBOL_GPL(qeth_clear_cmd_buffers);
@@ -924,7 +922,6 @@ static int qeth_setup_channel(struct qeth_channel *channel)
                         kfree(channel->iob[cnt].data);
                 return -ENOMEM;
         }
-        channel->buf_no = 0;
         channel->io_buf_no = 0;
         atomic_set(&channel->irq_pending, 0);
         spin_lock_init(&channel->iob_lock);
@@ -1100,16 +1097,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
 {
         int rc;
         int cstat, dstat;
-        struct qeth_cmd_buffer *buffer;
+        struct qeth_cmd_buffer *iob = NULL;
         struct qeth_channel *channel;
         struct qeth_card *card;
-        struct qeth_cmd_buffer *iob;
-        __u8 index;
-
-        if (__qeth_check_irb_error(cdev, intparm, irb))
-                return;
-        cstat = irb->scsw.cmd.cstat;
-        dstat = irb->scsw.cmd.dstat;
 
         card = CARD_FROM_CDEV(cdev);
         if (!card)
@@ -1127,6 +1117,19 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 channel = &card->data;
                 QETH_CARD_TEXT(card, 5, "data");
         }
+
+        if (qeth_intparm_is_iob(intparm))
+                iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
+
+        if (__qeth_check_irb_error(cdev, intparm, irb)) {
+                /* IO was terminated, free its resources. */
+                if (iob)
+                        qeth_release_buffer(iob->channel, iob);
+                atomic_set(&channel->irq_pending, 0);
+                wake_up(&card->wait_q);
+                return;
+        }
+
         atomic_set(&channel->irq_pending, 0);
 
         if (irb->scsw.cmd.fctl & (SCSW_FCTL_CLEAR_FUNC))
@@ -1150,6 +1153,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 /* we don't have to handle this further */
                 intparm = 0;
         }
+
+        cstat = irb->scsw.cmd.cstat;
+        dstat = irb->scsw.cmd.dstat;
+
         if ((dstat & DEV_STAT_UNIT_EXCEP) ||
             (dstat & DEV_STAT_UNIT_CHECK) ||
             (cstat)) {
@@ -1182,25 +1189,15 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 channel->state = CH_STATE_RCD_DONE;
                 goto out;
         }
-        if (intparm) {
-                buffer = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
-                buffer->state = BUF_STATE_PROCESSED;
-        }
         if (channel == &card->data)
                 return;
         if (channel == &card->read &&
             channel->state == CH_STATE_UP)
                 __qeth_issue_next_read(card);
 
-        iob = channel->iob;
-        index = channel->buf_no;
-        while (iob[index].state == BUF_STATE_PROCESSED) {
-                if (iob[index].callback != NULL)
-                        iob[index].callback(channel, iob + index);
+        if (iob && iob->callback)
+                iob->callback(iob->channel, iob);
 
-                index = (index + 1) % QETH_CMD_BUFFER_NO;
-        }
-        channel->buf_no = index;
 out:
         wake_up(&card->wait_q);
         return;
@@ -1870,8 +1867,8 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
                    atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0);
         QETH_DBF_TEXT(SETUP, 6, "noirqpnd");
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
-        rc = ccw_device_start(channel->ccwdev,
-                              &channel->ccw, (addr_t) iob, 0, 0);
+        rc = ccw_device_start_timeout(channel->ccwdev, &channel->ccw,
+                                      (addr_t) iob, 0, 0, QETH_TIMEOUT);
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
 
         if (rc) {
@@ -1888,7 +1885,6 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
         if (channel->state != CH_STATE_UP) {
                 rc = -ETIME;
                 QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc);
-                qeth_clear_cmd_buffers(channel);
         } else
                 rc = 0;
         return rc;
@@ -1942,8 +1938,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
                    atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0);
         QETH_DBF_TEXT(SETUP, 6, "noirqpnd");
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
-        rc = ccw_device_start(channel->ccwdev,
-                              &channel->ccw, (addr_t) iob, 0, 0);
+        rc = ccw_device_start_timeout(channel->ccwdev, &channel->ccw,
+                                      (addr_t) iob, 0, 0, QETH_TIMEOUT);
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
 
         if (rc) {
@@ -1964,7 +1960,6 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
                 QETH_DBF_MESSAGE(2, "%s IDX activate timed out\n",
                         dev_name(&channel->ccwdev->dev));
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", -ETIME);
-                qeth_clear_cmd_buffers(channel);
                 return -ETIME;
         }
         return qeth_idx_activate_get_answer(channel, idx_reply_cb);
@@ -2166,8 +2161,8 @@ int qeth_send_control_data(struct qeth_card *card, int len,
 
         QETH_CARD_TEXT(card, 6, "noirqpnd");
         spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags);
-        rc = ccw_device_start(card->write.ccwdev, &card->write.ccw,
-                              (addr_t) iob, 0, 0);
+        rc = ccw_device_start_timeout(CARD_WDEV(card), &card->write.ccw,
+                                      (addr_t) iob, 0, 0, event_timeout);
         spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
         if (rc) {
                 QETH_DBF_MESSAGE(2, "%s qeth_send_control_data: "
@@ -2199,8 +2194,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
                 }
         }
 
-        if (reply->rc == -EIO)
-                goto error;
         rc = reply->rc;
         qeth_put_reply(reply);
         return rc;
@@ -2211,10 +2204,6 @@ time_err:
         list_del_init(&reply->list);
         spin_unlock_irqrestore(&reply->card->lock, flags);
         atomic_inc(&reply->received);
-error:
-        atomic_set(&card->write.irq_pending, 0);
-        qeth_release_buffer(iob->channel, iob);
-        card->write.buf_no = (card->write.buf_no + 1) % QETH_CMD_BUFFER_NO;
         rc = reply->rc;
         qeth_put_reply(reply);
         return rc;
@@ -3033,28 +3022,23 @@ static int qeth_send_startlan(struct qeth_card *card)
         return rc;
 }
 
-static int qeth_default_setadapterparms_cb(struct qeth_card *card,
-                struct qeth_reply *reply, unsigned long data)
+static int qeth_setadpparms_inspect_rc(struct qeth_ipa_cmd *cmd)
 {
-        struct qeth_ipa_cmd *cmd;
-
-        QETH_CARD_TEXT(card, 4, "defadpcb");
-
-        cmd = (struct qeth_ipa_cmd *) data;
-        if (cmd->hdr.return_code == 0)
+        if (!cmd->hdr.return_code)
                 cmd->hdr.return_code =
                         cmd->data.setadapterparms.hdr.return_code;
-        return 0;
+        return cmd->hdr.return_code;
 }
 
 static int qeth_query_setadapterparms_cb(struct qeth_card *card,
                 struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 
         QETH_CARD_TEXT(card, 3, "quyadpcb");
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
 
-        cmd = (struct qeth_ipa_cmd *) data;
         if (cmd->data.setadapterparms.data.query_cmds_supp.lan_type & 0x7f) {
                 card->info.link_type =
                       cmd->data.setadapterparms.data.query_cmds_supp.lan_type;
@@ -3062,7 +3046,7 @@ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
         }
         card->options.adp.supported_funcs =
                 cmd->data.setadapterparms.data.query_cmds_supp.supported_cmds;
-        return qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
+        return 0;
 }
 
 static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
@@ -3154,22 +3138,20 @@ EXPORT_SYMBOL_GPL(qeth_query_ipassists);
 static int qeth_query_switch_attributes_cb(struct qeth_card *card,
                                 struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
-        struct qeth_switch_info *sw_info;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
         struct qeth_query_switch_attributes *attrs;
+        struct qeth_switch_info *sw_info;
 
         QETH_CARD_TEXT(card, 2, "qswiatcb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        sw_info = (struct qeth_switch_info *)reply->param;
-        if (cmd->data.setadapterparms.hdr.return_code == 0) {
-                attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
-                sw_info->capabilities = attrs->capabilities;
-                sw_info->settings = attrs->settings;
-                QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
-                                                        sw_info->settings);
-        }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
 
+        sw_info = (struct qeth_switch_info *)reply->param;
+        attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
+        sw_info->capabilities = attrs->capabilities;
+        sw_info->settings = attrs->settings;
+        QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
+                        sw_info->settings);
         return 0;
 }
 
@@ -4207,16 +4189,13 @@ EXPORT_SYMBOL_GPL(qeth_do_send_packet);
 static int qeth_setadp_promisc_mode_cb(struct qeth_card *card,
                 struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
         struct qeth_ipacmd_setadpparms *setparms;
 
         QETH_CARD_TEXT(card, 4, "prmadpcb");
 
-        cmd = (struct qeth_ipa_cmd *) data;
         setparms = &(cmd->data.setadapterparms);
-
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
-        if (cmd->hdr.return_code) {
+        if (qeth_setadpparms_inspect_rc(cmd)) {
                 QETH_CARD_TEXT_(card, 4, "prmrc%x", cmd->hdr.return_code);
                 setparms->data.mode = SET_PROMISC_MODE_OFF;
         }
@@ -4286,18 +4265,18 @@ EXPORT_SYMBOL_GPL(qeth_get_stats);
 static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
                 struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 
         QETH_CARD_TEXT(card, 4, "chgmaccb");
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
 
-        cmd = (struct qeth_ipa_cmd *) data;
         if (!card->options.layer2 ||
             !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
                 ether_addr_copy(card->dev->dev_addr,
                                 cmd->data.setadapterparms.data.change_addr.addr);
                 card->info.mac_bits |= QETH_LAYER2_MAC_READ;
         }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
         return 0;
 }
 
@@ -4328,13 +4307,15 @@ EXPORT_SYMBOL_GPL(qeth_setadpparms_change_macaddr);
 static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
                 struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
         struct qeth_set_access_ctrl *access_ctrl_req;
         int fallback = *(int *)reply->param;
 
         QETH_CARD_TEXT(card, 4, "setaccb");
+        if (cmd->hdr.return_code)
+                return 0;
+        qeth_setadpparms_inspect_rc(cmd);
 
-        cmd = (struct qeth_ipa_cmd *) data;
         access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
         QETH_DBF_TEXT_(SETUP, 2, "setaccb");
         QETH_DBF_TEXT_(SETUP, 2, "%s", card->gdev->dev.kobj.name);
@@ -4407,7 +4388,6 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
                         card->options.isolation = card->options.prev_isolation;
                 break;
         }
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
         return 0;
 }
 
@@ -4695,14 +4675,15 @@ out:
 static int qeth_setadpparms_query_oat_cb(struct qeth_card *card,
                 struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
         struct qeth_qoat_priv *priv;
         char *resdata;
         int resdatalen;
 
         QETH_CARD_TEXT(card, 3, "qoatcb");
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
 
-        cmd = (struct qeth_ipa_cmd *)data;
         priv = (struct qeth_qoat_priv *)reply->param;
         resdatalen = cmd->data.setadapterparms.hdr.cmdlength;
         resdata = (char *)data + 28;
@@ -4796,21 +4777,18 @@ out:
 static int qeth_query_card_info_cb(struct qeth_card *card,
                                    struct qeth_reply *reply, unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        struct carrier_info *carrier_info = (struct carrier_info *)reply->param;
+        struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
         struct qeth_query_card_info *card_info;
-        struct carrier_info *carrier_info;
 
         QETH_CARD_TEXT(card, 2, "qcrdincb");
-        carrier_info = (struct carrier_info *)reply->param;
-        cmd = (struct qeth_ipa_cmd *)data;
-        card_info = &cmd->data.setadapterparms.data.card_info;
-        if (cmd->data.setadapterparms.hdr.return_code == 0) {
-                carrier_info->card_type = card_info->card_type;
-                carrier_info->port_mode = card_info->port_mode;
-                carrier_info->port_speed = card_info->port_speed;
-        }
+        if (qeth_setadpparms_inspect_rc(cmd))
+                return 0;
 
-        qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+        card_info = &cmd->data.setadapterparms.data.card_info;
+        carrier_info->card_type = card_info->card_type;
+        carrier_info->port_mode = card_info->port_mode;
+        carrier_info->port_speed = card_info->port_speed;
         return 0;
 }
 
@@ -4857,7 +4835,7 @@ int qeth_vm_request_mac(struct qeth_card *card)
                 goto out;
         }
 
-        ccw_device_get_id(CARD_DDEV(card), &id);
+        ccw_device_get_id(CARD_RDEV(card), &id);
         request->resp_buf_len = sizeof(*response);
         request->resp_version = DIAG26C_VERSION2;
         request->op_code = DIAG26C_GET_MAC;
@@ -6563,10 +6541,14 @@ static int __init qeth_core_init(void)
         mutex_init(&qeth_mod_mutex);
 
         qeth_wq = create_singlethread_workqueue("qeth_wq");
+        if (!qeth_wq) {
+                rc = -ENOMEM;
+                goto out_err;
+        }
 
         rc = qeth_register_dbf_views();
         if (rc)
-                goto out_err;
+                goto dbf_err;
         qeth_core_root_dev = root_device_register("qeth");
         rc = PTR_ERR_OR_ZERO(qeth_core_root_dev);
         if (rc)
@@ -6603,6 +6585,8 @@ slab_err:
         root_device_unregister(qeth_core_root_dev);
 register_err:
         qeth_unregister_dbf_views();
+dbf_err:
+        destroy_workqueue(qeth_wq);
 out_err:
         pr_err("Initializing the qeth device driver failed\n");
         return rc;
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index 619f897b4bb0..f4d1ec0b8f5a 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -35,6 +35,18 @@ extern unsigned char IPA_PDU_HEADER[];
 #define QETH_HALT_CHANNEL_PARM  -11
 #define QETH_RCD_PARM -12
 
+static inline bool qeth_intparm_is_iob(unsigned long intparm)
+{
+        switch (intparm) {
+        case QETH_CLEAR_CHANNEL_PARM:
+        case QETH_HALT_CHANNEL_PARM:
+        case QETH_RCD_PARM:
+        case 0:
+                return false;
+        }
+        return true;
+}
+
 /*****************************************************************************/
 /* IP Assist related definitions                                             */
 /*****************************************************************************/
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2ad6f12f3d49..b8079f2a65b3 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -121,13 +121,10 @@ static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
         QETH_CARD_TEXT(card, 2, "L2Setmac");
         rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC);
         if (rc == 0) {
-                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
-                ether_addr_copy(card->dev->dev_addr, mac);
                 dev_info(&card->gdev->dev,
-                        "MAC address %pM successfully registered on device %s\n",
-                        card->dev->dev_addr, card->dev->name);
+                         "MAC address %pM successfully registered on device %s\n",
+                         mac, card->dev->name);
         } else {
-                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
                 switch (rc) {
                 case -EEXIST:
                         dev_warn(&card->gdev->dev,
@@ -142,19 +139,6 @@ static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
         return rc;
 }
 
-static int qeth_l2_send_delmac(struct qeth_card *card, __u8 *mac)
-{
-        int rc;
-
-        QETH_CARD_TEXT(card, 2, "L2Delmac");
-        if (!(card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
-                return 0;
-        rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELVMAC);
-        if (rc == 0)
-                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
-        return rc;
-}
-
 static int qeth_l2_write_mac(struct qeth_card *card, u8 *mac)
 {
         enum qeth_ipa_cmds cmd = is_multicast_ether_addr_64bits(mac) ?
@@ -519,6 +503,7 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
 {
         struct sockaddr *addr = p;
         struct qeth_card *card = dev->ml_priv;
+        u8 old_addr[ETH_ALEN];
         int rc = 0;
 
         QETH_CARD_TEXT(card, 3, "setmac");
@@ -530,14 +515,35 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
                 return -EOPNOTSUPP;
         }
         QETH_CARD_HEX(card, 3, addr->sa_data, ETH_ALEN);
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
         if (qeth_wait_for_threads(card, QETH_RECOVER_THREAD)) {
                 QETH_CARD_TEXT(card, 3, "setmcREC");
                 return -ERESTARTSYS;
         }
-        rc = qeth_l2_send_delmac(card, &card->dev->dev_addr[0]);
-        if (!rc || (rc == -ENOENT))
-                rc = qeth_l2_send_setmac(card, addr->sa_data);
-        return rc ? -EINVAL : 0;
+
+        if (!qeth_card_hw_is_reachable(card)) {
+                ether_addr_copy(dev->dev_addr, addr->sa_data);
+                return 0;
+        }
+
+        /* don't register the same address twice */
+        if (ether_addr_equal_64bits(dev->dev_addr, addr->sa_data) &&
+            (card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
+                return 0;
+
+        /* add the new address, switch over, drop the old */
+        rc = qeth_l2_send_setmac(card, addr->sa_data);
+        if (rc)
+                return rc;
+        ether_addr_copy(old_addr, dev->dev_addr);
+        ether_addr_copy(dev->dev_addr, addr->sa_data);
+
+        if (card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED)
+                qeth_l2_remove_mac(card, old_addr);
+        card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
+        return 0;
 }
 
 static void qeth_promisc_to_bridge(struct qeth_card *card)
@@ -1067,8 +1073,9 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 goto out_remove;
         }
 
-        if (card->info.type != QETH_CARD_TYPE_OSN)
-                qeth_l2_send_setmac(card, &card->dev->dev_addr[0]);
+        if (card->info.type != QETH_CARD_TYPE_OSN &&
+            !qeth_l2_send_setmac(card, card->dev->dev_addr))
+                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
 
         if (qeth_is_diagass_supported(card, QETH_DIAGS_CMD_TRAP)) {
                 if (card->info.hwtrap &&
@@ -1338,8 +1345,8 @@ static int qeth_osn_send_control_data(struct qeth_card *card, int len,
         qeth_prepare_control_data(card, len, iob);
         QETH_CARD_TEXT(card, 6, "osnoirqp");
         spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags);
-        rc = ccw_device_start(card->write.ccwdev, &card->write.ccw,
-                              (addr_t) iob, 0, 0);
+        rc = ccw_device_start_timeout(CARD_WDEV(card), &card->write.ccw,
+                                      (addr_t) iob, 0, 0, QETH_IPA_TIMEOUT);
         spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
         if (rc) {
                 QETH_DBF_MESSAGE(2, "qeth_osn_send_control_data: "
diff --git a/drivers/scsi/fnic/fnic_trace.c b/drivers/scsi/fnic/fnic_trace.c
index abddde11982b..98597b59c12a 100644
--- a/drivers/scsi/fnic/fnic_trace.c
+++ b/drivers/scsi/fnic/fnic_trace.c
@@ -296,7 +296,7 @@ int fnic_get_stats_data(struct stats_debug_info *debug,
                   "Number of Abort FW Timeouts: %lld\n"
                   "Number of Abort IO NOT Found: %lld\n"
 
-                  "Abord issued times: \n"
+                  "Abort issued times: \n"
                   "            < 6 sec : %lld\n"
                   "     6 sec - 20 sec : %lld\n"
                   "    20 sec - 30 sec : %lld\n"
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index ce97cde3b41c..f4d988dd1e9d 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -1124,12 +1124,12 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
                 goto fail_fw_init;
         }
 
-        ret = 0;
+        return 0;
 
 fail_fw_init:
         dev_err(&instance->pdev->dev,
-                "Init cmd return status %s for SCSI host %d\n",
-                ret ? "FAILED" : "SUCCESS", instance->host->host_no);
+                "Init cmd return status FAILED for SCSI host %d\n",
+                instance->host->host_no);
 
         return ret;
 }
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 9ef5e3b810f6..656c98e116a9 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -234,11 +234,13 @@ static const char *sdebug_version_date = "20180128";
 #define F_INV_OP                0x200
 #define F_FAKE_RW               0x400
 #define F_M_ACCESS              0x800   /* media access */
-#define F_LONG_DELAY            0x1000
+#define F_SSU_DELAY             0x1000
+#define F_SYNC_DELAY            0x2000
 
 #define FF_RESPOND (F_RL_WLUN_OK | F_SKIP_UA | F_DELAY_OVERR)
 #define FF_MEDIA_IO (F_M_ACCESS | F_FAKE_RW)
 #define FF_SA (F_SA_HIGH | F_SA_LOW)
+#define F_LONG_DELAY            (F_SSU_DELAY | F_SYNC_DELAY)
 
 #define SDEBUG_MAX_PARTS 4
 
@@ -510,7 +512,7 @@ static const struct opcode_info_t release_iarr[] = {
 };
 
 static const struct opcode_info_t sync_cache_iarr[] = {
-        {0, 0x91, 0, F_LONG_DELAY | F_M_ACCESS, resp_sync_cache, NULL,
+        {0, 0x91, 0, F_SYNC_DELAY | F_M_ACCESS, resp_sync_cache, NULL,
             {16,  0x6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
              0xff, 0xff, 0xff, 0xff, 0x3f, 0xc7} },     /* SYNC_CACHE (16) */
 };
@@ -553,7 +555,7 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
             resp_write_dt0, write_iarr,                 /* WRITE(16) */
                 {16,  0xfa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                  0xff, 0xff, 0xff, 0xff, 0xff, 0xc7} },
-        {0, 0x1b, 0, F_LONG_DELAY, resp_start_stop, NULL,/* START STOP UNIT */
+        {0, 0x1b, 0, F_SSU_DELAY, resp_start_stop, NULL,/* START STOP UNIT */
             {6,  0x1, 0, 0xf, 0xf7, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
         {ARRAY_SIZE(sa_in_16_iarr), 0x9e, 0x10, F_SA_LOW | F_D_IN,
             resp_readcap16, sa_in_16_iarr, /* SA_IN(16), READ CAPACITY(16) */
@@ -606,7 +608,7 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
             resp_write_same_10, write_same_iarr,        /* WRITE SAME(10) */
                 {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, 0xff, 0xff, 0xc7, 0,
                  0, 0, 0, 0, 0} },
-        {ARRAY_SIZE(sync_cache_iarr), 0x35, 0, F_LONG_DELAY | F_M_ACCESS,
+        {ARRAY_SIZE(sync_cache_iarr), 0x35, 0, F_SYNC_DELAY | F_M_ACCESS,
             resp_sync_cache, sync_cache_iarr,
             {10,  0x7, 0xff, 0xff, 0xff, 0xff, 0x3f, 0xff, 0xff, 0xc7, 0, 0,
              0, 0, 0, 0} },                     /* SYNC_CACHE (10) */
@@ -667,6 +669,7 @@ static bool sdebug_strict = DEF_STRICT;
 static bool sdebug_any_injecting_opt;
 static bool sdebug_verbose;
 static bool have_dif_prot;
+static bool write_since_sync;
 static bool sdebug_statistics = DEF_STATISTICS;
 
 static unsigned int sdebug_store_sectors;
@@ -1607,6 +1610,7 @@ static int resp_start_stop(struct scsi_cmnd *scp,
 {
         unsigned char *cmd = scp->cmnd;
         int power_cond, stop;
+        bool changing;
 
         power_cond = (cmd[4] & 0xf0) >> 4;
         if (power_cond) {
@@ -1614,8 +1618,12 @@ static int resp_start_stop(struct scsi_cmnd *scp,
                 return check_condition_result;
         }
         stop = !(cmd[4] & 1);
+        changing = atomic_read(&devip->stopped) == !stop;
         atomic_xchg(&devip->stopped, stop);
-        return (cmd[1] & 0x1) ? SDEG_RES_IMMED_MASK : 0; /* check IMMED bit */
+        if (!changing || cmd[1] & 0x1)  /* state unchanged or IMMED set */
+                return SDEG_RES_IMMED_MASK;
+        else
+                return 0;
 }
 
 static sector_t get_sdebug_capacity(void)
@@ -2473,6 +2481,7 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
         if (do_write) {
                 sdb = scsi_out(scmd);
                 dir = DMA_TO_DEVICE;
+                write_since_sync = true;
         } else {
                 sdb = scsi_in(scmd);
                 dir = DMA_FROM_DEVICE;
@@ -3583,6 +3592,7 @@ static int resp_get_lba_status(struct scsi_cmnd *scp,
 static int resp_sync_cache(struct scsi_cmnd *scp,
                            struct sdebug_dev_info *devip)
 {
+        int res = 0;
         u64 lba;
         u32 num_blocks;
         u8 *cmd = scp->cmnd;
@@ -3598,7 +3608,11 @@ static int resp_sync_cache(struct scsi_cmnd *scp,
                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
                 return check_condition_result;
         }
-        return (cmd[1] & 0x2) ? SDEG_RES_IMMED_MASK : 0; /* check IMMED bit */
+        if (!write_since_sync || cmd[1] & 0x2)
+                res = SDEG_RES_IMMED_MASK;
+        else            /* delay if write_since_sync and IMMED clear */
+                write_since_sync = false;
+        return res;
 }
 
 #define RL_BUCKET_ELEMS 8
@@ -5777,13 +5791,14 @@ fini:
                 return schedule_resp(scp, devip, errsts, pfp, 0, 0);
         else if ((sdebug_jdelay || sdebug_ndelay) && (flags & F_LONG_DELAY)) {
                 /*
-                 * If any delay is active, want F_LONG_DELAY to be at least 1
+                 * If any delay is active, for F_SSU_DELAY want at least 1
                  * second and if sdebug_jdelay>0 want a long delay of that
-                 * many seconds.
+                 * many seconds; for F_SYNC_DELAY want 1/20 of that.
                  */
                 int jdelay = (sdebug_jdelay < 2) ? 1 : sdebug_jdelay;
+                int denom = (flags & F_SYNC_DELAY) ? 20 : 1;
 
-                jdelay = mult_frac(USER_HZ * jdelay, HZ, USER_HZ);
+                jdelay = mult_frac(USER_HZ * jdelay, HZ, denom * USER_HZ);
                 return schedule_resp(scp, devip, errsts, pfp, jdelay, 0);
         } else
                 return schedule_resp(scp, devip, errsts, pfp, sdebug_jdelay,
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index f4b52b44b966..65f6c94f2e9b 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2322,6 +2322,12 @@ iscsi_multicast_skb(struct sk_buff *skb, uint32_t group, gfp_t gfp)
         return nlmsg_multicast(nls, skb, 0, group, gfp);
 }
 
+static int
+iscsi_unicast_skb(struct sk_buff *skb, u32 portid)
+{
+        return nlmsg_unicast(nls, skb, portid);
+}
+
 int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
                    char *data, uint32_t data_size)
 {
@@ -2524,14 +2530,11 @@ void iscsi_ping_comp_event(uint32_t host_no, struct iscsi_transport *transport,
 EXPORT_SYMBOL_GPL(iscsi_ping_comp_event);
 
 static int
-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
-                    void *payload, int size)
+iscsi_if_send_reply(u32 portid, int type, void *payload, int size)
 {
         struct sk_buff  *skb;
         struct nlmsghdr *nlh;
         int len = nlmsg_total_size(size);
-        int flags = multi ? NLM_F_MULTI : 0;
-        int t = done ? NLMSG_DONE : type;
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
@@ -2539,10 +2542,9 @@ iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
                 return -ENOMEM;
         }
 
-        nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0);
-        nlh->nlmsg_flags = flags;
+        nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0);
         memcpy(nlmsg_data(nlh), payload, size);
-        return iscsi_multicast_skb(skb, group, GFP_ATOMIC);
+        return iscsi_unicast_skb(skb, portid);
 }
 
 static int
@@ -3470,6 +3472,7 @@ static int
 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 {
         int err = 0;
+        u32 portid;
         struct iscsi_uevent *ev = nlmsg_data(nlh);
         struct iscsi_transport *transport = NULL;
         struct iscsi_internal *priv;
@@ -3490,10 +3493,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
         if (!try_module_get(transport->owner))
                 return -EINVAL;
 
+        portid = NETLINK_CB(skb).portid;
+
         switch (nlh->nlmsg_type) {
         case ISCSI_UEVENT_CREATE_SESSION:
                 err = iscsi_if_create_session(priv, ep, ev,
-                                              NETLINK_CB(skb).portid,
+                                              portid,
                                               ev->u.c_session.initial_cmdsn,
                                               ev->u.c_session.cmds_max,
                                               ev->u.c_session.queue_depth);
@@ -3506,7 +3511,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
                 }
 
                 err = iscsi_if_create_session(priv, ep, ev,
-                                        NETLINK_CB(skb).portid,
+                                        portid,
                                         ev->u.c_bound_session.initial_cmdsn,
                                         ev->u.c_bound_session.cmds_max,
                                         ev->u.c_bound_session.queue_depth);
@@ -3664,6 +3669,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 static void
 iscsi_if_rx(struct sk_buff *skb)
 {
+        u32 portid = NETLINK_CB(skb).portid;
+
         mutex_lock(&rx_queue_mutex);
         while (skb->len >= NLMSG_HDRLEN) {
                 int err;
@@ -3699,8 +3706,8 @@ iscsi_if_rx(struct sk_buff *skb)
                                 break;
                         if (ev->type == ISCSI_UEVENT_GET_CHAP && !err)
                                 break;
-                        err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
-                                nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
+                        err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
+                                                  ev, sizeof(*ev));
                 } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
                 skb_pull(skb, rlen);
         }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a6201e696ab9..9421d9877730 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2121,6 +2121,8 @@ sd_spinup_disk(struct scsi_disk *sdkp)
                                 break;  /* standby */
                         if (sshdr.asc == 4 && sshdr.ascq == 0xc)
                                 break;  /* unavailable */
+                        if (sshdr.asc == 4 && sshdr.ascq == 0x1b)
+                                break;  /* sanitize in progress */
                         /*
                          * Issue command to spin up drive when not ready
                          */
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 41df75eea57b..210407cd2341 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -400,8 +400,10 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
  *
  * Check that all zones of the device are equal. The last zone can however
  * be smaller. The zone size must also be a power of two number of LBAs.
+ *
+ * Returns the zone size in bytes upon success or an error code upon failure.
  */
-static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
+static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
         u64 zone_blocks = 0;
         sector_t block = 0;
@@ -412,8 +414,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
         int ret;
         u8 same;
 
-        sdkp->zone_blocks = 0;
-
         /* Get a buffer */
         buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL);
         if (!buf)
@@ -445,16 +445,17 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 
                 /* Parse zone descriptors */
                 while (rec < buf + buf_len) {
-                        zone_blocks = get_unaligned_be64(&rec[8]);
-                        if (sdkp->zone_blocks == 0) {
-                                sdkp->zone_blocks = zone_blocks;
-                        } else if (zone_blocks != sdkp->zone_blocks &&
-                                   (block + zone_blocks < sdkp->capacity
-                                    || zone_blocks > sdkp->zone_blocks)) {
-                                zone_blocks = 0;
+                        u64 this_zone_blocks = get_unaligned_be64(&rec[8]);
+
+                        if (zone_blocks == 0) {
+                                zone_blocks = this_zone_blocks;
+                        } else if (this_zone_blocks != zone_blocks &&
+                                   (block + this_zone_blocks < sdkp->capacity
+                                    || this_zone_blocks > zone_blocks)) {
+                                this_zone_blocks = 0;
                                 goto out;
                         }
-                        block += zone_blocks;
+                        block += this_zone_blocks;
                         rec += 64;
                 }
 
@@ -467,8 +468,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 
         } while (block < sdkp->capacity);
 
-        zone_blocks = sdkp->zone_blocks;
-
 out:
         if (!zone_blocks) {
                 if (sdkp->first_scan)
@@ -488,8 +487,7 @@ out:
                                   "Zone size too large\n");
                 ret = -ENODEV;
         } else {
-                sdkp->zone_blocks = zone_blocks;
-                sdkp->zone_shift = ilog2(zone_blocks);
+                ret = zone_blocks;
         }
 
 out_free:
@@ -500,15 +498,14 @@ out_free:
 
 /**
  * sd_zbc_alloc_zone_bitmap - Allocate a zone bitmap (one bit per zone).
- * @sdkp: The disk of the bitmap
+ * @nr_zones: Number of zones to allocate space for.
+ * @numa_node: NUMA node to allocate the memory from.
  */
-static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
+static inline unsigned long *
+sd_zbc_alloc_zone_bitmap(u32 nr_zones, int numa_node)
 {
-        struct request_queue *q = sdkp->disk->queue;
-
-        return kzalloc_node(BITS_TO_LONGS(sdkp->nr_zones)
-                            * sizeof(unsigned long),
-                            GFP_KERNEL, q->node);
+        return kzalloc_node(BITS_TO_LONGS(nr_zones) * sizeof(unsigned long),
+                            GFP_KERNEL, numa_node);
 }
 
 /**
@@ -516,6 +513,7 @@ static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
  * @sdkp: disk used
  * @buf: report reply buffer
  * @buflen: length of @buf
+ * @zone_shift: logarithm base 2 of the number of blocks in a zone
  * @seq_zones_bitmap: bitmap of sequential zones to set
  *
  * Parse reported zone descriptors in @buf to identify sequential zones and
@@ -525,7 +523,7 @@ static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
  * Return the LBA after the last zone reported.
  */
 static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
-                                     unsigned int buflen,
+                                     unsigned int buflen, u32 zone_shift,
                                      unsigned long *seq_zones_bitmap)
 {
         sector_t lba, next_lba = sdkp->capacity;
@@ -544,7 +542,7 @@ static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
                 if (type != ZBC_ZONE_TYPE_CONV &&
                     cond != ZBC_ZONE_COND_READONLY &&
                     cond != ZBC_ZONE_COND_OFFLINE)
-                        set_bit(lba >> sdkp->zone_shift, seq_zones_bitmap);
+                        set_bit(lba >> zone_shift, seq_zones_bitmap);
                 next_lba = lba + get_unaligned_be64(&rec[8]);
                 rec += 64;
         }
@@ -553,12 +551,16 @@ static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
 }
 
 /**
- * sd_zbc_setup_seq_zones_bitmap - Initialize the disk seq zone bitmap.
+ * sd_zbc_setup_seq_zones_bitmap - Initialize a seq zone bitmap.
  * @sdkp: target disk
+ * @zone_shift: logarithm base 2 of the number of blocks in a zone
+ * @nr_zones: number of zones to set up a seq zone bitmap for
  *
  * Allocate a zone bitmap and initialize it by identifying sequential zones.
  */
-static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
+static unsigned long *
+sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp, u32 zone_shift,
+                              u32 nr_zones)
 {
         struct request_queue *q = sdkp->disk->queue;
         unsigned long *seq_zones_bitmap;
@@ -566,9 +568,9 @@ static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
         unsigned char *buf;
         int ret = -ENOMEM;
 
-        seq_zones_bitmap = sd_zbc_alloc_zone_bitmap(sdkp);
+        seq_zones_bitmap = sd_zbc_alloc_zone_bitmap(nr_zones, q->node);
         if (!seq_zones_bitmap)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL);
         if (!buf)
@@ -579,7 +581,7 @@ static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
                 if (ret)
                         goto out;
                 lba = sd_zbc_get_seq_zones(sdkp, buf, SD_ZBC_BUF_SIZE,
-                                           seq_zones_bitmap);
+                                           zone_shift, seq_zones_bitmap);
         }
 
         if (lba != sdkp->capacity) {
@@ -591,12 +593,9 @@ out:
         kfree(buf);
         if (ret) {
                 kfree(seq_zones_bitmap);
-                return ret;
+                return ERR_PTR(ret);
         }
-
-        q->seq_zones_bitmap = seq_zones_bitmap;
-
-        return 0;
+        return seq_zones_bitmap;
 }
 
 static void sd_zbc_cleanup(struct scsi_disk *sdkp)
@@ -612,44 +611,64 @@ static void sd_zbc_cleanup(struct scsi_disk *sdkp)
         q->nr_zones = 0;
 }
 
-static int sd_zbc_setup(struct scsi_disk *sdkp)
+static int sd_zbc_setup(struct scsi_disk *sdkp, u32 zone_blocks)
 {
         struct request_queue *q = sdkp->disk->queue;
+        u32 zone_shift = ilog2(zone_blocks);
+        u32 nr_zones;
         int ret;
 
-        /* READ16/WRITE16 is mandatory for ZBC disks */
-        sdkp->device->use_16_for_rw = 1;
-        sdkp->device->use_10_for_rw = 0;
-
         /* chunk_sectors indicates the zone size */
-        blk_queue_chunk_sectors(sdkp->disk->queue,
-                        logical_to_sectors(sdkp->device, sdkp->zone_blocks));
-        sdkp->nr_zones =
-                round_up(sdkp->capacity, sdkp->zone_blocks) >> sdkp->zone_shift;
+        blk_queue_chunk_sectors(q,
+                        logical_to_sectors(sdkp->device, zone_blocks));
+        nr_zones = round_up(sdkp->capacity, zone_blocks) >> zone_shift;
 
         /*
          * Initialize the device request queue information if the number
          * of zones changed.
          */
-        if (sdkp->nr_zones != q->nr_zones) {
-
-                sd_zbc_cleanup(sdkp);
-
-                q->nr_zones = sdkp->nr_zones;
-                if (sdkp->nr_zones) {
-                        q->seq_zones_wlock = sd_zbc_alloc_zone_bitmap(sdkp);
-                        if (!q->seq_zones_wlock) {
+        if (nr_zones != sdkp->nr_zones || nr_zones != q->nr_zones) {
+                unsigned long *seq_zones_wlock = NULL, *seq_zones_bitmap = NULL;
+                size_t zone_bitmap_size;
+
+                if (nr_zones) {
+                        seq_zones_wlock = sd_zbc_alloc_zone_bitmap(nr_zones,
+                                                                   q->node);
+                        if (!seq_zones_wlock) {
                                 ret = -ENOMEM;
                                 goto err;
                         }
 
-                        ret = sd_zbc_setup_seq_zones_bitmap(sdkp);
-                        if (ret) {
-                                sd_zbc_cleanup(sdkp);
+                        seq_zones_bitmap = sd_zbc_setup_seq_zones_bitmap(sdkp,
+                                                        zone_shift, nr_zones);
+                        if (IS_ERR(seq_zones_bitmap)) {
+                                ret = PTR_ERR(seq_zones_bitmap);
+                                kfree(seq_zones_wlock);
                                 goto err;
                         }
                 }
-
+                zone_bitmap_size = BITS_TO_LONGS(nr_zones) *
+                        sizeof(unsigned long);
+                blk_mq_freeze_queue(q);
+                if (q->nr_zones != nr_zones) {
+                        /* READ16/WRITE16 is mandatory for ZBC disks */
+                        sdkp->device->use_16_for_rw = 1;
+                        sdkp->device->use_10_for_rw = 0;
+
+                        sdkp->zone_blocks = zone_blocks;
+                        sdkp->zone_shift = zone_shift;
+                        sdkp->nr_zones = nr_zones;
+                        q->nr_zones = nr_zones;
+                        swap(q->seq_zones_wlock, seq_zones_wlock);
+                        swap(q->seq_zones_bitmap, seq_zones_bitmap);
+                } else if (memcmp(q->seq_zones_bitmap, seq_zones_bitmap,
+                                  zone_bitmap_size) != 0) {
+                        memcpy(q->seq_zones_bitmap, seq_zones_bitmap,
+                               zone_bitmap_size);
+                }
+                blk_mq_unfreeze_queue(q);
+                kfree(seq_zones_wlock);
+                kfree(seq_zones_bitmap);
         }
 
         return 0;
@@ -661,6 +680,7 @@ err:
 
 int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
 {
+        int64_t zone_blocks;
         int ret;
 
         if (!sd_is_zoned(sdkp))
@@ -697,12 +717,16 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
          * Check zone size: only devices with a constant zone size (except
          * an eventual last runt zone) that is a power of 2 are supported.
          */
-        ret = sd_zbc_check_zone_size(sdkp);
-        if (ret)
+        zone_blocks = sd_zbc_check_zone_size(sdkp);
+        ret = -EFBIG;
+        if (zone_blocks != (u32)zone_blocks)
+                goto err;
+        ret = zone_blocks;
+        if (ret < 0)
                 goto err;
 
         /* The drive satisfies the kernel restrictions: set it up */
-        ret = sd_zbc_setup(sdkp);
+        ret = sd_zbc_setup(sdkp, zone_blocks);
         if (ret)
                 goto err;
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index c5b1bf1cadcb..00e79057f870 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -276,6 +276,35 @@ static inline void ufshcd_remove_non_printable(char *val)
                 *val = ' ';
 }
 
+static void ufshcd_add_cmd_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_upiu_req *rq = hba->lrb[tag].ucd_req_ptr;
+
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &rq->header, &rq->sc.cdb);
+}
+
+static void ufshcd_add_query_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_upiu_req *rq = hba->lrb[tag].ucd_req_ptr;
+
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &rq->header, &rq->qr);
+}
+
+static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_task_req_desc *descp;
+        struct utp_upiu_task_req *task_req;
+        int off = (int)tag - hba->nutrs;
+
+        descp = &hba->utmrdl_base_addr[off];
+        task_req = (struct utp_upiu_task_req *)descp->task_req_upiu;
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &task_req->header,
+                        &task_req->input_param1);
+}
+
 static void ufshcd_add_command_trace(struct ufs_hba *hba,
                 unsigned int tag, const char *str)
 {
@@ -285,6 +314,9 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba,
         struct ufshcd_lrb *lrbp;
         int transfer_len = -1;
 
+        /* trace UPIU also */
+        ufshcd_add_cmd_upiu_trace(hba, tag, str);
+
         if (!trace_ufshcd_command_enabled())
                 return;
 
@@ -2550,6 +2582,7 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
 
         hba->dev_cmd.complete = &wait;
 
+        ufshcd_add_query_upiu_trace(hba, tag, "query_send");
         /* Make sure descriptors are ready before ringing the doorbell */
         wmb();
         spin_lock_irqsave(hba->host->host_lock, flags);
@@ -2559,6 +2592,9 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
 
         err = ufshcd_wait_for_dev_cmd(hba, lrbp, timeout);
 
+        ufshcd_add_query_upiu_trace(hba, tag,
+                        err ? "query_complete_err" : "query_complete");
+
 out_put_tag:
         ufshcd_put_dev_cmd_tag(hba, tag);
         wake_up(&hba->dev_cmd.tag_wq);
@@ -5443,11 +5479,14 @@ static int ufshcd_issue_tm_cmd(struct ufs_hba *hba, int lun_id, int task_id,
 
         spin_unlock_irqrestore(host->host_lock, flags);
 
+        ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_send");
+
         /* wait until the task management command is completed */
         err = wait_event_timeout(hba->tm_wq,
                         test_bit(free_slot, &hba->tm_condition),
                         msecs_to_jiffies(TM_CMD_TIMEOUT));
         if (!err) {
+                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete_err");
                 dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n",
                                 __func__, tm_function);
                 if (ufshcd_clear_tm_cmd(hba, free_slot))
@@ -5456,6 +5495,7 @@ static int ufshcd_issue_tm_cmd(struct ufs_hba *hba, int lun_id, int task_id,
                 err = -ETIMEDOUT;
         } else {
                 err = ufshcd_task_req_compl(hba, free_slot, tm_response);
+                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete");
         }
 
         clear_bit(free_slot, &hba->tm_condition);
diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index 884419c37e84..457ea1f8db30 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -183,7 +183,7 @@ static u16 slim_slicesize(int code)
                 0, 1, 2, 3, 3, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 7
         };
 
-        clamp(code, 1, (int)ARRAY_SIZE(sizetocode));
+        code = clamp(code, 1, (int)ARRAY_SIZE(sizetocode));
 
         return sizetocode[code - 1];
 }
diff --git a/drivers/soc/bcm/raspberrypi-power.c b/drivers/soc/bcm/raspberrypi-power.c
index fe96a8b956fb..f7ed1187518b 100644
--- a/drivers/soc/bcm/raspberrypi-power.c
+++ b/drivers/soc/bcm/raspberrypi-power.c
@@ -45,7 +45,7 @@ struct rpi_power_domains {
 struct rpi_power_domain_packet {
         u32 domain;
         u32 on;
-} __packet;
+};
 
 /*
  * Asks the firmware to enable or disable power on a specific power
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 6b5300ca44a6..885f5fcead77 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -1390,7 +1390,7 @@ static inline void host_int_parse_assoc_resp_info(struct wilc_vif *vif,
         }
 
         if (hif_drv->usr_conn_req.ies) {
-                conn_info.req_ies = kmemdup(conn_info.req_ies,
+                conn_info.req_ies = kmemdup(hif_drv->usr_conn_req.ies,
                                             hif_drv->usr_conn_req.ies_len,
                                             GFP_KERNEL);
                 if (conn_info.req_ies)
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 0d99b242e82e..6cb933ecc084 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -890,6 +890,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                         bytes = min(bytes, data_len);
 
                         if (!bio) {
+new_bio:
                                 nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages);
                                 nr_pages -= nr_vecs;
                                 /*
@@ -931,6 +932,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                                  * be allocated with pscsi_get_bio() above.
                                  */
                                 bio = NULL;
+                                goto new_bio;
                         }
 
                         data_len -= bytes;
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 3b3e1f6632d7..1dbe27c9946c 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -121,6 +121,9 @@ struct gsm_dlci {
         struct mutex mutex;
 
         /* Link layer */
+        int mode;
+#define DLCI_MODE_ABM           0       /* Normal Asynchronous Balanced Mode */
+#define DLCI_MODE_ADM           1       /* Asynchronous Disconnected Mode */
         spinlock_t lock;        /* Protects the internal state */
         struct timer_list t1;   /* Retransmit timer for SABM and UA */
         int retries;
@@ -1364,7 +1367,13 @@ retry:
         ctrl->data = data;
         ctrl->len = clen;
         gsm->pending_cmd = ctrl;
-        gsm->cretries = gsm->n2;
+
+        /* If DLCI0 is in ADM mode skip retries, it won't respond */
+        if (gsm->dlci[0]->mode == DLCI_MODE_ADM)
+                gsm->cretries = 1;
+        else
+                gsm->cretries = gsm->n2;
+
         mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100);
         gsm_control_transmit(gsm, ctrl);
         spin_unlock_irqrestore(&gsm->control_lock, flags);
@@ -1472,6 +1481,7 @@ static void gsm_dlci_t1(struct timer_list *t)
                         if (debug & 8)
                                 pr_info("DLCI %d opening in ADM mode.\n",
                                         dlci->addr);
+                        dlci->mode = DLCI_MODE_ADM;
                         gsm_dlci_open(dlci);
                 } else {
                         gsm_dlci_close(dlci);
@@ -2861,11 +2871,22 @@ static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk)
 static int gsm_carrier_raised(struct tty_port *port)
 {
         struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
+        struct gsm_mux *gsm = dlci->gsm;
+
         /* Not yet open so no carrier info */
         if (dlci->state != DLCI_OPEN)
                 return 0;
         if (debug & 2)
                 return 1;
+
+        /*
+         * Basic mode with control channel in ADM mode may not respond
+         * to CMD_MSC at all and modem_rx is empty.
+         */
+        if (gsm->encoding == 0 && gsm->dlci[0]->mode == DLCI_MODE_ADM &&
+            !dlci->modem_rx)
+                return 1;
+
         return dlci->modem_rx & TIOCM_CD;
 }
 
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index a24278380fec..22683393a0f2 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -169,7 +169,7 @@ static int __init register_earlycon(char *buf, const struct earlycon_id *match)
  */
 int __init setup_earlycon(char *buf)
 {
-        const struct earlycon_id *match;
+        const struct earlycon_id **p_match;
 
         if (!buf || !buf[0])
                 return -EINVAL;
@@ -177,7 +177,9 @@ int __init setup_earlycon(char *buf)
         if (early_con.flags & CON_ENABLED)
                 return -EALREADY;
 
-        for (match = __earlycon_table; match < __earlycon_table_end; match++) {
+        for (p_match = __earlycon_table; p_match < __earlycon_table_end;
+             p_match++) {
+                const struct earlycon_id *match = *p_match;
                 size_t len = strlen(match->name);
 
                 if (strncmp(buf, match->name, len))
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 91f3a1a5cb7f..c2fc6bef7a6f 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -316,7 +316,7 @@ static u32 imx_uart_readl(struct imx_port *sport, u32 offset)
                  * differ from the value that was last written. As it only
                  * clears after being set, reread conditionally.
                  */
-                if (sport->ucr2 & UCR2_SRST)
+                if (!(sport->ucr2 & UCR2_SRST))
                         sport->ucr2 = readl(sport->port.membase + offset);
                 return sport->ucr2;
                 break;
@@ -1833,6 +1833,11 @@ static int imx_uart_rs485_config(struct uart_port *port,
                 rs485conf->flags &= ~SER_RS485_ENABLED;
 
         if (rs485conf->flags & SER_RS485_ENABLED) {
+                /* Enable receiver if low-active RTS signal is requested */
+                if (sport->have_rtscts &&  !sport->have_rtsgpio &&
+                    !(rs485conf->flags & SER_RS485_RTS_ON_SEND))
+                        rs485conf->flags |= SER_RS485_RX_DURING_TX;
+
                 /* disable transmitter */
                 ucr2 = imx_uart_readl(sport, UCR2);
                 if (rs485conf->flags & SER_RS485_RTS_AFTER_SEND)
@@ -2265,6 +2270,18 @@ static int imx_uart_probe(struct platform_device *pdev)
             (!sport->have_rtscts && !sport->have_rtsgpio))
                 dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
 
+        /*
+         * If using the i.MX UART RTS/CTS control then the RTS (CTS_B)
+         * signal cannot be set low during transmission in case the
+         * receiver is off (limitation of the i.MX UART IP).
+         */
+        if (sport->port.rs485.flags & SER_RS485_ENABLED &&
+            sport->have_rtscts && !sport->have_rtsgpio &&
+            (!(sport->port.rs485.flags & SER_RS485_RTS_ON_SEND) &&
+             !(sport->port.rs485.flags & SER_RS485_RX_DURING_TX)))
+                dev_err(&pdev->dev,
+                        "low-active RTS not possible when receiver is off, enabling receiver\n");
+
         imx_uart_rs485_config(&sport->port, &sport->port.rs485);
 
         /* Disable interrupts before requesting them */
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index 750e5645dc85..f503fab1e268 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -495,7 +495,6 @@ static void mvebu_uart_set_termios(struct uart_port *port,
                 termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
                 termios->c_cflag &= CREAD | CBAUD;
                 termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
-                termios->c_lflag = old->c_lflag;
         }
 
         spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index 65ff669373d4..a1b3eb04cb32 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -1022,6 +1022,7 @@ static int qcom_geni_serial_probe(struct platform_device *pdev)
         struct qcom_geni_serial_port *port;
         struct uart_port *uport;
         struct resource *res;
+        int irq;
 
         if (pdev->dev.of_node)
                 line = of_alias_get_id(pdev->dev.of_node, "serial");
@@ -1061,11 +1062,12 @@ static int qcom_geni_serial_probe(struct platform_device *pdev)
         port->rx_fifo_depth = DEF_FIFO_DEPTH_WORDS;
         port->tx_fifo_width = DEF_FIFO_WIDTH_BITS;
 
-        uport->irq = platform_get_irq(pdev, 0);
-        if (uport->irq < 0) {
-                dev_err(&pdev->dev, "Failed to get IRQ %d\n", uport->irq);
-                return uport->irq;
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "Failed to get IRQ %d\n", irq);
+                return irq;
         }
+        uport->irq = irq;
 
         uport->private_data = &qcom_geni_console_driver;
         platform_set_drvdata(pdev, port);
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index abcb4d09a2d8..bd72dd843338 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -1181,7 +1181,7 @@ static int __init cdns_early_console_setup(struct earlycon_device *device,
         /* only set baud if specified on command line - otherwise
          * assume it has been initialized by a boot loader.
          */
-        if (device->baud) {
+        if (port->uartclk && device->baud) {
                 u32 cd = 0, bdiv = 0;
                 u32 mr;
                 int div8;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 63114ea35ec1..7c838b90a31d 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2816,7 +2816,10 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
 
         kref_init(&tty->kref);
         tty->magic = TTY_MAGIC;
-        tty_ldisc_init(tty);
+        if (tty_ldisc_init(tty)) {
+                kfree(tty);
+                return NULL;
+        }
         tty->session = NULL;
         tty->pgrp = NULL;
         mutex_init(&tty->legacy_mutex);
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 050f4d650891..fb7329ab2b37 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -176,12 +176,11 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc)
                         return ERR_CAST(ldops);
         }
 
-        ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
-        if (ld == NULL) {
-                put_ldops(ldops);
-                return ERR_PTR(-ENOMEM);
-        }
-
+        /*
+         * There is no way to handle allocation failure of only 16 bytes.
+         * Let's simplify error handling and save more memory.
+         */
+        ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL | __GFP_NOFAIL);
         ld->ops = ldops;
         ld->tty = tty;
 
@@ -527,19 +526,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int ld)
 static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 {
         /* There is an outstanding reference here so this is safe */
-        old = tty_ldisc_get(tty, old->ops->num);
-        WARN_ON(IS_ERR(old));
-        tty->ldisc = old;
-        tty_set_termios_ldisc(tty, old->ops->num);
-        if (tty_ldisc_open(tty, old) < 0) {
-                tty_ldisc_put(old);
+        if (tty_ldisc_failto(tty, old->ops->num) < 0) {
+                const char *name = tty_name(tty);
+
+                pr_warn("Falling back ldisc for %s.\n", name);
                 /* The traditional behaviour is to fall back to N_TTY, we
                    want to avoid falling back to N_NULL unless we have no
                    choice to avoid the risk of breaking anything */
                 if (tty_ldisc_failto(tty, N_TTY) < 0 &&
                     tty_ldisc_failto(tty, N_NULL) < 0)
-                        panic("Couldn't open N_NULL ldisc for %s.",
-                              tty_name(tty));
+                        panic("Couldn't open N_NULL ldisc for %s.", name);
         }
 }
 
@@ -824,12 +820,13 @@ EXPORT_SYMBOL_GPL(tty_ldisc_release);
  *      the tty structure is not completely set up when this call is made.
  */
 
-void tty_ldisc_init(struct tty_struct *tty)
+int tty_ldisc_init(struct tty_struct *tty)
 {
         struct tty_ldisc *ld = tty_ldisc_get(tty, N_TTY);
         if (IS_ERR(ld))
-                panic("n_tty: init_tty");
+                return PTR_ERR(ld);
         tty->ldisc = ld;
+        return 0;
 }
 
 /**
diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
index f695a7e8c314..c690d100adcd 100644
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -19,7 +19,7 @@
  * # echo -n "ed963694-e847-4b2a-85af-bc9cfc11d6f3" \
  *    > /sys/bus/vmbus/drivers/uio_hv_generic/bind
  */
-
+#define DEBUG 1
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/device.h>
@@ -94,10 +94,11 @@ hv_uio_irqcontrol(struct uio_info *info, s32 irq_state)
  */
 static void hv_uio_channel_cb(void *context)
 {
-        struct hv_uio_private_data *pdata = context;
-        struct hv_device *dev = pdata->device;
+        struct vmbus_channel *chan = context;
+        struct hv_device *hv_dev = chan->device_obj;
+        struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
-        dev->channel->inbound.ring_buffer->interrupt_mask = 1;
+        chan->inbound.ring_buffer->interrupt_mask = 1;
         virt_mb();
 
         uio_event_notify(&pdata->info);
@@ -121,78 +122,46 @@ static void hv_uio_rescind(struct vmbus_channel *channel)
         uio_event_notify(&pdata->info);
 }
 
-/*
- * Handle fault when looking for sub channel ring buffer
- * Subchannel ring buffer is same as resource 0 which is main ring buffer
- * This is derived from uio_vma_fault
+/* Sysfs API to allow mmap of the ring buffers
+ * The ring buffer is allocated as contiguous memory by vmbus_open
  */
-static int hv_uio_vma_fault(struct vm_fault *vmf)
-{
-        struct vm_area_struct *vma = vmf->vma;
-        void *ring_buffer = vma->vm_private_data;
-        struct page *page;
-        void *addr;
-
-        addr = ring_buffer + (vmf->pgoff << PAGE_SHIFT);
-        page = virt_to_page(addr);
-        get_page(page);
-        vmf->page = page;
-        return 0;
-}
-
-static const struct vm_operations_struct hv_uio_vm_ops = {
-        .fault = hv_uio_vma_fault,
-};
-
-/* Sysfs API to allow mmap of the ring buffers */
 static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
                             struct bin_attribute *attr,
                             struct vm_area_struct *vma)
 {
         struct vmbus_channel *channel
                 = container_of(kobj, struct vmbus_channel, kobj);
-        unsigned long requested_pages, actual_pages;
-
-        if (vma->vm_end < vma->vm_start)
-                return -EINVAL;
-
-        /* only allow 0 for now */
-        if (vma->vm_pgoff > 0)
-                return -EINVAL;
+        struct hv_device *dev = channel->primary_channel->device_obj;
+        u16 q_idx = channel->offermsg.offer.sub_channel_index;
 
-        requested_pages = vma_pages(vma);
-        actual_pages = 2 * HV_RING_SIZE;
-        if (requested_pages > actual_pages)
-                return -EINVAL;
+        dev_dbg(&dev->device, "mmap channel %u pages %#lx at %#lx\n",
+                q_idx, vma_pages(vma), vma->vm_pgoff);
 
-        vma->vm_private_data = channel->ringbuffer_pages;
-        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
-        vma->vm_ops = &hv_uio_vm_ops;
-        return 0;
+        return vm_iomap_memory(vma, virt_to_phys(channel->ringbuffer_pages),
+                               channel->ringbuffer_pagecount << PAGE_SHIFT);
 }
 
-static struct bin_attribute ring_buffer_bin_attr __ro_after_init = {
+static const struct bin_attribute ring_buffer_bin_attr = {
         .attr = {
                 .name = "ring",
                 .mode = 0600,
-                /* size is set at init time */
         },
+        .size = 2 * HV_RING_SIZE * PAGE_SIZE,
         .mmap = hv_uio_ring_mmap,
 };
 
-/* Callback from VMBUS subystem when new channel created. */
+/* Callback from VMBUS subsystem when new channel created. */
 static void
 hv_uio_new_channel(struct vmbus_channel *new_sc)
 {
         struct hv_device *hv_dev = new_sc->primary_channel->device_obj;
         struct device *device = &hv_dev->device;
-        struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
         const size_t ring_bytes = HV_RING_SIZE * PAGE_SIZE;
         int ret;
 
         /* Create host communication ring */
         ret = vmbus_open(new_sc, ring_bytes, ring_bytes, NULL, 0,
-                         hv_uio_channel_cb, pdata);
+                         hv_uio_channel_cb, new_sc);
         if (ret) {
                 dev_err(device, "vmbus_open subchannel failed: %d\n", ret);
                 return;
@@ -234,7 +203,7 @@ hv_uio_probe(struct hv_device *dev,
 
         ret = vmbus_open(dev->channel, HV_RING_SIZE * PAGE_SIZE,
                          HV_RING_SIZE * PAGE_SIZE, NULL, 0,
-                         hv_uio_channel_cb, pdata);
+                         hv_uio_channel_cb, dev->channel);
         if (ret)
                 goto fail;
 
@@ -326,6 +295,11 @@ hv_uio_probe(struct hv_device *dev,
         vmbus_set_chn_rescind_callback(dev->channel, hv_uio_rescind);
         vmbus_set_sc_create_callback(dev->channel, hv_uio_new_channel);
 
+        ret = sysfs_create_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr);
+        if (ret)
+                dev_notice(&dev->device,
+                           "sysfs create ring bin file failed; %d\n", ret);
+
         hv_set_drvdata(dev, pdata);
 
         return 0;
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 75f7fb151f71..987fc5ba6321 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -207,5 +207,6 @@ config USB_ULPI_BUS
 
 config USB_ROLE_SWITCH
         tristate
+        select USB_COMMON
 
 endif # USB_SUPPORT
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 777036ae6367..0a42c5df3c0f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2262,7 +2262,8 @@ int hcd_bus_suspend(struct usb_device *rhdev, pm_message_t msg)
                 hcd->state = HC_STATE_SUSPENDED;
 
                 if (!PMSG_IS_AUTO(msg))
-                        usb_phy_roothub_power_off(hcd->phy_roothub);
+                        usb_phy_roothub_suspend(hcd->self.sysdev,
+                                                hcd->phy_roothub);
 
                 /* Did we race with a root-hub wakeup event? */
                 if (rhdev->do_remote_wakeup) {
@@ -2302,7 +2303,8 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
         }
 
         if (!PMSG_IS_AUTO(msg)) {
-                status = usb_phy_roothub_power_on(hcd->phy_roothub);
+                status = usb_phy_roothub_resume(hcd->self.sysdev,
+                                                hcd->phy_roothub);
                 if (status)
                         return status;
         }
@@ -2344,7 +2346,7 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
                 }
         } else {
                 hcd->state = old_state;
-                usb_phy_roothub_power_off(hcd->phy_roothub);
+                usb_phy_roothub_suspend(hcd->self.sysdev, hcd->phy_roothub);
                 dev_dbg(&rhdev->dev, "bus %s fail, err %d\n",
                                 "resume", status);
                 if (status != -ESHUTDOWN)
@@ -2377,6 +2379,7 @@ void usb_hcd_resume_root_hub (struct usb_hcd *hcd)
 
         spin_lock_irqsave (&hcd_root_hub_lock, flags);
         if (hcd->rh_registered) {
+                pm_wakeup_event(&hcd->self.root_hub->dev, 0);
                 set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
                 queue_work(pm_wq, &hcd->wakeup_work);
         }
@@ -2758,12 +2761,16 @@ int usb_add_hcd(struct usb_hcd *hcd,
         }
 
         if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
-                hcd->phy_roothub = usb_phy_roothub_init(hcd->self.sysdev);
+                hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);
                 if (IS_ERR(hcd->phy_roothub)) {
                         retval = PTR_ERR(hcd->phy_roothub);
-                        goto err_phy_roothub_init;
+                        goto err_phy_roothub_alloc;
                 }
 
+                retval = usb_phy_roothub_init(hcd->phy_roothub);
+                if (retval)
+                        goto err_phy_roothub_alloc;
+
                 retval = usb_phy_roothub_power_on(hcd->phy_roothub);
                 if (retval)
                         goto err_usb_phy_roothub_power_on;
@@ -2936,7 +2943,7 @@ err_create_buf:
         usb_phy_roothub_power_off(hcd->phy_roothub);
 err_usb_phy_roothub_power_on:
         usb_phy_roothub_exit(hcd->phy_roothub);
-err_phy_roothub_init:
+err_phy_roothub_alloc:
         if (hcd->remove_phy && hcd->usb_phy) {
                 usb_phy_shutdown(hcd->usb_phy);
                 usb_put_phy(hcd->usb_phy);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f6ea16e9f6bb..aa9968d90a48 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -653,12 +653,17 @@ void usb_wakeup_notification(struct usb_device *hdev,
                 unsigned int portnum)
 {
         struct usb_hub *hub;
+        struct usb_port *port_dev;
 
         if (!hdev)
                 return;
 
         hub = usb_hub_to_struct_hub(hdev);
         if (hub) {
+                port_dev = hub->ports[portnum - 1];
+                if (port_dev && port_dev->child)
+                        pm_wakeup_event(&port_dev->child->dev, 0);
+
                 set_bit(portnum, hub->wakeup_bits);
                 kick_hub_wq(hub);
         }
@@ -3434,8 +3439,11 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
 
         /* Skip the initial Clear-Suspend step for a remote wakeup */
         status = hub_port_status(hub, port1, &portstatus, &portchange);
-        if (status == 0 && !port_is_suspended(hub, portstatus))
+        if (status == 0 && !port_is_suspended(hub, portstatus)) {
+                if (portchange & USB_PORT_STAT_C_SUSPEND)
+                        pm_wakeup_event(&udev->dev, 0);
                 goto SuspendCleared;
+        }
 
         /* see 7.1.7.7; affects power usage, but not budgeting */
         if (hub_is_superspeed(hub->hdev))
diff --git a/drivers/usb/core/phy.c b/drivers/usb/core/phy.c
index 09b7c43c0ea4..9879767452a2 100644
--- a/drivers/usb/core/phy.c
+++ b/drivers/usb/core/phy.c
@@ -19,19 +19,6 @@ struct usb_phy_roothub {
         struct list_head        list;
 };
 
-static struct usb_phy_roothub *usb_phy_roothub_alloc(struct device *dev)
-{
-        struct usb_phy_roothub *roothub_entry;
-
-        roothub_entry = devm_kzalloc(dev, sizeof(*roothub_entry), GFP_KERNEL);
-        if (!roothub_entry)
-                return ERR_PTR(-ENOMEM);
-
-        INIT_LIST_HEAD(&roothub_entry->list);
-
-        return roothub_entry;
-}
-
 static int usb_phy_roothub_add_phy(struct device *dev, int index,
                                    struct list_head *list)
 {
@@ -45,9 +32,11 @@ static int usb_phy_roothub_add_phy(struct device *dev, int index,
                         return PTR_ERR(phy);
         }
 
-        roothub_entry = usb_phy_roothub_alloc(dev);
-        if (IS_ERR(roothub_entry))
-                return PTR_ERR(roothub_entry);
+        roothub_entry = devm_kzalloc(dev, sizeof(*roothub_entry), GFP_KERNEL);
+        if (!roothub_entry)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&roothub_entry->list);
 
         roothub_entry->phy = phy;
 
@@ -56,28 +45,44 @@ static int usb_phy_roothub_add_phy(struct device *dev, int index,
         return 0;
 }
 
-struct usb_phy_roothub *usb_phy_roothub_init(struct device *dev)
+struct usb_phy_roothub *usb_phy_roothub_alloc(struct device *dev)
 {
         struct usb_phy_roothub *phy_roothub;
-        struct usb_phy_roothub *roothub_entry;
-        struct list_head *head;
         int i, num_phys, err;
 
+        if (!IS_ENABLED(CONFIG_GENERIC_PHY))
+                return NULL;
+
         num_phys = of_count_phandle_with_args(dev->of_node, "phys",
                                               "#phy-cells");
         if (num_phys <= 0)
                 return NULL;
 
-        phy_roothub = usb_phy_roothub_alloc(dev);
-        if (IS_ERR(phy_roothub))
-                return phy_roothub;
+        phy_roothub = devm_kzalloc(dev, sizeof(*phy_roothub), GFP_KERNEL);
+        if (!phy_roothub)
+                return ERR_PTR(-ENOMEM);
+
+        INIT_LIST_HEAD(&phy_roothub->list);
 
         for (i = 0; i < num_phys; i++) {
                 err = usb_phy_roothub_add_phy(dev, i, &phy_roothub->list);
                 if (err)
-                        goto err_out;
+                        return ERR_PTR(err);
         }
 
+        return phy_roothub;
+}
+EXPORT_SYMBOL_GPL(usb_phy_roothub_alloc);
+
+int usb_phy_roothub_init(struct usb_phy_roothub *phy_roothub)
+{
+        struct usb_phy_roothub *roothub_entry;
+        struct list_head *head;
+        int err;
+
+        if (!phy_roothub)
+                return 0;
+
         head = &phy_roothub->list;
 
         list_for_each_entry(roothub_entry, head, list) {
@@ -86,14 +91,13 @@ struct usb_phy_roothub *usb_phy_roothub_init(struct device *dev)
                         goto err_exit_phys;
         }
 
-        return phy_roothub;
+        return 0;
 
 err_exit_phys:
         list_for_each_entry_continue_reverse(roothub_entry, head, list)
                 phy_exit(roothub_entry->phy);
 
-err_out:
-        return ERR_PTR(err);
+        return err;
 }
 EXPORT_SYMBOL_GPL(usb_phy_roothub_init);
 
@@ -111,7 +115,7 @@ int usb_phy_roothub_exit(struct usb_phy_roothub *phy_roothub)
         list_for_each_entry(roothub_entry, head, list) {
                 err = phy_exit(roothub_entry->phy);
                 if (err)
-                        ret = ret;
+                        ret = err;
         }
 
         return ret;
@@ -156,3 +160,38 @@ void usb_phy_roothub_power_off(struct usb_phy_roothub *phy_roothub)
                 phy_power_off(roothub_entry->phy);
 }
 EXPORT_SYMBOL_GPL(usb_phy_roothub_power_off);
+
+int usb_phy_roothub_suspend(struct device *controller_dev,
+                            struct usb_phy_roothub *phy_roothub)
+{
+        usb_phy_roothub_power_off(phy_roothub);
+
+        /* keep the PHYs initialized so the device can wake up the system */
+        if (device_may_wakeup(controller_dev))
+                return 0;
+
+        return usb_phy_roothub_exit(phy_roothub);
+}
+EXPORT_SYMBOL_GPL(usb_phy_roothub_suspend);
+
+int usb_phy_roothub_resume(struct device *controller_dev,
+                           struct usb_phy_roothub *phy_roothub)
+{
+        int err;
+
+        /* if the device can't wake up the system _exit was called */
+        if (!device_may_wakeup(controller_dev)) {
+                err = usb_phy_roothub_init(phy_roothub);
+                if (err)
+                        return err;
+        }
+
+        err = usb_phy_roothub_power_on(phy_roothub);
+
+        /* undo _init if _power_on failed */
+        if (err && !device_may_wakeup(controller_dev))
+                usb_phy_roothub_exit(phy_roothub);
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(usb_phy_roothub_resume);
diff --git a/drivers/usb/core/phy.h b/drivers/usb/core/phy.h
index 6fde59bfbff8..88a3c037e9df 100644
--- a/drivers/usb/core/phy.h
+++ b/drivers/usb/core/phy.h
@@ -1,7 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * USB roothub wrapper
+ *
+ * Copyright (C) 2018 Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+ */
+
+#ifndef __USB_CORE_PHY_H_
+#define __USB_CORE_PHY_H_
+
+struct device;
 struct usb_phy_roothub;
 
-struct usb_phy_roothub *usb_phy_roothub_init(struct device *dev);
+struct usb_phy_roothub *usb_phy_roothub_alloc(struct device *dev);
+
+int usb_phy_roothub_init(struct usb_phy_roothub *phy_roothub);
 int usb_phy_roothub_exit(struct usb_phy_roothub *phy_roothub);
 
 int usb_phy_roothub_power_on(struct usb_phy_roothub *phy_roothub);
 void usb_phy_roothub_power_off(struct usb_phy_roothub *phy_roothub);
+
+int usb_phy_roothub_suspend(struct device *controller_dev,
+                            struct usb_phy_roothub *phy_roothub);
+int usb_phy_roothub_resume(struct device *controller_dev,
+                           struct usb_phy_roothub *phy_roothub);
+
+#endif /* __USB_CORE_PHY_H_ */
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 920f48a49a87..c55def2f1320 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -186,6 +186,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x03f0, 0x0701), .driver_info =
                         USB_QUIRK_STRING_FETCH_255 },
 
+        /* HP v222w 16GB Mini USB Drive */
+        { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 48779c44c361..eb494ec547e8 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -320,9 +320,11 @@ int xhci_dbc_tty_register_driver(struct xhci_hcd *xhci)
 
 void xhci_dbc_tty_unregister_driver(void)
 {
-        tty_unregister_driver(dbc_tty_driver);
-        put_tty_driver(dbc_tty_driver);
-        dbc_tty_driver = NULL;
+        if (dbc_tty_driver) {
+                tty_unregister_driver(dbc_tty_driver);
+                put_tty_driver(dbc_tty_driver);
+                dbc_tty_driver = NULL;
+        }
 }
 
 static void dbc_rx_push(unsigned long _port)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index f17b7eab66cf..85ffda85f8ab 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -126,7 +126,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
 
-        if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb)
+        if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+                (pdev->device == 0x15e0 ||
+                 pdev->device == 0x15e1 ||
+                 pdev->device == 0x43bb))
                 xhci->quirks |= XHCI_SUSPEND_DELAY;
 
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index df327dcc2bac..c1b22fc64e38 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -157,6 +157,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
         struct resource         *res;
         struct usb_hcd          *hcd;
         struct clk              *clk;
+        struct clk              *reg_clk;
         int                     ret;
         int                     irq;
 
@@ -226,17 +227,27 @@ static int xhci_plat_probe(struct platform_device *pdev)
         hcd->rsrc_len = resource_size(res);
 
         /*
-         * Not all platforms have a clk so it is not an error if the
-         * clock does not exists.
+         * Not all platforms have clks so it is not an error if the
+         * clock do not exist.
          */
+        reg_clk = devm_clk_get(&pdev->dev, "reg");
+        if (!IS_ERR(reg_clk)) {
+                ret = clk_prepare_enable(reg_clk);
+                if (ret)
+                        goto put_hcd;
+        } else if (PTR_ERR(reg_clk) == -EPROBE_DEFER) {
+                ret = -EPROBE_DEFER;
+                goto put_hcd;
+        }
+
         clk = devm_clk_get(&pdev->dev, NULL);
         if (!IS_ERR(clk)) {
                 ret = clk_prepare_enable(clk);
                 if (ret)
-                        goto put_hcd;
+                        goto disable_reg_clk;
         } else if (PTR_ERR(clk) == -EPROBE_DEFER) {
                 ret = -EPROBE_DEFER;
-                goto put_hcd;
+                goto disable_reg_clk;
         }
 
         xhci = hcd_to_xhci(hcd);
@@ -252,6 +263,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
         device_wakeup_enable(hcd->self.controller);
 
         xhci->clk = clk;
+        xhci->reg_clk = reg_clk;
         xhci->main_hcd = hcd;
         xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
                         dev_name(&pdev->dev), hcd);
@@ -320,8 +332,10 @@ put_usb3_hcd:
         usb_put_hcd(xhci->shared_hcd);
 
 disable_clk:
-        if (!IS_ERR(clk))
-                clk_disable_unprepare(clk);
+        clk_disable_unprepare(clk);
+
+disable_reg_clk:
+        clk_disable_unprepare(reg_clk);
 
 put_hcd:
         usb_put_hcd(hcd);
@@ -338,6 +352,7 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct usb_hcd  *hcd = platform_get_drvdata(dev);
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
+        struct clk *reg_clk = xhci->reg_clk;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
@@ -347,8 +362,8 @@ static int xhci_plat_remove(struct platform_device *dev)
         usb_remove_hcd(hcd);
         usb_put_hcd(xhci->shared_hcd);
 
-        if (!IS_ERR(clk))
-                clk_disable_unprepare(clk);
+        clk_disable_unprepare(clk);
+        clk_disable_unprepare(reg_clk);
         usb_put_hcd(hcd);
 
         pm_runtime_set_suspended(&dev->dev);
@@ -420,7 +435,6 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
 static struct platform_driver usb_xhci_driver = {
         .probe  = xhci_plat_probe,
         .remove = xhci_plat_remove,
-        .shutdown       = usb_hcd_platform_shutdown,
         .driver = {
                 .name = "xhci-hcd",
                 .pm = &xhci_plat_pm_ops,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 05c909b04f14..6dfc4867dbcf 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1729,8 +1729,9 @@ struct xhci_hcd {
         int             page_shift;
         /* msi-x vectors */
         int             msix_count;
-        /* optional clock */
+        /* optional clocks */
         struct clk              *clk;
+        struct clk              *reg_clk;
         /* data structures */
         struct xhci_device_context_array *dcbaa;
         struct xhci_ring        *cmd_ring;
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 05a679d5e3a2..6a60bc0490c5 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -451,7 +451,6 @@ static int dsps_musb_init(struct musb *musb)
         if (!rev)
                 return -ENODEV;
 
-        usb_phy_init(musb->xceiv);
         if (IS_ERR(musb->phy))  {
                 musb->phy = NULL;
         } else {
@@ -501,7 +500,6 @@ static int dsps_musb_exit(struct musb *musb)
         struct dsps_glue *glue = dev_get_drvdata(dev->parent);
 
         del_timer_sync(&musb->dev_timer);
-        usb_phy_shutdown(musb->xceiv);
         phy_power_off(musb->phy);
         phy_exit(musb->phy);
         debugfs_remove_recursive(glue->dbgfs_root);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 3a8451a15f7f..4fa372c845e1 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2754,6 +2754,7 @@ int musb_host_setup(struct musb *musb, int power_budget)
         hcd->self.otg_port = 1;
         musb->xceiv->otg->host = &hcd->self;
         hcd->power_budget = 2 * (power_budget ? : 250);
+        hcd->skip_phy_initialization = 1;
 
         ret = usb_add_hcd(hcd, 0, 0);
         if (ret < 0)
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index a646820f5a78..533f127c30ad 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -62,6 +62,7 @@ config USB_SERIAL_SIMPLE
                 - Fundamental Software dongle.
                 - Google USB serial devices
                 - HP4x calculators
+                - Libtransistor USB console
                 - a number of Motorola phones
                 - Motorola Tetra devices
                 - Novatel Wireless GPS receivers
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index de1e759dd512..eb6c26cbe579 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -214,6 +214,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
         { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
         { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
+        { USB_DEVICE(0x3923, 0x7A0B) }, /* National Instruments USB Serial Console */
         { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
         { } /* Terminating Entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 87202ad5a50d..7ea221d42dba 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1898,7 +1898,8 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
                 return ftdi_jtag_probe(serial);
 
         if (udev->product &&
-                (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+                (!strcmp(udev->product, "Arrow USB Blaster") ||
+                 !strcmp(udev->product, "BeagleBone/XDS100V2") ||
                  !strcmp(udev->product, "SNAP Connect E10")))
                 return ftdi_jtag_probe(serial);
 
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 4ef79e29cb26..40864c2bd9dc 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -63,6 +63,11 @@ DEVICE(flashloader, FLASHLOADER_IDS);
                                         0x01) }
 DEVICE(google, GOOGLE_IDS);
 
+/* Libtransistor USB console */
+#define LIBTRANSISTOR_IDS()                     \
+        { USB_DEVICE(0x1209, 0x8b00) }
+DEVICE(libtransistor, LIBTRANSISTOR_IDS);
+
 /* ViVOpay USB Serial Driver */
 #define VIVOPAY_IDS()                   \
         { USB_DEVICE(0x1d5f, 0x1004) }  /* ViVOpay 8800 */
@@ -110,6 +115,7 @@ static struct usb_serial_driver * const serial_drivers[] = {
         &funsoft_device,
         &flashloader_device,
         &google_device,
+        &libtransistor_device,
         &vivopay_device,
         &moto_modem_device,
         &motorola_tetra_device,
@@ -126,6 +132,7 @@ static const struct usb_device_id id_table[] = {
         FUNSOFT_IDS(),
         FLASHLOADER_IDS(),
         GOOGLE_IDS(),
+        LIBTRANSISTOR_IDS(),
         VIVOPAY_IDS(),
         MOTO_IDS(),
         MOTOROLA_TETRA_IDS(),
diff --git a/drivers/usb/typec/ucsi/Makefile b/drivers/usb/typec/ucsi/Makefile
index b57891c1fd31..7afbea512207 100644
--- a/drivers/usb/typec/ucsi/Makefile
+++ b/drivers/usb/typec/ucsi/Makefile
@@ -5,6 +5,6 @@ obj-$(CONFIG_TYPEC_UCSI)	+= typec_ucsi.o
 
 typec_ucsi-y                    := ucsi.o
 
-typec_ucsi-$(CONFIG_FTRACE)     += trace.o
+typec_ucsi-$(CONFIG_TRACING)    += trace.o
 
 obj-$(CONFIG_UCSI_ACPI)         += ucsi_acpi.o
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index bf0977fbd100..bd5cca5632b3 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -28,7 +28,7 @@
  * difficult to estimate the time it takes for the system to process the command
  * before it is actually passed to the PPM.
  */
-#define UCSI_TIMEOUT_MS         1000
+#define UCSI_TIMEOUT_MS         5000
 
 /*
  * UCSI_SWAP_TIMEOUT_MS - Timeout for role swap requests
diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index c31c8402a0c5..d41d0cdeec0f 100644
--- a/drivers/usb/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
@@ -186,7 +186,12 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf,
         if (!bid)
                 return -ENODEV;
 
+        /* device_attach() callers should hold parent lock for USB */
+        if (bid->udev->dev.parent)
+                device_lock(bid->udev->dev.parent);
         ret = device_attach(&bid->udev->dev);
+        if (bid->udev->dev.parent)
+                device_unlock(bid->udev->dev.parent);
         if (ret < 0) {
                 dev_err(&bid->udev->dev, "rebind failed\n");
                 return ret;
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index 473fb8a87289..bf8afe9b5883 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -243,7 +243,7 @@ enum usbip_side {
 #define VUDC_EVENT_ERROR_USB    (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
 #define VUDC_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
 
-#define VDEV_EVENT_REMOVED      (USBIP_EH_SHUTDOWN | USBIP_EH_BYE)
+#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_RESET | USBIP_EH_BYE)
 #define VDEV_EVENT_DOWN         (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
 #define VDEV_EVENT_ERROR_TCP    (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
 #define VDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 5b4c0864ad92..5d88917c9631 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -91,10 +91,6 @@ static void event_handler(struct work_struct *work)
                         unset_event(ud, USBIP_EH_UNUSABLE);
                 }
 
-                /* Stop the error handler. */
-                if (ud->event & USBIP_EH_BYE)
-                        usbip_dbg_eh("removed %p\n", ud);
-
                 wake_up(&ud->eh_waitq);
         }
 }
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 20e3d4609583..d11f3f8dad40 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -354,6 +354,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 usbip_dbg_vhci_rh(" ClearHubFeature\n");
                 break;
         case ClearPortFeature:
+                if (rhport < 0)
+                        goto error;
                 switch (wValue) {
                 case USB_PORT_FEAT_SUSPEND:
                         if (hcd->speed == HCD_USB3) {
@@ -511,11 +513,16 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                 goto error;
                         }
 
+                        if (rhport < 0)
+                                goto error;
+
                         vhci_hcd->port_status[rhport] |= USB_PORT_STAT_SUSPEND;
                         break;
                 case USB_PORT_FEAT_POWER:
                         usbip_dbg_vhci_rh(
                                 " SetPortFeature: USB_PORT_FEAT_POWER\n");
+                        if (rhport < 0)
+                                goto error;
                         if (hcd->speed == HCD_USB3)
                                 vhci_hcd->port_status[rhport] |= USB_SS_PORT_STAT_POWER;
                         else
@@ -524,6 +531,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 case USB_PORT_FEAT_BH_PORT_RESET:
                         usbip_dbg_vhci_rh(
                                 " SetPortFeature: USB_PORT_FEAT_BH_PORT_RESET\n");
+                        if (rhport < 0)
+                                goto error;
                         /* Applicable only for USB3.0 hub */
                         if (hcd->speed != HCD_USB3) {
                                 pr_err("USB_PORT_FEAT_BH_PORT_RESET req not "
@@ -534,6 +543,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 case USB_PORT_FEAT_RESET:
                         usbip_dbg_vhci_rh(
                                 " SetPortFeature: USB_PORT_FEAT_RESET\n");
+                        if (rhport < 0)
+                                goto error;
                         /* if it's already enabled, disable */
                         if (hcd->speed == HCD_USB3) {
                                 vhci_hcd->port_status[rhport] = 0;
@@ -554,6 +565,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 default:
                         usbip_dbg_vhci_rh(" SetPortFeature: default %d\n",
                                           wValue);
+                        if (rhport < 0)
+                                goto error;
                         if (hcd->speed == HCD_USB3) {
                                 if ((vhci_hcd->port_status[rhport] &
                                      USB_SS_PORT_STAT_POWER) != 0) {
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 190dbf8cfcb5..2f3856a95856 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -114,7 +114,7 @@ static void vbg_guest_mappings_init(struct vbg_dev *gdev)
         }
 
 out:
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         kfree(pages);
 }
 
@@ -144,7 +144,7 @@ static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
 
         rc = vbg_req_perform(gdev, req);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         if (rc < 0) {
                 vbg_err("%s error: %d\n", __func__, rc);
@@ -214,8 +214,8 @@ static int vbg_report_guest_info(struct vbg_dev *gdev)
         ret = vbg_status_code_to_errno(rc);
 
 out_free:
-        kfree(req2);
-        kfree(req1);
+        vbg_req_free(req2, sizeof(*req2));
+        vbg_req_free(req1, sizeof(*req1));
         return ret;
 }
 
@@ -245,7 +245,7 @@ static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
         if (rc == VERR_NOT_IMPLEMENTED) /* Compatibility with older hosts. */
                 rc = VINF_SUCCESS;
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return vbg_status_code_to_errno(rc);
 }
@@ -431,7 +431,7 @@ static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
         rc = vbg_req_perform(gdev, req);
         do_div(req->interval_ns, 1000000); /* ns -> ms */
         gdev->heartbeat_interval_ms = req->interval_ns;
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return vbg_status_code_to_errno(rc);
 }
@@ -454,12 +454,6 @@ static int vbg_heartbeat_init(struct vbg_dev *gdev)
         if (ret < 0)
                 return ret;
 
-        /*
-         * Preallocate the request to use it from the timer callback because:
-         *    1) on Windows vbg_req_alloc must be called at IRQL <= APC_LEVEL
-         *       and the timer callback runs at DISPATCH_LEVEL;
-         *    2) avoid repeated allocations.
-         */
         gdev->guest_heartbeat_req = vbg_req_alloc(
                                         sizeof(*gdev->guest_heartbeat_req),
                                         VMMDEVREQ_GUEST_HEARTBEAT);
@@ -481,8 +475,8 @@ static void vbg_heartbeat_exit(struct vbg_dev *gdev)
 {
         del_timer_sync(&gdev->heartbeat_timer);
         vbg_heartbeat_host_config(gdev, false);
-        kfree(gdev->guest_heartbeat_req);
-
+        vbg_req_free(gdev->guest_heartbeat_req,
+                     sizeof(*gdev->guest_heartbeat_req));
 }
 
 /**
@@ -543,7 +537,7 @@ static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
         if (rc < 0)
                 vbg_err("%s error, rc: %d\n", __func__, rc);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return vbg_status_code_to_errno(rc);
 }
 
@@ -617,7 +611,7 @@ static int vbg_set_session_event_filter(struct vbg_dev *gdev,
 
 out:
         mutex_unlock(&gdev->session_mutex);
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return ret;
 }
@@ -642,7 +636,7 @@ static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
         if (rc < 0)
                 vbg_err("%s error, rc: %d\n", __func__, rc);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return vbg_status_code_to_errno(rc);
 }
 
@@ -712,7 +706,7 @@ static int vbg_set_session_capabilities(struct vbg_dev *gdev,
 
 out:
         mutex_unlock(&gdev->session_mutex);
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return ret;
 }
@@ -733,8 +727,10 @@ static int vbg_query_host_version(struct vbg_dev *gdev)
 
         rc = vbg_req_perform(gdev, req);
         ret = vbg_status_code_to_errno(rc);
-        if (ret)
+        if (ret) {
+                vbg_err("%s error: %d\n", __func__, rc);
                 goto out;
+        }
 
         snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u",
                  req->major, req->minor, req->build, req->revision);
@@ -749,7 +745,7 @@ static int vbg_query_host_version(struct vbg_dev *gdev)
         }
 
 out:
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return ret;
 }
 
@@ -847,11 +843,16 @@ int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
         return 0;
 
 err_free_reqs:
-        kfree(gdev->mouse_status_req);
-        kfree(gdev->ack_events_req);
-        kfree(gdev->cancel_req);
-        kfree(gdev->mem_balloon.change_req);
-        kfree(gdev->mem_balloon.get_req);
+        vbg_req_free(gdev->mouse_status_req,
+                     sizeof(*gdev->mouse_status_req));
+        vbg_req_free(gdev->ack_events_req,
+                     sizeof(*gdev->ack_events_req));
+        vbg_req_free(gdev->cancel_req,
+                     sizeof(*gdev->cancel_req));
+        vbg_req_free(gdev->mem_balloon.change_req,
+                     sizeof(*gdev->mem_balloon.change_req));
+        vbg_req_free(gdev->mem_balloon.get_req,
+                     sizeof(*gdev->mem_balloon.get_req));
         return ret;
 }
 
@@ -872,11 +873,16 @@ void vbg_core_exit(struct vbg_dev *gdev)
         vbg_reset_host_capabilities(gdev);
         vbg_core_set_mouse_status(gdev, 0);
 
-        kfree(gdev->mouse_status_req);
-        kfree(gdev->ack_events_req);
-        kfree(gdev->cancel_req);
-        kfree(gdev->mem_balloon.change_req);
-        kfree(gdev->mem_balloon.get_req);
+        vbg_req_free(gdev->mouse_status_req,
+                     sizeof(*gdev->mouse_status_req));
+        vbg_req_free(gdev->ack_events_req,
+                     sizeof(*gdev->ack_events_req));
+        vbg_req_free(gdev->cancel_req,
+                     sizeof(*gdev->cancel_req));
+        vbg_req_free(gdev->mem_balloon.change_req,
+                     sizeof(*gdev->mem_balloon.change_req));
+        vbg_req_free(gdev->mem_balloon.get_req,
+                     sizeof(*gdev->mem_balloon.get_req));
 }
 
 /**
@@ -1415,7 +1421,7 @@ static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
         req->flags = dump->u.in.flags;
         dump->hdr.rc = vbg_req_perform(gdev, req);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return 0;
 }
 
@@ -1513,7 +1519,7 @@ int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
         if (rc < 0)
                 vbg_err("%s error, rc: %d\n", __func__, rc);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return vbg_status_code_to_errno(rc);
 }
 
diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h
index 6c784bf4fa6d..7ad9ec45bfa9 100644
--- a/drivers/virt/vboxguest/vboxguest_core.h
+++ b/drivers/virt/vboxguest/vboxguest_core.h
@@ -171,4 +171,13 @@ irqreturn_t vbg_core_isr(int irq, void *dev_id);
 
 void vbg_linux_mouse_event(struct vbg_dev *gdev);
 
+/* Private (non exported) functions form vboxguest_utils.c */
+void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
+void vbg_req_free(void *req, size_t len);
+int vbg_req_perform(struct vbg_dev *gdev, void *req);
+int vbg_hgcm_call32(
+        struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
+        struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
+        int *vbox_status);
+
 #endif
diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
index 82e280d38cc2..398d22693234 100644
--- a/drivers/virt/vboxguest/vboxguest_linux.c
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -87,6 +87,7 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
         struct vbg_session *session = filp->private_data;
         size_t returned_size, size;
         struct vbg_ioctl_hdr hdr;
+        bool is_vmmdev_req;
         int ret = 0;
         void *buf;
 
@@ -106,8 +107,17 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
         if (size > SZ_16M)
                 return -E2BIG;
 
-        /* __GFP_DMA32 because IOCTL_VMMDEV_REQUEST passes this to the host */
-        buf = kmalloc(size, GFP_KERNEL | __GFP_DMA32);
+        /*
+         * IOCTL_VMMDEV_REQUEST needs the buffer to be below 4G to avoid
+         * the need for a bounce-buffer and another copy later on.
+         */
+        is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) ||
+                         req == VBG_IOCTL_VMMDEV_REQUEST_BIG;
+
+        if (is_vmmdev_req)
+                buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT);
+        else
+                buf = kmalloc(size, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
@@ -132,7 +142,10 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
                 ret = -EFAULT;
 
 out:
-        kfree(buf);
+        if (is_vmmdev_req)
+                vbg_req_free(buf, size);
+        else
+                kfree(buf);
 
         return ret;
 }
diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
index 0f0dab8023cf..bf4474214b4d 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -65,8 +65,9 @@ VBG_LOG(vbg_debug, pr_debug);
 void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
 {
         struct vmmdev_request_header *req;
+        int order = get_order(PAGE_ALIGN(len));
 
-        req = kmalloc(len, GFP_KERNEL | __GFP_DMA32);
+        req = (void *)__get_free_pages(GFP_KERNEL | GFP_DMA32, order);
         if (!req)
                 return NULL;
 
@@ -82,6 +83,14 @@ void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
         return req;
 }
 
+void vbg_req_free(void *req, size_t len)
+{
+        if (!req)
+                return;
+
+        free_pages((unsigned long)req, get_order(PAGE_ALIGN(len)));
+}
+
 /* Note this function returns a VBox status code, not a negative errno!! */
 int vbg_req_perform(struct vbg_dev *gdev, void *req)
 {
@@ -137,7 +146,7 @@ int vbg_hgcm_connect(struct vbg_dev *gdev,
                 rc = hgcm_connect->header.result;
         }
 
-        kfree(hgcm_connect);
+        vbg_req_free(hgcm_connect, sizeof(*hgcm_connect));
 
         *vbox_status = rc;
         return 0;
@@ -166,7 +175,7 @@ int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status)
         if (rc >= 0)
                 rc = hgcm_disconnect->header.result;
 
-        kfree(hgcm_disconnect);
+        vbg_req_free(hgcm_disconnect, sizeof(*hgcm_disconnect));
 
         *vbox_status = rc;
         return 0;
@@ -623,7 +632,7 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
         }
 
         if (!leak_it)
-                kfree(call);
+                vbg_req_free(call, size);
 
 free_bounce_bufs:
         if (bounce_bufs) {
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 7e72348639e4..315f7e63e7cc 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -228,7 +228,15 @@ static size_t ceph_vxattrcb_dir_rctime(struct ceph_inode_info *ci, char *val,
 
 static bool ceph_vxattrcb_quota_exists(struct ceph_inode_info *ci)
 {
-        return (ci->i_max_files || ci->i_max_bytes);
+        bool ret = false;
+        spin_lock(&ci->i_ceph_lock);
+        if ((ci->i_max_files || ci->i_max_bytes) &&
+            ci->i_vino.snap == CEPH_NOSNAP &&
+            ci->i_snap_realm &&
+            ci->i_snap_realm->ino == ci->i_vino.ino)
+                ret = true;
+        spin_unlock(&ci->i_ceph_lock);
+        return ret;
 }
 
 static size_t ceph_vxattrcb_quota(struct ceph_inode_info *ci, char *val,
@@ -1008,14 +1016,19 @@ int __ceph_setxattr(struct inode *inode, const char *name,
         char *newval = NULL;
         struct ceph_inode_xattr *xattr = NULL;
         int required_blob_size;
+        bool check_realm = false;
         bool lock_snap_rwsem = false;
 
         if (ceph_snap(inode) != CEPH_NOSNAP)
                 return -EROFS;
 
         vxattr = ceph_match_vxattr(inode, name);
-        if (vxattr && vxattr->readonly)
-                return -EOPNOTSUPP;
+        if (vxattr) {
+                if (vxattr->readonly)
+                        return -EOPNOTSUPP;
+                if (value && !strncmp(vxattr->name, "ceph.quota", 10))
+                        check_realm = true;
+        }
 
         /* pass any unhandled ceph.* xattrs through to the MDS */
         if (!strncmp(name, XATTR_CEPH_PREFIX, XATTR_CEPH_PREFIX_LEN))
@@ -1109,6 +1122,15 @@ do_sync_unlocked:
                 err = -EBUSY;
         } else {
                 err = ceph_sync_setxattr(inode, name, value, size, flags);
+                if (err >= 0 && check_realm) {
+                        /* check if snaprealm was created for quota inode */
+                        spin_lock(&ci->i_ceph_lock);
+                        if ((ci->i_max_files || ci->i_max_bytes) &&
+                            !(ci->i_snap_realm &&
+                              ci->i_snap_realm->ino == ci->i_vino.ino))
+                                err = -EOPNOTSUPP;
+                        spin_unlock(&ci->i_ceph_lock);
+                }
         }
 out:
         ceph_free_cap_flush(prealloc_cf);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 6d3e40d7029c..1529a088383d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -455,6 +455,9 @@ cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required)
                 server->sign = true;
         }
 
+        if (cifs_rdma_enabled(server) && server->sign)
+                cifs_dbg(VFS, "Signing is enabled, and RDMA read/write will be disabled");
+
         return 0;
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e8830f076a7f..a5aa158d535a 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2959,6 +2959,22 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                 }
         }
 
+        if (volume_info->seal) {
+                if (ses->server->vals->protocol_id == 0) {
+                        cifs_dbg(VFS,
+                                 "SMB3 or later required for encryption\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                } else if (tcon->ses->server->capabilities &
+                                        SMB2_GLOBAL_CAP_ENCRYPTION)
+                        tcon->seal = true;
+                else {
+                        cifs_dbg(VFS, "Encryption is not supported on share\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                }
+        }
+
         /*
          * BB Do we need to wrap session_mutex around this TCon call and Unix
          * SetFS as we do on SessSetup and reconnect?
@@ -3007,22 +3023,6 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                 tcon->use_resilient = true;
         }
 
-        if (volume_info->seal) {
-                if (ses->server->vals->protocol_id == 0) {
-                        cifs_dbg(VFS,
-                                 "SMB3 or later required for encryption\n");
-                        rc = -EOPNOTSUPP;
-                        goto out_fail;
-                } else if (tcon->ses->server->capabilities &
-                                        SMB2_GLOBAL_CAP_ENCRYPTION)
-                        tcon->seal = true;
-                else {
-                        cifs_dbg(VFS, "Encryption is not supported on share\n");
-                        rc = -EOPNOTSUPP;
-                        goto out_fail;
-                }
-        }
-
         /*
          * We can have only one retry value for a connection to a share so for
          * resources mounted more than once to the same server share the last
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 38ebf3f357d2..b76b85881dcc 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -252,9 +252,14 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         wsize = volume_info->wsize ? volume_info->wsize : CIFS_DEFAULT_IOSIZE;
         wsize = min_t(unsigned int, wsize, server->max_write);
 #ifdef CONFIG_CIFS_SMB_DIRECT
-        if (server->rdma)
-                wsize = min_t(unsigned int,
+        if (server->rdma) {
+                if (server->sign)
+                        wsize = min_t(unsigned int,
+                                wsize, server->smbd_conn->max_fragmented_send_size);
+                else
+                        wsize = min_t(unsigned int,
                                 wsize, server->smbd_conn->max_readwrite_size);
+        }
 #endif
         if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
                 wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE);
@@ -272,9 +277,14 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         rsize = volume_info->rsize ? volume_info->rsize : CIFS_DEFAULT_IOSIZE;
         rsize = min_t(unsigned int, rsize, server->max_read);
 #ifdef CONFIG_CIFS_SMB_DIRECT
-        if (server->rdma)
-                rsize = min_t(unsigned int,
+        if (server->rdma) {
+                if (server->sign)
+                        rsize = min_t(unsigned int,
+                                rsize, server->smbd_conn->max_fragmented_recv_size);
+                else
+                        rsize = min_t(unsigned int,
                                 rsize, server->smbd_conn->max_readwrite_size);
+        }
 #endif
 
         if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 0f044c4a2dc9..60db51bae0e3 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -383,10 +383,10 @@ static void
 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
 {
         pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
-        pneg_ctxt->DataLength = cpu_to_le16(6);
-        pneg_ctxt->CipherCount = cpu_to_le16(2);
-        pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
-        pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM;
+        pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + le16 cipher */
+        pneg_ctxt->CipherCount = cpu_to_le16(1);
+/* pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;*/ /* not supported yet */
+        pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_CCM;
 }
 
 static void
@@ -444,6 +444,7 @@ static int decode_encrypt_ctx(struct TCP_Server_Info *server,
                 return -EINVAL;
         }
         server->cipher_type = ctxt->Ciphers[0];
+        server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
         return 0;
 }
 
@@ -2590,7 +2591,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len,
          * If we want to do a RDMA write, fill in and append
          * smbd_buffer_descriptor_v1 to the end of read request
          */
-        if (server->rdma && rdata &&
+        if (server->rdma && rdata && !server->sign &&
                 rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) {
 
                 struct smbd_buffer_descriptor_v1 *v1;
@@ -2968,7 +2969,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
          * If we want to do a server RDMA read, fill in and append
          * smbd_buffer_descriptor_v1 to the end of write request
          */
-        if (server->rdma && wdata->bytes >=
+        if (server->rdma && !server->sign && wdata->bytes >=
                 server->smbd_conn->rdma_readwrite_threshold) {
 
                 struct smbd_buffer_descriptor_v1 *v1;
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 6093e5142b2b..d28f358022c5 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -297,7 +297,7 @@ struct smb2_encryption_neg_context {
         __le16  DataLength;
         __le32  Reserved;
         __le16  CipherCount; /* AES-128-GCM and AES-128-CCM */
-        __le16  Ciphers[2]; /* Ciphers[0] since only one used now */
+        __le16  Ciphers[1]; /* Ciphers[0] since only one used now */
 } __packed;
 
 struct smb2_negotiate_rsp {
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
index 87817ddcc096..c62f7c95683c 100644
--- a/fs/cifs/smbdirect.c
+++ b/fs/cifs/smbdirect.c
@@ -2086,7 +2086,7 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
         int start, i, j;
         int max_iov_size =
                 info->max_send_size - sizeof(struct smbd_data_transfer);
-        struct kvec iov[SMBDIRECT_MAX_SGE];
+        struct kvec *iov;
         int rc;
 
         info->smbd_send_pending++;
@@ -2096,32 +2096,20 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
         }
 
         /*
-         * This usually means a configuration error
-         * We use RDMA read/write for packet size > rdma_readwrite_threshold
-         * as long as it's properly configured we should never get into this
-         * situation
-         */
-        if (rqst->rq_nvec + rqst->rq_npages > SMBDIRECT_MAX_SGE) {
-                log_write(ERR, "maximum send segment %x exceeding %x\n",
-                         rqst->rq_nvec + rqst->rq_npages, SMBDIRECT_MAX_SGE);
-                rc = -EINVAL;
-                goto done;
-        }
-
-        /*
-         * Remove the RFC1002 length defined in MS-SMB2 section 2.1
-         * It is used only for TCP transport
+         * Skip the RFC1002 length defined in MS-SMB2 section 2.1
+         * It is used only for TCP transport in the iov[0]
          * In future we may want to add a transport layer under protocol
          * layer so this will only be issued to TCP transport
          */
-        iov[0].iov_base = (char *)rqst->rq_iov[0].iov_base + 4;
-        iov[0].iov_len = rqst->rq_iov[0].iov_len - 4;
-        buflen += iov[0].iov_len;
+
+        if (rqst->rq_iov[0].iov_len != 4) {
+                log_write(ERR, "expected the pdu length in 1st iov, but got %zu\n", rqst->rq_iov[0].iov_len);
+                return -EINVAL;
+        }
+        iov = &rqst->rq_iov[1];
 
         /* total up iov array first */
-        for (i = 1; i < rqst->rq_nvec; i++) {
-                iov[i].iov_base = rqst->rq_iov[i].iov_base;
-                iov[i].iov_len = rqst->rq_iov[i].iov_len;
+        for (i = 0; i < rqst->rq_nvec-1; i++) {
                 buflen += iov[i].iov_len;
         }
 
@@ -2198,14 +2186,14 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
                                                 goto done;
                                 }
                                 i++;
-                                if (i == rqst->rq_nvec)
+                                if (i == rqst->rq_nvec-1)
                                         break;
                         }
                         start = i;
                         buflen = 0;
                 } else {
                         i++;
-                        if (i == rqst->rq_nvec) {
+                        if (i == rqst->rq_nvec-1) {
                                 /* send out all remaining vecs */
                                 remaining_data_length -= buflen;
                                 log_write(INFO,
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 8f6f25918229..927226a2122f 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -753,7 +753,7 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
                 goto out;
 
 #ifdef CONFIG_CIFS_SMB311
-        if (ses->status == CifsNew)
+        if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
                 smb311_update_preauth_hash(ses, rqst->rq_iov+1,
                                            rqst->rq_nvec-1);
 #endif
@@ -798,7 +798,7 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
                 *resp_buf_type = CIFS_SMALL_BUFFER;
 
 #ifdef CONFIG_CIFS_SMB311
-        if (ses->status == CifsNew) {
+        if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
                 struct kvec iov = {
                         .iov_base = buf + 4,
                         .iov_len = get_rfc1002_length(buf)
@@ -834,8 +834,11 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
                 new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1),
                                   GFP_KERNEL);
-                if (!new_iov)
+                if (!new_iov) {
+                        /* otherwise cifs_send_recv below sets resp_buf_type */
+                        *resp_buf_type = CIFS_NO_BUFFER;
                         return -ENOMEM;
+                }
         } else
                 new_iov = s_iov;
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index a33d8fb1bf2a..508b905d744d 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -321,6 +321,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         struct ext4_sb_info *sbi = EXT4_SB(sb);
         ext4_grpblk_t offset;
         ext4_grpblk_t next_zero_bit;
+        ext4_grpblk_t max_bit = EXT4_CLUSTERS_PER_GROUP(sb);
         ext4_fsblk_t blk;
         ext4_fsblk_t group_first_block;
 
@@ -338,7 +339,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         /* check whether block bitmap block number is set */
         blk = ext4_block_bitmap(sb, desc);
         offset = blk - group_first_block;
-        if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+        if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
             !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
                 /* bad block bitmap */
                 return blk;
@@ -346,7 +347,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         /* check whether the inode bitmap block number is set */
         blk = ext4_inode_bitmap(sb, desc);
         offset = blk - group_first_block;
-        if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+        if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
             !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
                 /* bad block bitmap */
                 return blk;
@@ -354,8 +355,8 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         /* check whether the inode table block number is set */
         blk = ext4_inode_table(sb, desc);
         offset = blk - group_first_block;
-        if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
-            EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= sb->s_blocksize)
+        if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
+            EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= max_bit)
                 return blk;
         next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
                         EXT4_B2C(sbi, offset + sbi->s_itb_per_group),
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 0a7315961bac..c969275ce3ee 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5329,8 +5329,9 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
         stop = le32_to_cpu(extent->ee_block);
 
        /*
-         * In case of left shift, Don't start shifting extents until we make
-         * sure the hole is big enough to accommodate the shift.
+        * For left shifts, make sure the hole on the left is big enough to
+        * accommodate the shift.  For right shifts, make sure the last extent
+        * won't be shifted beyond EXT_MAX_BLOCKS.
         */
         if (SHIFT == SHIFT_LEFT) {
                 path = ext4_find_extent(inode, start - 1, &path,
@@ -5350,9 +5351,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
 
                 if ((start == ex_start && shift > ex_start) ||
                     (shift > start - ex_end)) {
-                        ext4_ext_drop_refs(path);
-                        kfree(path);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
+                }
+        } else {
+                if (shift > EXT_MAX_BLOCKS -
+                    (stop + ext4_ext_get_actual_len(extent))) {
+                        ret = -EINVAL;
+                        goto out;
                 }
         }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 185f7e61f4cf..eb104e8476f0 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5886,5 +5886,6 @@ static void __exit ext4_exit_fs(void)
 MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
 MODULE_DESCRIPTION("Fourth Extended Filesystem");
 MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: crc32c");
 module_init(ext4_init_fs)
 module_exit(ext4_exit_fs)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ac311037d7a5..8aa453784402 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -532,6 +532,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
          */
         ret = start_this_handle(journal, handle, GFP_NOFS);
         if (ret < 0) {
+                handle->h_journal = journal;
                 jbd2_journal_free_reserved(handle);
                 return ret;
         }
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 278841c75b97..af240573e482 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -188,7 +188,7 @@
 #endif
 
 #ifdef CONFIG_SERIAL_EARLYCON
-#define EARLYCON_TABLE() STRUCT_ALIGN();                        \
+#define EARLYCON_TABLE() . = ALIGN(8);                          \
                          VMLINUX_SYMBOL(__earlycon_table) = .;  \
                          KEEP(*(__earlycon_table))              \
                          VMLINUX_SYMBOL(__earlycon_table_end) = .;
diff --git a/include/kvm/arm_psci.h b/include/kvm/arm_psci.h
index e518e4e3dfb5..4b1548129fa2 100644
--- a/include/kvm/arm_psci.h
+++ b/include/kvm/arm_psci.h
@@ -37,10 +37,15 @@ static inline int kvm_psci_version(struct kvm_vcpu *vcpu, struct kvm *kvm)
          * Our PSCI implementation stays the same across versions from
          * v0.2 onward, only adding the few mandatory functions (such
          * as FEATURES with 1.0) that are required by newer
-         * revisions. It is thus safe to return the latest.
+         * revisions. It is thus safe to return the latest, unless
+         * userspace has instructed us otherwise.
          */
-        if (test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features))
+        if (test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features)) {
+                if (vcpu->kvm->arch.psci_version)
+                        return vcpu->kvm->arch.psci_version;
+
                 return KVM_ARM_PSCI_LATEST;
+        }
 
         return KVM_ARM_PSCI_0_1;
 }
@@ -48,4 +53,11 @@ static inline int kvm_psci_version(struct kvm_vcpu *vcpu, struct kvm *kvm)
 
 int kvm_hvc_call_handler(struct kvm_vcpu *vcpu);
 
+struct kvm_one_reg;
+
+int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu);
+int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices);
+int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg);
+int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg);
+
 #endif /* __KVM_ARM_PSCI_H__ */
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index e3986f4b3461..ebc34a5686dc 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -9,6 +9,9 @@
 struct blk_mq_tags;
 struct blk_flush_queue;
 
+/**
+ * struct blk_mq_hw_ctx - State for a hardware queue facing the hardware block device
+ */
 struct blk_mq_hw_ctx {
         struct {
                 spinlock_t              lock;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 9af3e0f430bc..5c4eee043191 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -605,6 +605,11 @@ struct request_queue {
          * initialized by the low level device driver (e.g. scsi/sd.c).
          * Stacking drivers (device mappers) may or may not initialize
          * these fields.
+         *
+         * Reads of this information must be protected with blk_queue_enter() /
+         * blk_queue_exit(). Modifying this information is only allowed while
+         * no requests are being processed. See also blk_mq_freeze_queue() and
+         * blk_mq_unfreeze_queue().
          */
         unsigned int            nr_zones;
         unsigned long           *seq_zones_bitmap;
@@ -737,6 +742,7 @@ bool blk_queue_flag_test_and_clear(unsigned int flag, struct request_queue *q);
 #define blk_queue_quiesced(q)   test_bit(QUEUE_FLAG_QUIESCED, &(q)->queue_flags)
 #define blk_queue_preempt_only(q)                               \
         test_bit(QUEUE_FLAG_PREEMPT_ONLY, &(q)->queue_flags)
+#define blk_queue_fua(q)        test_bit(QUEUE_FLAG_FUA, &(q)->queue_flags)
 
 extern int blk_set_preempt_only(struct request_queue *q);
 extern void blk_clear_preempt_only(struct request_queue *q);
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 95a7abd0ee92..486e65e3db26 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -339,8 +339,8 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
 void bpf_prog_array_delete_safe(struct bpf_prog_array __rcu *progs,
                                 struct bpf_prog *old_prog);
 int bpf_prog_array_copy_info(struct bpf_prog_array __rcu *array,
-                             __u32 __user *prog_ids, u32 request_cnt,
-                             __u32 __user *prog_cnt);
+                             u32 *prog_ids, u32 request_cnt,
+                             u32 *prog_cnt);
 int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
                         struct bpf_prog *exclude_prog,
                         struct bpf_prog *include_prog,
diff --git a/include/linux/device.h b/include/linux/device.h
index 0059b99e1f25..477956990f5e 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -256,7 +256,9 @@ enum probe_type {
  *              automatically.
  * @pm:         Power management operations of the device which matched
  *              this driver.
- * @coredump:   Called through sysfs to initiate a device coredump.
+ * @coredump:   Called when sysfs entry is written to. The device driver
+ *              is expected to call the dev_coredump API resulting in a
+ *              uevent.
  * @p:          Driver core's private data, no one other than the driver
  *              core can touch this.
  *
@@ -288,7 +290,7 @@ struct device_driver {
         const struct attribute_group **groups;
 
         const struct dev_pm_ops *pm;
-        int (*coredump) (struct device *dev);
+        void (*coredump) (struct device *dev);
 
         struct driver_private *p;
 };
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index ebe41811ed34..b32cd2062f18 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -310,6 +310,8 @@ bool ethtool_convert_link_mode_to_legacy_u32(u32 *legacy_u32,
  *      fields should be ignored (use %__ETHTOOL_LINK_MODE_MASK_NBITS
  *      instead of the latter), any change to them will be overwritten
  *      by kernel. Returns a negative error code or zero.
+ * @get_fecparam: Get the network device Forward Error Correction parameters.
+ * @set_fecparam: Set the network device Forward Error Correction parameters.
  *
  * All operations are optional (i.e. the function pointer may be set
  * to %NULL) and callers must take this into account.  Callers must
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index e0c95c9f1e29..e64c0294f50b 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -217,12 +217,10 @@ struct fsnotify_mark_connector {
         union { /* Object pointer [lock] */
                 struct inode *inode;
                 struct vfsmount *mnt;
-        };
-        union {
-                struct hlist_head list;
                 /* Used listing heads to free after srcu period expires */
                 struct fsnotify_mark_connector *destroy_next;
         };
+        struct hlist_head list;
 };
 
 /*
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index a2656c3ebe81..3892e9c8b2de 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -161,9 +161,11 @@ struct hrtimer_clock_base {
 enum  hrtimer_base_type {
         HRTIMER_BASE_MONOTONIC,
         HRTIMER_BASE_REALTIME,
+        HRTIMER_BASE_BOOTTIME,
         HRTIMER_BASE_TAI,
         HRTIMER_BASE_MONOTONIC_SOFT,
         HRTIMER_BASE_REALTIME_SOFT,
+        HRTIMER_BASE_BOOTTIME_SOFT,
         HRTIMER_BASE_TAI_SOFT,
         HRTIMER_MAX_CLOCK_BASES,
 };
diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h
index b63fa457febd..3529683f691e 100644
--- a/include/linux/mtd/flashchip.h
+++ b/include/linux/mtd/flashchip.h
@@ -85,6 +85,7 @@ struct flchip {
         unsigned int write_suspended:1;
         unsigned int erase_suspended:1;
         unsigned long in_progress_block_addr;
+        unsigned long in_progress_block_mask;
 
         struct mutex mutex;
         wait_queue_head_t wq; /* Wait on here when we're waiting for the chip
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index 1d356105f25a..b4c9fda9d833 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -351,10 +351,10 @@ struct earlycon_id {
         char    name[16];
         char    compatible[128];
         int     (*setup)(struct earlycon_device *, const char *options);
-} __aligned(32);
+};
 
-extern const struct earlycon_id __earlycon_table[];
-extern const struct earlycon_id __earlycon_table_end[];
+extern const struct earlycon_id *__earlycon_table[];
+extern const struct earlycon_id *__earlycon_table_end[];
 
 #if defined(CONFIG_SERIAL_EARLYCON) && !defined(MODULE)
 #define EARLYCON_USED_OR_UNUSED __used
@@ -362,12 +362,19 @@ extern const struct earlycon_id __earlycon_table_end[];
 #define EARLYCON_USED_OR_UNUSED __maybe_unused
 #endif
 
-#define OF_EARLYCON_DECLARE(_name, compat, fn)                          \
-        static const struct earlycon_id __UNIQUE_ID(__earlycon_##_name) \
-             EARLYCON_USED_OR_UNUSED __section(__earlycon_table)        \
+#define _OF_EARLYCON_DECLARE(_name, compat, fn, unique_id)              \
+        static const struct earlycon_id unique_id                       \
+             EARLYCON_USED_OR_UNUSED __initconst                        \
                 = { .name = __stringify(_name),                         \
                     .compatible = compat,                               \
-                    .setup = fn  }
+                    .setup = fn  };                                     \
+        static const struct earlycon_id EARLYCON_USED_OR_UNUSED         \
+                __section(__earlycon_table)                             \
+                * const __PASTE(__p, unique_id) = &unique_id
+
+#define OF_EARLYCON_DECLARE(_name, compat, fn)                          \
+        _OF_EARLYCON_DECLARE(_name, compat, fn,                         \
+                             __UNIQUE_ID(__earlycon_##_name))
 
 #define EARLYCON_DECLARE(_name, fn)     OF_EARLYCON_DECLARE(_name, "", fn)
 
diff --git a/include/linux/stringhash.h b/include/linux/stringhash.h
index e8f0f852968f..c0c5c5b73dc0 100644
--- a/include/linux/stringhash.h
+++ b/include/linux/stringhash.h
@@ -50,9 +50,9 @@ partial_name_hash(unsigned long c, unsigned long prevhash)
  * losing bits).  This also has the property (wanted by the dcache)
  * that the msbits make a good hash table index.
  */
-static inline unsigned long end_name_hash(unsigned long hash)
+static inline unsigned int end_name_hash(unsigned long hash)
 {
-        return __hash_32((unsigned int)hash);
+        return hash_long(hash, 32);
 }
 
 /*
diff --git a/include/linux/ti-emif-sram.h b/include/linux/ti-emif-sram.h
index 45bc6b376492..53604b087f2c 100644
--- a/include/linux/ti-emif-sram.h
+++ b/include/linux/ti-emif-sram.h
@@ -60,6 +60,81 @@ struct ti_emif_pm_functions {
         u32 abort_sr;
 } __packed __aligned(8);
 
+static inline void ti_emif_asm_offsets(void)
+{
+        DEFINE(EMIF_SDCFG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_sdcfg_val));
+        DEFINE(EMIF_TIMING1_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing1_val));
+        DEFINE(EMIF_TIMING2_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing2_val));
+        DEFINE(EMIF_TIMING3_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing3_val));
+        DEFINE(EMIF_REF_CTRL_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ref_ctrl_val));
+        DEFINE(EMIF_ZQCFG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_zqcfg_val));
+        DEFINE(EMIF_PMCR_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_pmcr_val));
+        DEFINE(EMIF_PMCR_SHDW_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_pmcr_shdw_val));
+        DEFINE(EMIF_RD_WR_LEVEL_RAMP_CTRL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_rd_wr_level_ramp_ctrl));
+        DEFINE(EMIF_RD_WR_EXEC_THRESH_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_rd_wr_exec_thresh));
+        DEFINE(EMIF_COS_CONFIG_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_cos_config));
+        DEFINE(EMIF_PRIORITY_TO_COS_MAPPING_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_priority_to_cos_mapping));
+        DEFINE(EMIF_CONNECT_ID_SERV_1_MAP_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_connect_id_serv_1_map));
+        DEFINE(EMIF_CONNECT_ID_SERV_2_MAP_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_connect_id_serv_2_map));
+        DEFINE(EMIF_OCP_CONFIG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ocp_config_val));
+        DEFINE(EMIF_LPDDR2_NVM_TIM_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim));
+        DEFINE(EMIF_LPDDR2_NVM_TIM_SHDW_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim_shdw));
+        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val));
+        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_SHDW_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val_shdw));
+        DEFINE(EMIF_DDR_PHY_CTLR_1_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ddr_phy_ctlr_1));
+        DEFINE(EMIF_EXT_PHY_CTRL_VALS_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ext_phy_ctrl_vals));
+        DEFINE(EMIF_REGS_AMX3_SIZE, sizeof(struct emif_regs_amx3));
+
+        BLANK();
+
+        DEFINE(EMIF_PM_BASE_ADDR_VIRT_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_virt));
+        DEFINE(EMIF_PM_BASE_ADDR_PHYS_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_phys));
+        DEFINE(EMIF_PM_CONFIG_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_sram_config));
+        DEFINE(EMIF_PM_REGS_VIRT_OFFSET,
+               offsetof(struct ti_emif_pm_data, regs_virt));
+        DEFINE(EMIF_PM_REGS_PHYS_OFFSET,
+               offsetof(struct ti_emif_pm_data, regs_phys));
+        DEFINE(EMIF_PM_DATA_SIZE, sizeof(struct ti_emif_pm_data));
+
+        BLANK();
+
+        DEFINE(EMIF_PM_SAVE_CONTEXT_OFFSET,
+               offsetof(struct ti_emif_pm_functions, save_context));
+        DEFINE(EMIF_PM_RESTORE_CONTEXT_OFFSET,
+               offsetof(struct ti_emif_pm_functions, restore_context));
+        DEFINE(EMIF_PM_ENTER_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, enter_sr));
+        DEFINE(EMIF_PM_EXIT_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, exit_sr));
+        DEFINE(EMIF_PM_ABORT_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, abort_sr));
+        DEFINE(EMIF_PM_FUNCTIONS_SIZE, sizeof(struct ti_emif_pm_functions));
+}
+
 struct gen_pool;
 
 int ti_emif_copy_pm_function_table(struct gen_pool *sram_pool, void *dst);
diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h
index 4b3dca173e89..7acb953298a7 100644
--- a/include/linux/timekeeper_internal.h
+++ b/include/linux/timekeeper_internal.h
@@ -52,7 +52,6 @@ struct tk_read_base {
  * @offs_real:          Offset clock monotonic -> clock realtime
  * @offs_boot:          Offset clock monotonic -> clock boottime
  * @offs_tai:           Offset clock monotonic -> clock tai
- * @time_suspended:     Accumulated suspend time
  * @tai_offset:         The current UTC to TAI offset in seconds
  * @clock_was_set_seq:  The sequence number of clock was set events
  * @cs_was_changed_seq: The sequence number of clocksource change events
@@ -95,7 +94,6 @@ struct timekeeper {
         ktime_t                 offs_real;
         ktime_t                 offs_boot;
         ktime_t                 offs_tai;
-        ktime_t                 time_suspended;
         s32                     tai_offset;
         unsigned int            clock_was_set_seq;
         u8                      cs_was_changed_seq;
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 9737fbec7019..588a0e4b1ab9 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -33,25 +33,20 @@ extern void ktime_get_ts64(struct timespec64 *ts);
 extern time64_t ktime_get_seconds(void);
 extern time64_t __ktime_get_real_seconds(void);
 extern time64_t ktime_get_real_seconds(void);
-extern void ktime_get_active_ts64(struct timespec64 *ts);
 
 extern int __getnstimeofday64(struct timespec64 *tv);
 extern void getnstimeofday64(struct timespec64 *tv);
 extern void getboottime64(struct timespec64 *ts);
 
-#define ktime_get_real_ts64(ts)         getnstimeofday64(ts)
-
-/* Clock BOOTTIME compatibility wrappers */
-static inline void get_monotonic_boottime64(struct timespec64 *ts)
-{
-        ktime_get_ts64(ts);
-}
+#define ktime_get_real_ts64(ts) getnstimeofday64(ts)
 
 /*
  * ktime_t based interfaces
  */
+
 enum tk_offsets {
         TK_OFFS_REAL,
+        TK_OFFS_BOOT,
         TK_OFFS_TAI,
         TK_OFFS_MAX,
 };
@@ -62,10 +57,6 @@ extern ktime_t ktime_mono_to_any(ktime_t tmono, enum tk_offsets offs);
 extern ktime_t ktime_get_raw(void);
 extern u32 ktime_get_resolution_ns(void);
 
-/* Clock BOOTTIME compatibility wrappers */
-static inline ktime_t ktime_get_boottime(void) { return ktime_get(); }
-static inline u64 ktime_get_boot_ns(void) { return ktime_get(); }
-
 /**
  * ktime_get_real - get the real (wall-) time in ktime_t format
  */
@@ -75,6 +66,17 @@ static inline ktime_t ktime_get_real(void)
 }
 
 /**
+ * ktime_get_boottime - Returns monotonic time since boot in ktime_t format
+ *
+ * This is similar to CLOCK_MONTONIC/ktime_get, but also includes the
+ * time spent in suspend.
+ */
+static inline ktime_t ktime_get_boottime(void)
+{
+        return ktime_get_with_offset(TK_OFFS_BOOT);
+}
+
+/**
  * ktime_get_clocktai - Returns the TAI time of day in ktime_t format
  */
 static inline ktime_t ktime_get_clocktai(void)
@@ -100,6 +102,11 @@ static inline u64 ktime_get_real_ns(void)
         return ktime_to_ns(ktime_get_real());
 }
 
+static inline u64 ktime_get_boot_ns(void)
+{
+        return ktime_to_ns(ktime_get_boottime());
+}
+
 static inline u64 ktime_get_tai_ns(void)
 {
         return ktime_to_ns(ktime_get_clocktai());
@@ -112,11 +119,17 @@ static inline u64 ktime_get_raw_ns(void)
 
 extern u64 ktime_get_mono_fast_ns(void);
 extern u64 ktime_get_raw_fast_ns(void);
+extern u64 ktime_get_boot_fast_ns(void);
 extern u64 ktime_get_real_fast_ns(void);
 
 /*
  * timespec64 interfaces utilizing the ktime based ones
  */
+static inline void get_monotonic_boottime64(struct timespec64 *ts)
+{
+        *ts = ktime_to_timespec64(ktime_get_boottime());
+}
+
 static inline void timekeeping_clocktai64(struct timespec64 *ts)
 {
         *ts = ktime_to_timespec64(ktime_get_clocktai());
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 47f8af22f216..1dd587ba6d88 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -701,7 +701,7 @@ extern int tty_unregister_ldisc(int disc);
 extern int tty_set_ldisc(struct tty_struct *tty, int disc);
 extern int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty);
 extern void tty_ldisc_release(struct tty_struct *tty);
-extern void tty_ldisc_init(struct tty_struct *tty);
+extern int __must_check tty_ldisc_init(struct tty_struct *tty);
 extern void tty_ldisc_deinit(struct tty_struct *tty);
 extern int tty_ldisc_receive_buf(struct tty_ldisc *ld, const unsigned char *p,
                                  char *f, int count);
diff --git a/include/linux/vbox_utils.h b/include/linux/vbox_utils.h
index c71def6b310f..a240ed2a0372 100644
--- a/include/linux/vbox_utils.h
+++ b/include/linux/vbox_utils.h
@@ -24,24 +24,6 @@ __printf(1, 2) void vbg_debug(const char *fmt, ...);
 #define vbg_debug pr_debug
 #endif
 
-/**
- * Allocate memory for generic request and initialize the request header.
- *
- * Return: the allocated memory
- * @len:                Size of memory block required for the request.
- * @req_type:           The generic request type.
- */
-void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
-
-/**
- * Perform a generic request.
- *
- * Return: VBox status code
- * @gdev:               The Guest extension device.
- * @req:                Pointer to the request structure.
- */
-int vbg_req_perform(struct vbg_dev *gdev, void *req);
-
 int vbg_hgcm_connect(struct vbg_dev *gdev,
                      struct vmmdev_hgcm_service_location *loc,
                      u32 *client_id, int *vbox_status);
@@ -52,11 +34,6 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
                   u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
                   u32 parm_count, int *vbox_status);
 
-int vbg_hgcm_call32(
-        struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
-        struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
-        int *vbox_status);
-
 /**
  * Convert a VirtualBox status code to a standard Linux kernel return value.
  * Return: 0 or negative errno value.
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 988c7355bc22..fa1b5da2804e 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -157,6 +157,9 @@ int virtio_device_freeze(struct virtio_device *dev);
 int virtio_device_restore(struct virtio_device *dev);
 #endif
 
+#define virtio_device_for_each_vq(vdev, vq) \
+        list_for_each_entry(vq, &vdev->vqs, list)
+
 /**
  * virtio_driver - operations for a virtio I/O driver
  * @driver: underlying device driver (populate name and owner).
diff --git a/include/net/ife.h b/include/net/ife.h
index 44b9c00f7223..e117617e3c34 100644
--- a/include/net/ife.h
+++ b/include/net/ife.h
@@ -12,7 +12,8 @@
 void *ife_encode(struct sk_buff *skb, u16 metalen);
 void *ife_decode(struct sk_buff *skb, u16 *metalen);
 
-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen);
+void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
+                          u16 *dlen, u16 *totlen);
 int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen,
                         const void *dval);
 
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index 5c40f118c0fa..df528a623548 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -97,6 +97,7 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb)
 
 struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority,
                           struct proto *prot, int kern);
+void llc_sk_stop_all_timers(struct sock *sk, bool sync);
 void llc_sk_free(struct sock *sk);
 
 void llc_sk_reset(struct sock *sk);
diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h
index 04e0679767f6..e03bd9d41fa8 100644
--- a/include/scsi/scsi_dbg.h
+++ b/include/scsi/scsi_dbg.h
@@ -11,8 +11,6 @@ struct scsi_sense_hdr;
 extern void scsi_print_command(struct scsi_cmnd *);
 extern size_t __scsi_format_command(char *, size_t,
                                    const unsigned char *, size_t);
-extern void scsi_show_extd_sense(const struct scsi_device *, const char *,
-                                 unsigned char, unsigned char);
 extern void scsi_print_sense_hdr(const struct scsi_device *, const char *,
                                  const struct scsi_sense_hdr *);
 extern void scsi_print_sense(const struct scsi_cmnd *);
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 50df5b28d2c9..8ee8991aa099 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -143,13 +143,13 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
 static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
                                         void *data, size_t len)
 {
-        return 0;
+        return -ENOSYS;
 }
 
 static inline int rpi_firmware_property_list(struct rpi_firmware *fw,
                                              void *data, size_t tag_size)
 {
-        return 0;
+        return -ENOSYS;
 }
 
 static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
diff --git a/include/sound/control.h b/include/sound/control.h
index ca13a44ae9d4..6011a58d3e20 100644
--- a/include/sound/control.h
+++ b/include/sound/control.h
@@ -23,6 +23,7 @@
  */
 
 #include <linux/wait.h>
+#include <linux/nospec.h>
 #include <sound/asound.h>
 
 #define snd_kcontrol_chip(kcontrol) ((kcontrol)->private_data)
@@ -148,12 +149,14 @@ int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type);
 
 static inline unsigned int snd_ctl_get_ioffnum(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
 {
-        return id->numid - kctl->id.numid;
+        unsigned int ioff = id->numid - kctl->id.numid;
+        return array_index_nospec(ioff, kctl->count);
 }
 
 static inline unsigned int snd_ctl_get_ioffidx(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
 {
-        return id->index - kctl->id.index;
+        unsigned int ioff = id->index - kctl->id.index;
+        return array_index_nospec(ioff, kctl->count);
 }
 
 static inline unsigned int snd_ctl_get_ioff(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
diff --git a/include/trace/events/ufs.h b/include/trace/events/ufs.h
index bf6f82673492..f8260e5c79ad 100644
--- a/include/trace/events/ufs.h
+++ b/include/trace/events/ufs.h
@@ -257,6 +257,33 @@ TRACE_EVENT(ufshcd_command,
         )
 );
 
+TRACE_EVENT(ufshcd_upiu,
+        TP_PROTO(const char *dev_name, const char *str, void *hdr, void *tsf),
+
+        TP_ARGS(dev_name, str, hdr, tsf),
+
+        TP_STRUCT__entry(
+                __string(dev_name, dev_name)
+                __string(str, str)
+                __array(unsigned char, hdr, 12)
+                __array(unsigned char, tsf, 16)
+        ),
+
+        TP_fast_assign(
+                __assign_str(dev_name, dev_name);
+                __assign_str(str, str);
+                memcpy(__entry->hdr, hdr, sizeof(__entry->hdr));
+                memcpy(__entry->tsf, tsf, sizeof(__entry->tsf));
+        ),
+
+        TP_printk(
+                "%s: %s: HDR:%s, CDB:%s",
+                __get_str(str), __get_str(dev_name),
+                __print_hex(__entry->hdr, sizeof(__entry->hdr)),
+                __print_hex(__entry->tsf, sizeof(__entry->tsf))
+        )
+);
+
 #endif /* if !defined(_TRACE_UFS_H) || defined(TRACE_HEADER_MULTI_READ) */
 
 /* This part must be outside protection */
diff --git a/include/trace/events/workqueue.h b/include/trace/events/workqueue.h
index 2f057a494d93..9a761bc6a251 100644
--- a/include/trace/events/workqueue.h
+++ b/include/trace/events/workqueue.h
@@ -25,6 +25,8 @@ DECLARE_EVENT_CLASS(workqueue_work,
         TP_printk("work struct %p", __entry->work)
 );
 
+struct pool_workqueue;
+
 /**
  * workqueue_queue_work - called when a work gets queued
  * @req_cpu:    the requested cpu
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 1065006c9bf5..b02c41e53d56 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -676,6 +676,13 @@ struct kvm_ioeventfd {
         __u8  pad[36];
 };
 
+#define KVM_X86_DISABLE_EXITS_MWAIT          (1 << 0)
+#define KVM_X86_DISABLE_EXITS_HTL            (1 << 1)
+#define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
+#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
+                                              KVM_X86_DISABLE_EXITS_HTL | \
+                                              KVM_X86_DISABLE_EXITS_PAUSE)
+
 /* for KVM_ENABLE_CAP */
 struct kvm_enable_cap {
         /* in */
diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
index 0f272818a4d2..6b58371b1f0d 100644
--- a/include/uapi/linux/sysctl.h
+++ b/include/uapi/linux/sysctl.h
@@ -780,24 +780,6 @@ enum {
         NET_BRIDGE_NF_FILTER_PPPOE_TAGGED = 5,
 };
 
-/* proc/sys/net/irda */
-enum {
-        NET_IRDA_DISCOVERY=1,
-        NET_IRDA_DEVNAME=2,
-        NET_IRDA_DEBUG=3,
-        NET_IRDA_FAST_POLL=4,
-        NET_IRDA_DISCOVERY_SLOTS=5,
-        NET_IRDA_DISCOVERY_TIMEOUT=6,
-        NET_IRDA_SLOT_TIMEOUT=7,
-        NET_IRDA_MAX_BAUD_RATE=8,
-        NET_IRDA_MIN_TX_TURN_TIME=9,
-        NET_IRDA_MAX_TX_DATA_SIZE=10,
-        NET_IRDA_MAX_TX_WINDOW=11,
-        NET_IRDA_MAX_NOREPLY_TIME=12,
-        NET_IRDA_WARN_NOREPLY_TIME=13,
-        NET_IRDA_LAP_KEEPALIVE_TIME=14,
-};
-
 
 /* CTL_FS names: */
 enum
diff --git a/include/uapi/linux/time.h b/include/uapi/linux/time.h
index 16a296612ba4..4c0338ea308a 100644
--- a/include/uapi/linux/time.h
+++ b/include/uapi/linux/time.h
@@ -73,7 +73,6 @@ struct __kernel_old_timeval {
  */
 #define CLOCK_SGI_CYCLE                 10
 #define CLOCK_TAI                       11
-#define CLOCK_MONOTONIC_ACTIVE          12
 
 #define MAX_CLOCKS                      16
 #define CLOCKS_MASK                     (CLOCK_REALTIME | CLOCK_MONOTONIC)
diff --git a/include/uapi/linux/virtio_balloon.h b/include/uapi/linux/virtio_balloon.h
index 40297a3181ed..13b8cb563892 100644
--- a/include/uapi/linux/virtio_balloon.h
+++ b/include/uapi/linux/virtio_balloon.h
@@ -57,6 +57,21 @@ struct virtio_balloon_config {
 #define VIRTIO_BALLOON_S_HTLB_PGFAIL   9  /* Hugetlb page allocation failures */
 #define VIRTIO_BALLOON_S_NR       10
 
+#define VIRTIO_BALLOON_S_NAMES_WITH_PREFIX(VIRTIO_BALLOON_S_NAMES_prefix) { \
+        VIRTIO_BALLOON_S_NAMES_prefix "swap-in", \
+        VIRTIO_BALLOON_S_NAMES_prefix "swap-out", \
+        VIRTIO_BALLOON_S_NAMES_prefix "major-faults", \
+        VIRTIO_BALLOON_S_NAMES_prefix "minor-faults", \
+        VIRTIO_BALLOON_S_NAMES_prefix "free-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "total-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "available-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "disk-caches", \
+        VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-allocations", \
+        VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures" \
+}
+
+#define VIRTIO_BALLOON_S_NAMES VIRTIO_BALLOON_S_NAMES_WITH_PREFIX("")
+
 /*
  * Memory statistics structure.
  * Driver fills an array of these structures and passes to device.
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d315b393abdd..ba03ec39efb3 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1572,13 +1572,32 @@ int bpf_prog_array_length(struct bpf_prog_array __rcu *progs)
         return cnt;
 }
 
+static bool bpf_prog_array_copy_core(struct bpf_prog **prog,
+                                     u32 *prog_ids,
+                                     u32 request_cnt)
+{
+        int i = 0;
+
+        for (; *prog; prog++) {
+                if (*prog == &dummy_bpf_prog.prog)
+                        continue;
+                prog_ids[i] = (*prog)->aux->id;
+                if (++i == request_cnt) {
+                        prog++;
+                        break;
+                }
+        }
+
+        return !!(*prog);
+}
+
 int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
                                 __u32 __user *prog_ids, u32 cnt)
 {
         struct bpf_prog **prog;
         unsigned long err = 0;
-        u32 i = 0, *ids;
         bool nospc;
+        u32 *ids;
 
         /* users of this function are doing:
          * cnt = bpf_prog_array_length();
@@ -1595,16 +1614,7 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
                 return -ENOMEM;
         rcu_read_lock();
         prog = rcu_dereference(progs)->progs;
-        for (; *prog; prog++) {
-                if (*prog == &dummy_bpf_prog.prog)
-                        continue;
-                ids[i] = (*prog)->aux->id;
-                if (++i == cnt) {
-                        prog++;
-                        break;
-                }
-        }
-        nospc = !!(*prog);
+        nospc = bpf_prog_array_copy_core(prog, ids, cnt);
         rcu_read_unlock();
         err = copy_to_user(prog_ids, ids, cnt * sizeof(u32));
         kfree(ids);
@@ -1683,22 +1693,25 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
 }
 
 int bpf_prog_array_copy_info(struct bpf_prog_array __rcu *array,
-                             __u32 __user *prog_ids, u32 request_cnt,
-                             __u32 __user *prog_cnt)
+                             u32 *prog_ids, u32 request_cnt,
+                             u32 *prog_cnt)
 {
+        struct bpf_prog **prog;
         u32 cnt = 0;
 
         if (array)
                 cnt = bpf_prog_array_length(array);
 
-        if (copy_to_user(prog_cnt, &cnt, sizeof(cnt)))
-                return -EFAULT;
+        *prog_cnt = cnt;
 
         /* return early if user requested only program count or nothing to copy */
         if (!request_cnt || !cnt)
                 return 0;
 
-        return bpf_prog_array_copy_to_user(array, prog_ids, request_cnt);
+        /* this function is called under trace/bpf_trace.c: bpf_event_mutex */
+        prog = rcu_dereference_check(array, 1)->progs;
+        return bpf_prog_array_copy_core(prog, prog_ids, request_cnt) ? -ENOSPC
+                                                                     : 0;
 }
 
 static void bpf_prog_free_deferred(struct work_struct *work)
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 8dd9210d7db7..a3b21385e947 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1442,9 +1442,6 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
             attr->value_size != 4 || attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
                 return ERR_PTR(-EINVAL);
 
-        if (attr->value_size > KMALLOC_MAX_SIZE)
-                return ERR_PTR(-E2BIG);
-
         err = bpf_tcp_ulp_register();
         if (err && err != -EEXIST)
                 return ERR_PTR(err);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 102160ff5c66..ea619021d901 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
         struct kprobe_blacklist_entry *ent =
                 list_entry(v, struct kprobe_blacklist_entry, list);
 
-        seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr,
+        seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr,
                    (void *)ent->end_addr, (void *)ent->start_addr);
         return 0;
 }
diff --git a/kernel/module.c b/kernel/module.c
index a6e43a5806a1..ce8066b88178 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1472,7 +1472,8 @@ static ssize_t module_sect_show(struct module_attribute *mattr,
 {
         struct module_sect_attr *sattr =
                 container_of(mattr, struct module_sect_attr, mattr);
-        return sprintf(buf, "0x%pK\n", (void *)sattr->address);
+        return sprintf(buf, "0x%px\n", kptr_restrict < 2 ?
+                       (void *)sattr->address : NULL);
 }
 
 static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index e8c0dab4fd65..07148b497451 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -704,24 +704,6 @@ static const struct bin_table bin_net_netfilter_table[] = {
         {}
 };
 
-static const struct bin_table bin_net_irda_table[] = {
-        { CTL_INT,      NET_IRDA_DISCOVERY,             "discovery" },
-        { CTL_STR,      NET_IRDA_DEVNAME,               "devname" },
-        { CTL_INT,      NET_IRDA_DEBUG,                 "debug" },
-        { CTL_INT,      NET_IRDA_FAST_POLL,             "fast_poll_increase" },
-        { CTL_INT,      NET_IRDA_DISCOVERY_SLOTS,       "discovery_slots" },
-        { CTL_INT,      NET_IRDA_DISCOVERY_TIMEOUT,     "discovery_timeout" },
-        { CTL_INT,      NET_IRDA_SLOT_TIMEOUT,          "slot_timeout" },
-        { CTL_INT,      NET_IRDA_MAX_BAUD_RATE,         "max_baud_rate" },
-        { CTL_INT,      NET_IRDA_MIN_TX_TURN_TIME,      "min_tx_turn_time" },
-        { CTL_INT,      NET_IRDA_MAX_TX_DATA_SIZE,      "max_tx_data_size" },
-        { CTL_INT,      NET_IRDA_MAX_TX_WINDOW,         "max_tx_window" },
-        { CTL_INT,      NET_IRDA_MAX_NOREPLY_TIME,      "max_noreply_time" },
-        { CTL_INT,      NET_IRDA_WARN_NOREPLY_TIME,     "warn_noreply_time" },
-        { CTL_INT,      NET_IRDA_LAP_KEEPALIVE_TIME,    "lap_keepalive_time" },
-        {}
-};
-
 static const struct bin_table bin_net_table[] = {
         { CTL_DIR,      NET_CORE,               "core",         bin_net_core_table },
         /* NET_ETHER not used */
@@ -743,7 +725,7 @@ static const struct bin_table bin_net_table[] = {
         { CTL_DIR,      NET_LLC,                "llc",          bin_net_llc_table },
         { CTL_DIR,      NET_NETFILTER,          "netfilter",    bin_net_netfilter_table },
         /* NET_DCCP "dccp" no longer used */
-        { CTL_DIR,      NET_IRDA,               "irda",         bin_net_irda_table },
+        /* NET_IRDA "irda" no longer used */
         { CTL_INT,      2089,                   "nf_conntrack_max" },
         {}
 };
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index eda1210ce50f..14e858753d76 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -91,6 +91,11 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
                         .get_time = &ktime_get_real,
                 },
                 {
+                        .index = HRTIMER_BASE_BOOTTIME,
+                        .clockid = CLOCK_BOOTTIME,
+                        .get_time = &ktime_get_boottime,
+                },
+                {
                         .index = HRTIMER_BASE_TAI,
                         .clockid = CLOCK_TAI,
                         .get_time = &ktime_get_clocktai,
@@ -106,6 +111,11 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
                         .get_time = &ktime_get_real,
                 },
                 {
+                        .index = HRTIMER_BASE_BOOTTIME_SOFT,
+                        .clockid = CLOCK_BOOTTIME,
+                        .get_time = &ktime_get_boottime,
+                },
+                {
                         .index = HRTIMER_BASE_TAI_SOFT,
                         .clockid = CLOCK_TAI,
                         .get_time = &ktime_get_clocktai,
@@ -119,7 +129,7 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
 
         [CLOCK_REALTIME]        = HRTIMER_BASE_REALTIME,
         [CLOCK_MONOTONIC]       = HRTIMER_BASE_MONOTONIC,
-        [CLOCK_BOOTTIME]        = HRTIMER_BASE_MONOTONIC,
+        [CLOCK_BOOTTIME]        = HRTIMER_BASE_BOOTTIME,
         [CLOCK_TAI]             = HRTIMER_BASE_TAI,
 };
 
@@ -571,12 +581,14 @@ __hrtimer_get_next_event(struct hrtimer_cpu_base *cpu_base, unsigned int active_
 static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
 {
         ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset;
+        ktime_t *offs_boot = &base->clock_base[HRTIMER_BASE_BOOTTIME].offset;
         ktime_t *offs_tai = &base->clock_base[HRTIMER_BASE_TAI].offset;
 
         ktime_t now = ktime_get_update_offsets_now(&base->clock_was_set_seq,
-                                                   offs_real, offs_tai);
+                                            offs_real, offs_boot, offs_tai);
 
         base->clock_base[HRTIMER_BASE_REALTIME_SOFT].offset = *offs_real;
+        base->clock_base[HRTIMER_BASE_BOOTTIME_SOFT].offset = *offs_boot;
         base->clock_base[HRTIMER_BASE_TAI_SOFT].offset = *offs_tai;
 
         return now;
diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c
index e0dbae98db9d..69a937c3cd81 100644
--- a/kernel/time/posix-stubs.c
+++ b/kernel/time/posix-stubs.c
@@ -83,8 +83,6 @@ int do_clock_gettime(clockid_t which_clock, struct timespec64 *tp)
         case CLOCK_BOOTTIME:
                 get_monotonic_boottime64(tp);
                 break;
-        case CLOCK_MONOTONIC_ACTIVE:
-                ktime_get_active_ts64(tp);
         default:
                 return -EINVAL;
         }
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index b6899b5060bd..10b7186d0638 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -252,16 +252,15 @@ static int posix_get_coarse_res(const clockid_t which_clock, struct timespec64 *
         return 0;
 }
 
-static int posix_get_tai(clockid_t which_clock, struct timespec64 *tp)
+static int posix_get_boottime(const clockid_t which_clock, struct timespec64 *tp)
 {
-        timekeeping_clocktai64(tp);
+        get_monotonic_boottime64(tp);
         return 0;
 }
 
-static int posix_get_monotonic_active(clockid_t which_clock,
-                                      struct timespec64 *tp)
+static int posix_get_tai(clockid_t which_clock, struct timespec64 *tp)
 {
-        ktime_get_active_ts64(tp);
+        timekeeping_clocktai64(tp);
         return 0;
 }
 
@@ -1317,9 +1316,19 @@ static const struct k_clock clock_tai = {
         .timer_arm              = common_hrtimer_arm,
 };
 
-static const struct k_clock clock_monotonic_active = {
+static const struct k_clock clock_boottime = {
         .clock_getres           = posix_get_hrtimer_res,
-        .clock_get              = posix_get_monotonic_active,
+        .clock_get              = posix_get_boottime,
+        .nsleep                 = common_nsleep,
+        .timer_create           = common_timer_create,
+        .timer_set              = common_timer_set,
+        .timer_get              = common_timer_get,
+        .timer_del              = common_timer_del,
+        .timer_rearm            = common_hrtimer_rearm,
+        .timer_forward          = common_hrtimer_forward,
+        .timer_remaining        = common_hrtimer_remaining,
+        .timer_try_to_cancel    = common_hrtimer_try_to_cancel,
+        .timer_arm              = common_hrtimer_arm,
 };
 
 static const struct k_clock * const posix_clocks[] = {
@@ -1330,11 +1339,10 @@ static const struct k_clock * const posix_clocks[] = {
         [CLOCK_MONOTONIC_RAW]           = &clock_monotonic_raw,
         [CLOCK_REALTIME_COARSE]         = &clock_realtime_coarse,
         [CLOCK_MONOTONIC_COARSE]        = &clock_monotonic_coarse,
-        [CLOCK_BOOTTIME]                = &clock_monotonic,
+        [CLOCK_BOOTTIME]                = &clock_boottime,
         [CLOCK_REALTIME_ALARM]          = &alarm_clock,
         [CLOCK_BOOTTIME_ALARM]          = &alarm_clock,
         [CLOCK_TAI]                     = &clock_tai,
-        [CLOCK_MONOTONIC_ACTIVE]        = &clock_monotonic_active,
 };
 
 static const struct k_clock *clockid_to_kclock(const clockid_t id)
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 099572ca4a8f..49edc1c4f3e6 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -419,19 +419,6 @@ void tick_suspend_local(void)
         clockevents_shutdown(td->evtdev);
 }
 
-static void tick_forward_next_period(void)
-{
-        ktime_t delta, now = ktime_get();
-        u64 n;
-
-        delta = ktime_sub(now, tick_next_period);
-        n = ktime_divns(delta, tick_period);
-        tick_next_period += n * tick_period;
-        if (tick_next_period < now)
-                tick_next_period += tick_period;
-        tick_sched_forward_next_period();
-}
-
 /**
  * tick_resume_local - Resume the local tick device
  *
@@ -444,8 +431,6 @@ void tick_resume_local(void)
         struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
         bool broadcast = tick_resume_check_broadcast();
 
-        tick_forward_next_period();
-
         clockevents_tick_resume(td->evtdev);
         if (!broadcast) {
                 if (td->mode == TICKDEV_MODE_PERIODIC)
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 21efab7485ca..e277284c2831 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -141,12 +141,6 @@ static inline void tick_check_oneshot_broadcast_this_cpu(void) { }
 static inline bool tick_broadcast_oneshot_available(void) { return tick_oneshot_possible(); }
 #endif /* !(BROADCAST && ONESHOT) */
 
-#if defined(CONFIG_NO_HZ_COMMON) || defined(CONFIG_HIGH_RES_TIMERS)
-extern void tick_sched_forward_next_period(void);
-#else
-static inline void tick_sched_forward_next_period(void) { }
-#endif
-
 /* NO_HZ_FULL internal */
 #ifdef CONFIG_NO_HZ_FULL
 extern void tick_nohz_init(void);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 646645e981f9..da9455a6b42b 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -52,15 +52,6 @@ struct tick_sched *tick_get_tick_sched(int cpu)
 static ktime_t last_jiffies_update;
 
 /*
- * Called after resume. Make sure that jiffies are not fast forwarded due to
- * clock monotonic being forwarded by the suspended time.
- */
-void tick_sched_forward_next_period(void)
-{
-        last_jiffies_update = tick_next_period;
-}
-
-/*
  * Must be called with interrupts disabled !
  */
 static void tick_do_update_jiffies64(ktime_t now)
@@ -804,12 +795,12 @@ static void tick_nohz_stop_tick(struct tick_sched *ts, int cpu)
                 return;
         }
 
-        hrtimer_set_expires(&ts->sched_timer, tick);
-
-        if (ts->nohz_mode == NOHZ_MODE_HIGHRES)
-                hrtimer_start_expires(&ts->sched_timer, HRTIMER_MODE_ABS_PINNED);
-        else
+        if (ts->nohz_mode == NOHZ_MODE_HIGHRES) {
+                hrtimer_start(&ts->sched_timer, tick, HRTIMER_MODE_ABS_PINNED);
+        } else {
+                hrtimer_set_expires(&ts->sched_timer, tick);
                 tick_program_event(tick, 1);
+        }
 }
 
 static void tick_nohz_retain_tick(struct tick_sched *ts)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index dcf7f20fcd12..49cbceef5deb 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -138,12 +138,7 @@ static void tk_set_wall_to_mono(struct timekeeper *tk, struct timespec64 wtm)
 
 static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta)
 {
-        /* Update both bases so mono and raw stay coupled. */
-        tk->tkr_mono.base += delta;
-        tk->tkr_raw.base += delta;
-
-        /* Accumulate time spent in suspend */
-        tk->time_suspended += delta;
+        tk->offs_boot = ktime_add(tk->offs_boot, delta);
 }
 
 /*
@@ -473,6 +468,36 @@ u64 ktime_get_raw_fast_ns(void)
 }
 EXPORT_SYMBOL_GPL(ktime_get_raw_fast_ns);
 
+/**
+ * ktime_get_boot_fast_ns - NMI safe and fast access to boot clock.
+ *
+ * To keep it NMI safe since we're accessing from tracing, we're not using a
+ * separate timekeeper with updates to monotonic clock and boot offset
+ * protected with seqlocks. This has the following minor side effects:
+ *
+ * (1) Its possible that a timestamp be taken after the boot offset is updated
+ * but before the timekeeper is updated. If this happens, the new boot offset
+ * is added to the old timekeeping making the clock appear to update slightly
+ * earlier:
+ *    CPU 0                                        CPU 1
+ *    timekeeping_inject_sleeptime64()
+ *    __timekeeping_inject_sleeptime(tk, delta);
+ *                                                 timestamp();
+ *    timekeeping_update(tk, TK_CLEAR_NTP...);
+ *
+ * (2) On 32-bit systems, the 64-bit boot offset (tk->offs_boot) may be
+ * partially updated.  Since the tk->offs_boot update is a rare event, this
+ * should be a rare occurrence which postprocessing should be able to handle.
+ */
+u64 notrace ktime_get_boot_fast_ns(void)
+{
+        struct timekeeper *tk = &tk_core.timekeeper;
+
+        return (ktime_get_mono_fast_ns() + ktime_to_ns(tk->offs_boot));
+}
+EXPORT_SYMBOL_GPL(ktime_get_boot_fast_ns);
+
+
 /*
  * See comment for __ktime_get_fast_ns() vs. timestamp ordering
  */
@@ -764,6 +789,7 @@ EXPORT_SYMBOL_GPL(ktime_get_resolution_ns);
 
 static ktime_t *offsets[TK_OFFS_MAX] = {
         [TK_OFFS_REAL]  = &tk_core.timekeeper.offs_real,
+        [TK_OFFS_BOOT]  = &tk_core.timekeeper.offs_boot,
         [TK_OFFS_TAI]   = &tk_core.timekeeper.offs_tai,
 };
 
@@ -861,39 +887,6 @@ void ktime_get_ts64(struct timespec64 *ts)
 EXPORT_SYMBOL_GPL(ktime_get_ts64);
 
 /**
- * ktime_get_active_ts64 - Get the active non-suspended monotonic clock
- * @ts:         pointer to timespec variable
- *
- * The function calculates the monotonic clock from the realtime clock and
- * the wall_to_monotonic offset, subtracts the accumulated suspend time and
- * stores the result in normalized timespec64 format in the variable
- * pointed to by @ts.
- */
-void ktime_get_active_ts64(struct timespec64 *ts)
-{
-        struct timekeeper *tk = &tk_core.timekeeper;
-        struct timespec64 tomono, tsusp;
-        u64 nsec, nssusp;
-        unsigned int seq;
-
-        WARN_ON(timekeeping_suspended);
-
-        do {
-                seq = read_seqcount_begin(&tk_core.seq);
-                ts->tv_sec = tk->xtime_sec;
-                nsec = timekeeping_get_ns(&tk->tkr_mono);
-                tomono = tk->wall_to_monotonic;
-                nssusp = tk->time_suspended;
-        } while (read_seqcount_retry(&tk_core.seq, seq));
-
-        ts->tv_sec += tomono.tv_sec;
-        ts->tv_nsec = 0;
-        timespec64_add_ns(ts, nsec + tomono.tv_nsec);
-        tsusp = ns_to_timespec64(nssusp);
-        *ts = timespec64_sub(*ts, tsusp);
-}
-
-/**
  * ktime_get_seconds - Get the seconds portion of CLOCK_MONOTONIC
  *
  * Returns the seconds portion of CLOCK_MONOTONIC with a single non
@@ -1593,6 +1586,7 @@ static void __timekeeping_inject_sleeptime(struct timekeeper *tk,
                 return;
         }
         tk_xtime_add(tk, delta);
+        tk_set_wall_to_mono(tk, timespec64_sub(tk->wall_to_monotonic, *delta));
         tk_update_sleep_time(tk, timespec64_to_ktime(*delta));
         tk_debug_account_sleep_time(delta);
 }
@@ -2125,7 +2119,7 @@ out:
 void getboottime64(struct timespec64 *ts)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
-        ktime_t t = ktime_sub(tk->offs_real, tk->time_suspended);
+        ktime_t t = ktime_sub(tk->offs_real, tk->offs_boot);
 
         *ts = ktime_to_timespec64(t);
 }
@@ -2188,6 +2182,7 @@ void do_timer(unsigned long ticks)
  * ktime_get_update_offsets_now - hrtimer helper
  * @cwsseq:     pointer to check and store the clock was set sequence number
  * @offs_real:  pointer to storage for monotonic -> realtime offset
+ * @offs_boot:  pointer to storage for monotonic -> boottime offset
  * @offs_tai:   pointer to storage for monotonic -> clock tai offset
  *
  * Returns current monotonic time and updates the offsets if the
@@ -2197,7 +2192,7 @@ void do_timer(unsigned long ticks)
  * Called from hrtimer_interrupt() or retrigger_next_event()
  */
 ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
-                                     ktime_t *offs_tai)
+                                     ktime_t *offs_boot, ktime_t *offs_tai)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
         unsigned int seq;
@@ -2214,6 +2209,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
                 if (*cwsseq != tk->clock_was_set_seq) {
                         *cwsseq = tk->clock_was_set_seq;
                         *offs_real = tk->offs_real;
+                        *offs_boot = tk->offs_boot;
                         *offs_tai = tk->offs_tai;
                 }
 
diff --git a/kernel/time/timekeeping.h b/kernel/time/timekeeping.h
index 79b67f5e0343..7a9b4eb7a1d5 100644
--- a/kernel/time/timekeeping.h
+++ b/kernel/time/timekeeping.h
@@ -6,6 +6,7 @@
  */
 extern ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq,
                                             ktime_t *offs_real,
+                                            ktime_t *offs_boot,
                                             ktime_t *offs_tai);
 
 extern int timekeeping_valid_for_hres(void);
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index d88e96d4e12c..56ba0f2a01db 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -977,6 +977,7 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info)
 {
         struct perf_event_query_bpf __user *uquery = info;
         struct perf_event_query_bpf query = {};
+        u32 *ids, prog_cnt, ids_len;
         int ret;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -985,16 +986,32 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info)
                 return -EINVAL;
         if (copy_from_user(&query, uquery, sizeof(query)))
                 return -EFAULT;
-        if (query.ids_len > BPF_TRACE_MAX_PROGS)
+
+        ids_len = query.ids_len;
+        if (ids_len > BPF_TRACE_MAX_PROGS)
                 return -E2BIG;
+        ids = kcalloc(ids_len, sizeof(u32), GFP_USER | __GFP_NOWARN);
+        if (!ids)
+                return -ENOMEM;
+        /*
+         * The above kcalloc returns ZERO_SIZE_PTR when ids_len = 0, which
+         * is required when user only wants to check for uquery->prog_cnt.
+         * There is no need to check for it since the case is handled
+         * gracefully in bpf_prog_array_copy_info.
+         */
 
         mutex_lock(&bpf_event_mutex);
         ret = bpf_prog_array_copy_info(event->tp_event->prog_array,
-                                       uquery->ids,
-                                       query.ids_len,
-                                       &uquery->prog_cnt);
+                                       ids,
+                                       ids_len,
+                                       &prog_cnt);
         mutex_unlock(&bpf_event_mutex);
 
+        if (copy_to_user(&uquery->prog_cnt, &prog_cnt, sizeof(prog_cnt)) ||
+            copy_to_user(uquery->ids, ids, ids_len * sizeof(u32)))
+                ret = -EFAULT;
+
+        kfree(ids);
         return ret;
 }
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index dfbcf9ee1447..414d7210b2ec 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1165,7 +1165,7 @@ static struct {
         { trace_clock,                  "perf",         1 },
         { ktime_get_mono_fast_ns,       "mono",         1 },
         { ktime_get_raw_fast_ns,        "mono_raw",     1 },
-        { ktime_get_mono_fast_ns,       "boot",         1 },
+        { ktime_get_boot_fast_ns,       "boot",         1 },
         ARCH_TRACE_CLOCKS
 };
 
diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index e954ae3d82c0..e3a658bac10f 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry,
                 __field(        unsigned int,           seqnum          )
         ),
 
-        F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n",
+        F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n",
                  __entry->seqnum,
                  __entry->tv_sec,
                  __entry->tv_nsec,
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 9b4716bb8bb0..1f951b3df60c 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1499,14 +1499,14 @@ static int process_preds(struct trace_event_call *call,
                 return ret;
         }
 
-        if (!nr_preds) {
-                prog = NULL;
-        } else {
-                prog = predicate_parse(filter_string, nr_parens, nr_preds,
+        if (!nr_preds)
+                return -EINVAL;
+
+        prog = predicate_parse(filter_string, nr_parens, nr_preds,
                                parse_pred, call, pe);
-                if (IS_ERR(prog))
-                        return PTR_ERR(prog);
-        }
+        if (IS_ERR(prog))
+                return PTR_ERR(prog);
+
         rcu_assign_pointer(filter->prog, prog);
         return 0;
 }
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index c0bba30fef0a..bbfb229aa067 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,7 +84,8 @@ again:
                 __free_pages(page, page_order);
                 page = NULL;
 
-                if (dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
+                if (IS_ENABLED(CONFIG_ZONE_DMA) &&
+                    dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
                     !(gfp & GFP_DMA)) {
                         gfp = (gfp & ~GFP_DMA32) | GFP_DMA;
                         goto again;
diff --git a/lib/kobject.c b/lib/kobject.c
index e1d1f290bf35..18989b5b3b56 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -233,13 +233,12 @@ static int kobject_add_internal(struct kobject *kobj)
 
                 /* be noisy on error issues */
                 if (error == -EEXIST)
-                        WARN(1,
-                             "%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
-                             __func__, kobject_name(kobj));
+                        pr_err("%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
+                               __func__, kobject_name(kobj));
                 else
-                        WARN(1, "%s failed for %s (error: %d parent: %s)\n",
-                             __func__, kobject_name(kobj), error,
-                             parent ? kobject_name(parent) : "'none'");
+                        pr_err("%s failed for %s (error: %d parent: %s)\n",
+                               __func__, kobject_name(kobj), error,
+                               parent ? kobject_name(parent) : "'none'");
         } else
                 kobj->state_in_sysfs = 1;
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 188f195883b9..9d5968d1e8e3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -100,11 +100,20 @@ pgprot_t protection_map[16] __ro_after_init = {
         __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
 };
 
+#ifndef CONFIG_ARCH_HAS_FILTER_PGPROT
+static inline pgprot_t arch_filter_pgprot(pgprot_t prot)
+{
+        return prot;
+}
+#endif
+
 pgprot_t vm_get_page_prot(unsigned long vm_flags)
 {
-        return __pgprot(pgprot_val(protection_map[vm_flags &
+        pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &
                                 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
                         pgprot_val(arch_vm_get_page_prot(vm_flags)));
+
+        return arch_filter_pgprot(ret);
 }
 EXPORT_SYMBOL(vm_get_page_prot);
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 032e0fe45940..28a4c3490359 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1825,13 +1825,14 @@ static int compat_table_info(const struct ebt_table_info *info,
 {
         unsigned int size = info->entries_size;
         const void *entries = info->entries;
-        int ret;
 
         newinfo->entries_size = size;
-
-        ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
-        if (ret)
-                return ret;
+        if (info->nentries) {
+                int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
+                                                 info->nentries);
+                if (ret)
+                        return ret;
+        }
 
         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
                                                         entries, newinfo);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index fcb40c12b1f8..3b3d33ea9ed8 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2569,6 +2569,11 @@ static int try_write(struct ceph_connection *con)
         int ret = 1;
 
         dout("try_write start %p state %lu\n", con, con->state);
+        if (con->state != CON_STATE_PREOPEN &&
+            con->state != CON_STATE_CONNECTING &&
+            con->state != CON_STATE_NEGOTIATING &&
+            con->state != CON_STATE_OPEN)
+                return 0;
 
 more:
         dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
@@ -2594,6 +2599,8 @@ more:
         }
 
 more_kvec:
+        BUG_ON(!con->sock);
+
         /* kvec data queued? */
         if (con->out_kvec_left) {
                 ret = write_partial_kvec(con);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index b3dac24412d3..21ac6e3b96bb 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -209,6 +209,14 @@ static void reopen_session(struct ceph_mon_client *monc)
         __open_session(monc);
 }
 
+static void un_backoff(struct ceph_mon_client *monc)
+{
+        monc->hunt_mult /= 2; /* reduce by 50% */
+        if (monc->hunt_mult < 1)
+                monc->hunt_mult = 1;
+        dout("%s hunt_mult now %d\n", __func__, monc->hunt_mult);
+}
+
 /*
  * Reschedule delayed work timer.
  */
@@ -963,6 +971,7 @@ static void delayed_work(struct work_struct *work)
                 if (!monc->hunting) {
                         ceph_con_keepalive(&monc->con);
                         __validate_auth(monc);
+                        un_backoff(monc);
                 }
 
                 if (is_auth &&
@@ -1123,9 +1132,8 @@ static void finish_hunting(struct ceph_mon_client *monc)
                 dout("%s found mon%d\n", __func__, monc->cur_mon);
                 monc->hunting = false;
                 monc->had_a_connection = true;
-                monc->hunt_mult /= 2; /* reduce by 50% */
-                if (monc->hunt_mult < 1)
-                        monc->hunt_mult = 1;
+                un_backoff(monc);
+                __schedule_delayed(monc);
         }
 }
 
diff --git a/net/ife/ife.c b/net/ife/ife.c
index 7d1ec76e7f43..13bbf8cb6a39 100644
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -69,6 +69,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
         int total_pull;
         u16 ifehdrln;
 
+        if (!pskb_may_pull(skb, skb->dev->hard_header_len + IFE_METAHDRLEN))
+                return NULL;
+
         ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);
         ifehdrln = ntohs(ifehdr->metalen);
         total_pull = skb->dev->hard_header_len + ifehdrln;
@@ -92,12 +95,43 @@ struct meta_tlvhdr {
         __be16 len;
 };
 
+static bool __ife_tlv_meta_valid(const unsigned char *skbdata,
+                                 const unsigned char *ifehdr_end)
+{
+        const struct meta_tlvhdr *tlv;
+        u16 tlvlen;
+
+        if (unlikely(skbdata + sizeof(*tlv) > ifehdr_end))
+                return false;
+
+        tlv = (const struct meta_tlvhdr *)skbdata;
+        tlvlen = ntohs(tlv->len);
+
+        /* tlv length field is inc header, check on minimum */
+        if (tlvlen < NLA_HDRLEN)
+                return false;
+
+        /* overflow by NLA_ALIGN check */
+        if (NLA_ALIGN(tlvlen) < tlvlen)
+                return false;
+
+        if (unlikely(skbdata + NLA_ALIGN(tlvlen) > ifehdr_end))
+                return false;
+
+        return true;
+}
+
 /* Caller takes care of presenting data in network order
  */
-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen)
+void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
+                          u16 *dlen, u16 *totlen)
 {
-        struct meta_tlvhdr *tlv = (struct meta_tlvhdr *) skbdata;
+        struct meta_tlvhdr *tlv;
+
+        if (!__ife_tlv_meta_valid(skbdata, ifehdr_end))
+                return NULL;
 
+        tlv = (struct meta_tlvhdr *)skbdata;
         *dlen = ntohs(tlv->len) - NLA_HDRLEN;
         *attrtype = ntohs(tlv->type);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 367def6ddeda..e51c644484dc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3868,11 +3868,8 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
         int length = (th->doff << 2) - sizeof(*th);
         const u8 *ptr = (const u8 *)(th + 1);
 
-        /* If the TCP option is too short, we can short cut */
-        if (length < TCPOLEN_MD5SIG)
-                return NULL;
-
-        while (length > 0) {
+        /* If not enough data remaining, we can short cut */
+        while (length >= TCPOLEN_MD5SIG) {
                 int opcode = *ptr++;
                 int opsize;
 
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index ccbfa83e4bb0..ce77bcc2490c 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -48,6 +48,34 @@ config NFT_CHAIN_ROUTE_IPV6
           fields such as the source, destination, flowlabel, hop-limit and
           the packet mark.
 
+if NF_NAT_IPV6
+
+config NFT_CHAIN_NAT_IPV6
+        tristate "IPv6 nf_tables nat chain support"
+        help
+          This option enables the "nat" chain for IPv6 in nf_tables. This
+          chain type is used to perform Network Address Translation (NAT)
+          packet transformations such as the source, destination address and
+          source and destination ports.
+
+config NFT_MASQ_IPV6
+        tristate "IPv6 masquerade support for nf_tables"
+        depends on NFT_MASQ
+        select NF_NAT_MASQUERADE_IPV6
+        help
+          This is the expression that provides IPv4 masquerading support for
+          nf_tables.
+
+config NFT_REDIR_IPV6
+        tristate "IPv6 redirect support for nf_tables"
+        depends on NFT_REDIR
+        select NF_NAT_REDIRECT
+        help
+          This is the expression that provides IPv4 redirect support for
+          nf_tables.
+
+endif # NF_NAT_IPV6
+
 config NFT_REJECT_IPV6
         select NF_REJECT_IPV6
         default NFT_REJECT
@@ -107,39 +135,12 @@ config NF_NAT_IPV6
 
 if NF_NAT_IPV6
 
-config NFT_CHAIN_NAT_IPV6
-        depends on NF_TABLES_IPV6
-        tristate "IPv6 nf_tables nat chain support"
-        help
-          This option enables the "nat" chain for IPv6 in nf_tables. This
-          chain type is used to perform Network Address Translation (NAT)
-          packet transformations such as the source, destination address and
-          source and destination ports.
-
 config NF_NAT_MASQUERADE_IPV6
         tristate "IPv6 masquerade support"
         help
           This is the kernel functionality to provide NAT in the masquerade
           flavour (automatic source address selection) for IPv6.
 
-config NFT_MASQ_IPV6
-        tristate "IPv6 masquerade support for nf_tables"
-        depends on NF_TABLES_IPV6
-        depends on NFT_MASQ
-        select NF_NAT_MASQUERADE_IPV6
-        help
-          This is the expression that provides IPv4 masquerading support for
-          nf_tables.
-
-config NFT_REDIR_IPV6
-        tristate "IPv6 redirect support for nf_tables"
-        depends on NF_TABLES_IPV6
-        depends on NFT_REDIR
-        select NF_NAT_REDIRECT
-        help
-          This is the expression that provides IPv4 redirect support for
-          nf_tables.
-
 endif # NF_NAT_IPV6
 
 config IP6_NF_IPTABLES
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 49b954d6d0fa..cde7d8251377 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3975,6 +3975,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
 
 static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
         [RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
+        [RTA_PREFSRC]           = { .len = sizeof(struct in6_addr) },
         [RTA_OIF]               = { .type = NLA_U32 },
         [RTA_IIF]               = { .type = NLA_U32 },
         [RTA_PRIORITY]          = { .type = NLA_U32 },
@@ -3986,6 +3987,7 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
         [RTA_EXPIRES]           = { .type = NLA_U32 },
         [RTA_UID]               = { .type = NLA_U32 },
         [RTA_MARK]              = { .type = NLA_U32 },
+        [RTA_TABLE]             = { .type = NLA_U32 },
 };
 
 static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index f343e6f0fc95..5fe139484919 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -136,7 +136,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
         isrh->nexthdr = proto;
 
         hdr->daddr = isrh->segments[isrh->first_segment];
-        set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
+        set_tun_src(net, dst->dev, &hdr->daddr, &hdr->saddr);
 
 #ifdef CONFIG_IPV6_SEG6_HMAC
         if (sr_has_hmac(isrh)) {
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index b8f9d45bfeb1..7f1e842ef05a 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -106,8 +106,11 @@ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
                 return;
 
         /* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
-        if (pd->tunnel)
+        if (pd->tunnel) {
                 l2tp_tunnel_dec_refcount(pd->tunnel);
+                pd->tunnel = NULL;
+                pd->session = NULL;
+        }
 }
 
 static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 7d0c963680e6..1fd9e145076a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -619,6 +619,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         lock_sock(sk);
 
         error = -EINVAL;
+
+        if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
+            sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
+            sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
+            sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
+                goto end;
+
         if (sp->sa_protocol != PX_PROTO_OL2TP)
                 goto end;
 
@@ -1618,8 +1625,11 @@ static void pppol2tp_seq_stop(struct seq_file *p, void *v)
                 return;
 
         /* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
-        if (pd->tunnel)
+        if (pd->tunnel) {
                 l2tp_tunnel_dec_refcount(pd->tunnel);
+                pd->tunnel = NULL;
+                pd->session = NULL;
+        }
 }
 
 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 6d29b2b94e84..cb80ebb38311 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct llc_sock *llc;
-        struct llc_sap *sap;
 
         if (unlikely(sk == NULL))
                 goto out;
@@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock)
                 llc->laddr.lsap, llc->daddr.lsap);
         if (!llc_send_disc(sk))
                 llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-        sap = llc->sap;
-        /* Hold this for release_sock(), so that llc_backlog_rcv() could still
-         * use it.
-         */
-        llc_sap_hold(sap);
-        if (!sock_flag(sk, SOCK_ZAPPED))
+        if (!sock_flag(sk, SOCK_ZAPPED)) {
+                struct llc_sap *sap = llc->sap;
+
+                /* Hold this for release_sock(), so that llc_backlog_rcv()
+                 * could still use it.
+                 */
+                llc_sap_hold(sap);
                 llc_sap_remove_socket(llc->sap, sk);
-        release_sock(sk);
-        llc_sap_put(sap);
+                release_sock(sk);
+                llc_sap_put(sap);
+        } else {
+                release_sock(sk);
+        }
         if (llc->dev)
                 dev_put(llc->dev);
         sock_put(sk);
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 163121192aca..4d78375f9872 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -1099,14 +1099,7 @@ int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_sock *llc = llc_sk(sk);
-
-        del_timer(&llc->pf_cycle_timer.timer);
-        del_timer(&llc->ack_timer.timer);
-        del_timer(&llc->rej_sent_timer.timer);
-        del_timer(&llc->busy_state_timer.timer);
-        llc->ack_must_be_send = 0;
-        llc->ack_pf = 0;
+        llc_sk_stop_all_timers(sk, false);
         return 0;
 }
 
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 110e32bcb399..c0ac522b48a1 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -961,6 +961,26 @@ out:
         return sk;
 }
 
+void llc_sk_stop_all_timers(struct sock *sk, bool sync)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        if (sync) {
+                del_timer_sync(&llc->pf_cycle_timer.timer);
+                del_timer_sync(&llc->ack_timer.timer);
+                del_timer_sync(&llc->rej_sent_timer.timer);
+                del_timer_sync(&llc->busy_state_timer.timer);
+        } else {
+                del_timer(&llc->pf_cycle_timer.timer);
+                del_timer(&llc->ack_timer.timer);
+                del_timer(&llc->rej_sent_timer.timer);
+                del_timer(&llc->busy_state_timer.timer);
+        }
+
+        llc->ack_must_be_send = 0;
+        llc->ack_pf = 0;
+}
+
 /**
  *      llc_sk_free - Frees a LLC socket
  *      @sk - socket to free
@@ -973,7 +993,7 @@ void llc_sk_free(struct sock *sk)
 
         llc->state = LLC_CONN_OUT_OF_SVC;
         /* Stop all (possibly) running timers */
-        llc_conn_ac_stop_all_timers(sk, NULL);
+        llc_sk_stop_all_timers(sk, true);
 #ifdef DEBUG_LLC_CONN_ALLOC
         printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__,
                 skb_queue_len(&llc->pdu_unack_q),
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 704b3832dbad..44d8a55e9721 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -594,6 +594,7 @@ config NFT_QUOTA
 config NFT_REJECT
         default m if NETFILTER_ADVANCED=n
         tristate "Netfilter nf_tables reject support"
+        depends on !NF_TABLES_INET || (IPV6!=m || m)
         help
           This option adds the "reject" expression that you can use to
           explicitly deny and notify via TCP reset/ICMP informational errors
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 5ebde4b15810..f36098887ad0 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2384,11 +2384,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                         strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
                                 sizeof(cfg.mcast_ifn));
                         cfg.syncid = dm->syncid;
-                        rtnl_lock();
-                        mutex_lock(&ipvs->sync_mutex);
                         ret = start_sync_thread(ipvs, &cfg, dm->state);
-                        mutex_unlock(&ipvs->sync_mutex);
-                        rtnl_unlock();
                 } else {
                         mutex_lock(&ipvs->sync_mutex);
                         ret = stop_sync_thread(ipvs, dm->state);
@@ -3481,12 +3477,8 @@ static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
         if (ipvs->mixed_address_family_dests > 0)
                 return -EINVAL;
 
-        rtnl_lock();
-        mutex_lock(&ipvs->sync_mutex);
         ret = start_sync_thread(ipvs, &c,
                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
-        mutex_unlock(&ipvs->sync_mutex);
-        rtnl_unlock();
         return ret;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index fbaf3bd05b2e..001501e25625 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -49,6 +49,7 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/kernel.h>
+#include <linux/sched/signal.h>
 
 #include <asm/unaligned.h>              /* Used for ntoh_seq and hton_seq */
 
@@ -1360,15 +1361,9 @@ static void set_mcast_pmtudisc(struct sock *sk, int val)
 /*
  *      Specifiy default interface for outgoing multicasts
  */
-static int set_mcast_if(struct sock *sk, char *ifname)
+static int set_mcast_if(struct sock *sk, struct net_device *dev)
 {
-        struct net_device *dev;
         struct inet_sock *inet = inet_sk(sk);
-        struct net *net = sock_net(sk);
-
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
 
         if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
                 return -EINVAL;
@@ -1396,19 +1391,14 @@ static int set_mcast_if(struct sock *sk, char *ifname)
  *      in the in_addr structure passed in as a parameter.
  */
 static int
-join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname)
+join_mcast_group(struct sock *sk, struct in_addr *addr, struct net_device *dev)
 {
-        struct net *net = sock_net(sk);
         struct ip_mreqn mreq;
-        struct net_device *dev;
         int ret;
 
         memset(&mreq, 0, sizeof(mreq));
         memcpy(&mreq.imr_multiaddr, addr, sizeof(struct in_addr));
 
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
         if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
                 return -EINVAL;
 
@@ -1423,15 +1413,10 @@ join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname)
 
 #ifdef CONFIG_IP_VS_IPV6
 static int join_mcast_group6(struct sock *sk, struct in6_addr *addr,
-                             char *ifname)
+                             struct net_device *dev)
 {
-        struct net *net = sock_net(sk);
-        struct net_device *dev;
         int ret;
 
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
         if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
                 return -EINVAL;
 
@@ -1443,24 +1428,18 @@ static int join_mcast_group6(struct sock *sk, struct in6_addr *addr,
 }
 #endif
 
-static int bind_mcastif_addr(struct socket *sock, char *ifname)
+static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
 {
-        struct net *net = sock_net(sock->sk);
-        struct net_device *dev;
         __be32 addr;
         struct sockaddr_in sin;
 
-        dev = __dev_get_by_name(net, ifname);
-        if (!dev)
-                return -ENODEV;
-
         addr = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
         if (!addr)
                 pr_err("You probably need to specify IP address on "
                        "multicast interface.\n");
 
         IP_VS_DBG(7, "binding socket with (%s) %pI4\n",
-                  ifname, &addr);
+                  dev->name, &addr);
 
         /* Now bind the socket with the address of multicast interface */
         sin.sin_family       = AF_INET;
@@ -1493,7 +1472,8 @@ static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,
 /*
  *      Set up sending multicast socket over UDP
  */
-static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
+static int make_send_sock(struct netns_ipvs *ipvs, int id,
+                          struct net_device *dev, struct socket **sock_ret)
 {
         /* multicast addr */
         union ipvs_sockaddr mcast_addr;
@@ -1505,9 +1485,10 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
                                   IPPROTO_UDP, &sock);
         if (result < 0) {
                 pr_err("Error during creation of socket; terminating\n");
-                return ERR_PTR(result);
+                goto error;
         }
-        result = set_mcast_if(sock->sk, ipvs->mcfg.mcast_ifn);
+        *sock_ret = sock;
+        result = set_mcast_if(sock->sk, dev);
         if (result < 0) {
                 pr_err("Error setting outbound mcast interface\n");
                 goto error;
@@ -1522,7 +1503,7 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
                 set_sock_size(sock->sk, 1, result);
 
         if (AF_INET == ipvs->mcfg.mcast_af)
-                result = bind_mcastif_addr(sock, ipvs->mcfg.mcast_ifn);
+                result = bind_mcastif_addr(sock, dev);
         else
                 result = 0;
         if (result < 0) {
@@ -1538,19 +1519,18 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
                 goto error;
         }
 
-        return sock;
+        return 0;
 
 error:
-        sock_release(sock);
-        return ERR_PTR(result);
+        return result;
 }
 
 
 /*
  *      Set up receiving multicast socket over UDP
  */
-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
-                                        int ifindex)
+static int make_receive_sock(struct netns_ipvs *ipvs, int id,
+                             struct net_device *dev, struct socket **sock_ret)
 {
         /* multicast addr */
         union ipvs_sockaddr mcast_addr;
@@ -1562,8 +1542,9 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
                                   IPPROTO_UDP, &sock);
         if (result < 0) {
                 pr_err("Error during creation of socket; terminating\n");
-                return ERR_PTR(result);
+                goto error;
         }
+        *sock_ret = sock;
         /* it is equivalent to the REUSEADDR option in user-space */
         sock->sk->sk_reuse = SK_CAN_REUSE;
         result = sysctl_sync_sock_size(ipvs);
@@ -1571,7 +1552,7 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
                 set_sock_size(sock->sk, 0, result);
 
         get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
-        sock->sk->sk_bound_dev_if = ifindex;
+        sock->sk->sk_bound_dev_if = dev->ifindex;
         result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
         if (result < 0) {
                 pr_err("Error binding to the multicast addr\n");
@@ -1582,21 +1563,20 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
 #ifdef CONFIG_IP_VS_IPV6
         if (ipvs->bcfg.mcast_af == AF_INET6)
                 result = join_mcast_group6(sock->sk, &mcast_addr.in6.sin6_addr,
-                                           ipvs->bcfg.mcast_ifn);
+                                           dev);
         else
 #endif
                 result = join_mcast_group(sock->sk, &mcast_addr.in.sin_addr,
-                                          ipvs->bcfg.mcast_ifn);
+                                          dev);
         if (result < 0) {
                 pr_err("Error joining to the multicast group\n");
                 goto error;
         }
 
-        return sock;
+        return 0;
 
 error:
-        sock_release(sock);
-        return ERR_PTR(result);
+        return result;
 }
 
 
@@ -1778,13 +1758,12 @@ static int sync_thread_backup(void *data)
 int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
                       int state)
 {
-        struct ip_vs_sync_thread_data *tinfo;
+        struct ip_vs_sync_thread_data *tinfo = NULL;
         struct task_struct **array = NULL, *task;
-        struct socket *sock;
         struct net_device *dev;
         char *name;
         int (*threadfn)(void *data);
-        int id, count, hlen;
+        int id = 0, count, hlen;
         int result = -ENOMEM;
         u16 mtu, min_mtu;
 
@@ -1792,6 +1771,18 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
                   sizeof(struct ip_vs_sync_conn_v0));
 
+        /* Do not hold one mutex and then to block on another */
+        for (;;) {
+                rtnl_lock();
+                if (mutex_trylock(&ipvs->sync_mutex))
+                        break;
+                rtnl_unlock();
+                mutex_lock(&ipvs->sync_mutex);
+                if (rtnl_trylock())
+                        break;
+                mutex_unlock(&ipvs->sync_mutex);
+        }
+
         if (!ipvs->sync_state) {
                 count = clamp(sysctl_sync_ports(ipvs), 1, IPVS_SYNC_PORTS_MAX);
                 ipvs->threads_mask = count - 1;
@@ -1810,7 +1801,8 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         dev = __dev_get_by_name(ipvs->net, c->mcast_ifn);
         if (!dev) {
                 pr_err("Unknown mcast interface: %s\n", c->mcast_ifn);
-                return -ENODEV;
+                result = -ENODEV;
+                goto out_early;
         }
         hlen = (AF_INET6 == c->mcast_af) ?
                sizeof(struct ipv6hdr) + sizeof(struct udphdr) :
@@ -1827,26 +1819,30 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
                 c->sync_maxlen = mtu - hlen;
 
         if (state == IP_VS_STATE_MASTER) {
+                result = -EEXIST;
                 if (ipvs->ms)
-                        return -EEXIST;
+                        goto out_early;
 
                 ipvs->mcfg = *c;
                 name = "ipvs-m:%d:%d";
                 threadfn = sync_thread_master;
         } else if (state == IP_VS_STATE_BACKUP) {
+                result = -EEXIST;
                 if (ipvs->backup_threads)
-                        return -EEXIST;
+                        goto out_early;
 
                 ipvs->bcfg = *c;
                 name = "ipvs-b:%d:%d";
                 threadfn = sync_thread_backup;
         } else {
-                return -EINVAL;
+                result = -EINVAL;
+                goto out_early;
         }
 
         if (state == IP_VS_STATE_MASTER) {
                 struct ipvs_master_sync_state *ms;
 
+                result = -ENOMEM;
                 ipvs->ms = kcalloc(count, sizeof(ipvs->ms[0]), GFP_KERNEL);
                 if (!ipvs->ms)
                         goto out;
@@ -1862,39 +1858,38 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         } else {
                 array = kcalloc(count, sizeof(struct task_struct *),
                                 GFP_KERNEL);
+                result = -ENOMEM;
                 if (!array)
                         goto out;
         }
 
-        tinfo = NULL;
         for (id = 0; id < count; id++) {
-                if (state == IP_VS_STATE_MASTER)
-                        sock = make_send_sock(ipvs, id);
-                else
-                        sock = make_receive_sock(ipvs, id, dev->ifindex);
-                if (IS_ERR(sock)) {
-                        result = PTR_ERR(sock);
-                        goto outtinfo;
-                }
+                result = -ENOMEM;
                 tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
                 if (!tinfo)
-                        goto outsocket;
+                        goto out;
                 tinfo->ipvs = ipvs;
-                tinfo->sock = sock;
+                tinfo->sock = NULL;
                 if (state == IP_VS_STATE_BACKUP) {
                         tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen,
                                              GFP_KERNEL);
                         if (!tinfo->buf)
-                                goto outtinfo;
+                                goto out;
                 } else {
                         tinfo->buf = NULL;
                 }
                 tinfo->id = id;
+                if (state == IP_VS_STATE_MASTER)
+                        result = make_send_sock(ipvs, id, dev, &tinfo->sock);
+                else
+                        result = make_receive_sock(ipvs, id, dev, &tinfo->sock);
+                if (result < 0)
+                        goto out;
 
                 task = kthread_run(threadfn, tinfo, name, ipvs->gen, id);
                 if (IS_ERR(task)) {
                         result = PTR_ERR(task);
-                        goto outtinfo;
+                        goto out;
                 }
                 tinfo = NULL;
                 if (state == IP_VS_STATE_MASTER)
@@ -1911,20 +1906,20 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         ipvs->sync_state |= state;
         spin_unlock_bh(&ipvs->sync_buff_lock);
 
+        mutex_unlock(&ipvs->sync_mutex);
+        rtnl_unlock();
+
         /* increase the module use count */
         ip_vs_use_count_inc();
 
         return 0;
 
-outsocket:
-        sock_release(sock);
-
-outtinfo:
-        if (tinfo) {
-                sock_release(tinfo->sock);
-                kfree(tinfo->buf);
-                kfree(tinfo);
-        }
+out:
+        /* We do not need RTNL lock anymore, release it here so that
+         * sock_release below and in the kthreads can use rtnl_lock
+         * to leave the mcast group.
+         */
+        rtnl_unlock();
         count = id;
         while (count-- > 0) {
                 if (state == IP_VS_STATE_MASTER)
@@ -1932,13 +1927,23 @@ outtinfo:
                 else
                         kthread_stop(array[count]);
         }
-        kfree(array);
-
-out:
         if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
                 kfree(ipvs->ms);
                 ipvs->ms = NULL;
         }
+        mutex_unlock(&ipvs->sync_mutex);
+        if (tinfo) {
+                if (tinfo->sock)
+                        sock_release(tinfo->sock);
+                kfree(tinfo->buf);
+                kfree(tinfo);
+        }
+        kfree(array);
+        return result;
+
+out_early:
+        mutex_unlock(&ipvs->sync_mutex);
+        rtnl_unlock();
         return result;
 }
 
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 8ef21d9f9a00..4b2b3d53acfc 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -252,7 +252,7 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
 static inline int expect_matches(const struct nf_conntrack_expect *a,
                                  const struct nf_conntrack_expect *b)
 {
-        return a->master == b->master && a->class == b->class &&
+        return a->master == b->master &&
                nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
                nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
                net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) &&
@@ -421,6 +421,9 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         h = nf_ct_expect_dst_hash(net, &expect->tuple);
         hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
                 if (expect_matches(i, expect)) {
+                        if (i->class != expect->class)
+                                return -EALREADY;
+
                         if (nf_ct_remove_expect(i))
                                 break;
                 } else if (expect_clash(i, expect)) {
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 9fe0ddc333fb..277bbfe26478 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -9,6 +9,7 @@
  *      2 of the License, or (at your option) any later version.
  */
 #include <linux/kernel.h>
+#include <linux/kmemleak.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
@@ -71,6 +72,7 @@ void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
         rcu_read_unlock();
 
         alloc = max(newlen, NF_CT_EXT_PREALLOC);
+        kmemleak_not_leak(old);
         new = __krealloc(old, alloc, gfp);
         if (!new)
                 return NULL;
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 4dbb5bad4363..908e51e2dc2b 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -938,11 +938,19 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
                                        datalen, rtp_exp, rtcp_exp,
                                        mediaoff, medialen, daddr);
         else {
-                if (nf_ct_expect_related(rtp_exp) == 0) {
-                        if (nf_ct_expect_related(rtcp_exp) != 0)
-                                nf_ct_unexpect_related(rtp_exp);
-                        else
+                /* -EALREADY handling works around end-points that send
+                 * SDP messages with identical port but different media type,
+                 * we pretend expectation was set up.
+                 */
+                int errp = nf_ct_expect_related(rtp_exp);
+
+                if (errp == 0 || errp == -EALREADY) {
+                        int errcp = nf_ct_expect_related(rtcp_exp);
+
+                        if (errcp == 0 || errcp == -EALREADY)
                                 ret = NF_ACCEPT;
+                        else if (errp == 0)
+                                nf_ct_unexpect_related(rtp_exp);
                 }
         }
         nf_ct_expect_put(rtcp_exp);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 9134cc429ad4..04d4e3772584 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2361,41 +2361,46 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
         }
 
         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
-                if (nft_is_active_next(net, old_rule)) {
-                        trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
-                                                   old_rule);
-                        if (trans == NULL) {
-                                err = -ENOMEM;
-                                goto err2;
-                        }
-                        nft_deactivate_next(net, old_rule);
-                        chain->use--;
-                        list_add_tail_rcu(&rule->list, &old_rule->list);
-                } else {
+                if (!nft_is_active_next(net, old_rule)) {
                         err = -ENOENT;
                         goto err2;
                 }
-        } else if (nlh->nlmsg_flags & NLM_F_APPEND)
-                if (old_rule)
-                        list_add_rcu(&rule->list, &old_rule->list);
-                else
-                        list_add_tail_rcu(&rule->list, &chain->rules);
-        else {
-                if (old_rule)
-                        list_add_tail_rcu(&rule->list, &old_rule->list);
-                else
-                        list_add_rcu(&rule->list, &chain->rules);
-        }
+                trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
+                                           old_rule);
+                if (trans == NULL) {
+                        err = -ENOMEM;
+                        goto err2;
+                }
+                nft_deactivate_next(net, old_rule);
+                chain->use--;
 
-        if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
-                err = -ENOMEM;
-                goto err3;
+                if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
+                        err = -ENOMEM;
+                        goto err2;
+                }
+
+                list_add_tail_rcu(&rule->list, &old_rule->list);
+        } else {
+                if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
+                        err = -ENOMEM;
+                        goto err2;
+                }
+
+                if (nlh->nlmsg_flags & NLM_F_APPEND) {
+                        if (old_rule)
+                                list_add_rcu(&rule->list, &old_rule->list);
+                        else
+                                list_add_tail_rcu(&rule->list, &chain->rules);
+                 } else {
+                        if (old_rule)
+                                list_add_tail_rcu(&rule->list, &old_rule->list);
+                        else
+                                list_add_rcu(&rule->list, &chain->rules);
+                }
         }
         chain->use++;
         return 0;
 
-err3:
-        list_del_rcu(&rule->list);
 err2:
         nf_tables_rule_destroy(&ctx, rule);
 err1:
@@ -3207,18 +3212,20 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 
         err = ops->init(set, &desc, nla);
         if (err < 0)
-                goto err2;
+                goto err3;
 
         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
         if (err < 0)
-                goto err3;
+                goto err4;
 
         list_add_tail_rcu(&set->list, &table->sets);
         table->use++;
         return 0;
 
-err3:
+err4:
         ops->destroy(set);
+err3:
+        kfree(set->name);
 err2:
         kvfree(set);
 err1:
@@ -5738,7 +5745,7 @@ static void nft_chain_commit_update(struct nft_trans *trans)
         struct nft_base_chain *basechain;
 
         if (nft_trans_chain_name(trans))
-                strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
+                swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
 
         if (!nft_is_base_chain(trans->ctx.chain))
                 return;
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 773da82190dc..94df000abb92 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -36,11 +36,10 @@ MODULE_ALIAS("ipt_connmark");
 MODULE_ALIAS("ip6t_connmark");
 
 static unsigned int
-connmark_tg_shift(struct sk_buff *skb,
-                const struct xt_connmark_tginfo1 *info,
-                u8 shift_bits, u8 shift_dir)
+connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
 {
         enum ip_conntrack_info ctinfo;
+        u_int32_t new_targetmark;
         struct nf_conn *ct;
         u_int32_t newmark;
 
@@ -51,34 +50,39 @@ connmark_tg_shift(struct sk_buff *skb,
         switch (info->mode) {
         case XT_CONNMARK_SET:
                 newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
-                if (shift_dir == D_SHIFT_RIGHT)
-                        newmark >>= shift_bits;
+                if (info->shift_dir == D_SHIFT_RIGHT)
+                        newmark >>= info->shift_bits;
                 else
-                        newmark <<= shift_bits;
+                        newmark <<= info->shift_bits;
+
                 if (ct->mark != newmark) {
                         ct->mark = newmark;
                         nf_conntrack_event_cache(IPCT_MARK, ct);
                 }
                 break;
         case XT_CONNMARK_SAVE:
-                newmark = (ct->mark & ~info->ctmask) ^
-                          (skb->mark & info->nfmask);
-                if (shift_dir == D_SHIFT_RIGHT)
-                        newmark >>= shift_bits;
+                new_targetmark = (skb->mark & info->nfmask);
+                if (info->shift_dir == D_SHIFT_RIGHT)
+                        new_targetmark >>= info->shift_bits;
                 else
-                        newmark <<= shift_bits;
+                        new_targetmark <<= info->shift_bits;
+
+                newmark = (ct->mark & ~info->ctmask) ^
+                          new_targetmark;
                 if (ct->mark != newmark) {
                         ct->mark = newmark;
                         nf_conntrack_event_cache(IPCT_MARK, ct);
                 }
                 break;
         case XT_CONNMARK_RESTORE:
-                newmark = (skb->mark & ~info->nfmask) ^
-                          (ct->mark & info->ctmask);
-                if (shift_dir == D_SHIFT_RIGHT)
-                        newmark >>= shift_bits;
+                new_targetmark = (ct->mark & info->ctmask);
+                if (info->shift_dir == D_SHIFT_RIGHT)
+                        new_targetmark >>= info->shift_bits;
                 else
-                        newmark <<= shift_bits;
+                        new_targetmark <<= info->shift_bits;
+
+                newmark = (skb->mark & ~info->nfmask) ^
+                          new_targetmark;
                 skb->mark = newmark;
                 break;
         }
@@ -89,8 +93,14 @@ static unsigned int
 connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct xt_connmark_tginfo1 *info = par->targinfo;
-
-        return connmark_tg_shift(skb, info, 0, 0);
+        const struct xt_connmark_tginfo2 info2 = {
+                .ctmark = info->ctmark,
+                .ctmask = info->ctmask,
+                .nfmask = info->nfmask,
+                .mode   = info->mode,
+        };
+
+        return connmark_tg_shift(skb, &info2);
 }
 
 static unsigned int
@@ -98,8 +108,7 @@ connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct xt_connmark_tginfo2 *info = par->targinfo;
 
-        return connmark_tg_shift(skb, (const struct xt_connmark_tginfo1 *)info,
-                                 info->shift_bits, info->shift_dir);
+        return connmark_tg_shift(skb, info);
 }
 
 static int connmark_tg_check(const struct xt_tgchk_param *par)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c31b0687396a..01f3515cada0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -329,11 +329,11 @@ static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
         skb_set_queue_mapping(skb, queue_index);
 }
 
-/* register_prot_hook must be invoked with the po->bind_lock held,
+/* __register_prot_hook must be invoked through register_prot_hook
  * or from a context in which asynchronous accesses to the packet
  * socket is not possible (packet_create()).
  */
-static void register_prot_hook(struct sock *sk)
+static void __register_prot_hook(struct sock *sk)
 {
         struct packet_sock *po = pkt_sk(sk);
 
@@ -348,8 +348,13 @@ static void register_prot_hook(struct sock *sk)
         }
 }
 
-/* {,__}unregister_prot_hook() must be invoked with the po->bind_lock
- * held.   If the sync parameter is true, we will temporarily drop
+static void register_prot_hook(struct sock *sk)
+{
+        lockdep_assert_held_once(&pkt_sk(sk)->bind_lock);
+        __register_prot_hook(sk);
+}
+
+/* If the sync parameter is true, we will temporarily drop
  * the po->bind_lock and do a synchronize_net to make sure no
  * asynchronous packet processing paths still refer to the elements
  * of po->prot_hook.  If the sync parameter is false, it is the
@@ -359,6 +364,8 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
 {
         struct packet_sock *po = pkt_sk(sk);
 
+        lockdep_assert_held_once(&po->bind_lock);
+
         po->running = 0;
 
         if (po->fanout)
@@ -3252,7 +3259,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
 
         if (proto) {
                 po->prot_hook.type = proto;
-                register_prot_hook(sk);
+                __register_prot_hook(sk);
         }
 
         mutex_lock(&net->packet.sklist_lock);
@@ -3732,12 +3739,18 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
-                po->tp_loss = !!val;
-                return 0;
+
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_loss = !!val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_AUXDATA:
         {
@@ -3748,7 +3761,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
 
+                lock_sock(sk);
                 po->auxdata = !!val;
+                release_sock(sk);
                 return 0;
         }
         case PACKET_ORIGDEV:
@@ -3760,7 +3775,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
 
+                lock_sock(sk);
                 po->origdev = !!val;
+                release_sock(sk);
                 return 0;
         }
         case PACKET_VNET_HDR:
@@ -3769,15 +3786,20 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (sock->type != SOCK_RAW)
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (optlen < sizeof(val))
                         return -EINVAL;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
 
-                po->has_vnet_hdr = !!val;
-                return 0;
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->has_vnet_hdr = !!val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_TIMESTAMP:
         {
@@ -3815,11 +3837,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
-                po->tp_tx_has_off = !!val;
+
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_tx_has_off = !!val;
+                        ret = 0;
+                }
+                release_sock(sk);
                 return 0;
         }
         case PACKET_QDISC_BYPASS:
diff --git a/net/packet/internal.h b/net/packet/internal.h
index a1d2b2319ae9..3bb7c5fb3bff 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -112,10 +112,12 @@ struct packet_sock {
         int                     copy_thresh;
         spinlock_t              bind_lock;
         struct mutex            pg_vec_lock;
-        unsigned int            running:1,      /* prot_hook is attached*/
-                                auxdata:1,
+        unsigned int            running;        /* bind_lock must be held */
+        unsigned int            auxdata:1,      /* writer must hold sock lock */
                                 origdev:1,
-                                has_vnet_hdr:1;
+                                has_vnet_hdr:1,
+                                tp_loss:1,
+                                tp_tx_has_off:1;
         int                     pressure;
         int                     ifindex;        /* bound device         */
         __be16                  num;
@@ -125,8 +127,6 @@ struct packet_sock {
         enum tpacket_versions   tp_version;
         unsigned int            tp_hdrlen;
         unsigned int            tp_reserve;
-        unsigned int            tp_loss:1;
-        unsigned int            tp_tx_has_off:1;
         unsigned int            tp_tstamp;
         struct net_device __rcu *cached_dev;
         int                     (*xmit)(struct sk_buff *skb);
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index a5994cf0512b..8527cfdc446d 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -652,7 +652,7 @@ static int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife,
                 }
         }
 
-        return 0;
+        return -ENOENT;
 }
 
 static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
@@ -682,7 +682,12 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                 u16 mtype;
                 u16 dlen;
 
-                curr_data = ife_tlv_meta_decode(tlv_data, &mtype, &dlen, NULL);
+                curr_data = ife_tlv_meta_decode(tlv_data, ifehdr_end, &mtype,
+                                                &dlen, NULL);
+                if (!curr_data) {
+                        qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
+                        return TC_ACT_SHOT;
+                }
 
                 if (find_decode_metaid(skb, ife, mtype, dlen, curr_data)) {
                         /* abuse overlimits to count when we receive metadata
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 805b139756db..092bebc70048 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -67,7 +67,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
 
 static void strp_start_timer(struct strparser *strp, long timeo)
 {
-        if (timeo)
+        if (timeo && timeo != LONG_MAX)
                 mod_delayed_work(strp_wq, &strp->msg_timer_work, timeo);
 }
 
diff --git a/security/commoncap.c b/security/commoncap.c
index 48620c93d697..1ce701fcb3f3 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
                                 magic |= VFS_CAP_FLAGS_EFFECTIVE;
                         memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
                         cap->magic_etc = cpu_to_le32(magic);
+                } else {
+                        size = -ENOMEM;
                 }
         }
         kfree(tmpbuf);
diff --git a/sound/core/control.c b/sound/core/control.c
index 69734b0eafd0..9aa15bfc7936 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1492,7 +1492,7 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
                              int op_flag)
 {
         struct snd_ctl_tlv header;
-        unsigned int *container;
+        unsigned int __user *container;
         unsigned int container_size;
         struct snd_kcontrol *kctl;
         struct snd_ctl_elem_id id;
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index b719d0bd833e..06d7c40af570 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -27,10 +27,11 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
                                       s32 __user *src)
 {
         snd_pcm_sframes_t delay;
+        int err;
 
-        delay = snd_pcm_delay(substream);
-        if (delay < 0)
-                return delay;
+        err = snd_pcm_delay(substream, &delay);
+        if (err)
+                return err;
         if (put_user(delay, src))
                 return -EFAULT;
         return 0;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 35ffccea94c3..0e875d5a9e86 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2692,7 +2692,8 @@ static int snd_pcm_hwsync(struct snd_pcm_substream *substream)
         return err;
 }
                 
-static snd_pcm_sframes_t snd_pcm_delay(struct snd_pcm_substream *substream)
+static int snd_pcm_delay(struct snd_pcm_substream *substream,
+                         snd_pcm_sframes_t *delay)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         int err;
@@ -2708,7 +2709,9 @@ static snd_pcm_sframes_t snd_pcm_delay(struct snd_pcm_substream *substream)
                 n += runtime->delay;
         }
         snd_pcm_stream_unlock_irq(substream);
-        return err < 0 ? err : n;
+        if (!err)
+                *delay = n;
+        return err;
 }
                 
 static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream,
@@ -2751,6 +2754,7 @@ static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream,
         sync_ptr.s.status.hw_ptr = status->hw_ptr;
         sync_ptr.s.status.tstamp = status->tstamp;
         sync_ptr.s.status.suspended_state = status->suspended_state;
+        sync_ptr.s.status.audio_tstamp = status->audio_tstamp;
         snd_pcm_stream_unlock_irq(substream);
         if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr)))
                 return -EFAULT;
@@ -2916,11 +2920,13 @@ static int snd_pcm_common_ioctl(struct file *file,
                 return snd_pcm_hwsync(substream);
         case SNDRV_PCM_IOCTL_DELAY:
         {
-                snd_pcm_sframes_t delay = snd_pcm_delay(substream);
+                snd_pcm_sframes_t delay;
                 snd_pcm_sframes_t __user *res = arg;
+                int err;
 
-                if (delay < 0)
-                        return delay;
+                err = snd_pcm_delay(substream, &delay);
+                if (err)
+                        return err;
                 if (put_user(delay, res))
                         return -EFAULT;
                 return 0;
@@ -3008,13 +3014,7 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
         case SNDRV_PCM_IOCTL_DROP:
                 return snd_pcm_drop(substream);
         case SNDRV_PCM_IOCTL_DELAY:
-        {
-                result = snd_pcm_delay(substream);
-                if (result < 0)
-                        return result;
-                *frames = result;
-                return 0;
-        }
+                return snd_pcm_delay(substream, frames);
         default:
                 return -EINVAL;
         }
@@ -3234,7 +3234,7 @@ static __poll_t snd_pcm_capture_poll(struct file *file, poll_table * wait)
 /*
  * mmap status record
  */
-static int snd_pcm_mmap_status_fault(struct vm_fault *vmf)
+static vm_fault_t snd_pcm_mmap_status_fault(struct vm_fault *vmf)
 {
         struct snd_pcm_substream *substream = vmf->vma->vm_private_data;
         struct snd_pcm_runtime *runtime;
@@ -3270,7 +3270,7 @@ static int snd_pcm_mmap_status(struct snd_pcm_substream *substream, struct file
 /*
  * mmap control record
  */
-static int snd_pcm_mmap_control_fault(struct vm_fault *vmf)
+static vm_fault_t snd_pcm_mmap_control_fault(struct vm_fault *vmf)
 {
         struct snd_pcm_substream *substream = vmf->vma->vm_private_data;
         struct snd_pcm_runtime *runtime;
@@ -3359,7 +3359,7 @@ snd_pcm_default_page_ops(struct snd_pcm_substream *substream, unsigned long ofs)
 /*
  * fault callback for mmapping a RAM page
  */
-static int snd_pcm_mmap_data_fault(struct vm_fault *vmf)
+static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf)
 {
         struct snd_pcm_substream *substream = vmf->vma->vm_private_data;
         struct snd_pcm_runtime *runtime;
diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c
index c3908862bc8b..86ca584c27b2 100644
--- a/sound/core/seq/oss/seq_oss_event.c
+++ b/sound/core/seq/oss/seq_oss_event.c
@@ -26,6 +26,7 @@
 #include <sound/seq_oss_legacy.h>
 #include "seq_oss_readq.h"
 #include "seq_oss_writeq.h"
+#include <linux/nospec.h>
 
 
 /*
@@ -287,10 +288,10 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st
 {
         struct seq_oss_synthinfo *info;
 
-        if (!snd_seq_oss_synth_is_valid(dp, dev))
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        info = &dp->synths[dev];
         switch (info->arg.event_passing) {
         case SNDRV_SEQ_OSS_PROCESS_EVENTS:
                 if (! info->ch || ch < 0 || ch >= info->nr_voices) {
@@ -298,6 +299,7 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st
                         return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev);
                 }
 
+                ch = array_index_nospec(ch, info->nr_voices);
                 if (note == 255 && info->ch[ch].note >= 0) {
                         /* volume control */
                         int type;
@@ -347,10 +349,10 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
 {
         struct seq_oss_synthinfo *info;
 
-        if (!snd_seq_oss_synth_is_valid(dp, dev))
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        info = &dp->synths[dev];
         switch (info->arg.event_passing) {
         case SNDRV_SEQ_OSS_PROCESS_EVENTS:
                 if (! info->ch || ch < 0 || ch >= info->nr_voices) {
@@ -358,6 +360,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
                         return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev);
                 }
 
+                ch = array_index_nospec(ch, info->nr_voices);
                 if (info->ch[ch].note >= 0) {
                         note = info->ch[ch].note;
                         info->ch[ch].vel = 0;
@@ -381,7 +384,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
 static int
 set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note, int vel, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        if (!snd_seq_oss_synth_info(dp, dev))
                 return -ENXIO;
         
         ev->type = type;
@@ -399,7 +402,7 @@ set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note,
 static int
 set_control_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int param, int val, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        if (!snd_seq_oss_synth_info(dp, dev))
                 return -ENXIO;
         
         ev->type = type;
diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
index b30b2139e3f0..9debd1b8fd28 100644
--- a/sound/core/seq/oss/seq_oss_midi.c
+++ b/sound/core/seq/oss/seq_oss_midi.c
@@ -29,6 +29,7 @@
 #include "../seq_lock.h"
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 
 
 /*
@@ -315,6 +316,7 @@ get_mididev(struct seq_oss_devinfo *dp, int dev)
 {
         if (dev < 0 || dev >= dp->max_mididev)
                 return NULL;
+        dev = array_index_nospec(dev, dp->max_mididev);
         return get_mdev(dev);
 }
 
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index cd0e0ebbfdb1..278ebb993122 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -26,6 +26,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 
 /*
  * constants
@@ -339,17 +340,13 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
         dp->max_synthdev = 0;
 }
 
-/*
- * check if the specified device is MIDI mapped device
- */
-static int
-is_midi_dev(struct seq_oss_devinfo *dp, int dev)
+static struct seq_oss_synthinfo *
+get_synthinfo_nospec(struct seq_oss_devinfo *dp, int dev)
 {
         if (dev < 0 || dev >= dp->max_synthdev)
-                return 0;
-        if (dp->synths[dev].is_midi)
-                return 1;
-        return 0;
+                return NULL;
+        dev = array_index_nospec(dev, SNDRV_SEQ_OSS_MAX_SYNTH_DEVS);
+        return &dp->synths[dev];
 }
 
 /*
@@ -359,14 +356,20 @@ static struct seq_oss_synth *
 get_synthdev(struct seq_oss_devinfo *dp, int dev)
 {
         struct seq_oss_synth *rec;
-        if (dev < 0 || dev >= dp->max_synthdev)
-                return NULL;
-        if (! dp->synths[dev].opened)
+        struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
+
+        if (!info)
                 return NULL;
-        if (dp->synths[dev].is_midi)
-                return &midi_synth_dev;
-        if ((rec = get_sdev(dev)) == NULL)
+        if (!info->opened)
                 return NULL;
+        if (info->is_midi) {
+                rec = &midi_synth_dev;
+                snd_use_lock_use(&rec->use_lock);
+        } else {
+                rec = get_sdev(dev);
+                if (!rec)
+                        return NULL;
+        }
         if (! rec->opened) {
                 snd_use_lock_free(&rec->use_lock);
                 return NULL;
@@ -402,10 +405,8 @@ snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev)
         struct seq_oss_synth *rec;
         struct seq_oss_synthinfo *info;
 
-        if (snd_BUG_ON(dev < 0 || dev >= dp->max_synthdev))
-                return;
-        info = &dp->synths[dev];
-        if (! info->opened)
+        info = get_synthinfo_nospec(dp, dev);
+        if (!info || !info->opened)
                 return;
         if (info->sysex)
                 info->sysex->len = 0; /* reset sysex */
@@ -454,12 +455,14 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
                             const char __user *buf, int p, int c)
 {
         struct seq_oss_synth *rec;
+        struct seq_oss_synthinfo *info;
         int rc;
 
-        if (dev < 0 || dev >= dp->max_synthdev)
+        info = get_synthinfo_nospec(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        if (is_midi_dev(dp, dev))
+        if (info->is_midi)
                 return 0;
         if ((rec = get_synthdev(dp, dev)) == NULL)
                 return -ENXIO;
@@ -467,24 +470,25 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
         if (rec->oper.load_patch == NULL)
                 rc = -ENXIO;
         else
-                rc = rec->oper.load_patch(&dp->synths[dev].arg, fmt, buf, p, c);
+                rc = rec->oper.load_patch(&info->arg, fmt, buf, p, c);
         snd_use_lock_free(&rec->use_lock);
         return rc;
 }
 
 /*
- * check if the device is valid synth device
+ * check if the device is valid synth device and return the synth info
  */
-int
-snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev)
+struct seq_oss_synthinfo *
+snd_seq_oss_synth_info(struct seq_oss_devinfo *dp, int dev)
 {
         struct seq_oss_synth *rec;
+
         rec = get_synthdev(dp, dev);
         if (rec) {
                 snd_use_lock_free(&rec->use_lock);
-                return 1;
+                return get_synthinfo_nospec(dp, dev);
         }
-        return 0;
+        return NULL;
 }
 
 
@@ -499,16 +503,18 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
         int i, send;
         unsigned char *dest;
         struct seq_oss_synth_sysex *sysex;
+        struct seq_oss_synthinfo *info;
 
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        sysex = dp->synths[dev].sysex;
+        sysex = info->sysex;
         if (sysex == NULL) {
                 sysex = kzalloc(sizeof(*sysex), GFP_KERNEL);
                 if (sysex == NULL)
                         return -ENOMEM;
-                dp->synths[dev].sysex = sysex;
+                info->sysex = sysex;
         }
 
         send = 0;
@@ -553,10 +559,12 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
 int
 snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        struct seq_oss_synthinfo *info = snd_seq_oss_synth_info(dp, dev);
+
+        if (!info)
                 return -EINVAL;
-        snd_seq_oss_fill_addr(dp, ev, dp->synths[dev].arg.addr.client,
-                              dp->synths[dev].arg.addr.port);
+        snd_seq_oss_fill_addr(dp, ev, info->arg.addr.client,
+                              info->arg.addr.port);
         return 0;
 }
 
@@ -568,16 +576,18 @@ int
 snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, unsigned long addr)
 {
         struct seq_oss_synth *rec;
+        struct seq_oss_synthinfo *info;
         int rc;
 
-        if (is_midi_dev(dp, dev))
+        info = get_synthinfo_nospec(dp, dev);
+        if (!info || info->is_midi)
                 return -ENXIO;
         if ((rec = get_synthdev(dp, dev)) == NULL)
                 return -ENXIO;
         if (rec->oper.ioctl == NULL)
                 rc = -ENXIO;
         else
-                rc = rec->oper.ioctl(&dp->synths[dev].arg, cmd, addr);
+                rc = rec->oper.ioctl(&info->arg, cmd, addr);
         snd_use_lock_free(&rec->use_lock);
         return rc;
 }
@@ -589,7 +599,10 @@ snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, u
 int
 snd_seq_oss_synth_raw_event(struct seq_oss_devinfo *dp, int dev, unsigned char *data, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev) || is_midi_dev(dp, dev))
+        struct seq_oss_synthinfo *info;
+
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info || info->is_midi)
                 return -ENXIO;
         ev->type = SNDRV_SEQ_EVENT_OSS;
         memcpy(ev->data.raw8.d, data, 8);
diff --git a/sound/core/seq/oss/seq_oss_synth.h b/sound/core/seq/oss/seq_oss_synth.h
index 74ac55f166b6..a63f9e22974d 100644
--- a/sound/core/seq/oss/seq_oss_synth.h
+++ b/sound/core/seq/oss/seq_oss_synth.h
@@ -37,7 +37,8 @@ void snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp);
 void snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev);
 int snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
                                  const char __user *buf, int p, int c);
-int snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev);
+struct seq_oss_synthinfo *snd_seq_oss_synth_info(struct seq_oss_devinfo *dp,
+                                                 int dev);
 int snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
                             struct snd_seq_event *ev);
 int snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev);
diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
index ddcc1a325a61..42920a243328 100644
--- a/sound/drivers/opl3/opl3_synth.c
+++ b/sound/drivers/opl3/opl3_synth.c
@@ -21,6 +21,7 @@
 
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/nospec.h>
 #include <sound/opl3.h>
 #include <sound/asound_fm.h>
 
@@ -448,7 +449,7 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
 {
         unsigned short reg_side;
         unsigned char op_offset;
-        unsigned char voice_offset;
+        unsigned char voice_offset, voice_op;
 
         unsigned short opl3_reg;
         unsigned char reg_val;
@@ -473,7 +474,9 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
                 voice_offset = voice->voice - MAX_OPL2_VOICES;
         }
         /* Get register offset of operator */
-        op_offset = snd_opl3_regmap[voice_offset][voice->op];
+        voice_offset = array_index_nospec(voice_offset, MAX_OPL2_VOICES);
+        voice_op = array_index_nospec(voice->op, 4);
+        op_offset = snd_opl3_regmap[voice_offset][voice_op];
 
         reg_val = 0x00;
         /* Set amplitude modulation (tremolo) effect */
diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c
index 8573289c381e..928a255bfc35 100644
--- a/sound/firewire/dice/dice-stream.c
+++ b/sound/firewire/dice/dice-stream.c
@@ -435,7 +435,7 @@ int snd_dice_stream_init_duplex(struct snd_dice *dice)
                 err = init_stream(dice, AMDTP_IN_STREAM, i);
                 if (err < 0) {
                         for (; i >= 0; i--)
-                                destroy_stream(dice, AMDTP_OUT_STREAM, i);
+                                destroy_stream(dice, AMDTP_IN_STREAM, i);
                         goto end;
                 }
         }
diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
index 4ddb4cdd054b..96bb01b6b751 100644
--- a/sound/firewire/dice/dice.c
+++ b/sound/firewire/dice/dice.c
@@ -14,7 +14,7 @@ MODULE_LICENSE("GPL v2");
 #define OUI_WEISS               0x001c6a
 #define OUI_LOUD                0x000ff2
 #define OUI_FOCUSRITE           0x00130e
-#define OUI_TCELECTRONIC        0x001486
+#define OUI_TCELECTRONIC        0x000166
 
 #define DICE_CATEGORY_ID        0x04
 #define WEISS_CATEGORY_ID       0x00
diff --git a/sound/pci/asihpi/hpimsginit.c b/sound/pci/asihpi/hpimsginit.c
index 7eb617175fde..a31a70dccecf 100644
--- a/sound/pci/asihpi/hpimsginit.c
+++ b/sound/pci/asihpi/hpimsginit.c
@@ -23,6 +23,7 @@
 
 #include "hpi_internal.h"
 #include "hpimsginit.h"
+#include <linux/nospec.h>
 
 /* The actual message size for each object type */
 static u16 msg_size[HPI_OBJ_MAXINDEX + 1] = HPI_MESSAGE_SIZE_BY_OBJECT;
@@ -39,10 +40,12 @@ static void hpi_init_message(struct hpi_message *phm, u16 object,
 {
         u16 size;
 
-        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX))
+        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) {
+                object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1);
                 size = msg_size[object];
-        else
+        } else {
                 size = sizeof(*phm);
+        }
 
         memset(phm, 0, size);
         phm->size = size;
@@ -66,10 +69,12 @@ void hpi_init_response(struct hpi_response *phr, u16 object, u16 function,
 {
         u16 size;
 
-        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX))
+        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) {
+                object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1);
                 size = res_size[object];
-        else
+        } else {
                 size = sizeof(*phr);
+        }
 
         memset(phr, 0, sizeof(*phr));
         phr->size = size;
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 5badd08e1d69..b1a2a7ea4172 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -33,6 +33,7 @@
 #include <linux/stringify.h>
 #include <linux/module.h>
 #include <linux/vmalloc.h>
+#include <linux/nospec.h>
 
 #ifdef MODULE_FIRMWARE
 MODULE_FIRMWARE("asihpi/dsp5000.bin");
@@ -186,7 +187,8 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 struct hpi_adapter *pa = NULL;
 
                 if (hm->h.adapter_index < ARRAY_SIZE(adapters))
-                        pa = &adapters[hm->h.adapter_index];
+                        pa = &adapters[array_index_nospec(hm->h.adapter_index,
+                                                          ARRAY_SIZE(adapters))];
 
                 if (!pa || !pa->adapter || !pa->adapter->type) {
                         hpi_init_response(&hr->r0, hm->h.object,
diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c
index 57df06e76968..cc009a4a3d1d 100644
--- a/sound/pci/hda/hda_hwdep.c
+++ b/sound/pci/hda/hda_hwdep.c
@@ -21,6 +21,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/compat.h>
+#include <linux/nospec.h>
 #include <sound/core.h>
 #include "hda_codec.h"
 #include "hda_local.h"
@@ -51,7 +52,16 @@ static int get_wcap_ioctl(struct hda_codec *codec,
         
         if (get_user(verb, &arg->verb))
                 return -EFAULT;
-        res = get_wcaps(codec, verb >> 24);
+        /* open-code get_wcaps(verb>>24) with nospec */
+        verb >>= 24;
+        if (verb < codec->core.start_nid ||
+            verb >= codec->core.start_nid + codec->core.num_nodes) {
+                res = 0;
+        } else {
+                verb -= codec->core.start_nid;
+                verb = array_index_nospec(verb, codec->core.num_nodes);
+                res = codec->wcaps[verb];
+        }
         if (put_user(res, &arg->res))
                 return -EFAULT;
         return 0;
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index b4f1b6e88305..7d7eb1354eee 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1383,6 +1383,8 @@ static void hdmi_pcm_setup_pin(struct hdmi_spec *spec,
                 pcm = get_pcm_rec(spec, per_pin->pcm_idx);
         else
                 return;
+        if (!pcm->pcm)
+                return;
         if (!test_bit(per_pin->pcm_idx, &spec->pcm_in_use))
                 return;
 
@@ -2151,8 +2153,13 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
         int dev, err;
         int pin_idx, pcm_idx;
 
-
         for (pcm_idx = 0; pcm_idx < spec->pcm_used; pcm_idx++) {
+                if (!get_pcm_rec(spec, pcm_idx)->pcm) {
+                        /* no PCM: mark this for skipping permanently */
+                        set_bit(pcm_idx, &spec->pcm_bitmap);
+                        continue;
+                }
+
                 err = generic_hdmi_build_jack(codec, pcm_idx);
                 if (err < 0)
                         return err;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fc77bf7a1544..8c238e51bb5a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -331,6 +331,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
                 /* fallthrough */
         case 0x10ec0215:
         case 0x10ec0233:
+        case 0x10ec0235:
         case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
@@ -6575,6 +6576,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
@@ -7160,8 +7162,11 @@ static int patch_alc269(struct hda_codec *codec)
         case 0x10ec0298:
                 spec->codec_variant = ALC269_TYPE_ALC298;
                 break;
+        case 0x10ec0235:
         case 0x10ec0255:
                 spec->codec_variant = ALC269_TYPE_ALC255;
+                spec->shutup = alc256_shutup;
+                spec->init_hook = alc256_init;
                 break;
         case 0x10ec0236:
         case 0x10ec0256:
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index 4c59983158e0..11b5b5e0e058 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -137,6 +137,7 @@
 #include <linux/pci.h>
 #include <linux/math64.h>
 #include <linux/io.h>
+#include <linux/nospec.h>
 
 #include <sound/core.h>
 #include <sound/control.h>
@@ -5698,40 +5699,43 @@ static int snd_hdspm_channel_info(struct snd_pcm_substream *substream,
                 struct snd_pcm_channel_info *info)
 {
         struct hdspm *hdspm = snd_pcm_substream_chip(substream);
+        unsigned int channel = info->channel;
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                if (snd_BUG_ON(info->channel >= hdspm->max_channels_out)) {
+                if (snd_BUG_ON(channel >= hdspm->max_channels_out)) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: output channel out of range (%d)\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                if (hdspm->channel_map_out[info->channel] < 0) {
+                channel = array_index_nospec(channel, hdspm->max_channels_out);
+                if (hdspm->channel_map_out[channel] < 0) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: output channel %d mapped out\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                info->offset = hdspm->channel_map_out[info->channel] *
+                info->offset = hdspm->channel_map_out[channel] *
                         HDSPM_CHANNEL_BUFFER_BYTES;
         } else {
-                if (snd_BUG_ON(info->channel >= hdspm->max_channels_in)) {
+                if (snd_BUG_ON(channel >= hdspm->max_channels_in)) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: input channel out of range (%d)\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                if (hdspm->channel_map_in[info->channel] < 0) {
+                channel = array_index_nospec(channel, hdspm->max_channels_in);
+                if (hdspm->channel_map_in[channel] < 0) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: input channel %d mapped out\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                info->offset = hdspm->channel_map_in[info->channel] *
+                info->offset = hdspm->channel_map_in[channel] *
                         HDSPM_CHANNEL_BUFFER_BYTES;
         }
 
diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
index df648b1d9217..edd765e22377 100644
--- a/sound/pci/rme9652/rme9652.c
+++ b/sound/pci/rme9652/rme9652.c
@@ -26,6 +26,7 @@
 #include <linux/pci.h>
 #include <linux/module.h>
 #include <linux/io.h>
+#include <linux/nospec.h>
 
 #include <sound/core.h>
 #include <sound/control.h>
@@ -2071,9 +2072,10 @@ static int snd_rme9652_channel_info(struct snd_pcm_substream *substream,
         if (snd_BUG_ON(info->channel >= RME9652_NCHANNELS))
                 return -EINVAL;
 
-        if ((chn = rme9652->channel_map[info->channel]) < 0) {
+        chn = rme9652->channel_map[array_index_nospec(info->channel,
+                                                      RME9652_NCHANNELS)];
+        if (chn < 0)
                 return -EINVAL;
-        }
 
         info->offset = chn * RME9652_CHANNEL_BUFFER_BYTES;
         info->first = 0;
diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
index b205c782e494..f41560ecbcd1 100644
--- a/sound/soc/amd/acp-da7219-max98357a.c
+++ b/sound/soc/amd/acp-da7219-max98357a.c
@@ -43,7 +43,7 @@
 #define DUAL_CHANNEL            2
 
 static struct snd_soc_jack cz_jack;
-struct clk *da7219_dai_clk;
+static struct clk *da7219_dai_clk;
 
 static int cz_da7219_init(struct snd_soc_pcm_runtime *rtd)
 {
diff --git a/sound/soc/codecs/adau17x1.c b/sound/soc/codecs/adau17x1.c
index 80c2a06285bb..12bf24c26818 100644
--- a/sound/soc/codecs/adau17x1.c
+++ b/sound/soc/codecs/adau17x1.c
@@ -502,7 +502,7 @@ static int adau17x1_hw_params(struct snd_pcm_substream *substream,
         }
 
         if (adau->sigmadsp) {
-                ret = adau17x1_setup_firmware(adau, params_rate(params));
+                ret = adau17x1_setup_firmware(component, params_rate(params));
                 if (ret < 0)
                         return ret;
         }
@@ -835,26 +835,40 @@ bool adau17x1_volatile_register(struct device *dev, unsigned int reg)
 }
 EXPORT_SYMBOL_GPL(adau17x1_volatile_register);
 
-int adau17x1_setup_firmware(struct adau *adau, unsigned int rate)
+int adau17x1_setup_firmware(struct snd_soc_component *component,
+        unsigned int rate)
 {
         int ret;
-        int dspsr;
+        int dspsr, dsp_run;
+        struct adau *adau = snd_soc_component_get_drvdata(component);
+        struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
+
+        snd_soc_dapm_mutex_lock(dapm);
 
         ret = regmap_read(adau->regmap, ADAU17X1_DSP_SAMPLING_RATE, &dspsr);
         if (ret)
-                return ret;
+                goto err;
+
+        ret = regmap_read(adau->regmap, ADAU17X1_DSP_RUN, &dsp_run);
+        if (ret)
+                goto err;
 
         regmap_write(adau->regmap, ADAU17X1_DSP_ENABLE, 1);
         regmap_write(adau->regmap, ADAU17X1_DSP_SAMPLING_RATE, 0xf);
+        regmap_write(adau->regmap, ADAU17X1_DSP_RUN, 0);
 
         ret = sigmadsp_setup(adau->sigmadsp, rate);
         if (ret) {
                 regmap_write(adau->regmap, ADAU17X1_DSP_ENABLE, 0);
-                return ret;
+                goto err;
         }
         regmap_write(adau->regmap, ADAU17X1_DSP_SAMPLING_RATE, dspsr);
+        regmap_write(adau->regmap, ADAU17X1_DSP_RUN, dsp_run);
 
-        return 0;
+err:
+        snd_soc_dapm_mutex_unlock(dapm);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(adau17x1_setup_firmware);
 
diff --git a/sound/soc/codecs/adau17x1.h b/sound/soc/codecs/adau17x1.h
index a7b1cb770814..e6fe87beec07 100644
--- a/sound/soc/codecs/adau17x1.h
+++ b/sound/soc/codecs/adau17x1.h
@@ -68,7 +68,8 @@ int adau17x1_resume(struct snd_soc_component *component);
 
 extern const struct snd_soc_dai_ops adau17x1_dai_ops;
 
-int adau17x1_setup_firmware(struct adau *adau, unsigned int rate);
+int adau17x1_setup_firmware(struct snd_soc_component *component,
+        unsigned int rate);
 bool adau17x1_has_dsp(struct adau *adau);
 
 #define ADAU17X1_CLOCK_CONTROL                  0x4000
diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
index 12ee83d52405..b7cf7cce95fe 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -1187,7 +1187,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
                 return irq;
         }
 
-        ret = devm_request_irq(dev, irq, pm8916_mbhc_switch_irq_handler,
+        ret = devm_request_threaded_irq(dev, irq, NULL,
+                               pm8916_mbhc_switch_irq_handler,
                                IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING |
                                IRQF_ONESHOT,
                                "mbhc switch irq", priv);
@@ -1201,7 +1202,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
                         return irq;
                 }
 
-                ret = devm_request_irq(dev, irq, mbhc_btn_press_irq_handler,
+                ret = devm_request_threaded_irq(dev, irq, NULL,
+                                       mbhc_btn_press_irq_handler,
                                        IRQF_TRIGGER_RISING |
                                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                        "mbhc btn press irq", priv);
@@ -1214,7 +1216,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
                         return irq;
                 }
 
-                ret = devm_request_irq(dev, irq, mbhc_btn_release_irq_handler,
+                ret = devm_request_threaded_irq(dev, irq, NULL,
+                                       mbhc_btn_release_irq_handler,
                                        IRQF_TRIGGER_RISING |
                                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                        "mbhc btn release irq", priv);
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index e8a66b03faab..1570b91bf018 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -89,6 +89,7 @@ static const struct reg_default rt5514_reg[] = {
         {RT5514_PLL3_CALIB_CTRL5,       0x40220012},
         {RT5514_DELAY_BUF_CTRL1,        0x7fff006a},
         {RT5514_DELAY_BUF_CTRL3,        0x00000000},
+        {RT5514_ASRC_IN_CTRL1,          0x00000003},
         {RT5514_DOWNFILTER0_CTRL1,      0x00020c2f},
         {RT5514_DOWNFILTER0_CTRL2,      0x00020c2f},
         {RT5514_DOWNFILTER0_CTRL3,      0x10000362},
@@ -181,6 +182,7 @@ static bool rt5514_readable_register(struct device *dev, unsigned int reg)
         case RT5514_PLL3_CALIB_CTRL5:
         case RT5514_DELAY_BUF_CTRL1:
         case RT5514_DELAY_BUF_CTRL3:
+        case RT5514_ASRC_IN_CTRL1:
         case RT5514_DOWNFILTER0_CTRL1:
         case RT5514_DOWNFILTER0_CTRL2:
         case RT5514_DOWNFILTER0_CTRL3:
@@ -238,6 +240,7 @@ static bool rt5514_i2c_readable_register(struct device *dev,
         case RT5514_DSP_MAPPING | RT5514_PLL3_CALIB_CTRL5:
         case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL1:
         case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL3:
+        case RT5514_DSP_MAPPING | RT5514_ASRC_IN_CTRL1:
         case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL1:
         case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL2:
         case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL3:
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 40a700493f4c..da8fd98c7f51 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -144,6 +144,13 @@ static int fsl_esai_divisor_cal(struct snd_soc_dai *dai, bool tx, u32 ratio,
 
         psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8;
 
+        /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */
+        if (ratio <= 256) {
+                pm = ratio;
+                fp = 1;
+                goto out;
+        }
+
         /* Set the max fluctuation -- 0.1% of the max devisor */
         savesub = (psr ? 1 : 8)  * 256 * maxfp / 1000;
 
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 0823b08923b5..89df2d9f63d7 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -217,6 +217,7 @@ struct fsl_ssi_soc_data {
  * @dai_fmt: DAI configuration this device is currently used with
  * @streams: Mask of current active streams: BIT(TX) and BIT(RX)
  * @i2s_net: I2S and Network mode configurations of SCR register
+ *           (this is the initial settings based on the DAI format)
  * @synchronous: Use synchronous mode - both of TX and RX use STCK and SFCK
  * @use_dma: DMA is used or FIQ with stream filter
  * @use_dual_fifo: DMA with support for dual FIFO mode
@@ -829,16 +830,23 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream,
         }
 
         if (!fsl_ssi_is_ac97(ssi)) {
+                /*
+                 * Keep the ssi->i2s_net intact while having a local variable
+                 * to override settings for special use cases. Otherwise, the
+                 * ssi->i2s_net will lose the settings for regular use cases.
+                 */
+                u8 i2s_net = ssi->i2s_net;
+
                 /* Normal + Network mode to send 16-bit data in 32-bit frames */
                 if (fsl_ssi_is_i2s_cbm_cfs(ssi) && sample_size == 16)
-                        ssi->i2s_net = SSI_SCR_I2S_MODE_NORMAL | SSI_SCR_NET;
+                        i2s_net = SSI_SCR_I2S_MODE_NORMAL | SSI_SCR_NET;
 
                 /* Use Normal mode to send mono data at 1st slot of 2 slots */
                 if (channels == 1)
-                        ssi->i2s_net = SSI_SCR_I2S_MODE_NORMAL;
+                        i2s_net = SSI_SCR_I2S_MODE_NORMAL;
 
                 regmap_update_bits(regs, REG_SSI_SCR,
-                                   SSI_SCR_I2S_NET_MASK, ssi->i2s_net);
+                                   SSI_SCR_I2S_NET_MASK, i2s_net);
         }
 
         /* In synchronous mode, the SSI uses STCCR for capture */
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index ceb105cbd461..addac2a8e52a 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -72,24 +72,28 @@ config SND_SOC_INTEL_BAYTRAIL
           for Baytrail Chromebooks but this option is now deprecated and is
           not recommended, use SND_SST_ATOM_HIFI2_PLATFORM instead.
 
+config SND_SST_ATOM_HIFI2_PLATFORM
+        tristate
+        select SND_SOC_COMPRESS
+
 config SND_SST_ATOM_HIFI2_PLATFORM_PCI
-        tristate "PCI HiFi2 (Medfield, Merrifield) Platforms"
+        tristate "PCI HiFi2 (Merrifield) Platforms"
         depends on X86 && PCI
         select SND_SST_IPC_PCI
-        select SND_SOC_COMPRESS
+        select SND_SST_ATOM_HIFI2_PLATFORM
         help
-          If you have a Intel Medfield or Merrifield/Edison platform, then
+          If you have a Intel Merrifield/Edison platform, then
           enable this option by saying Y or m. Distros will typically not
-          enable this option: Medfield devices are not available to
-          developers and while Merrifield/Edison can run a mainline kernel with
-          limited functionality it will require a firmware file which
-          is not in the standard firmware tree
+          enable this option: while Merrifield/Edison can run a mainline
+          kernel with limited functionality it will require a firmware file
+          which is not in the standard firmware tree
 
-config SND_SST_ATOM_HIFI2_PLATFORM
+config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
         tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms"
+        default ACPI
         depends on X86 && ACPI
         select SND_SST_IPC_ACPI
-        select SND_SOC_COMPRESS
+        select SND_SST_ATOM_HIFI2_PLATFORM
         select SND_SOC_ACPI_INTEL_MATCH
         select IOSF_MBI
         help
diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
index 09db2aec12a3..b2f5d2fa354d 100644
--- a/sound/soc/omap/omap-dmic.c
+++ b/sound/soc/omap/omap-dmic.c
@@ -281,7 +281,7 @@ static int omap_dmic_dai_trigger(struct snd_pcm_substream *substream,
 static int omap_dmic_select_fclk(struct omap_dmic *dmic, int clk_id,
                                  unsigned int freq)
 {
-        struct clk *parent_clk;
+        struct clk *parent_clk, *mux;
         char *parent_clk_name;
         int ret = 0;
 
@@ -329,14 +329,21 @@ static int omap_dmic_select_fclk(struct omap_dmic *dmic, int clk_id,
                 return -ENODEV;
         }
 
+        mux = clk_get_parent(dmic->fclk);
+        if (IS_ERR(mux)) {
+                dev_err(dmic->dev, "can't get fck mux parent\n");
+                clk_put(parent_clk);
+                return -ENODEV;
+        }
+
         mutex_lock(&dmic->mutex);
         if (dmic->active) {
                 /* disable clock while reparenting */
                 pm_runtime_put_sync(dmic->dev);
-                ret = clk_set_parent(dmic->fclk, parent_clk);
+                ret = clk_set_parent(mux, parent_clk);
                 pm_runtime_get_sync(dmic->dev);
         } else {
-                ret = clk_set_parent(dmic->fclk, parent_clk);
+                ret = clk_set_parent(mux, parent_clk);
         }
         mutex_unlock(&dmic->mutex);
 
@@ -349,6 +356,7 @@ static int omap_dmic_select_fclk(struct omap_dmic *dmic, int clk_id,
         dmic->fclk_freq = freq;
 
 err_busy:
+        clk_put(mux);
         clk_put(parent_clk);
 
         return ret;
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 6a76688a8ba9..94f081b93258 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1536,7 +1536,7 @@ static int rsnd_remove(struct platform_device *pdev)
         return ret;
 }
 
-static int rsnd_suspend(struct device *dev)
+static int __maybe_unused rsnd_suspend(struct device *dev)
 {
         struct rsnd_priv *priv = dev_get_drvdata(dev);
 
@@ -1545,7 +1545,7 @@ static int rsnd_suspend(struct device *dev)
         return 0;
 }
 
-static int rsnd_resume(struct device *dev)
+static int __maybe_unused rsnd_resume(struct device *dev)
 {
         struct rsnd_priv *priv = dev_get_drvdata(dev);
 
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index fa27d0fca6dc..986b8b2f90fb 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -513,7 +513,7 @@ static void remove_widget(struct snd_soc_component *comp,
          */
         if (dobj->widget.kcontrol_type == SND_SOC_TPLG_TYPE_ENUM) {
                 /* enumerated widget mixer */
-                for (i = 0; i < w->num_kcontrols; i++) {
+                for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) {
                         struct snd_kcontrol *kcontrol = w->kcontrols[i];
                         struct soc_enum *se =
                                 (struct soc_enum *)kcontrol->private_value;
@@ -530,7 +530,7 @@ static void remove_widget(struct snd_soc_component *comp,
                 }
         } else {
                 /* volume mixer or bytes controls */
-                for (i = 0; i < w->num_kcontrols; i++) {
+                for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) {
                         struct snd_kcontrol *kcontrol = w->kcontrols[i];
 
                         if (dobj->widget.kcontrol_type
@@ -1325,8 +1325,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
                         ec->hdr.name);
 
                 kc[i].name = kstrdup(ec->hdr.name, GFP_KERNEL);
-                if (kc[i].name == NULL)
+                if (kc[i].name == NULL) {
+                        kfree(se);
                         goto err_se;
+                }
                 kc[i].private_value = (long)se;
                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
                 kc[i].access = ec->hdr.access;
@@ -1442,8 +1444,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dbytes_create(
                         be->hdr.name, be->hdr.access);
 
                 kc[i].name = kstrdup(be->hdr.name, GFP_KERNEL);
-                if (kc[i].name == NULL)
+                if (kc[i].name == NULL) {
+                        kfree(sbe);
                         goto err;
+                }
                 kc[i].private_value = (long)sbe;
                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
                 kc[i].access = be->hdr.access;
@@ -2576,7 +2580,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
 
                         /* match index */
                         if (dobj->index != index &&
-                                dobj->index != SND_SOC_TPLG_INDEX_ALL)
+                                index != SND_SOC_TPLG_INDEX_ALL)
                                 continue;
 
                         switch (dobj->type) {
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 301ad61ed426..344d7b069d59 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1776,7 +1776,8 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
                                 build_feature_ctl(state, _ftr, ch_bits, control,
                                                   &iterm, unitid, ch_read_only);
                         if (uac_v2v3_control_is_readable(master_bits, control))
-                                build_feature_ctl(state, _ftr, 0, i, &iterm, unitid,
+                                build_feature_ctl(state, _ftr, 0, control,
+                                                  &iterm, unitid,
                                                   !uac_v2v3_control_is_writeable(master_bits,
                                                                                  control));
                 }
@@ -1859,7 +1860,7 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid,
         check_input_term(state, d->bTerminalID, &iterm);
         if (state->mixer->protocol == UAC_VERSION_2) {
                 /* Check for jack detection. */
-                if (uac_v2v3_control_is_readable(d->bmControls,
+                if (uac_v2v3_control_is_readable(le16_to_cpu(d->bmControls),
                                                  UAC2_TE_CONNECTOR)) {
                         build_connector_control(state, &iterm, true);
                 }
@@ -2561,7 +2562,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
                         if (err < 0 && err != -EINVAL)
                                 return err;
 
-                        if (uac_v2v3_control_is_readable(desc->bmControls,
+                        if (uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls),
                                                          UAC2_TE_CONNECTOR)) {
                                 build_connector_control(&state, &state.oterm,
                                                         false);
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 9038b2e7df73..eaa03acd4686 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -353,8 +353,11 @@ static struct usbmix_name_map bose_companion5_map[] = {
 /*
  * Dell usb dock with ALC4020 codec had a firmware problem where it got
  * screwed up when zero volume is passed; just skip it as a workaround
+ *
+ * Also the extension unit gives an access error, so skip it as well.
  */
 static const struct usbmix_name_map dell_alc4020_map[] = {
+        { 4, NULL },    /* extension unit */
         { 16, NULL },
         { 19, NULL },
         { 0 }
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 6a8f5843334e..956be9f7c72a 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -349,7 +349,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor
                          * TODO: this conversion is not complete, update it
                          * after adding UAC3 values to asound.h
                          */
-                        switch (is->bChPurpose) {
+                        switch (is->bChRelationship) {
                         case UAC3_CH_MONO:
                                 map = SNDRV_CHMAP_MONO;
                                 break;
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index ebcab5c5465d..8082f7b077f1 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -139,7 +139,7 @@ static void usb_stream_hwdep_vm_open(struct vm_area_struct *area)
         snd_printdd(KERN_DEBUG "%i\n", atomic_read(&us122l->mmap_count));
 }
 
-static int usb_stream_hwdep_vm_fault(struct vm_fault *vmf)
+static vm_fault_t usb_stream_hwdep_vm_fault(struct vm_fault *vmf)
 {
         unsigned long offset;
         struct page *page;
diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index d8bd7c99b48c..c1dd9a7b48df 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -31,7 +31,7 @@
 #include "usbusx2y.h"
 #include "usX2Yhwdep.h"
 
-static int snd_us428ctls_vm_fault(struct vm_fault *vmf)
+static vm_fault_t snd_us428ctls_vm_fault(struct vm_fault *vmf)
 {
         unsigned long offset;
         struct page * page;
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index 0d050528a4e1..4fd9276b8e50 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -652,7 +652,7 @@ static void snd_usX2Y_hwdep_pcm_vm_close(struct vm_area_struct *area)
 }
 
 
-static int snd_usX2Y_hwdep_pcm_vm_fault(struct vm_fault *vmf)
+static vm_fault_t snd_usX2Y_hwdep_pcm_vm_fault(struct vm_fault *vmf)
 {
         unsigned long offset;
         void *vaddr;
diff --git a/tools/perf/Documentation/perf-mem.txt b/tools/perf/Documentation/perf-mem.txt
index 8806ed5f3802..f8d2167cf3e7 100644
--- a/tools/perf/Documentation/perf-mem.txt
+++ b/tools/perf/Documentation/perf-mem.txt
@@ -28,29 +28,46 @@ OPTIONS
 <command>...::
         Any command you can specify in a shell.
 
+-i::
+--input=<file>::
+        Input file name.
+
 -f::
 --force::
         Don't do ownership validation
 
 -t::
---type=::
+--type=<type>::
         Select the memory operation type: load or store (default: load,store)
 
 -D::
---dump-raw-samples=::
+--dump-raw-samples::
         Dump the raw decoded samples on the screen in a format that is easy to parse with
         one sample per line.
 
 -x::
---field-separator::
+--field-separator=<separator>::
         Specify the field separator used when dump raw samples (-D option). By default,
         The separator is the space character.
 
 -C::
---cpu-list::
-        Restrict dump of raw samples to those provided via this option. Note that the same
-        option can be passed in record mode. It will be interpreted the same way as perf
-        record.
+--cpu=<cpu>::
+        Monitor only on the list of CPUs provided. Multiple CPUs can be provided as a
+        comma-separated list with no space: 0,1. Ranges of CPUs are specified with -: 0-2. Default
+        is to monitor all CPUS.
+-U::
+--hide-unresolved::
+        Only display entries resolved to a symbol.
+
+-p::
+--phys-data::
+        Record/Report sample physical addresses
+
+RECORD OPTIONS
+--------------
+-e::
+--event <event>::
+        Event selector. Use 'perf mem record -e list' to list available events.
 
 -K::
 --all-kernel::
@@ -60,12 +77,12 @@ OPTIONS
 --all-user::
         Configure all used events to run in user space.
 
---ldload::
-        Specify desired latency for loads event.
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc)
 
--p::
---phys-data::
-        Record/Report sample physical addresses
+--ldlat <n>::
+        Specify desired latency for loads event.
 
 In addition, for report all perf report options are valid, and for record
 all perf record options.
diff --git a/tools/perf/arch/s390/util/auxtrace.c b/tools/perf/arch/s390/util/auxtrace.c
index 6cb48e4cffd9..3afe8256eff2 100644
--- a/tools/perf/arch/s390/util/auxtrace.c
+++ b/tools/perf/arch/s390/util/auxtrace.c
@@ -87,6 +87,7 @@ struct auxtrace_record *auxtrace_record__init(struct perf_evlist *evlist,
         struct perf_evsel *pos;
         int diagnose = 0;
 
+        *err = 0;
         if (evlist->nr_entries == 0)
                 return NULL;
 
diff --git a/tools/perf/arch/s390/util/header.c b/tools/perf/arch/s390/util/header.c
index a4c30f1c70be..163b92f33998 100644
--- a/tools/perf/arch/s390/util/header.c
+++ b/tools/perf/arch/s390/util/header.c
@@ -146,21 +146,3 @@ char *get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
                 zfree(&buf);
         return buf;
 }
-
-/*
- * Compare the cpuid string returned by get_cpuid() function
- * with the name generated by the jevents file read from
- * pmu-events/arch/s390/mapfile.csv.
- *
- * Parameter mapcpuid is the cpuid as stored in the
- * pmu-events/arch/s390/mapfile.csv. This is just the type number.
- * Parameter cpuid is the cpuid returned by function get_cpuid().
- */
-int strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
-{
-        char *cp = strchr(cpuid, ',');
-
-        if (cp == NULL)
-                return -1;
-        return strncmp(cp + 1, mapcpuid, strlen(mapcpuid));
-}
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 147a27e8c937..f17dc601b0f3 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -172,6 +172,7 @@ static bool			interval_count;
 static const char               *output_name;
 static int                      output_fd;
 static int                      print_free_counters_hint;
+static int                      print_mixed_hw_group_error;
 
 struct perf_stat {
         bool                     record;
@@ -1126,6 +1127,30 @@ static void abs_printout(int id, int nr, struct perf_evsel *evsel, double avg)
                 fprintf(output, "%s%s", csv_sep, evsel->cgrp->name);
 }
 
+static bool is_mixed_hw_group(struct perf_evsel *counter)
+{
+        struct perf_evlist *evlist = counter->evlist;
+        u32 pmu_type = counter->attr.type;
+        struct perf_evsel *pos;
+
+        if (counter->nr_members < 2)
+                return false;
+
+        evlist__for_each_entry(evlist, pos) {
+                /* software events can be part of any hardware group */
+                if (pos->attr.type == PERF_TYPE_SOFTWARE)
+                        continue;
+                if (pmu_type == PERF_TYPE_SOFTWARE) {
+                        pmu_type = pos->attr.type;
+                        continue;
+                }
+                if (pmu_type != pos->attr.type)
+                        return true;
+        }
+
+        return false;
+}
+
 static void printout(int id, int nr, struct perf_evsel *counter, double uval,
                      char *prefix, u64 run, u64 ena, double noise,
                      struct runtime_stat *st)
@@ -1178,8 +1203,11 @@ static void printout(int id, int nr, struct perf_evsel *counter, double uval,
                         counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
                         csv_sep);
 
-                if (counter->supported)
+                if (counter->supported) {
                         print_free_counters_hint = 1;
+                        if (is_mixed_hw_group(counter))
+                                print_mixed_hw_group_error = 1;
+                }
 
                 fprintf(stat_config.output, "%-*s%s",
                         csv_output ? 0 : unit_width,
@@ -1256,7 +1284,8 @@ static void uniquify_event_name(struct perf_evsel *counter)
         char *new_name;
         char *config;
 
-        if (!counter->pmu_name || !strncmp(counter->name, counter->pmu_name,
+        if (counter->uniquified_name ||
+            !counter->pmu_name || !strncmp(counter->name, counter->pmu_name,
                                            strlen(counter->pmu_name)))
                 return;
 
@@ -1274,6 +1303,8 @@ static void uniquify_event_name(struct perf_evsel *counter)
                         counter->name = new_name;
                 }
         }
+
+        counter->uniquified_name = true;
 }
 
 static void collect_all_aliases(struct perf_evsel *counter,
@@ -1757,6 +1788,11 @@ static void print_footer(void)
 "       echo 0 > /proc/sys/kernel/nmi_watchdog\n"
 "       perf stat ...\n"
 "       echo 1 > /proc/sys/kernel/nmi_watchdog\n");
+
+        if (print_mixed_hw_group_error)
+                fprintf(output,
+                        "The events in group usually have to be from "
+                        "the same PMU. Try reorganizing the group.\n");
 }
 
 static void print_counters(struct timespec *ts, int argc, const char **argv)
diff --git a/tools/perf/pmu-events/arch/s390/mapfile.csv b/tools/perf/pmu-events/arch/s390/mapfile.csv
index ca7682748a4b..78bcf7f8e206 100644
--- a/tools/perf/pmu-events/arch/s390/mapfile.csv
+++ b/tools/perf/pmu-events/arch/s390/mapfile.csv
@@ -1,6 +1,6 @@
 Family-model,Version,Filename,EventType
-209[78],1,cf_z10,core
-281[78],1,cf_z196,core
-282[78],1,cf_zec12,core
-296[45],1,cf_z13,core
-3906,3,cf_z14,core
+^IBM.209[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z10,core
+^IBM.281[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z196,core
+^IBM.282[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_zec12,core
+^IBM.296[45].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z13,core
+^IBM.390[67].*[13]\.[1-5].[[:xdigit:]]+$,3,cf_z14,core
diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
index f906b793196f..8a33ca4f9e1f 100644
--- a/tools/perf/tests/attr/test-record-group-sampling
+++ b/tools/perf/tests/attr/test-record-group-sampling
@@ -35,3 +35,6 @@ inherit=0
 # sampling disabled
 sample_freq=0
 sample_period=0
+freq=0
+write_backward=0
+sample_id_all=0
diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
index 1ecc1f0ff84a..016882dbbc16 100755
--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
@@ -19,12 +19,10 @@ trace_libc_inet_pton_backtrace() {
         expected[1]=".*inet_pton[[:space:]]\($libc\)$"
         case "$(uname -m)" in
         s390x)
-                eventattr='call-graph=dwarf'
+                eventattr='call-graph=dwarf,max-stack=4'
                 expected[2]="gaih_inet.*[[:space:]]\($libc|inlined\)$"
-                expected[3]="__GI_getaddrinfo[[:space:]]\($libc|inlined\)$"
+                expected[3]="(__GI_)?getaddrinfo[[:space:]]\($libc|inlined\)$"
                 expected[4]="main[[:space:]]\(.*/bin/ping.*\)$"
-                expected[5]="__libc_start_main[[:space:]]\($libc\)$"
-                expected[6]="_start[[:space:]]\(.*/bin/ping.*\)$"
                 ;;
         *)
                 eventattr='max-stack=3'
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 3e87486c28fe..4cd2cf93f726 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -930,8 +930,11 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
          * than leader in case leader 'leads' the sampling.
          */
         if ((leader != evsel) && leader->sample_read) {
-                attr->sample_freq   = 0;
-                attr->sample_period = 0;
+                attr->freq           = 0;
+                attr->sample_freq    = 0;
+                attr->sample_period  = 0;
+                attr->write_backward = 0;
+                attr->sample_id_all  = 0;
         }
 
         if (opts->no_samples)
@@ -1922,7 +1925,8 @@ try_fallback:
                 goto fallback_missing_features;
         } else if (!perf_missing_features.group_read &&
                     evsel->attr.inherit &&
-                   (evsel->attr.read_format & PERF_FORMAT_GROUP)) {
+                   (evsel->attr.read_format & PERF_FORMAT_GROUP) &&
+                   perf_evsel__is_group_leader(evsel)) {
                 perf_missing_features.group_read = true;
                 pr_debug2("switching off group read\n");
                 goto fallback_missing_features;
@@ -2754,8 +2758,14 @@ bool perf_evsel__fallback(struct perf_evsel *evsel, int err,
                    (paranoid = perf_event_paranoid()) > 1) {
                 const char *name = perf_evsel__name(evsel);
                 char *new_name;
+                const char *sep = ":";
 
-                if (asprintf(&new_name, "%s%su", name, strchr(name, ':') ? "" : ":") < 0)
+                /* Is there already the separator in the name. */
+                if (strchr(name, '/') ||
+                    strchr(name, ':'))
+                        sep = "";
+
+                if (asprintf(&new_name, "%s%su", name, sep) < 0)
                         return false;
 
                 if (evsel->name)
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index d3ee3af618ef..92ec009a292d 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -115,6 +115,7 @@ struct perf_evsel {
         unsigned int            sample_size;
         int                     id_pos;
         int                     is_pos;
+        bool                    uniquified_name;
         bool                    snapshot;
         bool                    supported;
         bool                    needs_swap;
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 2eca8478e24f..32d50492505d 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1019,13 +1019,6 @@ int machine__load_vmlinux_path(struct machine *machine, enum map_type type)
         return ret;
 }
 
-static void map_groups__fixup_end(struct map_groups *mg)
-{
-        int i;
-        for (i = 0; i < MAP__NR_TYPES; ++i)
-                __map_groups__fixup_end(mg, i);
-}
-
 static char *get_kernel_version(const char *root_dir)
 {
         char version[PATH_MAX];
@@ -1233,6 +1226,7 @@ int machine__create_kernel_maps(struct machine *machine)
 {
         struct dso *kernel = machine__get_kernel(machine);
         const char *name = NULL;
+        struct map *map;
         u64 addr = 0;
         int ret;
 
@@ -1259,13 +1253,25 @@ int machine__create_kernel_maps(struct machine *machine)
                         machine__destroy_kernel_maps(machine);
                         return -1;
                 }
-                machine__set_kernel_mmap(machine, addr, 0);
+
+                /* we have a real start address now, so re-order the kmaps */
+                map = machine__kernel_map(machine);
+
+                map__get(map);
+                map_groups__remove(&machine->kmaps, map);
+
+                /* assume it's the last in the kmaps */
+                machine__set_kernel_mmap(machine, addr, ~0ULL);
+
+                map_groups__insert(&machine->kmaps, map);
+                map__put(map);
         }
 
-        /*
-         * Now that we have all the maps created, just set the ->end of them:
-         */
-        map_groups__fixup_end(&machine->kmaps);
+        /* update end address of the kernel map using adjacent module address */
+        map = map__next(machine__kernel_map(machine));
+        if (map)
+                machine__set_kernel_mmap(machine, addr, map->start);
+
         return 0;
 }
 
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index 7afeb80cc39e..d14464c42714 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -224,15 +224,15 @@ event_def: event_pmu |
            event_bpf_file
 
 event_pmu:
-PE_NAME opt_event_config
+PE_NAME '/' event_config '/'
 {
         struct list_head *list, *orig_terms, *terms;
 
-        if (parse_events_copy_term_list($2, &orig_terms))
+        if (parse_events_copy_term_list($3, &orig_terms))
                 YYABORT;
 
         ALLOC_LIST(list);
-        if (parse_events_add_pmu(_parse_state, list, $1, $2, false)) {
+        if (parse_events_add_pmu(_parse_state, list, $1, $3, false)) {
                 struct perf_pmu *pmu = NULL;
                 int ok = 0;
                 char *pattern;
@@ -262,7 +262,7 @@ PE_NAME opt_event_config
                 if (!ok)
                         YYABORT;
         }
-        parse_events_terms__delete($2);
+        parse_events_terms__delete($3);
         parse_events_terms__delete(orig_terms);
         $$ = list;
 }
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 61a5e5027338..d2fb597c9a8c 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -539,9 +539,10 @@ static bool pmu_is_uncore(const char *name)
 
 /*
  *  PMU CORE devices have different name other than cpu in sysfs on some
- *  platforms. looking for possible sysfs files to identify as core device.
+ *  platforms.
+ *  Looking for possible sysfs files to identify the arm core device.
  */
-static int is_pmu_core(const char *name)
+static int is_arm_pmu_core(const char *name)
 {
         struct stat st;
         char path[PATH_MAX];
@@ -550,12 +551,6 @@ static int is_pmu_core(const char *name)
         if (!sysfs)
                 return 0;
 
-        /* Look for cpu sysfs (x86 and others) */
-        scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/cpu", sysfs);
-        if ((stat(path, &st) == 0) &&
-                        (strncmp(name, "cpu", strlen("cpu")) == 0))
-                return 1;
-
         /* Look for cpu sysfs (specific to arm) */
         scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/%s/cpus",
                                 sysfs, name);
@@ -586,7 +581,7 @@ char * __weak get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
  * cpuid string generated on this platform.
  * Otherwise return non-zero.
  */
-int __weak strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
+int strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
 {
         regex_t re;
         regmatch_t pmatch[1];
@@ -668,6 +663,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
         struct pmu_events_map *map;
         struct pmu_event *pe;
         const char *name = pmu->name;
+        const char *pname;
 
         map = perf_pmu__find_map(pmu);
         if (!map)
@@ -686,11 +682,9 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
                         break;
                 }
 
-                if (!is_pmu_core(name)) {
-                        /* check for uncore devices */
-                        if (pe->pmu == NULL)
-                                continue;
-                        if (strncmp(pe->pmu, name, strlen(pe->pmu)))
+                if (!is_arm_pmu_core(name)) {
+                        pname = pe->pmu ? pe->pmu : "cpu";
+                        if (strncmp(pname, name, strlen(pname)))
                                 continue;
                 }
 
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index 9cf83f895d98..5e1ab2f0eb79 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -12,3 +12,6 @@ test_tcpbpf_user
 test_verifier_log
 feature
 test_libbpf_open
+test_sock
+test_sock_addr
+urandom_read
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 73bb20cfb9b7..f4d99fabc56d 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -13,6 +13,7 @@
 #include <bpf/bpf.h>
 
 #include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
 
 #ifndef ARRAY_SIZE
 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
index d488f20926e8..2950f80ba7fb 100644
--- a/tools/testing/selftests/bpf/test_sock_addr.c
+++ b/tools/testing/selftests/bpf/test_sock_addr.c
@@ -15,6 +15,7 @@
 #include <bpf/libbpf.h>
 
 #include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
 
 #define CG_PATH "/foo"
 #define CONNECT4_PROG_PATH      "./connect4_prog.o"
diff --git a/tools/testing/selftests/bpf/test_sock_addr.sh b/tools/testing/selftests/bpf/test_sock_addr.sh
index c6e1dcf992c4..9832a875a828 100755
--- a/tools/testing/selftests/bpf/test_sock_addr.sh
+++ b/tools/testing/selftests/bpf/test_sock_addr.sh
@@ -4,7 +4,7 @@ set -eu
 
 ping_once()
 {
-        ping -q -c 1 -W 1 ${1%%/*} >/dev/null 2>&1
+        ping -${1} -q -c 1 -W 1 ${2%%/*} >/dev/null 2>&1
 }
 
 wait_for_ip()
@@ -13,7 +13,7 @@ wait_for_ip()
         echo -n "Wait for testing IPv4/IPv6 to become available "
         for _i in $(seq ${MAX_PING_TRIES}); do
                 echo -n "."
-                if ping_once ${TEST_IPv4} && ping_once ${TEST_IPv6}; then
+                if ping_once 4 ${TEST_IPv4} && ping_once 6 ${TEST_IPv6}; then
                         echo " OK"
                         return
                 fi
diff --git a/tools/testing/selftests/firmware/Makefile b/tools/testing/selftests/firmware/Makefile
index 826f38d5dd19..261c81f08606 100644
--- a/tools/testing/selftests/firmware/Makefile
+++ b/tools/testing/selftests/firmware/Makefile
@@ -4,6 +4,7 @@
 all:
 
 TEST_PROGS := fw_run_tests.sh
+TEST_FILES := fw_fallback.sh fw_filesystem.sh fw_lib.sh
 
 include ../lib.mk
 
diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh
index 9ea31b57d71a..962d7f4ac627 100755
--- a/tools/testing/selftests/firmware/fw_lib.sh
+++ b/tools/testing/selftests/firmware/fw_lib.sh
@@ -154,11 +154,13 @@ test_finish()
         if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
                 echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
         fi
-        if [ "$OLD_FWPATH" = "" ]; then
-                OLD_FWPATH=" "
-        fi
         if [ "$TEST_REQS_FW_SET_CUSTOM_PATH" = "yes" ]; then
-                echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+                if [ "$OLD_FWPATH" = "" ]; then
+                        # A zero-length write won't work; write a null byte
+                        printf '\000' >/sys/module/firmware_class/parameters/path
+                else
+                        echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+                fi
         fi
         if [ -f $FW ]; then
                 rm -f "$FW"
diff --git a/tools/testing/selftests/firmware/fw_run_tests.sh b/tools/testing/selftests/firmware/fw_run_tests.sh
index 06d638e9dc62..cffdd4eb0a57 100755
--- a/tools/testing/selftests/firmware/fw_run_tests.sh
+++ b/tools/testing/selftests/firmware/fw_run_tests.sh
@@ -66,5 +66,5 @@ if [ -f $FW_FORCE_SYSFS_FALLBACK ]; then
         run_test_config_0003
 else
         echo "Running basic kernel configuration, working with your config"
-        run_test
+        run_tests
 fi
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
index 786dce7e48be..2aabab363cfb 100644
--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
@@ -29,7 +29,7 @@ do_reset
 
 echo "Test extended error support"
 echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_wakeup/trigger
-echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger &>/dev/null
+! echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger 2> /dev/null
 if ! grep -q "ERROR:" events/sched/sched_wakeup/hist; then
     fail "Failed to generate extended error in histogram"
 fi
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
new file mode 100644
index 000000000000..c193dce611a2
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
@@ -0,0 +1,44 @@
+#!/bin/sh
+# description: event trigger - test multiple actions on hist trigger
+
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test multiple actions on hist trigger"
+echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events
+TRIGGER1=events/sched/sched_wakeup/trigger
+TRIGGER2=events/sched/sched_switch/trigger
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/x86/test_syscall_vdso.c b/tools/testing/selftests/x86/test_syscall_vdso.c
index 40370354d4c1..c9c3281077bc 100644
--- a/tools/testing/selftests/x86/test_syscall_vdso.c
+++ b/tools/testing/selftests/x86/test_syscall_vdso.c
@@ -100,12 +100,19 @@ asm (
         "       shl     $32, %r8\n"
         "       orq     $0x7f7f7f7f, %r8\n"
         "       movq    %r8, %r9\n"
-        "       movq    %r8, %r10\n"
-        "       movq    %r8, %r11\n"
-        "       movq    %r8, %r12\n"
-        "       movq    %r8, %r13\n"
-        "       movq    %r8, %r14\n"
-        "       movq    %r8, %r15\n"
+        "       incq    %r9\n"
+        "       movq    %r9, %r10\n"
+        "       incq    %r10\n"
+        "       movq    %r10, %r11\n"
+        "       incq    %r11\n"
+        "       movq    %r11, %r12\n"
+        "       incq    %r12\n"
+        "       movq    %r12, %r13\n"
+        "       incq    %r13\n"
+        "       movq    %r13, %r14\n"
+        "       incq    %r14\n"
+        "       movq    %r14, %r15\n"
+        "       incq    %r15\n"
         "       ret\n"
         "       .code32\n"
         "       .popsection\n"
@@ -128,12 +135,13 @@ int check_regs64(void)
         int err = 0;
         int num = 8;
         uint64_t *r64 = &regs64.r8;
+        uint64_t expected = 0x7f7f7f7f7f7f7f7fULL;
 
         if (!kernel_is_64bit)
                 return 0;
 
         do {
-                if (*r64 == 0x7f7f7f7f7f7f7f7fULL)
+                if (*r64 == expected++)
                         continue; /* register did not change */
                 if (syscall_addr != (long)&int80) {
                         /*
@@ -147,18 +155,17 @@ int check_regs64(void)
                                 continue;
                         }
                 } else {
-                        /* INT80 syscall entrypoint can be used by
+                        /*
+                         * INT80 syscall entrypoint can be used by
                          * 64-bit programs too, unlike SYSCALL/SYSENTER.
                          * Therefore it must preserve R12+
                          * (they are callee-saved registers in 64-bit C ABI).
                          *
-                         * This was probably historically not intended,
-                         * but R8..11 are clobbered (cleared to 0).
-                         * IOW: they are the only registers which aren't
-                         * preserved across INT80 syscall.
+                         * Starting in Linux 4.17 (and any kernel that
+                         * backports the change), R8..11 are preserved.
+                         * Historically (and probably unintentionally), they
+                         * were clobbered or zeroed.
                          */
-                        if (*r64 == 0 && num <= 11)
-                                continue;
                 }
                 printf("[FAIL]\tR%d has changed:%016llx\n", num, *r64);
                 err++;
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index dba629c5f8ac..a4c1b76240df 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -63,7 +63,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
 static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
 static u32 kvm_next_vmid;
 static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_SPINLOCK(kvm_vmid_lock);
+static DEFINE_RWLOCK(kvm_vmid_lock);
 
 static bool vgic_present;
 
@@ -473,11 +473,16 @@ static void update_vttbr(struct kvm *kvm)
 {
         phys_addr_t pgd_phys;
         u64 vmid;
+        bool new_gen;
 
-        if (!need_new_vmid_gen(kvm))
+        read_lock(&kvm_vmid_lock);
+        new_gen = need_new_vmid_gen(kvm);
+        read_unlock(&kvm_vmid_lock);
+
+        if (!new_gen)
                 return;
 
-        spin_lock(&kvm_vmid_lock);
+        write_lock(&kvm_vmid_lock);
 
         /*
          * We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -485,7 +490,7 @@ static void update_vttbr(struct kvm *kvm)
          * use the same vmid.
          */
         if (!need_new_vmid_gen(kvm)) {
-                spin_unlock(&kvm_vmid_lock);
+                write_unlock(&kvm_vmid_lock);
                 return;
         }
 
@@ -519,7 +524,7 @@ static void update_vttbr(struct kvm *kvm)
         vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
         kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid;
 
-        spin_unlock(&kvm_vmid_lock);
+        write_unlock(&kvm_vmid_lock);
 }
 
 static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
index 6919352cbf15..c4762bef13c6 100644
--- a/virt/kvm/arm/psci.c
+++ b/virt/kvm/arm/psci.c
@@ -18,6 +18,7 @@
 #include <linux/arm-smccc.h>
 #include <linux/preempt.h>
 #include <linux/kvm_host.h>
+#include <linux/uaccess.h>
 #include <linux/wait.h>
 
 #include <asm/cputype.h>
@@ -427,3 +428,62 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu)
         smccc_set_retval(vcpu, val, 0, 0, 0);
         return 1;
 }
+
+int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu)
+{
+        return 1;               /* PSCI version */
+}
+
+int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
+{
+        if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices))
+                return -EFAULT;
+
+        return 0;
+}
+
+int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+{
+        if (reg->id == KVM_REG_ARM_PSCI_VERSION) {
+                void __user *uaddr = (void __user *)(long)reg->addr;
+                u64 val;
+
+                val = kvm_psci_version(vcpu, vcpu->kvm);
+                if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)))
+                        return -EFAULT;
+
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+{
+        if (reg->id == KVM_REG_ARM_PSCI_VERSION) {
+                void __user *uaddr = (void __user *)(long)reg->addr;
+                bool wants_02;
+                u64 val;
+
+                if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id)))
+                        return -EFAULT;
+
+                wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features);
+
+                switch (val) {
+                case KVM_ARM_PSCI_0_1:
+                        if (wants_02)
+                                return -EINVAL;
+                        vcpu->kvm->arch.psci_version = val;
+                        return 0;
+                case KVM_ARM_PSCI_0_2:
+                case KVM_ARM_PSCI_1_0:
+                        if (!wants_02)
+                                return -EINVAL;
+                        vcpu->kvm->arch.psci_version = val;
+                        return 0;
+                }
+        }
+
+        return -EINVAL;
+}
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index e21e2f49b005..ffc587bf4742 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -14,6 +14,8 @@
 #include <linux/irqchip/arm-gic.h>
 #include <linux/kvm.h>
 #include <linux/kvm_host.h>
+#include <linux/nospec.h>
+
 #include <kvm/iodev.h>
 #include <kvm/arm_vgic.h>
 
@@ -324,6 +326,9 @@ static unsigned long vgic_mmio_read_apr(struct kvm_vcpu *vcpu,
 
                 if (n > vgic_v3_max_apr_idx(vcpu))
                         return 0;
+
+                n = array_index_nospec(n, 4);
+
                 /* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */
                 return vgicv3->vgic_ap1r[n];
         }
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index e74baec76361..702936cbe173 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -14,11 +14,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/kvm.h>
 #include <linux/kvm_host.h>
 #include <linux/list_sort.h>
-#include <linux/interrupt.h>
-#include <linux/irq.h>
+#include <linux/nospec.h>
+
 #include <asm/kvm_hyp.h>
 
 #include "vgic.h"
@@ -101,12 +103,16 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu,
                               u32 intid)
 {
         /* SGIs and PPIs */
-        if (intid <= VGIC_MAX_PRIVATE)
+        if (intid <= VGIC_MAX_PRIVATE) {
+                intid = array_index_nospec(intid, VGIC_MAX_PRIVATE);
                 return &vcpu->arch.vgic_cpu.private_irqs[intid];
+        }
 
         /* SPIs */
-        if (intid <= VGIC_MAX_SPI)
+        if (intid <= VGIC_MAX_SPI) {
+                intid = array_index_nospec(intid, VGIC_MAX_SPI);
                 return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS];
+        }
 
         /* LPIs */
         if (intid >= VGIC_MIN_LPI)
@@ -594,6 +600,7 @@ retry:
 
         list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
                 struct kvm_vcpu *target_vcpu, *vcpuA, *vcpuB;
+                bool target_vcpu_needs_kick = false;
 
                 spin_lock(&irq->irq_lock);
 
@@ -664,11 +671,18 @@ retry:
                         list_del(&irq->ap_list);
                         irq->vcpu = target_vcpu;
                         list_add_tail(&irq->ap_list, &new_cpu->ap_list_head);
+                        target_vcpu_needs_kick = true;
                 }
 
                 spin_unlock(&irq->irq_lock);
                 spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock);
                 spin_unlock_irqrestore(&vcpuA->arch.vgic_cpu.ap_list_lock, flags);
+
+                if (target_vcpu_needs_kick) {
+                        kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu);
+                        kvm_vcpu_kick(target_vcpu);
+                }
+
                 goto retry;
         }