449 files changed, 3193 insertions, 1652 deletions
diff --git a/Documentation/admin-guide/pm/intel_pstate.rst b/Documentation/admin-guide/pm/intel_pstate.rst
index d2b6fda3d67b..ab2fe0eda1d7 100644
--- a/Documentation/admin-guide/pm/intel_pstate.rst
+++ b/Documentation/admin-guide/pm/intel_pstate.rst
@@ -145,7 +145,7 @@ feature enabled.]
 In this mode ``intel_pstate`` registers utilization update callbacks with the
 CPU scheduler in order to run a P-state selection algorithm, either
-``powersave`` or ``performance``, depending on the ``scaling_cur_freq`` policy
+``powersave`` or ``performance``, depending on the ``scaling_governor`` policy
 setting in ``sysfs``.  The current CPU frequency information to be made
 available from the ``scaling_cur_freq`` policy attribute in ``sysfs`` is
 periodically updated by those utilization update callbacks too.
diff --git a/Documentation/admin-guide/pm/sleep-states.rst b/Documentation/admin-guide/pm/sleep-states.rst
index 1e5c0f00cb2f..dbf5acd49f35 100644
--- a/Documentation/admin-guide/pm/sleep-states.rst
+++ b/Documentation/admin-guide/pm/sleep-states.rst
@@ -15,7 +15,7 @@ Sleep States That Can Be Supported
 ==================================
 Depending on its configuration and the capabilities of the platform it runs on,
-the Linux kernel can support up to four system sleep states, includig
+the Linux kernel can support up to four system sleep states, including
 hibernation and up to three variants of system suspend.  The sleep states that
 can be supported by the kernel are listed below.
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 4bcd4b7f79f9..3d01948ea061 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -264,7 +264,10 @@ i) Constructor
                           data device, but just remove the mapping.
      read_only: Don't allow any changes to be made to the pool
-                 metadata.
+                 metadata.  This mode is only available after the
+                 thin-pool has been created and first used in full
+                 read/write mode.  It cannot be specified on initial
+                 thin-pool creation.
      error_if_no_space: Error IOs, instead of queueing, if no space.
diff --git a/Documentation/devicetree/bindings/ata/ahci-platform.txt b/Documentation/devicetree/bindings/ata/ahci-platform.txt
index f4006d3c9fdf..c760ecb81381 100644
--- a/Documentation/devicetree/bindings/ata/ahci-platform.txt
+++ b/Documentation/devicetree/bindings/ata/ahci-platform.txt
@@ -30,7 +30,6 @@ compatible:
 Optional properties:
 - dma-coherent      : Present if dma operations are coherent
 - clocks            : a list of phandle + clock specifier pairs
- resets            : a list of phandle + reset specifier pairs
 - target-supply     : regulator for SATA target power
 - phys              : reference to the SATA PHY node
 - phy-names         : must be "sata-phy"
diff --git a/Documentation/devicetree/bindings/display/panel/panel-common.txt b/Documentation/devicetree/bindings/display/panel/panel-common.txt
index 557fa765adcb..5d2519af4bb5 100644
--- a/Documentation/devicetree/bindings/display/panel/panel-common.txt
+++ b/Documentation/devicetree/bindings/display/panel/panel-common.txt
@@ -38,7 +38,7 @@ Display Timings
  require specific display timings. The panel-timing subnode expresses those
  timings as specified in the timing subnode section of the display timing
  bindings defined in
-  Documentation/devicetree/bindings/display/display-timing.txt.
+  Documentation/devicetree/bindings/display/panel/display-timing.txt.
 Connectivity
diff --git a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt
index aadfb236d53a..61315eaa7660 100644
--- a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt
+++ b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt
@@ -26,6 +26,7 @@ Required Properties:
                - "renesas,dmac-r8a7794" (R-Car E2)
                - "renesas,dmac-r8a7795" (R-Car H3)
                - "renesas,dmac-r8a7796" (R-Car M3-W)
+                - "renesas,dmac-r8a77965" (R-Car M3-N)
                - "renesas,dmac-r8a77970" (R-Car V3M)
                - "renesas,dmac-r8a77980" (R-Car V3H)
diff --git a/Documentation/devicetree/bindings/net/can/rcar_canfd.txt b/Documentation/devicetree/bindings/net/can/rcar_canfd.txt
index 93c3a6ae32f9..ac71daa46195 100644
--- a/Documentation/devicetree/bindings/net/can/rcar_canfd.txt
+++ b/Documentation/devicetree/bindings/net/can/rcar_canfd.txt
@@ -5,7 +5,9 @@ Required properties:
 - compatible: Must contain one or more of the following:
  - "renesas,rcar-gen3-canfd" for R-Car Gen3 compatible controller.
  - "renesas,r8a7795-canfd" for R8A7795 (R-Car H3) compatible controller.
-  - "renesas,r8a7796-canfd" for R8A7796 (R-Car M3) compatible controller.
+  - "renesas,r8a7796-canfd" for R8A7796 (R-Car M3-W) compatible controller.
+  - "renesas,r8a77970-canfd" for R8A77970 (R-Car V3M) compatible controller.
+  - "renesas,r8a77980-canfd" for R8A77980 (R-Car V3H) compatible controller.
  When compatible with the generic version, nodes must list the
  SoC-specific version corresponding to the platform first, followed by the
diff --git a/Documentation/devicetree/bindings/net/renesas,ravb.txt b/Documentation/devicetree/bindings/net/renesas,ravb.txt
index c306f55d335b..890526dbfc26 100644
--- a/Documentation/devicetree/bindings/net/renesas,ravb.txt
+++ b/Documentation/devicetree/bindings/net/renesas,ravb.txt
@@ -18,6 +18,7 @@ Required properties:
      - "renesas,etheravb-r8a7795" for the R8A7795 SoC.
      - "renesas,etheravb-r8a7796" for the R8A7796 SoC.
+      - "renesas,etheravb-r8a77965" for the R8A77965 SoC.
      - "renesas,etheravb-r8a77970" for the R8A77970 SoC.
      - "renesas,etheravb-r8a77980" for the R8A77980 SoC.
      - "renesas,etheravb-r8a77995" for the R8A77995 SoC.
diff --git a/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt
index ed5eb547afc8..64bc5c2a76da 100644
--- a/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt
@@ -56,9 +56,9 @@ pins it needs, and how they should be configured, with regard to muxer
 configuration, drive strength and pullups. If one of these options is
 not set, its actual value will be unspecified.
-This driver supports the generic pin multiplexing and configuration
+Allwinner A1X Pin Controller supports the generic pin multiplexing and
-bindings. For details on each properties, you can refer to
+configuration bindings. For details on each properties, you can refer to
-./pinctrl-bindings.txt.
+ ./pinctrl-bindings.txt.
 Required sub-node properties:
  - pins
diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
index a006ea4d065f..106808b55b6d 100644
--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
+++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
@@ -43,6 +43,8 @@ Required properties:
    - "renesas,hscif-r8a7795" for R8A7795 (R-Car H3) HSCIF compatible UART.
    - "renesas,scif-r8a7796" for R8A7796 (R-Car M3-W) SCIF compatible UART.
    - "renesas,hscif-r8a7796" for R8A7796 (R-Car M3-W) HSCIF compatible UART.
+    - "renesas,scif-r8a77965" for R8A77965 (R-Car M3-N) SCIF compatible UART.
+    - "renesas,hscif-r8a77965" for R8A77965 (R-Car M3-N) HSCIF compatible UART.
    - "renesas,scif-r8a77970" for R8A77970 (R-Car V3M) SCIF compatible UART.
    - "renesas,hscif-r8a77970" for R8A77970 (R-Car V3M) HSCIF compatible UART.
    - "renesas,scif-r8a77980" for R8A77980 (R-Car V3H) SCIF compatible UART.
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index b5f978a4cac6..a38d8bfae19c 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -182,6 +182,7 @@ karo	Ka-Ro electronics GmbH
 keithkoep       Keith & Koep GmbH
 keymile Keymile GmbH
 khadas  Khadas
+kiebackpeter    Kieback & Peter GmbH
 kinetic Kinetic Technologies
 kingnovel       Kingnovel Technology Co., Ltd.
 kosagi  Sutajio Ko-Usagi PTE Ltd.
diff --git a/Documentation/devicetree/overlay-notes.txt b/Documentation/devicetree/overlay-notes.txt
index a4feb6dde8cd..725fb8d255c1 100644
--- a/Documentation/devicetree/overlay-notes.txt
+++ b/Documentation/devicetree/overlay-notes.txt
@@ -98,6 +98,14 @@ Finally, if you need to remove all overlays in one-go, just call
 of_overlay_remove_all() which will remove every single one in the correct
 order.
+In addition, there is the option to register notifiers that get called on
+overlay operations. See of_overlay_notifier_register/unregister and
+enum of_overlay_notify_action for details.
+Note that a notifier callback is not supposed to store pointers to a device
+tree node or its content beyond OF_OVERLAY_POST_REMOVE corresponding to the
+respective node it received.
 Overlay DTS Format
 ------------------
diff --git a/Documentation/doc-guide/parse-headers.rst b/Documentation/doc-guide/parse-headers.rst
index 96a0423d5dba..82a3e43b6864 100644
--- a/Documentation/doc-guide/parse-headers.rst
+++ b/Documentation/doc-guide/parse-headers.rst
@@ -177,14 +177,14 @@ BUGS
 ****
-Report bugs to Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Report bugs to Mauro Carvalho Chehab <mchehab@kernel.org>
 COPYRIGHT
 *********
-Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab@s-opensource.com>.
+Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab+samsung@kernel.org>.
 License GPLv2: GNU GPL version 2 <http://gnu.org/licenses/gpl.html>.
diff --git a/Documentation/media/uapi/rc/keytable.c.rst b/Documentation/media/uapi/rc/keytable.c.rst
index e6ce1e3f5a78..217237f93b37 100644
--- a/Documentation/media/uapi/rc/keytable.c.rst
+++ b/Documentation/media/uapi/rc/keytable.c.rst
@@ -7,7 +7,7 @@ file: uapi/v4l/keytable.c
    /* keytable.c - This program allows checking/replacing keys at IR
-       Copyright (C) 2006-2009 Mauro Carvalho Chehab <mchehab@infradead.org>
+       Copyright (C) 2006-2009 Mauro Carvalho Chehab <mchehab@kernel.org>
       This program is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published by
diff --git a/Documentation/media/uapi/v4l/v4l2grab.c.rst b/Documentation/media/uapi/v4l/v4l2grab.c.rst
index 5aabd0b7b089..f0d0ab6abd41 100644
--- a/Documentation/media/uapi/v4l/v4l2grab.c.rst
+++ b/Documentation/media/uapi/v4l/v4l2grab.c.rst
@@ -6,7 +6,7 @@ file: media/v4l/v4l2grab.c
 .. code-block:: c
    /* V4L2 video picture grabber
-       Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@infradead.org>
+       Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@kernel.org>
       This program is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published by
diff --git a/Documentation/sphinx/parse-headers.pl b/Documentation/sphinx/parse-headers.pl
index a958d8b5e99d..d410f47567e9 100755
--- a/Documentation/sphinx/parse-headers.pl
+++ b/Documentation/sphinx/parse-headers.pl
@@ -387,11 +387,11 @@ tree for more details.
 =head1 BUGS
-Report bugs to Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Report bugs to Mauro Carvalho Chehab <mchehab@kernel.org>
 =head1 COPYRIGHT
-Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab@s-opensource.com>.
+Copyright (c) 2016 by Mauro Carvalho Chehab <mchehab+samsung@kernel.org>.
 License GPLv2: GNU GPL version 2 <http://gnu.org/licenses/gpl.html>.
diff --git a/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt b/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt
index 698660b7f21f..c77c0f060864 100644
--- a/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt
+++ b/Documentation/translations/zh_CN/video4linux/v4l2-framework.txt
@@ -6,7 +6,7 @@ communicating in English you can also ask the Chinese maintainer for
 help.  Contact the Chinese maintainer if this translation is outdated
 or if there is a problem with the translation.
-Maintainer: Mauro Carvalho Chehab <mchehab@infradead.org>
+Maintainer: Mauro Carvalho Chehab <mchehab@kernel.org>
 Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
 ---------------------------------------------------------------------
 Documentation/video4linux/v4l2-framework.txt 的中文翻译
@@ -14,7 +14,7 @@ Documentation/video4linux/v4l2-framework.txt 的中文翻译
 如果想评论或更新本文的内容，请直接联系原文档的维护者。如果你使用英文
 交流有困难的话，也可以向中文版维护者求助。如果本翻译更新不及时或者翻
 译存在问题，请联系中文版维护者。
-英文版维护者： Mauro Carvalho Chehab <mchehab@infradead.org>
+英文版维护者： Mauro Carvalho Chehab <mchehab@kernel.org>
 中文版维护者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
 中文版翻译者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
 中文版校译者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index b22be10d5916..cecf461678b5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -137,9 +137,9 @@ Maintainers List (try to look for most precise areas first)
                -----------------------------------
 3C59X NETWORK DRIVER
-M:      Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
+M:      Steffen Klassert <klassert@kernel.org>
 L:      netdev@vger.kernel.org
-S:      Maintained
+S:      Odd Fixes
 F:      Documentation/networking/vortex.txt
 F:      drivers/net/ethernet/3com/3c59x.c
@@ -2554,7 +2554,6 @@ F:	Documentation/devicetree/bindings/sound/axentia,*
 F:      sound/soc/atmel/tse850-pcm5142.c
 AZ6007 DVB DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -3082,7 +3081,6 @@ F:	include/linux/btrfs*
 F:      include/uapi/linux/btrfs*
 BTTV VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -3811,7 +3809,6 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/cx24120*
 CX88 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -5052,7 +5049,6 @@ F:	drivers/edac/thunderx_edac*
 EDAC-CORE
 M:      Borislav Petkov <bp@alien8.de>
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git for-next
@@ -5081,7 +5077,6 @@ S:	Maintained
 F:      drivers/edac/fsl_ddr_edac.*
 EDAC-GHES
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
@@ -5098,21 +5093,18 @@ S:	Maintained
 F:      drivers/edac/i5000_edac.c
 EDAC-I5400
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i5400_edac.c
 EDAC-I7300
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i7300_edac.c
 EDAC-I7CORE
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
@@ -5162,7 +5154,6 @@ S:	Maintained
 F:      drivers/edac/r82600_edac.c
 EDAC-SBRIDGE
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
@@ -5221,7 +5212,6 @@ S:	Maintained
 F:      drivers/net/ethernet/ibm/ehea/
 EM28XX VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -7675,9 +7665,11 @@ L:	linux-kbuild@vger.kernel.org
 S:      Maintained
 F:      Documentation/kbuild/
 F:      Makefile
-F:      scripts/Makefile.*
+F:      scripts/Kbuild*
+F:      scripts/Makefile*
 F:      scripts/basic/
 F:      scripts/mk*
+F:      scripts/mod/
 F:      scripts/package/
 KERNEL JANITORS
@@ -8869,7 +8861,6 @@ F:	Documentation/devicetree/bindings/media/nvidia,tegra-vde.txt
 F:      drivers/staging/media/tegra-vde/
 MEDIA INPUT INFRASTRUCTURE (V4L/DVB)
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 P:      LinuxTV.org Project
 L:      linux-media@vger.kernel.org
@@ -9871,7 +9862,7 @@ F:	include/linux/platform_data/nxp-nci.h
 F:      Documentation/devicetree/bindings/net/nfc/
 NFS, SUNRPC, AND LOCKD CLIENTS
-M:      Trond Myklebust <trond.myklebust@primarydata.com>
+M:      Trond Myklebust <trond.myklebust@hammerspace.com>
 M:      Anna Schumaker <anna.schumaker@netapp.com>
 L:      linux-nfs@vger.kernel.org
 W:      http://client.linux-nfs.org
@@ -12249,7 +12240,6 @@ S:	Odd Fixes
 F:      drivers/media/i2c/saa6588*
 SAA7134 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -12754,7 +12744,6 @@ S:	Maintained
 F:      drivers/media/radio/si4713/radio-usb-si4713.c
 SIANO DVB DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -13745,7 +13734,6 @@ S:	Maintained
 F:      drivers/media/i2c/tda9840*
 TEA5761 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -13754,7 +13742,6 @@ S:	Odd fixes
 F:      drivers/media/tuners/tea5761.*
 TEA5767 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -14170,7 +14157,6 @@ F:	Documentation/networking/tlan.txt
 F:      drivers/net/ethernet/ti/tlan.*
 TM6000 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -15399,7 +15385,6 @@ S:	Maintained
 F:      arch/x86/entry/vdso/
 XC2028/3028 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
diff --git a/Makefile b/Makefile
index 619a85ad716b..d0d2652db174 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,8 @@
 VERSION = 4
 PATCHLEVEL = 17
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
-NAME = Fearless Coyote
+NAME = Merciless Moray
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
index bf343195697e..54111ed218b1 100644
--- a/arch/arm/boot/dts/imx35.dtsi
+++ b/arch/arm/boot/dts/imx35.dtsi
@@ -303,7 +303,7 @@
                        };
                        can1: can@53fe4000 {
-                                compatible = "fsl,imx35-flexcan";
+                                compatible = "fsl,imx35-flexcan", "fsl,imx25-flexcan";
                                reg = <0x53fe4000 0x1000>;
                                clocks = <&clks 33>, <&clks 33>;
                                clock-names = "ipg", "per";
@@ -312,7 +312,7 @@
                        };
                        can2: can@53fe8000 {
-                                compatible = "fsl,imx35-flexcan";
+                                compatible = "fsl,imx35-flexcan", "fsl,imx25-flexcan";
                                reg = <0x53fe8000 0x1000>;
                                clocks = <&clks 34>, <&clks 34>;
                                clock-names = "ipg", "per";
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index 7d647d043f52..3d65c0192f69 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -551,7 +551,7 @@
                        };
                        can1: can@53fc8000 {
-                                compatible = "fsl,imx53-flexcan";
+                                compatible = "fsl,imx53-flexcan", "fsl,imx25-flexcan";
                                reg = <0x53fc8000 0x4000>;
                                interrupts = <82>;
                                clocks = <&clks IMX5_CLK_CAN1_IPG_GATE>,
@@ -561,7 +561,7 @@
                        };
                        can2: can@53fcc000 {
-                                compatible = "fsl,imx53-flexcan";
+                                compatible = "fsl,imx53-flexcan", "fsl,imx25-flexcan";
                                reg = <0x53fcc000 0x4000>;
                                interrupts = <83>;
                                clocks = <&clks IMX5_CLK_CAN2_IPG_GATE>,
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index 30014a9f8f2b..ea690b3562af 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -75,6 +75,7 @@
 #define ARM_CPU_IMP_CAVIUM              0x43
 #define ARM_CPU_IMP_BRCM                0x42
 #define ARM_CPU_IMP_QCOM                0x51
+#define ARM_CPU_IMP_NVIDIA              0x4E
 #define ARM_CPU_PART_AEM_V8             0xD0F
 #define ARM_CPU_PART_FOUNDATION         0xD00
@@ -99,6 +100,9 @@
 #define QCOM_CPU_PART_FALKOR            0xC00
 #define QCOM_CPU_PART_KRYO              0x200
+#define NVIDIA_CPU_PART_DENVER          0x003
+#define NVIDIA_CPU_PART_CARMEL          0x004
 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
 #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
 #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
@@ -114,6 +118,8 @@
 #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1)
 #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR)
 #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO)
+#define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER)
+#define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL)
 #ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 23b33e8ea03a..1dab3a984608 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -333,7 +333,7 @@ static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu)
        } else {
                u64 sctlr = vcpu_read_sys_reg(vcpu, SCTLR_EL1);
                sctlr |= (1 << 25);
-                vcpu_write_sys_reg(vcpu, SCTLR_EL1, sctlr);
+                vcpu_write_sys_reg(vcpu, sctlr, SCTLR_EL1);
        }
 }
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index a900befadfe8..e4a1182deff7 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -316,6 +316,7 @@ static const struct midr_range arm64_bp_harden_smccc_cpus[] = {
        MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
        MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR_V1),
        MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+        MIDR_ALL_VERSIONS(MIDR_NVIDIA_DENVER),
        {},
 };
diff --git a/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c b/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c
index 86801b6055d6..39be799d0417 100644
--- a/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c
+++ b/arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c
@@ -18,11 +18,20 @@
 #include <linux/compiler.h>
 #include <linux/irqchip/arm-gic.h>
 #include <linux/kvm_host.h>
+#include <linux/swab.h>
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_hyp.h>
 #include <asm/kvm_mmu.h>
+static bool __hyp_text __is_be(struct kvm_vcpu *vcpu)
+{
+        if (vcpu_mode_is_32bit(vcpu))
+                return !!(read_sysreg_el2(spsr) & COMPAT_PSR_E_BIT);
+        return !!(read_sysreg(SCTLR_EL1) & SCTLR_ELx_EE);
+}
 /*
 * __vgic_v2_perform_cpuif_access -- perform a GICV access on behalf of the
 *                                   guest.
@@ -64,14 +73,19 @@ int __hyp_text __vgic_v2_perform_cpuif_access(struct kvm_vcpu *vcpu)
        addr += fault_ipa - vgic->vgic_cpu_base;
        if (kvm_vcpu_dabt_iswrite(vcpu)) {
-                u32 data = vcpu_data_guest_to_host(vcpu,
+                u32 data = vcpu_get_reg(vcpu, rd);
-                                                   vcpu_get_reg(vcpu, rd),
+                if (__is_be(vcpu)) {
-                                                   sizeof(u32));
+                        /* guest pre-swabbed data, undo this for writel() */
+                        data = swab32(data);
+                }
                writel_relaxed(data, addr);
        } else {
                u32 data = readl_relaxed(addr);
-                vcpu_set_reg(vcpu, rd, vcpu_data_host_to_guest(vcpu, data,
+                if (__is_be(vcpu)) {
-                                                               sizeof(u32)));
+                        /* guest expects swabbed data */
+                        data = swab32(data);
+                }
+                vcpu_set_reg(vcpu, rd, data);
        }
        return 1;
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 9f3c47acf8ff..1b18b4722420 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -646,8 +646,10 @@ static int keep_initrd __initdata;
 void __init free_initrd_mem(unsigned long start, unsigned long end)
 {
-        if (!keep_initrd)
+        if (!keep_initrd) {
                free_reserved_area((void *)start, (void *)end, 0, "initrd");
+                memblock_free(__virt_to_phys(start), end - start);
+        }
 }
 static int __init keepinitrd_setup(char *__unused)
diff --git a/arch/powerpc/include/asm/ftrace.h b/arch/powerpc/include/asm/ftrace.h
index 9abddde372ab..b2dabd06659d 100644
--- a/arch/powerpc/include/asm/ftrace.h
+++ b/arch/powerpc/include/asm/ftrace.h
@@ -69,17 +69,30 @@ struct dyn_arch_ftrace {
 #endif
 #if defined(CONFIG_FTRACE_SYSCALLS) && !defined(__ASSEMBLY__)
-#ifdef PPC64_ELF_ABI_v1
+/*
+ * Some syscall entry functions on powerpc start with "ppc_" (fork and clone,
+ * for instance) or ppc32_/ppc64_. We should also match the sys_ variant with
+ * those.
+ */
 #define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+#ifdef PPC64_ELF_ABI_v1
+static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+{
+        /* We need to skip past the initial dot, and the __se_sys alias */
+        return !strcmp(sym + 1, name) ||
+                (!strncmp(sym, ".__se_sys", 9) && !strcmp(sym + 6, name)) ||
+                (!strncmp(sym, ".ppc_", 5) && !strcmp(sym + 5, name + 4)) ||
+                (!strncmp(sym, ".ppc32_", 7) && !strcmp(sym + 7, name + 4)) ||
+                (!strncmp(sym, ".ppc64_", 7) && !strcmp(sym + 7, name + 4));
+}
+#else
 static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
 {
-        /*
+        return !strcmp(sym, name) ||
-         * Compare the symbol name with the system call name. Skip the .sys or .SyS
+                (!strncmp(sym, "__se_sys", 8) && !strcmp(sym + 5, name)) ||
-         * prefix from the symbol name and the sys prefix from the system call name and
+                (!strncmp(sym, "ppc_", 4) && !strcmp(sym + 4, name + 4)) ||
-         * just match the rest. This is only needed on ppc64 since symbol names on
+                (!strncmp(sym, "ppc32_", 6) && !strcmp(sym + 6, name + 4)) ||
-         * 32bit do not start with a period so the generic function will work.
+                (!strncmp(sym, "ppc64_", 6) && !strcmp(sym + 6, name + 4));
-         */
-        return !strcmp(sym + 4, name + 3);
 }
 #endif
 #endif /* CONFIG_FTRACE_SYSCALLS && !__ASSEMBLY__ */
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 4185f1c96125..3f109a3e3edb 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -165,7 +165,6 @@ struct paca_struct {
        u64 saved_msr;                  /* MSR saved here by enter_rtas */
        u16 trap_save;                  /* Used when bad stack is encountered */
        u8 irq_soft_mask;               /* mask for irq soft masking */
-        u8 soft_enabled;                /* irq soft-enable flag */
        u8 irq_happened;                /* irq happened while soft-disabled */
        u8 io_sync;                     /* writel() needs spin_unlock sync */
        u8 irq_work_pending;            /* IRQ_WORK interrupt while soft-disable */
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 9f421641a35c..16b077801a5f 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -91,6 +91,7 @@ extern int start_topology_update(void);
 extern int stop_topology_update(void);
 extern int prrn_is_enabled(void);
 extern int find_and_online_cpu_nid(int cpu);
+extern int timed_topology_update(int nsecs);
 #else
 static inline int start_topology_update(void)
 {
@@ -108,16 +109,12 @@ static inline int find_and_online_cpu_nid(int cpu)
 {
        return 0;
 }
+static inline int timed_topology_update(int nsecs)
+{
+        return 0;
+}
 #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */
-#if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_NEED_MULTIPLE_NODES)
-#if defined(CONFIG_PPC_SPLPAR)
-extern int timed_topology_update(int nsecs);
-#else
-#define timed_topology_update(nsecs)
-#endif /* CONFIG_PPC_SPLPAR */
-#endif /* CONFIG_HOTPLUG_CPU || CONFIG_NEED_MULTIPLE_NODES */
 #include <asm-generic/topology.h>
 #ifdef CONFIG_SMP
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 97fe29316476..1851eaeee131 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -9,6 +9,7 @@ config SUPERH
        select HAVE_IDE if HAS_IOPORT_MAP
        select HAVE_MEMBLOCK
        select HAVE_MEMBLOCK_NODE_MAP
+        select NO_BOOTMEM
        select ARCH_DISCARD_MEMBLOCK
        select HAVE_OPROFILE
        select HAVE_GENERIC_DMA_COHERENT
diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c
index 4205f6d42b69..a5bd03642678 100644
--- a/arch/sh/kernel/cpu/sh2/probe.c
+++ b/arch/sh/kernel/cpu/sh2/probe.c
@@ -43,7 +43,11 @@ void __ref cpu_probe(void)
 #endif
 #if defined(CONFIG_CPU_J2)
+#if defined(CONFIG_SMP)
        unsigned cpu = hard_smp_processor_id();
+#else
+        unsigned cpu = 0;
+#endif
        if (cpu == 0) of_scan_flat_dt(scan_cache, NULL);
        if (j2_ccr_base) __raw_writel(0x80000303, j2_ccr_base + 4*cpu);
        if (cpu != 0) return;
diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
index d34e998b809f..c286cf5da6e7 100644
--- a/arch/sh/kernel/setup.c
+++ b/arch/sh/kernel/setup.c
@@ -11,7 +11,6 @@
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/initrd.h>
-#include <linux/bootmem.h>
 #include <linux/console.h>
 #include <linux/root_dev.h>
 #include <linux/utsname.h>
diff --git a/arch/sh/mm/consistent.c b/arch/sh/mm/consistent.c
index 8ce98691d822..f1b44697ad68 100644
--- a/arch/sh/mm/consistent.c
+++ b/arch/sh/mm/consistent.c
@@ -59,7 +59,9 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
        split_page(pfn_to_page(virt_to_phys(ret) >> PAGE_SHIFT), order);
-        *dma_handle = virt_to_phys(ret) - PFN_PHYS(dev->dma_pfn_offset);
+        *dma_handle = virt_to_phys(ret);
+        if (!WARN_ON(!dev))
+                *dma_handle -= PFN_PHYS(dev->dma_pfn_offset);
        return ret_nocache;
 }
@@ -69,9 +71,12 @@ void dma_generic_free_coherent(struct device *dev, size_t size,
                               unsigned long attrs)
 {
        int order = get_order(size);
-        unsigned long pfn = (dma_handle >> PAGE_SHIFT) + dev->dma_pfn_offset;
+        unsigned long pfn = dma_handle >> PAGE_SHIFT;
        int k;
+        if (!WARN_ON(!dev))
+                pfn += dev->dma_pfn_offset;
        for (k = 0; k < (1 << order); k++)
                __free_pages(pfn_to_page(pfn + k), 0);
@@ -143,7 +148,7 @@ int __init platform_resource_setup_memory(struct platform_device *pdev,
        if (!memsize)
                return 0;
-        buf = dma_alloc_coherent(NULL, memsize, &dma_handle, GFP_KERNEL);
+        buf = dma_alloc_coherent(&pdev->dev, memsize, &dma_handle, GFP_KERNEL);
        if (!buf) {
                pr_warning("%s: unable to allocate memory\n", name);
                return -ENOMEM;
diff --git a/arch/sh/mm/init.c b/arch/sh/mm/init.c
index ce0bbaa7e404..4034035fbede 100644
--- a/arch/sh/mm/init.c
+++ b/arch/sh/mm/init.c
@@ -211,59 +211,15 @@ void __init allocate_pgdat(unsigned int nid)
        NODE_DATA(nid) = __va(phys);
        memset(NODE_DATA(nid), 0, sizeof(struct pglist_data));
-        NODE_DATA(nid)->bdata = &bootmem_node_data[nid];
 #endif
        NODE_DATA(nid)->node_start_pfn = start_pfn;
        NODE_DATA(nid)->node_spanned_pages = end_pfn - start_pfn;
 }
-static void __init bootmem_init_one_node(unsigned int nid)
-{
-        unsigned long total_pages, paddr;
-        unsigned long end_pfn;
-        struct pglist_data *p;
-        p = NODE_DATA(nid);
-        /* Nothing to do.. */
-        if (!p->node_spanned_pages)
-                return;
-        end_pfn = pgdat_end_pfn(p);
-        total_pages = bootmem_bootmap_pages(p->node_spanned_pages);
-        paddr = memblock_alloc(total_pages << PAGE_SHIFT, PAGE_SIZE);
-        if (!paddr)
-                panic("Can't allocate bootmap for nid[%d]\n", nid);
-        init_bootmem_node(p, paddr >> PAGE_SHIFT, p->node_start_pfn, end_pfn);
-        free_bootmem_with_active_regions(nid, end_pfn);
-        /*
-         * XXX Handle initial reservations for the system memory node
-         * only for the moment, we'll refactor this later for handling
-         * reservations in other nodes.
-         */
-        if (nid == 0) {
-                struct memblock_region *reg;
-                /* Reserve the sections we're already using. */
-                for_each_memblock(reserved, reg) {
-                        reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
-                }
-        }
-        sparse_memory_present_with_active_regions(nid);
-}
 static void __init do_init_bootmem(void)
 {
        struct memblock_region *reg;
-        int i;
        /* Add active regions with valid PFNs. */
        for_each_memblock(memory, reg) {
@@ -279,9 +235,12 @@ static void __init do_init_bootmem(void)
        plat_mem_setup();
-        for_each_online_node(i)
+        for_each_memblock(memory, reg) {
-                bootmem_init_one_node(i);
+                int nid = memblock_get_region_node(reg);
+                memory_present(nid, memblock_region_memory_base_pfn(reg),
+                        memblock_region_memory_end_pfn(reg));
+        }
        sparse_init();
 }
@@ -322,7 +281,6 @@ void __init paging_init(void)
 {
        unsigned long max_zone_pfns[MAX_NR_ZONES];
        unsigned long vaddr, end;
-        int nid;
        sh_mv.mv_mem_init();
@@ -377,21 +335,7 @@ void __init paging_init(void)
        kmap_coherent_init();
        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
+        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
-        for_each_online_node(nid) {
-                pg_data_t *pgdat = NODE_DATA(nid);
-                unsigned long low, start_pfn;
-                start_pfn = pgdat->bdata->node_min_pfn;
-                low = pgdat->bdata->node_low_pfn;
-                if (max_zone_pfns[ZONE_NORMAL] < low)
-                        max_zone_pfns[ZONE_NORMAL] = low;
-                printk("Node %u: start_pfn = 0x%lx, low = 0x%lx\n",
-                       nid, start_pfn, low);
-        }
        free_area_init_nodes(max_zone_pfns);
 }
diff --git a/arch/sh/mm/numa.c b/arch/sh/mm/numa.c
index 05713d190247..830e8b3684e4 100644
--- a/arch/sh/mm/numa.c
+++ b/arch/sh/mm/numa.c
@@ -8,7 +8,6 @@
 * for more details.
 */
 #include <linux/module.h>
-#include <linux/bootmem.h>
 #include <linux/memblock.h>
 #include <linux/mm.h>
 #include <linux/numa.h>
@@ -26,9 +25,7 @@ EXPORT_SYMBOL_GPL(node_data);
 */
 void __init setup_bootmem_node(int nid, unsigned long start, unsigned long end)
 {
-        unsigned long bootmap_pages;
        unsigned long start_pfn, end_pfn;
-        unsigned long bootmem_paddr;
        /* Don't allow bogus node assignment */
        BUG_ON(nid >= MAX_NUMNODES || nid <= 0);
@@ -48,25 +45,9 @@ void __init setup_bootmem_node(int nid, unsigned long start, unsigned long end)
                                             SMP_CACHE_BYTES, end));
        memset(NODE_DATA(nid), 0, sizeof(struct pglist_data));
-        NODE_DATA(nid)->bdata = &bootmem_node_data[nid];
        NODE_DATA(nid)->node_start_pfn = start_pfn;
        NODE_DATA(nid)->node_spanned_pages = end_pfn - start_pfn;
-        /* Node-local bootmap */
-        bootmap_pages = bootmem_bootmap_pages(end_pfn - start_pfn);
-        bootmem_paddr = memblock_alloc_base(bootmap_pages << PAGE_SHIFT,
-                                       PAGE_SIZE, end);
-        init_bootmem_node(NODE_DATA(nid), bootmem_paddr >> PAGE_SHIFT,
-                          start_pfn, end_pfn);
-        free_bootmem_with_active_regions(nid, end_pfn);
-        /* Reserve the pgdat and bootmap space with the bootmem allocator */
-        reserve_bootmem_node(NODE_DATA(nid), start_pfn << PAGE_SHIFT,
-                             sizeof(struct pglist_data), BOOTMEM_DEFAULT);
-        reserve_bootmem_node(NODE_DATA(nid), bootmem_paddr,
-                             bootmap_pages << PAGE_SHIFT, BOOTMEM_DEFAULT);
        /* It's up */
        node_set_online(nid);
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 8a5b185735e1..ce243f7d2d4e 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -848,6 +848,11 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                c->x86_power = edx;
        }
+        if (c->extended_cpuid_level >= 0x80000008) {
+                cpuid(0x80000008, &eax, &ebx, &ecx, &edx);
+                c->x86_capability[CPUID_8000_0008_EBX] = ebx;
+        }
        if (c->extended_cpuid_level >= 0x8000000a)
                c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a);
@@ -871,7 +876,6 @@ static void get_cpu_address_sizes(struct cpuinfo_x86 *c)
                c->x86_virt_bits = (eax >> 8) & 0xff;
                c->x86_phys_bits = eax & 0xff;
-                c->x86_capability[CPUID_8000_0008_EBX] = ebx;
        }
 #ifdef CONFIG_X86_32
        else if (cpu_has(c, X86_FEATURE_PAE) || cpu_has(c, X86_FEATURE_PSE36))
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 91e6da48cbb6..74392d9d51e0 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1067,6 +1067,7 @@ static struct clocksource clocksource_tsc_early = {
        .resume                 = tsc_resume,
        .mark_unstable          = tsc_cs_mark_unstable,
        .tick_stable            = tsc_cs_tick_stable,
+        .list                   = LIST_HEAD_INIT(clocksource_tsc_early.list),
 };
 /*
@@ -1086,6 +1087,7 @@ static struct clocksource clocksource_tsc = {
        .resume                 = tsc_resume,
        .mark_unstable          = tsc_cs_mark_unstable,
        .tick_stable            = tsc_cs_tick_stable,
+        .list                   = LIST_HEAD_INIT(clocksource_tsc.list),
 };
 void mark_tsc_unstable(char *reason)
@@ -1098,13 +1100,9 @@ void mark_tsc_unstable(char *reason)
                clear_sched_clock_stable();
        disable_sched_clock_irqtime();
        pr_info("Marking TSC unstable due to %s\n", reason);
-        /* Change only the rating, when not registered */
-        if (clocksource_tsc.mult) {
+        clocksource_mark_unstable(&clocksource_tsc_early);
-                clocksource_mark_unstable(&clocksource_tsc);
+        clocksource_mark_unstable(&clocksource_tsc);
-        } else {
-                clocksource_tsc.flags |= CLOCK_SOURCE_UNSTABLE;
-                clocksource_tsc.rating = 0;
-        }
 }
 EXPORT_SYMBOL_GPL(mark_tsc_unstable);
@@ -1244,7 +1242,7 @@ static void tsc_refine_calibration_work(struct work_struct *work)
        /* Don't bother refining TSC on unstable systems */
        if (tsc_unstable)
-                return;
+                goto unreg;
        /*
         * Since the work is started early in boot, we may be
@@ -1297,11 +1295,12 @@ static void tsc_refine_calibration_work(struct work_struct *work)
 out:
        if (tsc_unstable)
-                return;
+                goto unreg;
        if (boot_cpu_has(X86_FEATURE_ART))
                art_related_clocksource = &clocksource_tsc;
        clocksource_register_khz(&clocksource_tsc, tsc_khz);
+unreg:
        clocksource_unregister(&clocksource_tsc_early);
 }
@@ -1311,8 +1310,8 @@ static int __init init_tsc_clocksource(void)
        if (!boot_cpu_has(X86_FEATURE_TSC) || tsc_disabled > 0 || !tsc_khz)
                return 0;
-        if (check_tsc_unstable())
+        if (tsc_unstable)
-                return 0;
+                goto unreg;
        if (tsc_clocksource_reliable)
                clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY;
@@ -1328,6 +1327,7 @@ static int __init init_tsc_clocksource(void)
                if (boot_cpu_has(X86_FEATURE_ART))
                        art_related_clocksource = &clocksource_tsc;
                clocksource_register_khz(&clocksource_tsc, tsc_khz);
+unreg:
                clocksource_unregister(&clocksource_tsc_early);
                return 0;
        }
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 70dcb5548022..b74c9c1405b9 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1463,23 +1463,6 @@ static void start_sw_tscdeadline(struct kvm_lapic *apic)
        local_irq_restore(flags);
 }
-static void start_sw_period(struct kvm_lapic *apic)
-{
-        if (!apic->lapic_timer.period)
-                return;
-        if (apic_lvtt_oneshot(apic) &&
-            ktime_after(ktime_get(),
-                        apic->lapic_timer.target_expiration)) {
-                apic_timer_expired(apic);
-                return;
-        }
-        hrtimer_start(&apic->lapic_timer.timer,
-                apic->lapic_timer.target_expiration,
-                HRTIMER_MODE_ABS_PINNED);
-}
 static void update_target_expiration(struct kvm_lapic *apic, uint32_t old_divisor)
 {
        ktime_t now, remaining;
@@ -1546,6 +1529,26 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic)
                                apic->lapic_timer.period);
 }
+static void start_sw_period(struct kvm_lapic *apic)
+{
+        if (!apic->lapic_timer.period)
+                return;
+        if (ktime_after(ktime_get(),
+                        apic->lapic_timer.target_expiration)) {
+                apic_timer_expired(apic);
+                if (apic_lvtt_oneshot(apic))
+                        return;
+                advance_periodic_target_expiration(apic);
+        }
+        hrtimer_start(&apic->lapic_timer.timer,
+                apic->lapic_timer.target_expiration,
+                HRTIMER_MODE_ABS_PINNED);
+}
 bool kvm_lapic_hv_timer_in_use(struct kvm_vcpu *vcpu)
 {
        if (!lapic_in_kernel(vcpu))
diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c
index 826898701045..19c1ff542387 100644
--- a/arch/x86/xen/enlighten_hvm.c
+++ b/arch/x86/xen/enlighten_hvm.c
@@ -65,6 +65,19 @@ static void __init xen_hvm_init_mem_mapping(void)
 {
        early_memunmap(HYPERVISOR_shared_info, PAGE_SIZE);
        HYPERVISOR_shared_info = __va(PFN_PHYS(shared_info_pfn));
+        /*
+         * The virtual address of the shared_info page has changed, so
+         * the vcpu_info pointer for VCPU 0 is now stale.
+         *
+         * The prepare_boot_cpu callback will re-initialize it via
+         * xen_vcpu_setup, but we can't rely on that to be called for
+         * old Xen versions (xen_have_vector_callback == 0).
+         *
+         * It is, in any case, bad to have a stale vcpu_info pointer
+         * so reset it now.
+         */
+        xen_vcpu_info_reset(0);
 }
 static void __init init_hvm_pv_info(void)
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index c36d23aa6c35..357969a3697c 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -421,45 +421,33 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
 {
        unsigned long va = dtr->address;
        unsigned int size = dtr->size + 1;
-        unsigned pages = DIV_ROUND_UP(size, PAGE_SIZE);
+        unsigned long pfn, mfn;
-        unsigned long frames[pages];
+        int level;
-        int f;
+        pte_t *ptep;
+        void *virt;
-        /*
-         * A GDT can be up to 64k in size, which corresponds to 8192
-         * 8-byte entries, or 16 4k pages..
-         */
-        BUG_ON(size > 65536);
+        /* @size should be at most GDT_SIZE which is smaller than PAGE_SIZE. */
+        BUG_ON(size > PAGE_SIZE);
        BUG_ON(va & ~PAGE_MASK);
-        for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
+        /*
-                int level;
+         * The GDT is per-cpu and is in the percpu data area.
-                pte_t *ptep;
+         * That can be virtually mapped, so we need to do a
-                unsigned long pfn, mfn;
+         * page-walk to get the underlying MFN for the
-                void *virt;
+         * hypercall.  The page can also be in the kernel's
+         * linear range, so we need to RO that mapping too.
-                /*
+         */
-                 * The GDT is per-cpu and is in the percpu data area.
+        ptep = lookup_address(va, &level);
-                 * That can be virtually mapped, so we need to do a
+        BUG_ON(ptep == NULL);
-                 * page-walk to get the underlying MFN for the
-                 * hypercall.  The page can also be in the kernel's
-                 * linear range, so we need to RO that mapping too.
-                 */
-                ptep = lookup_address(va, &level);
-                BUG_ON(ptep == NULL);
-                pfn = pte_pfn(*ptep);
-                mfn = pfn_to_mfn(pfn);
-                virt = __va(PFN_PHYS(pfn));
-                frames[f] = mfn;
+        pfn = pte_pfn(*ptep);
+        mfn = pfn_to_mfn(pfn);
+        virt = __va(PFN_PHYS(pfn));
-                make_lowmem_page_readonly((void *)va);
+        make_lowmem_page_readonly((void *)va);
-                make_lowmem_page_readonly(virt);
+        make_lowmem_page_readonly(virt);
-        }
-        if (HYPERVISOR_set_gdt(frames, size / sizeof(struct desc_struct)))
+        if (HYPERVISOR_set_gdt(&mfn, size / sizeof(struct desc_struct)))
                BUG();
 }
@@ -470,34 +458,22 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
 {
        unsigned long va = dtr->address;
        unsigned int size = dtr->size + 1;
-        unsigned pages = DIV_ROUND_UP(size, PAGE_SIZE);
+        unsigned long pfn, mfn;
-        unsigned long frames[pages];
+        pte_t pte;
-        int f;
-        /*
-         * A GDT can be up to 64k in size, which corresponds to 8192
-         * 8-byte entries, or 16 4k pages..
-         */
-        BUG_ON(size > 65536);
+        /* @size should be at most GDT_SIZE which is smaller than PAGE_SIZE. */
+        BUG_ON(size > PAGE_SIZE);
        BUG_ON(va & ~PAGE_MASK);
-        for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
+        pfn = virt_to_pfn(va);
-                pte_t pte;
+        mfn = pfn_to_mfn(pfn);
-                unsigned long pfn, mfn;
-                pfn = virt_to_pfn(va);
+        pte = pfn_pte(pfn, PAGE_KERNEL_RO);
-                mfn = pfn_to_mfn(pfn);
-                pte = pfn_pte(pfn, PAGE_KERNEL_RO);
+        if (HYPERVISOR_update_va_mapping((unsigned long)va, pte, 0))
+                BUG();
-                if (HYPERVISOR_update_va_mapping((unsigned long)va, pte, 0))
-                        BUG();
-                frames[f] = mfn;
-        }
-        if (HYPERVISOR_set_gdt(frames, size / sizeof(struct desc_struct)))
+        if (HYPERVISOR_set_gdt(&mfn, size / sizeof(struct desc_struct)))
                BUG();
 }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index c3621453ad87..9ce9cac16c3f 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -95,18 +95,15 @@ static void blk_mq_check_inflight(struct blk_mq_hw_ctx *hctx,
 {
        struct mq_inflight *mi = priv;
-        if (blk_mq_rq_state(rq) == MQ_RQ_IN_FLIGHT) {
+        /*
-                /*
+         * index[0] counts the specific partition that was asked for. index[1]
-                 * index[0] counts the specific partition that was asked
+         * counts the ones that are active on the whole device, so increment
-                 * for. index[1] counts the ones that are active on the
+         * that if mi->part is indeed a partition, and not a whole device.
-                 * whole device, so increment that if mi->part is indeed
+         */
-                 * a partition, and not a whole device.
+        if (rq->part == mi->part)
-                 */
+                mi->inflight[0]++;
-                if (rq->part == mi->part)
+        if (mi->part->partno)
-                        mi->inflight[0]++;
+                mi->inflight[1]++;
-                if (mi->part->partno)
-                        mi->inflight[1]++;
-        }
 }
 void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part,
@@ -118,6 +115,25 @@ void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part,
        blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight, &mi);
 }
+static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx,
+                                     struct request *rq, void *priv,
+                                     bool reserved)
+{
+        struct mq_inflight *mi = priv;
+        if (rq->part == mi->part)
+                mi->inflight[rq_data_dir(rq)]++;
+}
+void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                         unsigned int inflight[2])
+{
+        struct mq_inflight mi = { .part = part, .inflight = inflight, };
+        inflight[0] = inflight[1] = 0;
+        blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight_rw, &mi);
+}
 void blk_freeze_queue_start(struct request_queue *q)
 {
        int freeze_depth;
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 89b5cd3a6c70..e1bb420dc5d6 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -188,7 +188,9 @@ static inline bool blk_mq_hw_queue_mapped(struct blk_mq_hw_ctx *hctx)
 }
 void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part,
-                        unsigned int inflight[2]);
+                      unsigned int inflight[2]);
+void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                         unsigned int inflight[2]);
 static inline void blk_mq_put_dispatch_budget(struct blk_mq_hw_ctx *hctx)
 {
diff --git a/block/genhd.c b/block/genhd.c
index dc7e089373b9..c4513fe1adda 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -82,6 +82,18 @@ void part_in_flight(struct request_queue *q, struct hd_struct *part,
        }
 }
+void part_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                       unsigned int inflight[2])
+{
+        if (q->mq_ops) {
+                blk_mq_in_flight_rw(q, part, inflight);
+                return;
+        }
+        inflight[0] = atomic_read(&part->in_flight[0]);
+        inflight[1] = atomic_read(&part->in_flight[1]);
+}
 struct hd_struct *__disk_get_part(struct gendisk *disk, int partno)
 {
        struct disk_part_tbl *ptbl = rcu_dereference(disk->part_tbl);
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 08dabcd8b6ae..db57cced9b98 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -145,13 +145,15 @@ ssize_t part_stat_show(struct device *dev,
                jiffies_to_msecs(part_stat_read(p, time_in_queue)));
 }
-ssize_t part_inflight_show(struct device *dev,
+ssize_t part_inflight_show(struct device *dev, struct device_attribute *attr,
-                        struct device_attribute *attr, char *buf)
+                           char *buf)
 {
        struct hd_struct *p = dev_to_part(dev);
+        struct request_queue *q = part_to_disk(p)->queue;
+        unsigned int inflight[2];
-        return sprintf(buf, "%8u %8u\n", atomic_read(&p->in_flight[0]),
+        part_in_flight_rw(q, p, inflight);
-                atomic_read(&p->in_flight[1]));
+        return sprintf(buf, "%8u %8u\n", inflight[0], inflight[1]);
 }
 #ifdef CONFIG_FAIL_MAKE_REQUEST
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 1ff17799769d..6389c88b3500 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -698,7 +698,7 @@ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
        DPRINTK("ENTER\n");
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        rc = sata_link_hardreset(link, sata_ehc_deb_timing(&link->eh_context),
                                 deadline, &online, NULL);
@@ -724,7 +724,7 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
        bool online;
        int rc;
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        /* clear D2H reception area to properly wait for D2H FIS */
        ata_tf_init(link->device, &tf);
@@ -788,7 +788,7 @@ static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
        DPRINTK("ENTER\n");
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        for (i = 0; i < 2; i++) {
                u16 val;
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 4356ef1d28a8..824bd399f02e 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -350,7 +350,6 @@ struct ahci_host_priv {
        u32                     em_msg_type;    /* EM message type */
        bool                    got_runtime_pm; /* Did we do pm_runtime_get? */
        struct clk              *clks[AHCI_MAX_CLKS]; /* Optional */
-        struct reset_control    *rsts;          /* Optional */
        struct regulator        **target_pwrs;  /* Optional */
        /*
         * If platform uses PHYs. There is a 1:1 relation between the port number and
@@ -366,6 +365,13 @@ struct ahci_host_priv {
         * be overridden anytime before the host is activated.
         */
        void                    (*start_engine)(struct ata_port *ap);
+        /*
+         * Optional ahci_stop_engine override, if not set this gets set to the
+         * default ahci_stop_engine during ahci_save_initial_config, this can
+         * be overridden anytime before the host is activated.
+         */
+        int                     (*stop_engine)(struct ata_port *ap);
        irqreturn_t             (*irq_handler)(int irq, void *dev_instance);
        /* only required for per-port MSI(-X) support */
diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
index de7128d81e9c..0045dacd814b 100644
--- a/drivers/ata/ahci_mvebu.c
+++ b/drivers/ata/ahci_mvebu.c
@@ -62,6 +62,60 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
        writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
 }
+/**
+ * ahci_mvebu_stop_engine
+ *
+ * @ap: Target ata port
+ *
+ * Errata Ref#226 - SATA Disk HOT swap issue when connected through
+ * Port Multiplier in FIS-based Switching mode.
+ *
+ * To avoid the issue, according to design, the bits[11:8, 0] of
+ * register PxFBS are cleared when Port Command and Status (0x18) bit[0]
+ * changes its value from 1 to 0, i.e. falling edge of Port
+ * Command and Status bit[0] sends PULSE that resets PxFBS
+ * bits[11:8; 0].
+ *
+ * This function is used to override function of "ahci_stop_engine"
+ * from libahci.c by adding the mvebu work around(WA) to save PxFBS
+ * value before the PxCMD ST write of 0, then restore PxFBS value.
+ *
+ * Return: 0 on success; Error code otherwise.
+ */
+int ahci_mvebu_stop_engine(struct ata_port *ap)
+{
+        void __iomem *port_mmio = ahci_port_base(ap);
+        u32 tmp, port_fbs;
+        tmp = readl(port_mmio + PORT_CMD);
+        /* check if the HBA is idle */
+        if ((tmp & (PORT_CMD_START | PORT_CMD_LIST_ON)) == 0)
+                return 0;
+        /* save the port PxFBS register for later restore */
+        port_fbs = readl(port_mmio + PORT_FBS);
+        /* setting HBA to idle */
+        tmp &= ~PORT_CMD_START;
+        writel(tmp, port_mmio + PORT_CMD);
+        /*
+         * bit #15 PxCMD signal doesn't clear PxFBS,
+         * restore the PxFBS register right after clearing the PxCMD ST,
+         * no need to wait for the PxCMD bit #15.
+         */
+        writel(port_fbs, port_mmio + PORT_FBS);
+        /* wait for engine to stop. This could be as long as 500 msec */
+        tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
+                                PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
+        if (tmp & PORT_CMD_LIST_ON)
+                return -EIO;
+        return 0;
+}
 #ifdef CONFIG_PM_SLEEP
 static int ahci_mvebu_suspend(struct platform_device *pdev, pm_message_t state)
 {
@@ -112,6 +166,8 @@ static int ahci_mvebu_probe(struct platform_device *pdev)
        if (rc)
                return rc;
+        hpriv->stop_engine = ahci_mvebu_stop_engine;
        if (of_device_is_compatible(pdev->dev.of_node,
                                    "marvell,armada-380-ahci")) {
                dram = mv_mbus_dram_info();
diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c
index 2685f28160f7..cfdef4d44ae9 100644
--- a/drivers/ata/ahci_qoriq.c
+++ b/drivers/ata/ahci_qoriq.c
@@ -96,7 +96,7 @@ static int ahci_qoriq_hardreset(struct ata_link *link, unsigned int *class,
        DPRINTK("ENTER\n");
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        /*
         * There is a errata on ls1021a Rev1.0 and Rev2.0 which is:
diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
index c2b5941d9184..ad58da7c9aff 100644
--- a/drivers/ata/ahci_xgene.c
+++ b/drivers/ata/ahci_xgene.c
@@ -165,7 +165,7 @@ static int xgene_ahci_restart_engine(struct ata_port *ap)
                                    PORT_CMD_ISSUE, 0x0, 1, 100))
                  return -EBUSY;
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        ahci_start_fis_rx(ap);
        /*
@@ -421,7 +421,7 @@ static int xgene_ahci_hardreset(struct ata_link *link, unsigned int *class,
        portrxfis_saved = readl(port_mmio + PORT_FIS_ADDR);
        portrxfishi_saved = readl(port_mmio + PORT_FIS_ADDR_HI);
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        rc = xgene_ahci_do_hardreset(link, deadline, &online);
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 7adcf3caabd0..e5d90977caec 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -560,6 +560,9 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
        if (!hpriv->start_engine)
                hpriv->start_engine = ahci_start_engine;
+        if (!hpriv->stop_engine)
+                hpriv->stop_engine = ahci_stop_engine;
        if (!hpriv->irq_handler)
                hpriv->irq_handler = ahci_single_level_irq_intr;
 }
@@ -897,9 +900,10 @@ static void ahci_start_port(struct ata_port *ap)
 static int ahci_deinit_port(struct ata_port *ap, const char **emsg)
 {
        int rc;
+        struct ahci_host_priv *hpriv = ap->host->private_data;
        /* disable DMA */
-        rc = ahci_stop_engine(ap);
+        rc = hpriv->stop_engine(ap);
        if (rc) {
                *emsg = "failed to stop engine";
                return rc;
@@ -1310,7 +1314,7 @@ int ahci_kick_engine(struct ata_port *ap)
        int busy, rc;
        /* stop engine */
-        rc = ahci_stop_engine(ap);
+        rc = hpriv->stop_engine(ap);
        if (rc)
                goto out_restart;
@@ -1549,7 +1553,7 @@ int ahci_do_hardreset(struct ata_link *link, unsigned int *class,
        DPRINTK("ENTER\n");
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        /* clear D2H reception area to properly wait for D2H FIS */
        ata_tf_init(link->device, &tf);
@@ -2075,14 +2079,14 @@ void ahci_error_handler(struct ata_port *ap)
        if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
                /* restart engine */
-                ahci_stop_engine(ap);
+                hpriv->stop_engine(ap);
                hpriv->start_engine(ap);
        }
        sata_pmp_error_handler(ap);
        if (!ata_dev_enabled(ap->link.device))
-                ahci_stop_engine(ap);
+                hpriv->stop_engine(ap);
 }
 EXPORT_SYMBOL_GPL(ahci_error_handler);
@@ -2129,7 +2133,7 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep)
                return;
        /* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */
-        rc = ahci_stop_engine(ap);
+        rc = hpriv->stop_engine(ap);
        if (rc)
                return;
@@ -2189,7 +2193,7 @@ static void ahci_enable_fbs(struct ata_port *ap)
                return;
        }
-        rc = ahci_stop_engine(ap);
+        rc = hpriv->stop_engine(ap);
        if (rc)
                return;
@@ -2222,7 +2226,7 @@ static void ahci_disable_fbs(struct ata_port *ap)
                return;
        }
-        rc = ahci_stop_engine(ap);
+        rc = hpriv->stop_engine(ap);
        if (rc)
                return;
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 46a762442dc5..30cc8f1a31e1 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -25,7 +25,6 @@
 #include <linux/phy/phy.h>
 #include <linux/pm_runtime.h>
 #include <linux/of_platform.h>
-#include <linux/reset.h>
 #include "ahci.h"
 static void ahci_host_stop(struct ata_host *host);
@@ -196,8 +195,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_disable_regulators);
 * following order:
 * 1) Regulator
 * 2) Clocks (through ahci_platform_enable_clks)
- * 3) Resets
+ * 3) Phys
- * 4) Phys
 *
 * If resource enabling fails at any point the previous enabled resources
 * are disabled in reverse order.
@@ -217,19 +215,12 @@ int ahci_platform_enable_resources(struct ahci_host_priv *hpriv)
        if (rc)
                goto disable_regulator;
-        rc = reset_control_deassert(hpriv->rsts);
-        if (rc)
-                goto disable_clks;
        rc = ahci_platform_enable_phys(hpriv);
        if (rc)
-                goto disable_resets;
+                goto disable_clks;
        return 0;
-disable_resets:
-        reset_control_assert(hpriv->rsts);
 disable_clks:
        ahci_platform_disable_clks(hpriv);
@@ -248,15 +239,12 @@ EXPORT_SYMBOL_GPL(ahci_platform_enable_resources);
 * following order:
 * 1) Phys
 * 2) Clocks (through ahci_platform_disable_clks)
- * 3) Resets
+ * 3) Regulator
- * 4) Regulator
 */
 void ahci_platform_disable_resources(struct ahci_host_priv *hpriv)
 {
        ahci_platform_disable_phys(hpriv);
-        reset_control_assert(hpriv->rsts);
        ahci_platform_disable_clks(hpriv);
        ahci_platform_disable_regulators(hpriv);
@@ -405,12 +393,6 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev)
                hpriv->clks[i] = clk;
        }
-        hpriv->rsts = devm_reset_control_array_get_optional_shared(dev);
-        if (IS_ERR(hpriv->rsts)) {
-                rc = PTR_ERR(hpriv->rsts);
-                goto err_out;
-        }
        hpriv->nports = child_nodes = of_get_child_count(dev->of_node);
        /*
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8bc71ca61e7f..68596bd4cf06 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4549,6 +4549,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
                                                ATA_HORKAGE_NOLPM, },
+        /* This specific Samsung model/firmware-rev does not handle LPM well */
+        { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+        /* Sandisk devices which are known to not handle LPM well */
+        { "SanDisk SD7UB3Q*G1001",      NULL,   ATA_HORKAGE_NOLPM, },
        /* devices that don't properly handle queued TRIM commands */
        { "Micron_M500_*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c016829a38fd..513b260bcff1 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -175,8 +175,8 @@ static void ata_eh_handle_port_resume(struct ata_port *ap)
 { }
 #endif /* CONFIG_PM */
-static void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, const char *fmt,
+static __printf(2, 0) void __ata_ehi_pushv_desc(struct ata_eh_info *ehi,
-                                 va_list args)
+                                 const char *fmt, va_list args)
 {
        ehi->desc_len += vscnprintf(ehi->desc + ehi->desc_len,
                                     ATA_EH_DESC_LEN - ehi->desc_len,
diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
index aafb8cc03523..e67815b896fc 100644
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -410,7 +410,7 @@ static int ahci_highbank_hardreset(struct ata_link *link, unsigned int *class,
        int rc;
        int retry = 100;
-        ahci_stop_engine(ap);
+        hpriv->stop_engine(ap);
        /* clear D2H reception area to properly wait for D2H FIS */
        ata_tf_init(link->device, &tf);
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 4b1995e2d044..010ca101d412 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -285,13 +285,13 @@ static const struct sil24_cerr_info {
        [PORT_CERR_INCONSISTENT] = { AC_ERR_HSM, ATA_EH_RESET,
                                     "protocol mismatch" },
        [PORT_CERR_DIRECTION]   = { AC_ERR_HSM, ATA_EH_RESET,
-                                    "data directon mismatch" },
+                                    "data direction mismatch" },
        [PORT_CERR_UNDERRUN]    = { AC_ERR_HSM, ATA_EH_RESET,
                                    "ran out of SGEs while writing" },
        [PORT_CERR_OVERRUN]     = { AC_ERR_HSM, ATA_EH_RESET,
                                    "ran out of SGEs while reading" },
        [PORT_CERR_PKT_PROT]    = { AC_ERR_HSM, ATA_EH_RESET,
-                                    "invalid data directon for ATAPI CDB" },
+                                    "invalid data direction for ATAPI CDB" },
        [PORT_CERR_SGT_BOUNDARY] = { AC_ERR_SYSTEM, ATA_EH_RESET,
                                     "SGT not on qword boundary" },
        [PORT_CERR_SGT_TGTABRT] = { AC_ERR_HOST_BUS, ATA_EH_RESET,
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index d97c05690faa..4e46dc9e41ad 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -191,7 +191,7 @@ static char *res_strings[] = {
        "reserved 37",
        "reserved 38",
        "reserved 39",
-        "reseverd 40",
+        "reserved 40",
        "reserved 41", 
        "reserved 42", 
        "reserved 43", 
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 1ef67db03c8e..9c9a22958717 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -28,6 +28,7 @@
 #include <asm/io.h>
 #include <linux/atomic.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 #include "uPD98401.h"
 #include "uPD98402.h"
@@ -1458,6 +1459,8 @@ static int zatm_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
                                        return -EFAULT;
                                if (pool < 0 || pool > ZATM_LAST_POOL)
                                        return -EINVAL;
+                                pool = array_index_nospec(pool,
+                                                          ZATM_LAST_POOL + 1);
                                spin_lock_irqsave(&zatm_dev->lock, flags);
                                info = zatm_dev->pool_info[pool];
                                if (cmd == ZATM_GETPOOLZ) {
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 8e8b04cc569a..33b36fea1d73 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2366,7 +2366,9 @@ static int rbd_obj_issue_copyup(struct rbd_obj_request *obj_req, u32 bytes)
        osd_req_op_cls_init(obj_req->osd_req, 0, CEPH_OSD_OP_CALL, "rbd",
                            "copyup");
        osd_req_op_cls_request_data_bvecs(obj_req->osd_req, 0,
-                                          obj_req->copyup_bvecs, bytes);
+                                          obj_req->copyup_bvecs,
+                                          obj_req->copyup_bvec_count,
+                                          bytes);
        switch (obj_req->img_request->op_type) {
        case OBJ_OP_WRITE:
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c8c8b0b8d333..b937cc1e2c07 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -231,6 +231,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
@@ -263,7 +264,6 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
        /* QCA ROME chipset */
-        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME },
        { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
        { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
        { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
@@ -399,6 +399,13 @@ static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
                },
        },
+        {
+                /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
+                },
+        },
        {}
 };
@@ -2852,6 +2859,12 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
 }
 #endif
+static void btusb_check_needs_reset_resume(struct usb_interface *intf)
+{
+        if (dmi_check_system(btusb_needs_reset_resume_table))
+                interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
+}
 static int btusb_probe(struct usb_interface *intf,
                       const struct usb_device_id *id)
 {
@@ -2974,9 +2987,6 @@ static int btusb_probe(struct usb_interface *intf,
        hdev->send   = btusb_send_frame;
        hdev->notify = btusb_notify;
-        if (dmi_check_system(btusb_needs_reset_resume_table))
-                interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
 #ifdef CONFIG_PM
        err = btusb_config_oob_wake(hdev);
        if (err)
@@ -3064,6 +3074,7 @@ static int btusb_probe(struct usb_interface *intf,
                data->setup_on_usb = btusb_setup_qca;
                hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
                set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
+                btusb_check_needs_reset_resume(intf);
        }
 #ifdef CONFIG_BT_HCIBTUSB_RTL
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index c381c8e396fc..79d8c84693a1 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -195,7 +195,7 @@ static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start, int ty
        return 0;
 }
-int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+static int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
        size_t i;
        u32 *gp;
@@ -470,7 +470,7 @@ static int uninorth_free_gatt_table(struct agp_bridge_data *bridge)
        return 0;
 }
-void null_cache_flush(void)
+static void null_cache_flush(void)
 {
        mb();
 }
diff --git a/drivers/clk/clk-cs2000-cp.c b/drivers/clk/clk-cs2000-cp.c
index c58019750b7e..a2f8c42e527a 100644
--- a/drivers/clk/clk-cs2000-cp.c
+++ b/drivers/clk/clk-cs2000-cp.c
@@ -541,7 +541,7 @@ probe_err:
        return ret;
 }
-static int cs2000_resume(struct device *dev)
+static int __maybe_unused cs2000_resume(struct device *dev)
 {
        struct cs2000_priv *priv = dev_get_drvdata(dev);
diff --git a/drivers/clk/clk-mux.c b/drivers/clk/clk-mux.c
index ac4a042f8658..1628b93655ed 100644
--- a/drivers/clk/clk-mux.c
+++ b/drivers/clk/clk-mux.c
@@ -112,10 +112,18 @@ static int clk_mux_set_parent(struct clk_hw *hw, u8 index)
        return 0;
 }
+static int clk_mux_determine_rate(struct clk_hw *hw,
+                                  struct clk_rate_request *req)
+{
+        struct clk_mux *mux = to_clk_mux(hw);
+        return clk_mux_determine_rate_flags(hw, req, mux->flags);
+}
 const struct clk_ops clk_mux_ops = {
        .get_parent = clk_mux_get_parent,
        .set_parent = clk_mux_set_parent,
-        .determine_rate = __clk_mux_determine_rate,
+        .determine_rate = clk_mux_determine_rate,
 };
 EXPORT_SYMBOL_GPL(clk_mux_ops);
diff --git a/drivers/clk/clk-stm32mp1.c b/drivers/clk/clk-stm32mp1.c
index f1d5967b4b39..edd3cf451401 100644
--- a/drivers/clk/clk-stm32mp1.c
+++ b/drivers/clk/clk-stm32mp1.c
@@ -216,7 +216,7 @@ static const char * const usart1_src[] = {
        "pclk5", "pll3_q", "ck_hsi", "ck_csi", "pll4_q", "ck_hse"
 };
-const char * const usart234578_src[] = {
+static const char * const usart234578_src[] = {
        "pclk1", "pll4_q", "ck_hsi", "ck_csi", "ck_hse"
 };
@@ -224,10 +224,6 @@ static const char * const usart6_src[] = {
        "pclk2", "pll4_q", "ck_hsi", "ck_csi", "ck_hse"
 };
-static const char * const dfsdm_src[] = {
-        "pclk2", "ck_mcu"
-};
 static const char * const fdcan_src[] = {
        "ck_hse", "pll3_q", "pll4_q"
 };
@@ -316,10 +312,8 @@ struct stm32_clk_mgate {
 struct clock_config {
        u32 id;
        const char *name;
-        union {
+        const char *parent_name;
-                const char *parent_name;
+        const char * const *parent_names;
-                const char * const *parent_names;
-        };
        int num_parents;
        unsigned long flags;
        void *cfg;
@@ -469,7 +463,7 @@ static void mp1_gate_clk_disable(struct clk_hw *hw)
        }
 }
-const struct clk_ops mp1_gate_clk_ops = {
+static const struct clk_ops mp1_gate_clk_ops = {
        .enable         = mp1_gate_clk_enable,
        .disable        = mp1_gate_clk_disable,
        .is_enabled     = clk_gate_is_enabled,
@@ -698,7 +692,7 @@ static void mp1_mgate_clk_disable(struct clk_hw *hw)
                mp1_gate_clk_disable(hw);
 }
-const struct clk_ops mp1_mgate_clk_ops = {
+static const struct clk_ops mp1_mgate_clk_ops = {
        .enable         = mp1_mgate_clk_enable,
        .disable        = mp1_mgate_clk_disable,
        .is_enabled     = clk_gate_is_enabled,
@@ -732,7 +726,7 @@ static int clk_mmux_set_parent(struct clk_hw *hw, u8 index)
        return 0;
 }
-const struct clk_ops clk_mmux_ops = {
+static const struct clk_ops clk_mmux_ops = {
        .get_parent     = clk_mmux_get_parent,
        .set_parent     = clk_mmux_set_parent,
        .determine_rate = __clk_mux_determine_rate,
@@ -1048,10 +1042,10 @@ struct stm32_pll_cfg {
        u32 offset;
 };
-struct clk_hw *_clk_register_pll(struct device *dev,
+static struct clk_hw *_clk_register_pll(struct device *dev,
-                                 struct clk_hw_onecell_data *clk_data,
+                                        struct clk_hw_onecell_data *clk_data,
-                                 void __iomem *base, spinlock_t *lock,
+                                        void __iomem *base, spinlock_t *lock,
-                                 const struct clock_config *cfg)
+                                        const struct clock_config *cfg)
 {
        struct stm32_pll_cfg *stm_pll_cfg = cfg->cfg;
@@ -1405,7 +1399,8 @@ enum {
        G_USBH,
        G_ETHSTP,
        G_RTCAPB,
-        G_TZC,
+        G_TZC1,
+        G_TZC2,
        G_TZPC,
        G_IWDG1,
        G_BSEC,
@@ -1417,7 +1412,7 @@ enum {
        G_LAST
 };
-struct stm32_mgate mp1_mgate[G_LAST];
+static struct stm32_mgate mp1_mgate[G_LAST];
 #define _K_GATE(_id, _gate_offset, _gate_bit_idx, _gate_flags,\
               _mgate, _ops)\
@@ -1440,7 +1435,7 @@ struct stm32_mgate mp1_mgate[G_LAST];
               &mp1_mgate[_id], &mp1_mgate_clk_ops)
 /* Peripheral gates */
-struct stm32_gate_cfg per_gate_cfg[G_LAST] = {
+static struct stm32_gate_cfg per_gate_cfg[G_LAST] = {
        /* Multi gates */
        K_GATE(G_MDIO,          RCC_APB1ENSETR, 31, 0),
        K_MGATE(G_DAC12,        RCC_APB1ENSETR, 29, 0),
@@ -1506,7 +1501,8 @@ struct stm32_gate_cfg per_gate_cfg[G_LAST] = {
        K_GATE(G_BSEC,          RCC_APB5ENSETR, 16, 0),
        K_GATE(G_IWDG1,         RCC_APB5ENSETR, 15, 0),
        K_GATE(G_TZPC,          RCC_APB5ENSETR, 13, 0),
-        K_GATE(G_TZC,           RCC_APB5ENSETR, 12, 0),
+        K_GATE(G_TZC2,          RCC_APB5ENSETR, 12, 0),
+        K_GATE(G_TZC1,          RCC_APB5ENSETR, 11, 0),
        K_GATE(G_RTCAPB,        RCC_APB5ENSETR, 8, 0),
        K_MGATE(G_USART1,       RCC_APB5ENSETR, 4, 0),
        K_MGATE(G_I2C6,         RCC_APB5ENSETR, 3, 0),
@@ -1600,7 +1596,7 @@ enum {
        M_LAST
 };
-struct stm32_mmux ker_mux[M_LAST];
+static struct stm32_mmux ker_mux[M_LAST];
 #define _K_MUX(_id, _offset, _shift, _width, _mux_flags, _mmux, _ops)\
        [_id] = {\
@@ -1623,7 +1619,7 @@ struct stm32_mmux ker_mux[M_LAST];
        _K_MUX(_id, _offset, _shift, _width, _mux_flags,\
                        &ker_mux[_id], &clk_mmux_ops)
-const struct stm32_mux_cfg ker_mux_cfg[M_LAST] = {
+static const struct stm32_mux_cfg ker_mux_cfg[M_LAST] = {
        /* Kernel multi mux */
        K_MMUX(M_SDMMC12, RCC_SDMMC12CKSELR, 0, 3, 0),
        K_MMUX(M_SPI23, RCC_SPI2S23CKSELR, 0, 3, 0),
@@ -1860,7 +1856,8 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
        PCLK(USART1, "usart1", "pclk5", 0, G_USART1),
        PCLK(RTCAPB, "rtcapb", "pclk5", CLK_IGNORE_UNUSED |
             CLK_IS_CRITICAL, G_RTCAPB),
-        PCLK(TZC, "tzc", "pclk5", CLK_IGNORE_UNUSED, G_TZC),
+        PCLK(TZC1, "tzc1", "ck_axi", CLK_IGNORE_UNUSED, G_TZC1),
+        PCLK(TZC2, "tzc2", "ck_axi", CLK_IGNORE_UNUSED, G_TZC2),
        PCLK(TZPC, "tzpc", "pclk5", CLK_IGNORE_UNUSED, G_TZPC),
        PCLK(IWDG1, "iwdg1", "pclk5", 0, G_IWDG1),
        PCLK(BSEC, "bsec", "pclk5", CLK_IGNORE_UNUSED, G_BSEC),
@@ -1916,8 +1913,7 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
        KCLK(RNG1_K, "rng1_k", rng_src, 0, G_RNG1, M_RNG1),
        KCLK(RNG2_K, "rng2_k", rng_src, 0, G_RNG2, M_RNG2),
        KCLK(USBPHY_K, "usbphy_k", usbphy_src, 0, G_USBPHY, M_USBPHY),
-        KCLK(STGEN_K, "stgen_k",  stgen_src, CLK_IGNORE_UNUSED,
+        KCLK(STGEN_K, "stgen_k", stgen_src, CLK_IS_CRITICAL, G_STGEN, M_STGEN),
-             G_STGEN, M_STGEN),
        KCLK(SPDIF_K, "spdif_k", spdif_src, 0, G_SPDIF, M_SPDIF),
        KCLK(SPI1_K, "spi1_k", spi123_src, 0, G_SPI1, M_SPI1),
        KCLK(SPI2_K, "spi2_k", spi123_src, 0, G_SPI2, M_SPI23),
@@ -1948,8 +1944,8 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
        KCLK(FDCAN_K, "fdcan_k", fdcan_src, 0, G_FDCAN, M_FDCAN),
        KCLK(SAI1_K, "sai1_k", sai_src, 0, G_SAI1, M_SAI1),
        KCLK(SAI2_K, "sai2_k", sai2_src, 0, G_SAI2, M_SAI2),
-        KCLK(SAI3_K, "sai3_k", sai_src, 0, G_SAI2, M_SAI3),
+        KCLK(SAI3_K, "sai3_k", sai_src, 0, G_SAI3, M_SAI3),
-        KCLK(SAI4_K, "sai4_k", sai_src, 0, G_SAI2, M_SAI4),
+        KCLK(SAI4_K, "sai4_k", sai_src, 0, G_SAI4, M_SAI4),
        KCLK(ADC12_K, "adc12_k", adc12_src, 0, G_ADC12, M_ADC12),
        KCLK(DSI_K, "dsi_k", dsi_src, 0, G_DSI, M_DSI),
        KCLK(ADFSDM_K, "adfsdm_k", sai_src, 0, G_ADFSDM, M_SAI1),
@@ -1992,10 +1988,6 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
                  _DIV(RCC_MCO2CFGR, 4, 4, 0, NULL)),
        /* Debug clocks */
-        FIXED_FACTOR(NO_ID, "ck_axi_div2", "ck_axi", 0, 1, 2),
-        GATE(DBG, "ck_apb_dbg", "ck_axi_div2", 0, RCC_DBGCFGR, 8, 0),
        GATE(CK_DBG, "ck_sys_dbg", "ck_axi", 0, RCC_DBGCFGR, 8, 0),
        COMPOSITE(CK_TRACE, "ck_trace", ck_trace_src, CLK_OPS_PARENT_ENABLE,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index ea67ac81c6f9..7af555f0e60c 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -426,9 +426,9 @@ static bool mux_is_better_rate(unsigned long rate, unsigned long now,
        return now <= rate && now > best;
 }
-static int
+int clk_mux_determine_rate_flags(struct clk_hw *hw,
-clk_mux_determine_rate_flags(struct clk_hw *hw, struct clk_rate_request *req,
+                                 struct clk_rate_request *req,
-                             unsigned long flags)
+                                 unsigned long flags)
 {
        struct clk_core *core = hw->core, *parent, *best_parent = NULL;
        int i, num_parents, ret;
@@ -488,6 +488,7 @@ out:
        return 0;
 }
+EXPORT_SYMBOL_GPL(clk_mux_determine_rate_flags);
 struct clk *__clk_lookup(const char *name)
 {
diff --git a/drivers/clk/meson/clk-regmap.c b/drivers/clk/meson/clk-regmap.c
index 3645fdb62343..ab7a3556f5b2 100644
--- a/drivers/clk/meson/clk-regmap.c
+++ b/drivers/clk/meson/clk-regmap.c
@@ -153,10 +153,19 @@ static int clk_regmap_mux_set_parent(struct clk_hw *hw, u8 index)
                                  val << mux->shift);
 }
+static int clk_regmap_mux_determine_rate(struct clk_hw *hw,
+                                         struct clk_rate_request *req)
+{
+        struct clk_regmap *clk = to_clk_regmap(hw);
+        struct clk_regmap_mux_data *mux = clk_get_regmap_mux_data(clk);
+        return clk_mux_determine_rate_flags(hw, req, mux->flags);
+}
 const struct clk_ops clk_regmap_mux_ops = {
        .get_parent = clk_regmap_mux_get_parent,
        .set_parent = clk_regmap_mux_set_parent,
-        .determine_rate = __clk_mux_determine_rate,
+        .determine_rate = clk_regmap_mux_determine_rate,
 };
 EXPORT_SYMBOL_GPL(clk_regmap_mux_ops);
diff --git a/drivers/clk/meson/gxbb-aoclk.h b/drivers/clk/meson/gxbb-aoclk.h
index 0be78383f257..badc4c22b4ee 100644
--- a/drivers/clk/meson/gxbb-aoclk.h
+++ b/drivers/clk/meson/gxbb-aoclk.h
@@ -17,8 +17,6 @@
 #define AO_RTC_ALT_CLK_CNTL0    0x94
 #define AO_RTC_ALT_CLK_CNTL1    0x98
-extern const struct clk_ops meson_aoclk_gate_regmap_ops;
 struct aoclk_cec_32k {
        struct clk_hw hw;
        struct regmap *regmap;
diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index cc2992493e0b..d0524ec71aad 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -253,7 +253,7 @@ static struct clk_fixed_factor meson8b_fclk_div3_div = {
        .mult = 1,
        .div = 3,
        .hw.init = &(struct clk_init_data){
-                .name = "fclk_div_div3",
+                .name = "fclk_div3_div",
                .ops = &clk_fixed_factor_ops,
                .parent_names = (const char *[]){ "fixed_pll" },
                .num_parents = 1,
@@ -632,7 +632,8 @@ static struct clk_regmap meson8b_cpu_clk = {
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk",
                .ops = &clk_regmap_mux_ro_ops,
-                .parent_names = (const char *[]){ "xtal", "cpu_out_sel" },
+                .parent_names = (const char *[]){ "xtal",
+                                                  "cpu_scale_out_sel" },
                .num_parents = 2,
                .flags = (CLK_SET_RATE_PARENT |
                          CLK_SET_RATE_NO_REPARENT),
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index bc5fc1630876..b15115a48775 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -126,6 +126,49 @@ static void cppc_cpufreq_stop_cpu(struct cpufreq_policy *policy)
                                cpu->perf_caps.lowest_perf, cpu_num, ret);
 }
+/*
+ * The PCC subspace describes the rate at which platform can accept commands
+ * on the shared PCC channel (including READs which do not count towards freq
+ * trasition requests), so ideally we need to use the PCC values as a fallback
+ * if we don't have a platform specific transition_delay_us
+ */
+#ifdef CONFIG_ARM64
+#include <asm/cputype.h>
+static unsigned int cppc_cpufreq_get_transition_delay_us(int cpu)
+{
+        unsigned long implementor = read_cpuid_implementor();
+        unsigned long part_num = read_cpuid_part_number();
+        unsigned int delay_us = 0;
+        switch (implementor) {
+        case ARM_CPU_IMP_QCOM:
+                switch (part_num) {
+                case QCOM_CPU_PART_FALKOR_V1:
+                case QCOM_CPU_PART_FALKOR:
+                        delay_us = 10000;
+                        break;
+                default:
+                        delay_us = cppc_get_transition_latency(cpu) / NSEC_PER_USEC;
+                        break;
+                }
+                break;
+        default:
+                delay_us = cppc_get_transition_latency(cpu) / NSEC_PER_USEC;
+                break;
+        }
+        return delay_us;
+}
+#else
+static unsigned int cppc_cpufreq_get_transition_delay_us(int cpu)
+{
+        return cppc_get_transition_latency(cpu) / NSEC_PER_USEC;
+}
+#endif
 static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
        struct cppc_cpudata *cpu;
@@ -162,8 +205,7 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
                cpu->perf_caps.highest_perf;
        policy->cpuinfo.max_freq = cppc_dmi_max_khz;
-        policy->transition_delay_us = cppc_get_transition_latency(cpu_num) /
+        policy->transition_delay_us = cppc_cpufreq_get_transition_delay_us(cpu_num);
-                NSEC_PER_USEC;
        policy->shared_type = cpu->shared_type;
        if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index 77e485557498..6f693b7d5220 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -384,7 +384,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set)
        if (set)
                reg |= bit;
        else
-                reg &= bit;
+                reg &= ~bit;
        iowrite32(reg, addr);
        spin_unlock_irqrestore(&gpio->lock, flags);
diff --git a/drivers/gpio/gpio-pci-idio-16.c b/drivers/gpio/gpio-pci-idio-16.c
index 1948724d8c36..25d16b2af1c3 100644
--- a/drivers/gpio/gpio-pci-idio-16.c
+++ b/drivers/gpio/gpio-pci-idio-16.c
@@ -116,9 +116,9 @@ static int idio_16_gpio_get_multiple(struct gpio_chip *chip,
        unsigned long word_mask;
        const unsigned long port_mask = GENMASK(gpio_reg_size - 1, 0);
        unsigned long port_state;
-        u8 __iomem ports[] = {
+        void __iomem *ports[] = {
-                idio16gpio->reg->out0_7, idio16gpio->reg->out8_15,
+                &idio16gpio->reg->out0_7, &idio16gpio->reg->out8_15,
-                idio16gpio->reg->in0_7, idio16gpio->reg->in8_15,
+                &idio16gpio->reg->in0_7, &idio16gpio->reg->in8_15,
        };
        /* clear bits array to a clean slate */
@@ -143,7 +143,7 @@ static int idio_16_gpio_get_multiple(struct gpio_chip *chip,
                }
                /* read bits from current gpio port */
-                port_state = ioread8(ports + i);
+                port_state = ioread8(ports[i]);
                /* store acquired bits at respective bits array offset */
                bits[word_index] |= port_state << word_offset;
diff --git a/drivers/gpio/gpio-pcie-idio-24.c b/drivers/gpio/gpio-pcie-idio-24.c
index 835607ecf658..f953541e7890 100644
--- a/drivers/gpio/gpio-pcie-idio-24.c
+++ b/drivers/gpio/gpio-pcie-idio-24.c
@@ -206,10 +206,10 @@ static int idio_24_gpio_get_multiple(struct gpio_chip *chip,
        unsigned long word_mask;
        const unsigned long port_mask = GENMASK(gpio_reg_size - 1, 0);
        unsigned long port_state;
-        u8 __iomem ports[] = {
+        void __iomem *ports[] = {
-                idio24gpio->reg->out0_7, idio24gpio->reg->out8_15,
+                &idio24gpio->reg->out0_7, &idio24gpio->reg->out8_15,
-                idio24gpio->reg->out16_23, idio24gpio->reg->in0_7,
+                &idio24gpio->reg->out16_23, &idio24gpio->reg->in0_7,
-                idio24gpio->reg->in8_15, idio24gpio->reg->in16_23,
+                &idio24gpio->reg->in8_15, &idio24gpio->reg->in16_23,
        };
        const unsigned long out_mode_mask = BIT(1);
@@ -217,7 +217,7 @@ static int idio_24_gpio_get_multiple(struct gpio_chip *chip,
        bitmap_zero(bits, chip->ngpio);
        /* get bits are evaluated a gpio port register at a time */
-        for (i = 0; i < ARRAY_SIZE(ports); i++) {
+        for (i = 0; i < ARRAY_SIZE(ports) + 1; i++) {
                /* gpio offset in bits array */
                bits_offset = i * gpio_reg_size;
@@ -236,7 +236,7 @@ static int idio_24_gpio_get_multiple(struct gpio_chip *chip,
                /* read bits from current gpio port (port 6 is TTL GPIO) */
                if (i < 6)
-                        port_state = ioread8(ports + i);
+                        port_state = ioread8(ports[i]);
                else if (ioread8(&idio24gpio->reg->ctl) & out_mode_mask)
                        port_state = ioread8(&idio24gpio->reg->ttl_out0_7);
                else
@@ -301,9 +301,9 @@ static void idio_24_gpio_set_multiple(struct gpio_chip *chip,
        const unsigned long port_mask = GENMASK(gpio_reg_size, 0);
        unsigned long flags;
        unsigned int out_state;
-        u8 __iomem ports[] = {
+        void __iomem *ports[] = {
-                idio24gpio->reg->out0_7, idio24gpio->reg->out8_15,
+                &idio24gpio->reg->out0_7, &idio24gpio->reg->out8_15,
-                idio24gpio->reg->out16_23
+                &idio24gpio->reg->out16_23
        };
        const unsigned long out_mode_mask = BIT(1);
        const unsigned int ttl_offset = 48;
@@ -327,9 +327,9 @@ static void idio_24_gpio_set_multiple(struct gpio_chip *chip,
                raw_spin_lock_irqsave(&idio24gpio->lock, flags);
                /* process output lines */
-                out_state = ioread8(ports + i) & ~gpio_mask;
+                out_state = ioread8(ports[i]) & ~gpio_mask;
                out_state |= (*bits >> bits_offset) & gpio_mask;
-                iowrite8(out_state, ports + i);
+                iowrite8(out_state, ports[i]);
                raw_spin_unlock_irqrestore(&idio24gpio->lock, flags);
        }
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 43aeb07343ec..d8ccb500872f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -497,7 +497,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
        struct gpiohandle_request handlereq;
        struct linehandle_state *lh;
        struct file *file;
-        int fd, i, ret;
+        int fd, i, count = 0, ret;
        u32 lflags;
        if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
@@ -558,6 +558,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
                if (ret)
                        goto out_free_descs;
                lh->descs[i] = desc;
+                count = i;
                if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
                        set_bit(FLAG_ACTIVE_LOW, &desc->flags);
@@ -628,7 +629,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 out_put_unused_fd:
        put_unused_fd(fd);
 out_free_descs:
-        for (; i >= 0; i--)
+        for (i = 0; i < count; i++)
                gpiod_free(lh->descs[i]);
        kfree(lh->label);
 out_free_lh:
@@ -902,7 +903,7 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
        desc = &gdev->descs[offset];
        ret = gpiod_request(desc, le->label);
        if (ret)
-                goto out_free_desc;
+                goto out_free_label;
        le->desc = desc;
        le->eflags = eflags;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 09d35051fdd6..3fabf9f97022 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -419,9 +419,11 @@ int amdgpu_ctx_wait_prev_fence(struct amdgpu_ctx *ctx, unsigned ring_id)
        if (other) {
                signed long r;
-                r = dma_fence_wait_timeout(other, false, MAX_SCHEDULE_TIMEOUT);
+                r = dma_fence_wait(other, true);
                if (r < 0) {
-                        DRM_ERROR("Error (%ld) waiting for fence!\n", r);
+                        if (r != -ERESTARTSYS)
+                                DRM_ERROR("Error (%ld) waiting for fence!\n", r);
                        return r;
                }
        }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index ace9ad578ca0..4304d9e408b8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -83,21 +83,22 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
        enum i2c_mot_mode mot = (msg->request & DP_AUX_I2C_MOT) ?
                I2C_MOT_TRUE : I2C_MOT_FALSE;
        enum ddc_result res;
-        ssize_t read_bytes;
+        uint32_t read_bytes = msg->size;
        if (WARN_ON(msg->size > 16))
                return -E2BIG;
        switch (msg->request & ~DP_AUX_I2C_MOT) {
        case DP_AUX_NATIVE_READ:
-                read_bytes = dal_ddc_service_read_dpcd_data(
+                res = dal_ddc_service_read_dpcd_data(
                                TO_DM_AUX(aux)->ddc_service,
                                false,
                                I2C_MOT_UNDEF,
                                msg->address,
                                msg->buffer,
-                                msg->size);
+                                msg->size,
-                return read_bytes;
+                                &read_bytes);
+                break;
        case DP_AUX_NATIVE_WRITE:
                res = dal_ddc_service_write_dpcd_data(
                                TO_DM_AUX(aux)->ddc_service,
@@ -108,14 +109,15 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
                                msg->size);
                break;
        case DP_AUX_I2C_READ:
-                read_bytes = dal_ddc_service_read_dpcd_data(
+                res = dal_ddc_service_read_dpcd_data(
                                TO_DM_AUX(aux)->ddc_service,
                                true,
                                mot,
                                msg->address,
                                msg->buffer,
-                                msg->size);
+                                msg->size,
-                return read_bytes;
+                                &read_bytes);
+                break;
        case DP_AUX_I2C_WRITE:
                res = dal_ddc_service_write_dpcd_data(
                                TO_DM_AUX(aux)->ddc_service,
@@ -137,7 +139,9 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
                 r == DDC_RESULT_SUCESSFULL);
 #endif
-        return msg->size;
+        if (res != DDC_RESULT_SUCESSFULL)
+                return -EIO;
+        return read_bytes;
 }
 static enum drm_connector_status
diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
index 985fe8c22875..10a5807a7e8b 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
@@ -70,6 +70,10 @@ static enum bp_result get_firmware_info_v3_1(
        struct bios_parser *bp,
        struct dc_firmware_info *info);
+static enum bp_result get_firmware_info_v3_2(
+        struct bios_parser *bp,
+        struct dc_firmware_info *info);
 static struct atom_hpd_int_record *get_hpd_record(struct bios_parser *bp,
                struct atom_display_object_path_v2 *object);
@@ -1321,9 +1325,11 @@ static enum bp_result bios_parser_get_firmware_info(
                case 3:
                        switch (revision.minor) {
                        case 1:
-                        case 2:
                                result = get_firmware_info_v3_1(bp, info);
                                break;
+                        case 2:
+                                result = get_firmware_info_v3_2(bp, info);
+                                break;
                        default:
                                break;
                        }
@@ -1383,6 +1389,84 @@ static enum bp_result get_firmware_info_v3_1(
        return BP_RESULT_OK;
 }
+static enum bp_result get_firmware_info_v3_2(
+        struct bios_parser *bp,
+        struct dc_firmware_info *info)
+{
+        struct atom_firmware_info_v3_2 *firmware_info;
+        struct atom_display_controller_info_v4_1 *dce_info = NULL;
+        struct atom_common_table_header *header;
+        struct atom_data_revision revision;
+        struct atom_smu_info_v3_2 *smu_info_v3_2 = NULL;
+        struct atom_smu_info_v3_3 *smu_info_v3_3 = NULL;
+        if (!info)
+                return BP_RESULT_BADINPUT;
+        firmware_info = GET_IMAGE(struct atom_firmware_info_v3_2,
+                        DATA_TABLES(firmwareinfo));
+        dce_info = GET_IMAGE(struct atom_display_controller_info_v4_1,
+                        DATA_TABLES(dce_info));
+        if (!firmware_info || !dce_info)
+                return BP_RESULT_BADBIOSTABLE;
+        memset(info, 0, sizeof(*info));
+        header = GET_IMAGE(struct atom_common_table_header,
+                                        DATA_TABLES(smu_info));
+        get_atom_data_table_revision(header, &revision);
+        if (revision.minor == 2) {
+                /* Vega12 */
+                smu_info_v3_2 = GET_IMAGE(struct atom_smu_info_v3_2,
+                                                        DATA_TABLES(smu_info));
+                if (!smu_info_v3_2)
+                        return BP_RESULT_BADBIOSTABLE;
+                info->default_engine_clk = smu_info_v3_2->bootup_dcefclk_10khz * 10;
+        } else if (revision.minor == 3) {
+                /* Vega20 */
+                smu_info_v3_3 = GET_IMAGE(struct atom_smu_info_v3_3,
+                                                        DATA_TABLES(smu_info));
+                if (!smu_info_v3_3)
+                        return BP_RESULT_BADBIOSTABLE;
+                info->default_engine_clk = smu_info_v3_3->bootup_dcefclk_10khz * 10;
+        }
+         // We need to convert from 10KHz units into KHz units.
+        info->default_memory_clk = firmware_info->bootup_mclk_in10khz * 10;
+         /* 27MHz for Vega10 & Vega12; 100MHz for Vega20 */
+        info->pll_info.crystal_frequency = dce_info->dce_refclk_10khz * 10;
+        /* Hardcode frequency if BIOS gives no DCE Ref Clk */
+        if (info->pll_info.crystal_frequency == 0) {
+                if (revision.minor == 2)
+                        info->pll_info.crystal_frequency = 27000;
+                else if (revision.minor == 3)
+                        info->pll_info.crystal_frequency = 100000;
+        }
+        /*dp_phy_ref_clk is not correct for atom_display_controller_info_v4_2, but we don't use it*/
+        info->dp_phy_ref_clk     = dce_info->dpphy_refclk_10khz * 10;
+        info->i2c_engine_ref_clk = dce_info->i2c_engine_refclk_10khz * 10;
+        /* Get GPU PLL VCO Clock */
+        if (bp->cmd_tbl.get_smu_clock_info != NULL) {
+                if (revision.minor == 2)
+                        info->smu_gpu_pll_output_freq =
+                                        bp->cmd_tbl.get_smu_clock_info(bp, SMU9_SYSPLL0_ID) * 10;
+                else if (revision.minor == 3)
+                        info->smu_gpu_pll_output_freq =
+                                        bp->cmd_tbl.get_smu_clock_info(bp, SMU11_SYSPLL3_0_ID) * 10;
+        }
+        return BP_RESULT_OK;
+}
 static enum bp_result bios_parser_get_encoder_cap_info(
        struct dc_bios *dcb,
        struct graphics_object_id object_id,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
index 49c2face1e7a..ae48d603ebd6 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
@@ -629,13 +629,14 @@ bool dal_ddc_service_query_ddc_data(
        return ret;
 }
-ssize_t dal_ddc_service_read_dpcd_data(
+enum ddc_result dal_ddc_service_read_dpcd_data(
        struct ddc_service *ddc,
        bool i2c,
        enum i2c_mot_mode mot,
        uint32_t address,
        uint8_t *data,
-        uint32_t len)
+        uint32_t len,
+        uint32_t *read)
 {
        struct aux_payload read_payload = {
                .i2c_over_aux = i2c,
@@ -652,6 +653,8 @@ ssize_t dal_ddc_service_read_dpcd_data(
                .mot = mot
        };
+        *read = 0;
        if (len > DEFAULT_AUX_MAX_DATA_SIZE) {
                BREAK_TO_DEBUGGER();
                return DDC_RESULT_FAILED_INVALID_OPERATION;
@@ -661,7 +664,8 @@ ssize_t dal_ddc_service_read_dpcd_data(
                ddc->ctx->i2caux,
                ddc->ddc_pin,
                &command)) {
-                return (ssize_t)command.payloads->length;
+                *read = command.payloads->length;
+                return DDC_RESULT_SUCESSFULL;
        }
        return DDC_RESULT_FAILED_OPERATION;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_surface.c b/drivers/gpu/drm/amd/display/dc/core/dc_surface.c
index ade5b8ee9c3c..132eef3826e2 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_surface.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_surface.c
@@ -66,8 +66,8 @@ struct dc_plane_state *dc_create_plane_state(struct dc *dc)
 {
        struct dc *core_dc = dc;
-        struct dc_plane_state *plane_state = kzalloc(sizeof(*plane_state),
+        struct dc_plane_state *plane_state = kvzalloc(sizeof(*plane_state),
-                                                     GFP_KERNEL);
+                                                      GFP_KERNEL);
        if (NULL == plane_state)
                return NULL;
@@ -120,7 +120,7 @@ static void dc_plane_state_free(struct kref *kref)
 {
        struct dc_plane_state *plane_state = container_of(kref, struct dc_plane_state, refcount);
        destruct(plane_state);
-        kfree(plane_state);
+        kvfree(plane_state);
 }
 void dc_plane_state_release(struct dc_plane_state *plane_state)
@@ -136,7 +136,7 @@ void dc_gamma_retain(struct dc_gamma *gamma)
 static void dc_gamma_free(struct kref *kref)
 {
        struct dc_gamma *gamma = container_of(kref, struct dc_gamma, refcount);
-        kfree(gamma);
+        kvfree(gamma);
 }
 void dc_gamma_release(struct dc_gamma **gamma)
@@ -147,7 +147,7 @@ void dc_gamma_release(struct dc_gamma **gamma)
 struct dc_gamma *dc_create_gamma(void)
 {
-        struct dc_gamma *gamma = kzalloc(sizeof(*gamma), GFP_KERNEL);
+        struct dc_gamma *gamma = kvzalloc(sizeof(*gamma), GFP_KERNEL);
        if (gamma == NULL)
                goto alloc_fail;
@@ -167,7 +167,7 @@ void dc_transfer_func_retain(struct dc_transfer_func *tf)
 static void dc_transfer_func_free(struct kref *kref)
 {
        struct dc_transfer_func *tf = container_of(kref, struct dc_transfer_func, refcount);
-        kfree(tf);
+        kvfree(tf);
 }
 void dc_transfer_func_release(struct dc_transfer_func *tf)
@@ -177,7 +177,7 @@ void dc_transfer_func_release(struct dc_transfer_func *tf)
 struct dc_transfer_func *dc_create_transfer_func(void)
 {
-        struct dc_transfer_func *tf = kzalloc(sizeof(*tf), GFP_KERNEL);
+        struct dc_transfer_func *tf = kvzalloc(sizeof(*tf), GFP_KERNEL);
        if (tf == NULL)
                goto alloc_fail;
diff --git a/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h b/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
index 090b7a8dd67b..30b3a08b91be 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
@@ -102,13 +102,14 @@ bool dal_ddc_service_query_ddc_data(
                uint8_t *read_buf,
                uint32_t read_size);
-ssize_t dal_ddc_service_read_dpcd_data(
+enum ddc_result dal_ddc_service_read_dpcd_data(
                struct ddc_service *ddc,
                bool i2c,
                enum i2c_mot_mode mot,
                uint32_t address,
                uint8_t *data,
-                uint32_t len);
+                uint32_t len,
+                uint32_t *read);
 enum ddc_result dal_ddc_service_write_dpcd_data(
                struct ddc_service *ddc,
diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
index 9831cb5eaa7c..9b0a04f99ac8 100644
--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
@@ -113,9 +113,14 @@
 #define AI_GREENLAND_P_A0 1
 #define AI_GREENLAND_P_A1 2
+#define AI_UNKNOWN 0xFF
-#define ASICREV_IS_GREENLAND_M(eChipRev)  (eChipRev < AI_UNKNOWN)
+#define AI_VEGA12_P_A0 20
-#define ASICREV_IS_GREENLAND_P(eChipRev)  (eChipRev < AI_UNKNOWN)
+#define ASICREV_IS_GREENLAND_M(eChipRev)  (eChipRev < AI_VEGA12_P_A0)
+#define ASICREV_IS_GREENLAND_P(eChipRev)  (eChipRev < AI_VEGA12_P_A0)
+#define ASICREV_IS_VEGA12_P(eChipRev) ((eChipRev >= AI_VEGA12_P_A0) && (eChipRev < AI_UNKNOWN))
+#define ASICREV_IS_VEGA12_p(eChipRev) ((eChipRev >= AI_VEGA12_P_A0) && (eChipRev < AI_UNKNOWN))
 /* DCN1_0 */
 #define INTERNAL_REV_RAVEN_A0             0x00    /* First spin of Raven */
diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index e7e374f56864..b3747a019deb 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1093,19 +1093,19 @@ bool mod_color_calculate_regamma_params(struct dc_transfer_func *output_tf,
        output_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
-        rgb_user = kzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
+        rgb_user = kvzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
-                           GFP_KERNEL);
+                            GFP_KERNEL);
        if (!rgb_user)
                goto rgb_user_alloc_fail;
-        rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS + _EXTRA_POINTS),
+        rgb_regamma = kvzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS + _EXTRA_POINTS),
-                        GFP_KERNEL);
+                               GFP_KERNEL);
        if (!rgb_regamma)
                goto rgb_regamma_alloc_fail;
-        axix_x = kzalloc(sizeof(*axix_x) * (ramp->num_entries + 3),
+        axix_x = kvzalloc(sizeof(*axix_x) * (ramp->num_entries + 3),
-                         GFP_KERNEL);
+                          GFP_KERNEL);
        if (!axix_x)
                goto axix_x_alloc_fail;
-        coeff = kzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
+        coeff = kvzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
        if (!coeff)
                goto coeff_alloc_fail;
@@ -1157,13 +1157,13 @@ bool mod_color_calculate_regamma_params(struct dc_transfer_func *output_tf,
        ret = true;
-        kfree(coeff);
+        kvfree(coeff);
 coeff_alloc_fail:
-        kfree(axix_x);
+        kvfree(axix_x);
 axix_x_alloc_fail:
-        kfree(rgb_regamma);
+        kvfree(rgb_regamma);
 rgb_regamma_alloc_fail:
-        kfree(rgb_user);
+        kvfree(rgb_user);
 rgb_user_alloc_fail:
        return ret;
 }
@@ -1192,19 +1192,19 @@ bool mod_color_calculate_degamma_params(struct dc_transfer_func *input_tf,
        input_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
-        rgb_user = kzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
+        rgb_user = kvzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
-                           GFP_KERNEL);
+                            GFP_KERNEL);
        if (!rgb_user)
                goto rgb_user_alloc_fail;
-        curve = kzalloc(sizeof(*curve) * (MAX_HW_POINTS + _EXTRA_POINTS),
+        curve = kvzalloc(sizeof(*curve) * (MAX_HW_POINTS + _EXTRA_POINTS),
-                        GFP_KERNEL);
+                         GFP_KERNEL);
        if (!curve)
                goto curve_alloc_fail;
-        axix_x = kzalloc(sizeof(*axix_x) * (ramp->num_entries + _EXTRA_POINTS),
+        axix_x = kvzalloc(sizeof(*axix_x) * (ramp->num_entries + _EXTRA_POINTS),
-                         GFP_KERNEL);
+                          GFP_KERNEL);
        if (!axix_x)
                goto axix_x_alloc_fail;
-        coeff = kzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
+        coeff = kvzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
        if (!coeff)
                goto coeff_alloc_fail;
@@ -1246,13 +1246,13 @@ bool mod_color_calculate_degamma_params(struct dc_transfer_func *input_tf,
        ret = true;
-        kfree(coeff);
+        kvfree(coeff);
 coeff_alloc_fail:
-        kfree(axix_x);
+        kvfree(axix_x);
 axix_x_alloc_fail:
-        kfree(curve);
+        kvfree(curve);
 curve_alloc_fail:
-        kfree(rgb_user);
+        kvfree(rgb_user);
 rgb_user_alloc_fail:
        return ret;
@@ -1281,8 +1281,9 @@ bool  mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
                }
                ret = true;
        } else if (trans == TRANSFER_FUNCTION_PQ) {
-                rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS +
+                rgb_regamma = kvzalloc(sizeof(*rgb_regamma) *
-                                                _EXTRA_POINTS), GFP_KERNEL);
+                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                                       GFP_KERNEL);
                if (!rgb_regamma)
                        goto rgb_regamma_alloc_fail;
                points->end_exponent = 7;
@@ -1302,11 +1303,12 @@ bool  mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
                }
                ret = true;
-                kfree(rgb_regamma);
+                kvfree(rgb_regamma);
        } else if (trans == TRANSFER_FUNCTION_SRGB ||
                          trans == TRANSFER_FUNCTION_BT709) {
-                rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS +
+                rgb_regamma = kvzalloc(sizeof(*rgb_regamma) *
-                                                _EXTRA_POINTS), GFP_KERNEL);
+                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                                       GFP_KERNEL);
                if (!rgb_regamma)
                        goto rgb_regamma_alloc_fail;
                points->end_exponent = 0;
@@ -1324,7 +1326,7 @@ bool  mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
                }
                ret = true;
-                kfree(rgb_regamma);
+                kvfree(rgb_regamma);
        }
 rgb_regamma_alloc_fail:
        return ret;
@@ -1348,8 +1350,9 @@ bool  mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
                }
                ret = true;
        } else if (trans == TRANSFER_FUNCTION_PQ) {
-                rgb_degamma = kzalloc(sizeof(*rgb_degamma) * (MAX_HW_POINTS +
+                rgb_degamma = kvzalloc(sizeof(*rgb_degamma) *
-                                                _EXTRA_POINTS), GFP_KERNEL);
+                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                                       GFP_KERNEL);
                if (!rgb_degamma)
                        goto rgb_degamma_alloc_fail;
@@ -1364,11 +1367,12 @@ bool  mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
                }
                ret = true;
-                kfree(rgb_degamma);
+                kvfree(rgb_degamma);
        } else if (trans == TRANSFER_FUNCTION_SRGB ||
                          trans == TRANSFER_FUNCTION_BT709) {
-                rgb_degamma = kzalloc(sizeof(*rgb_degamma) * (MAX_HW_POINTS +
+                rgb_degamma = kvzalloc(sizeof(*rgb_degamma) *
-                                                _EXTRA_POINTS), GFP_KERNEL);
+                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                                       GFP_KERNEL);
                if (!rgb_degamma)
                        goto rgb_degamma_alloc_fail;
@@ -1382,7 +1386,7 @@ bool  mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
                }
                ret = true;
-                kfree(rgb_degamma);
+                kvfree(rgb_degamma);
        }
        points->end_exponent = 0;
        points->x_point_at_y1_red = 1;
diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h
index 0f5ad54d3fd3..de177ce8ca80 100644
--- a/drivers/gpu/drm/amd/include/atomfirmware.h
+++ b/drivers/gpu/drm/amd/include/atomfirmware.h
@@ -501,6 +501,32 @@ enum atom_cooling_solution_id{
  LIQUID_COOLING = 0x01
 };
+struct atom_firmware_info_v3_2 {
+  struct atom_common_table_header table_header;
+  uint32_t firmware_revision;
+  uint32_t bootup_sclk_in10khz;
+  uint32_t bootup_mclk_in10khz;
+  uint32_t firmware_capability;             // enum atombios_firmware_capability
+  uint32_t main_call_parser_entry;          /* direct address of main parser call in VBIOS binary. */
+  uint32_t bios_scratch_reg_startaddr;      // 1st bios scratch register dword address
+  uint16_t bootup_vddc_mv;
+  uint16_t bootup_vddci_mv;
+  uint16_t bootup_mvddc_mv;
+  uint16_t bootup_vddgfx_mv;
+  uint8_t  mem_module_id;
+  uint8_t  coolingsolution_id;              /*0: Air cooling; 1: Liquid cooling ... */
+  uint8_t  reserved1[2];
+  uint32_t mc_baseaddr_high;
+  uint32_t mc_baseaddr_low;
+  uint8_t  board_i2c_feature_id;            // enum of atom_board_i2c_feature_id_def
+  uint8_t  board_i2c_feature_gpio_id;       // i2c id find in gpio_lut data table gpio_id
+  uint8_t  board_i2c_feature_slave_addr;
+  uint8_t  reserved3;
+  uint16_t bootup_mvddq_mv;
+  uint16_t bootup_mvpp_mv;
+  uint32_t zfbstartaddrin16mb;
+  uint32_t reserved2[3];
+};
 /* 
  ***************************************************************************
@@ -1169,7 +1195,29 @@ struct  atom_gfx_info_v2_2
  uint32_t rlc_gpu_timer_refclk; 
 };
+struct  atom_gfx_info_v2_3 {
+  struct  atom_common_table_header  table_header;
+  uint8_t gfxip_min_ver;
+  uint8_t gfxip_max_ver;
+  uint8_t max_shader_engines;
+  uint8_t max_tile_pipes;
+  uint8_t max_cu_per_sh;
+  uint8_t max_sh_per_se;
+  uint8_t max_backends_per_se;
+  uint8_t max_texture_channel_caches;
+  uint32_t regaddr_cp_dma_src_addr;
+  uint32_t regaddr_cp_dma_src_addr_hi;
+  uint32_t regaddr_cp_dma_dst_addr;
+  uint32_t regaddr_cp_dma_dst_addr_hi;
+  uint32_t regaddr_cp_dma_command;
+  uint32_t regaddr_cp_status;
+  uint32_t regaddr_rlc_gpu_clock_32;
+  uint32_t rlc_gpu_timer_refclk;
+  uint8_t active_cu_per_sh;
+  uint8_t active_rb_per_se;
+  uint16_t gcgoldenoffset;
+  uint32_t rm21_sram_vmin_value;
+};
 /* 
  ***************************************************************************
@@ -1198,6 +1246,76 @@ struct atom_smu_info_v3_1
  uint8_t  fw_ctf_polarity;         // GPIO polarity for CTF
 };
+struct atom_smu_info_v3_2 {
+  struct   atom_common_table_header  table_header;
+  uint8_t  smuip_min_ver;
+  uint8_t  smuip_max_ver;
+  uint8_t  smu_rsd1;
+  uint8_t  gpuclk_ss_mode;
+  uint16_t sclk_ss_percentage;
+  uint16_t sclk_ss_rate_10hz;
+  uint16_t gpuclk_ss_percentage;    // in unit of 0.001%
+  uint16_t gpuclk_ss_rate_10hz;
+  uint32_t core_refclk_10khz;
+  uint8_t  ac_dc_gpio_bit;          // GPIO bit shift in SMU_GPIOPAD_A  configured for AC/DC switching, =0xff means invalid
+  uint8_t  ac_dc_polarity;          // GPIO polarity for AC/DC switching
+  uint8_t  vr0hot_gpio_bit;         // GPIO bit shift in SMU_GPIOPAD_A  configured for VR0 HOT event, =0xff means invalid
+  uint8_t  vr0hot_polarity;         // GPIO polarity for VR0 HOT event
+  uint8_t  vr1hot_gpio_bit;         // GPIO bit shift in SMU_GPIOPAD_A configured for VR1 HOT event , =0xff means invalid
+  uint8_t  vr1hot_polarity;         // GPIO polarity for VR1 HOT event
+  uint8_t  fw_ctf_gpio_bit;         // GPIO bit shift in SMU_GPIOPAD_A configured for CTF, =0xff means invalid
+  uint8_t  fw_ctf_polarity;         // GPIO polarity for CTF
+  uint8_t  pcc_gpio_bit;            // GPIO bit shift in SMU_GPIOPAD_A configured for PCC, =0xff means invalid
+  uint8_t  pcc_gpio_polarity;       // GPIO polarity for CTF
+  uint16_t smugoldenoffset;
+  uint32_t gpupll_vco_freq_10khz;
+  uint32_t bootup_smnclk_10khz;
+  uint32_t bootup_socclk_10khz;
+  uint32_t bootup_mp0clk_10khz;
+  uint32_t bootup_mp1clk_10khz;
+  uint32_t bootup_lclk_10khz;
+  uint32_t bootup_dcefclk_10khz;
+  uint32_t ctf_threshold_override_value;
+  uint32_t reserved[5];
+};
+struct atom_smu_info_v3_3 {
+  struct   atom_common_table_header  table_header;
+  uint8_t  smuip_min_ver;
+  uint8_t  smuip_max_ver;
+  uint8_t  smu_rsd1;
+  uint8_t  gpuclk_ss_mode;
+  uint16_t sclk_ss_percentage;
+  uint16_t sclk_ss_rate_10hz;
+  uint16_t gpuclk_ss_percentage;    // in unit of 0.001%
+  uint16_t gpuclk_ss_rate_10hz;
+  uint32_t core_refclk_10khz;
+  uint8_t  ac_dc_gpio_bit;          // GPIO bit shift in SMU_GPIOPAD_A  configured for AC/DC switching, =0xff means invalid
+  uint8_t  ac_dc_polarity;          // GPIO polarity for AC/DC switching
+  uint8_t  vr0hot_gpio_bit;         // GPIO bit shift in SMU_GPIOPAD_A  configured for VR0 HOT event, =0xff means invalid
+  uint8_t  vr0hot_polarity;         // GPIO polarity for VR0 HOT event
+  uint8_t  vr1hot_gpio_bit;         // GPIO bit shift in SMU_GPIOPAD_A configured for VR1 HOT event , =0xff means invalid
+  uint8_t  vr1hot_polarity;         // GPIO polarity for VR1 HOT event
+  uint8_t  fw_ctf_gpio_bit;         // GPIO bit shift in SMU_GPIOPAD_A configured for CTF, =0xff means invalid
+  uint8_t  fw_ctf_polarity;         // GPIO polarity for CTF
+  uint8_t  pcc_gpio_bit;            // GPIO bit shift in SMU_GPIOPAD_A configured for PCC, =0xff means invalid
+  uint8_t  pcc_gpio_polarity;       // GPIO polarity for CTF
+  uint16_t smugoldenoffset;
+  uint32_t gpupll_vco_freq_10khz;
+  uint32_t bootup_smnclk_10khz;
+  uint32_t bootup_socclk_10khz;
+  uint32_t bootup_mp0clk_10khz;
+  uint32_t bootup_mp1clk_10khz;
+  uint32_t bootup_lclk_10khz;
+  uint32_t bootup_dcefclk_10khz;
+  uint32_t ctf_threshold_override_value;
+  uint32_t syspll3_0_vco_freq_10khz;
+  uint32_t syspll3_1_vco_freq_10khz;
+  uint32_t bootup_fclk_10khz;
+  uint32_t bootup_waflclk_10khz;
+  uint32_t reserved[3];
+};
 /*
 ***************************************************************************
   Data Table smc_dpm_info  structure
@@ -1283,7 +1401,6 @@ struct atom_smc_dpm_info_v4_1
        uint32_t boardreserved[10];
 };
 /* 
  ***************************************************************************
    Data Table asic_profiling_info  structure
@@ -1864,6 +1981,55 @@ enum atom_smu9_syspll0_clock_id
  SMU9_SYSPLL0_DISPCLK_ID  = 11,      //        DISPCLK
 };
+enum atom_smu11_syspll_id {
+  SMU11_SYSPLL0_ID            = 0,
+  SMU11_SYSPLL1_0_ID          = 1,
+  SMU11_SYSPLL1_1_ID          = 2,
+  SMU11_SYSPLL1_2_ID          = 3,
+  SMU11_SYSPLL2_ID            = 4,
+  SMU11_SYSPLL3_0_ID          = 5,
+  SMU11_SYSPLL3_1_ID          = 6,
+};
+enum atom_smu11_syspll0_clock_id {
+  SMU11_SYSPLL0_SOCCLK_ID   = 0,       //       SOCCLK
+  SMU11_SYSPLL0_MP0CLK_ID   = 1,       //       MP0CLK
+  SMU11_SYSPLL0_DCLK_ID     = 2,       //       DCLK
+  SMU11_SYSPLL0_VCLK_ID     = 3,       //       VCLK
+  SMU11_SYSPLL0_ECLK_ID     = 4,       //       ECLK
+  SMU11_SYSPLL0_DCEFCLK_ID  = 5,       //       DCEFCLK
+};
+enum atom_smu11_syspll1_0_clock_id {
+  SMU11_SYSPLL1_0_UCLKA_ID   = 0,       // UCLK_a
+};
+enum atom_smu11_syspll1_1_clock_id {
+  SMU11_SYSPLL1_0_UCLKB_ID   = 0,       // UCLK_b
+};
+enum atom_smu11_syspll1_2_clock_id {
+  SMU11_SYSPLL1_0_FCLK_ID   = 0,        // FCLK
+};
+enum atom_smu11_syspll2_clock_id {
+  SMU11_SYSPLL2_GFXCLK_ID   = 0,        // GFXCLK
+};
+enum atom_smu11_syspll3_0_clock_id {
+  SMU11_SYSPLL3_0_WAFCLK_ID = 0,       //       WAFCLK
+  SMU11_SYSPLL3_0_DISPCLK_ID = 1,      //       DISPCLK
+  SMU11_SYSPLL3_0_DPREFCLK_ID = 2,     //       DPREFCLK
+};
+enum atom_smu11_syspll3_1_clock_id {
+  SMU11_SYSPLL3_1_MP1CLK_ID = 0,       //       MP1CLK
+  SMU11_SYSPLL3_1_SMNCLK_ID = 1,       //       SMNCLK
+  SMU11_SYSPLL3_1_LCLK_ID = 2,         //       LCLK
+};
 struct  atom_get_smu_clock_info_output_parameters_v3_1
 {
  union {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 26fbeafc3c96..18b5b2ff47fe 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -79,12 +79,13 @@
 #define PCIE_BUS_CLK                10000
 #define TCLK                        (PCIE_BUS_CLK / 10)
-static const struct profile_mode_setting smu7_profiling[5] =
+static const struct profile_mode_setting smu7_profiling[6] =
                                        {{1, 0, 100, 30, 1, 0, 100, 10},
                                         {1, 10, 0, 30, 0, 0, 0, 0},
                                         {0, 0, 0, 0, 1, 10, 16, 31},
                                         {1, 0, 11, 50, 1, 0, 100, 10},
                                         {1, 0, 5, 30, 0, 0, 0, 0},
+                                         {0, 0, 0, 0, 0, 0, 0, 0},
                                        };
 /** Values for the CG_THERMAL_CTRL::DPM_EVENT_SRC field. */
@@ -4864,6 +4865,17 @@ static int smu7_get_power_profile_mode(struct pp_hwmgr *hwmgr, char *buf)
        len = sizeof(smu7_profiling) / sizeof(struct profile_mode_setting);
        for (i = 0; i < len; i++) {
+                if (i == hwmgr->power_profile_mode) {
+                        size += sprintf(buf + size, "%3d %14s %s: %8d %16d %16d %16d %16d %16d\n",
+                        i, profile_name[i], "*",
+                        data->current_profile_setting.sclk_up_hyst,
+                        data->current_profile_setting.sclk_down_hyst,
+                        data->current_profile_setting.sclk_activity,
+                        data->current_profile_setting.mclk_up_hyst,
+                        data->current_profile_setting.mclk_down_hyst,
+                        data->current_profile_setting.mclk_activity);
+                        continue;
+                }
                if (smu7_profiling[i].bupdate_sclk)
                        size += sprintf(buf + size, "%3d %16s: %8d %16d %16d ",
                        i, profile_name[i], smu7_profiling[i].sclk_up_hyst,
@@ -4883,24 +4895,6 @@ static int smu7_get_power_profile_mode(struct pp_hwmgr *hwmgr, char *buf)
                        "-", "-", "-");
        }
-        size += sprintf(buf + size, "%3d %16s: %8d %16d %16d %16d %16d %16d\n",
-                        i, profile_name[i],
-                        data->custom_profile_setting.sclk_up_hyst,
-                        data->custom_profile_setting.sclk_down_hyst,
-                        data->custom_profile_setting.sclk_activity,
-                        data->custom_profile_setting.mclk_up_hyst,
-                        data->custom_profile_setting.mclk_down_hyst,
-                        data->custom_profile_setting.mclk_activity);
-        size += sprintf(buf + size, "%3s %16s: %8d %16d %16d %16d %16d %16d\n",
-                        "*", "CURRENT",
-                        data->current_profile_setting.sclk_up_hyst,
-                        data->current_profile_setting.sclk_down_hyst,
-                        data->current_profile_setting.sclk_activity,
-                        data->current_profile_setting.mclk_up_hyst,
-                        data->current_profile_setting.mclk_down_hyst,
-                        data->current_profile_setting.mclk_activity);
        return size;
 }
@@ -4939,16 +4933,16 @@ static int smu7_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uint
                if (size < 8)
                        return -EINVAL;
-                data->custom_profile_setting.bupdate_sclk = input[0];
+                tmp.bupdate_sclk = input[0];
-                data->custom_profile_setting.sclk_up_hyst = input[1];
+                tmp.sclk_up_hyst = input[1];
-                data->custom_profile_setting.sclk_down_hyst = input[2];
+                tmp.sclk_down_hyst = input[2];
-                data->custom_profile_setting.sclk_activity = input[3];
+                tmp.sclk_activity = input[3];
-                data->custom_profile_setting.bupdate_mclk = input[4];
+                tmp.bupdate_mclk = input[4];
-                data->custom_profile_setting.mclk_up_hyst = input[5];
+                tmp.mclk_up_hyst = input[5];
-                data->custom_profile_setting.mclk_down_hyst = input[6];
+                tmp.mclk_down_hyst = input[6];
-                data->custom_profile_setting.mclk_activity = input[7];
+                tmp.mclk_activity = input[7];
-                if (!smum_update_dpm_settings(hwmgr, &data->custom_profile_setting)) {
+                if (!smum_update_dpm_settings(hwmgr, &tmp)) {
-                        memcpy(&data->current_profile_setting, &data->custom_profile_setting, sizeof(struct profile_mode_setting));
+                        memcpy(&data->current_profile_setting, &tmp, sizeof(struct profile_mode_setting));
                        hwmgr->power_profile_mode = mode;
                }
                break;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.h
index f40179c9ca97..b8d0bb378595 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.h
@@ -325,7 +325,6 @@ struct smu7_hwmgr {
        uint16_t                              mem_latency_high;
        uint16_t                              mem_latency_low;
        uint32_t                              vr_config;
-        struct profile_mode_setting           custom_profile_setting;
        struct profile_mode_setting           current_profile_setting;
 };
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c
index 03bc7453f3b1..d9e92e306535 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c
@@ -852,12 +852,10 @@ int smu7_set_power_limit(struct pp_hwmgr *hwmgr, uint32_t n)
 {
        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
-        n = (n & 0xff) << 8;
        if (data->power_containment_features &
                        POWERCONTAINMENT_FEATURE_PkgPwrLimit)
                return smum_send_msg_to_smc_with_parameter(hwmgr,
-                                PPSMC_MSG_PkgPwrSetLimit, n);
+                                PPSMC_MSG_PkgPwrSetLimit, n<<8);
        return 0;
 }
diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index 3aa65bdecb0e..684ac626ac53 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -74,6 +74,7 @@ config DRM_SIL_SII8620
        tristate "Silicon Image SII8620 HDMI/MHL bridge"
        depends on OF && RC_CORE
        select DRM_KMS_HELPER
+        imply EXTCON
        help
          Silicon Image SII8620 HDMI/MHL bridge chip driver.
diff --git a/drivers/gpu/drm/bridge/dumb-vga-dac.c b/drivers/gpu/drm/bridge/dumb-vga-dac.c
index 498d5948d1a8..9837c8d69e69 100644
--- a/drivers/gpu/drm/bridge/dumb-vga-dac.c
+++ b/drivers/gpu/drm/bridge/dumb-vga-dac.c
@@ -56,7 +56,9 @@ static int dumb_vga_get_modes(struct drm_connector *connector)
        }
        drm_mode_connector_update_edid_property(connector, edid);
-        return drm_add_edid_modes(connector, edid);
+        ret = drm_add_edid_modes(connector, edid);
+        kfree(edid);
+        return ret;
 fallback:
        /*
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 7d25c42f22db..c825c76edc1d 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -155,6 +155,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
                                                       state->connectors[i].state);
                state->connectors[i].ptr = NULL;
                state->connectors[i].state = NULL;
+                state->connectors[i].old_state = NULL;
+                state->connectors[i].new_state = NULL;
                drm_connector_put(connector);
        }
@@ -169,6 +171,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
                state->crtcs[i].ptr = NULL;
                state->crtcs[i].state = NULL;
+                state->crtcs[i].old_state = NULL;
+                state->crtcs[i].new_state = NULL;
        }
        for (i = 0; i < config->num_total_plane; i++) {
@@ -181,6 +185,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
                                                   state->planes[i].state);
                state->planes[i].ptr = NULL;
                state->planes[i].state = NULL;
+                state->planes[i].old_state = NULL;
+                state->planes[i].new_state = NULL;
        }
        for (i = 0; i < state->num_private_objs; i++) {
@@ -190,6 +196,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
                                                 state->private_objs[i].state);
                state->private_objs[i].ptr = NULL;
                state->private_objs[i].state = NULL;
+                state->private_objs[i].old_state = NULL;
+                state->private_objs[i].new_state = NULL;
        }
        state->num_private_objs = 0;
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index abd84cbcf1c2..09c4bc0b1859 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -954,8 +954,6 @@ static int hdmi_create_connector(struct drm_encoder *encoder)
        drm_mode_connector_attach_encoder(connector, encoder);
        if (hdata->bridge) {
-                encoder->bridge = hdata->bridge;
-                hdata->bridge->encoder = encoder;
                ret = drm_bridge_attach(encoder, hdata->bridge, NULL);
                if (ret)
                        DRM_ERROR("Failed to attach bridge\n");
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 257299ec95c4..272c79f5f5bf 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -473,7 +473,7 @@ static void vp_video_buffer(struct mixer_context *ctx,
                        chroma_addr[1] = chroma_addr[0] + 0x40;
                } else {
                        luma_addr[1] = luma_addr[0] + fb->pitches[0];
-                        chroma_addr[1] = chroma_addr[0] + fb->pitches[0];
+                        chroma_addr[1] = chroma_addr[0] + fb->pitches[1];
                }
        } else {
                luma_addr[1] = 0;
@@ -482,6 +482,7 @@ static void vp_video_buffer(struct mixer_context *ctx,
        spin_lock_irqsave(&ctx->reg_slock, flags);
+        vp_reg_write(ctx, VP_SHADOW_UPDATE, 1);
        /* interlace or progressive scan mode */
        val = (test_bit(MXR_BIT_INTERLACE, &ctx->flags) ? ~0 : 0);
        vp_reg_writemask(ctx, VP_MODE, val, VP_MODE_LINE_SKIP);
@@ -495,21 +496,23 @@ static void vp_video_buffer(struct mixer_context *ctx,
        vp_reg_write(ctx, VP_IMG_SIZE_Y, VP_IMG_HSIZE(fb->pitches[0]) |
                VP_IMG_VSIZE(fb->height));
        /* chroma plane for NV12/NV21 is half the height of the luma plane */
-        vp_reg_write(ctx, VP_IMG_SIZE_C, VP_IMG_HSIZE(fb->pitches[0]) |
+        vp_reg_write(ctx, VP_IMG_SIZE_C, VP_IMG_HSIZE(fb->pitches[1]) |
                VP_IMG_VSIZE(fb->height / 2));
        vp_reg_write(ctx, VP_SRC_WIDTH, state->src.w);
-        vp_reg_write(ctx, VP_SRC_HEIGHT, state->src.h);
        vp_reg_write(ctx, VP_SRC_H_POSITION,
                        VP_SRC_H_POSITION_VAL(state->src.x));
-        vp_reg_write(ctx, VP_SRC_V_POSITION, state->src.y);
        vp_reg_write(ctx, VP_DST_WIDTH, state->crtc.w);
        vp_reg_write(ctx, VP_DST_H_POSITION, state->crtc.x);
        if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) {
+                vp_reg_write(ctx, VP_SRC_HEIGHT, state->src.h / 2);
+                vp_reg_write(ctx, VP_SRC_V_POSITION, state->src.y / 2);
                vp_reg_write(ctx, VP_DST_HEIGHT, state->crtc.h / 2);
                vp_reg_write(ctx, VP_DST_V_POSITION, state->crtc.y / 2);
        } else {
+                vp_reg_write(ctx, VP_SRC_HEIGHT, state->src.h);
+                vp_reg_write(ctx, VP_SRC_V_POSITION, state->src.y);
                vp_reg_write(ctx, VP_DST_HEIGHT, state->crtc.h);
                vp_reg_write(ctx, VP_DST_V_POSITION, state->crtc.y);
        }
@@ -699,6 +702,15 @@ static irqreturn_t mixer_irq_handler(int irq, void *arg)
                /* interlace scan need to check shadow register */
                if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) {
+                        if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) &&
+                            vp_reg_read(ctx, VP_SHADOW_UPDATE))
+                                goto out;
+                        base = mixer_reg_read(ctx, MXR_CFG);
+                        shadow = mixer_reg_read(ctx, MXR_CFG_S);
+                        if (base != shadow)
+                                goto out;
                        base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0));
                        shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0));
                        if (base != shadow)
diff --git a/drivers/gpu/drm/exynos/regs-mixer.h b/drivers/gpu/drm/exynos/regs-mixer.h
index c311f571bdf9..189cfa2470a8 100644
--- a/drivers/gpu/drm/exynos/regs-mixer.h
+++ b/drivers/gpu/drm/exynos/regs-mixer.h
@@ -47,6 +47,7 @@
 #define MXR_MO                          0x0304
 #define MXR_RESOLUTION                  0x0310
+#define MXR_CFG_S                       0x2004
 #define MXR_GRAPHIC0_BASE_S             0x2024
 #define MXR_GRAPHIC1_BASE_S             0x2044
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index 32d24c69da3c..704ddb4d3ca7 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -2302,9 +2302,44 @@ static int bdw_modeset_calc_cdclk(struct drm_atomic_state *state)
        return 0;
 }
+static int skl_dpll0_vco(struct intel_atomic_state *intel_state)
+{
+        struct drm_i915_private *dev_priv = to_i915(intel_state->base.dev);
+        struct intel_crtc *crtc;
+        struct intel_crtc_state *crtc_state;
+        int vco, i;
+        vco = intel_state->cdclk.logical.vco;
+        if (!vco)
+                vco = dev_priv->skl_preferred_vco_freq;
+        for_each_new_intel_crtc_in_state(intel_state, crtc, crtc_state, i) {
+                if (!crtc_state->base.enable)
+                        continue;
+                if (!intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP))
+                        continue;
+                /*
+                 * DPLL0 VCO may need to be adjusted to get the correct
+                 * clock for eDP. This will affect cdclk as well.
+                 */
+                switch (crtc_state->port_clock / 2) {
+                case 108000:
+                case 216000:
+                        vco = 8640000;
+                        break;
+                default:
+                        vco = 8100000;
+                        break;
+                }
+        }
+        return vco;
+}
 static int skl_modeset_calc_cdclk(struct drm_atomic_state *state)
 {
-        struct drm_i915_private *dev_priv = to_i915(state->dev);
        struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
        int min_cdclk, cdclk, vco;
@@ -2312,9 +2347,7 @@ static int skl_modeset_calc_cdclk(struct drm_atomic_state *state)
        if (min_cdclk < 0)
                return min_cdclk;
-        vco = intel_state->cdclk.logical.vco;
+        vco = skl_dpll0_vco(intel_state);
-        if (!vco)
-                vco = dev_priv->skl_preferred_vco_freq;
        /*
         * FIXME should also account for plane ratio
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 41e6c75a7f3c..f9550ea46c26 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -35,6 +35,7 @@
 */
 #define I915_CSR_GLK "i915/glk_dmc_ver1_04.bin"
+MODULE_FIRMWARE(I915_CSR_GLK);
 #define GLK_CSR_VERSION_REQUIRED        CSR_VERSION(1, 4)
 #define I915_CSR_CNL "i915/cnl_dmc_ver1_07.bin"
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3b48fd2561fe..56004ffbd8bb 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15178,6 +15178,8 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
                memset(&crtc->base.mode, 0, sizeof(crtc->base.mode));
                if (crtc_state->base.active) {
                        intel_mode_from_pipe_config(&crtc->base.mode, crtc_state);
+                        crtc->base.mode.hdisplay = crtc_state->pipe_src_w;
+                        crtc->base.mode.vdisplay = crtc_state->pipe_src_h;
                        intel_mode_from_pipe_config(&crtc_state->base.adjusted_mode, crtc_state);
                        WARN_ON(drm_atomic_set_mode_for_crtc(crtc->base.state, &crtc->base.mode));
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 9a4a51e79fa1..b7b4cfdeb974 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1881,26 +1881,6 @@ found:
                                reduce_m_n);
        }
-        /*
-         * DPLL0 VCO may need to be adjusted to get the correct
-         * clock for eDP. This will affect cdclk as well.
-         */
-        if (intel_dp_is_edp(intel_dp) && IS_GEN9_BC(dev_priv)) {
-                int vco;
-                switch (pipe_config->port_clock / 2) {
-                case 108000:
-                case 216000:
-                        vco = 8640000;
-                        break;
-                default:
-                        vco = 8100000;
-                        break;
-                }
-                to_intel_atomic_state(pipe_config->base.state)->cdclk.logical.vco = vco;
-        }
        if (!HAS_DDI(dev_priv))
                intel_dp_set_clock(encoder, pipe_config);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index d35d2d50f595..8691c86f579c 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -326,7 +326,8 @@ static void intel_enable_lvds(struct intel_encoder *encoder,
        I915_WRITE(PP_CONTROL(0), I915_READ(PP_CONTROL(0)) | PANEL_POWER_ON);
        POSTING_READ(lvds_encoder->reg);
-        if (intel_wait_for_register(dev_priv, PP_STATUS(0), PP_ON, PP_ON, 1000))
+        if (intel_wait_for_register(dev_priv, PP_STATUS(0), PP_ON, PP_ON, 5000))
                DRM_ERROR("timed out waiting for panel to power on\n");
        intel_panel_enable_backlight(pipe_config, conn_state);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 6f402c4f2bdd..ab61c038f42c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -214,7 +214,6 @@ nouveau_bo_new(struct nouveau_cli *cli, u64 size, int align,
        INIT_LIST_HEAD(&nvbo->entry);
        INIT_LIST_HEAD(&nvbo->vma_list);
        nvbo->bo.bdev = &drm->ttm.bdev;
-        nvbo->cli = cli;
        /* This is confusing, and doesn't actually mean we want an uncached
         * mapping, but is what NOUVEAU_GEM_DOMAIN_COHERENT gets translated
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.h b/drivers/gpu/drm/nouveau/nouveau_bo.h
index be8e00b49cde..73c48440d4d7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.h
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.h
@@ -26,8 +26,6 @@ struct nouveau_bo {
        struct list_head vma_list;
-        struct nouveau_cli *cli;
        unsigned contig:1;
        unsigned page:5;
        unsigned kind:8;
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index dff51a0ee028..8c093ca4222e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -63,7 +63,7 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
                         struct ttm_mem_reg *reg)
 {
        struct nouveau_bo *nvbo = nouveau_bo(bo);
-        struct nouveau_drm *drm = nvbo->cli->drm;
+        struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
        struct nouveau_mem *mem;
        int ret;
@@ -103,7 +103,7 @@ nouveau_gart_manager_new(struct ttm_mem_type_manager *man,
                         struct ttm_mem_reg *reg)
 {
        struct nouveau_bo *nvbo = nouveau_bo(bo);
-        struct nouveau_drm *drm = nvbo->cli->drm;
+        struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
        struct nouveau_mem *mem;
        int ret;
@@ -131,7 +131,7 @@ nv04_gart_manager_new(struct ttm_mem_type_manager *man,
                      struct ttm_mem_reg *reg)
 {
        struct nouveau_bo *nvbo = nouveau_bo(bo);
-        struct nouveau_drm *drm = nvbo->cli->drm;
+        struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
        struct nouveau_mem *mem;
        int ret;
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 8bd739cfd00d..2b3ccd850750 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -3264,10 +3264,11 @@ nv50_mstm_destroy_connector(struct drm_dp_mst_topology_mgr *mgr,
        drm_connector_unregister(&mstc->connector);
-        drm_modeset_lock_all(drm->dev);
        drm_fb_helper_remove_one_connector(&drm->fbcon->helper, &mstc->connector);
+        drm_modeset_lock(&drm->dev->mode_config.connection_mutex, NULL);
        mstc->port = NULL;
-        drm_modeset_unlock_all(drm->dev);
+        drm_modeset_unlock(&drm->dev->mode_config.connection_mutex);
        drm_connector_unreference(&mstc->connector);
 }
@@ -3277,9 +3278,7 @@ nv50_mstm_register_connector(struct drm_connector *connector)
 {
        struct nouveau_drm *drm = nouveau_drm(connector->dev);
-        drm_modeset_lock_all(drm->dev);
        drm_fb_helper_add_one_connector(&drm->fbcon->helper, connector);
-        drm_modeset_unlock_all(drm->dev);
        drm_connector_register(connector);
 }
diff --git a/drivers/gpu/drm/omapdrm/dss/dispc.c b/drivers/gpu/drm/omapdrm/dss/dispc.c
index 5e2e65e88847..7f3ac6b13b56 100644
--- a/drivers/gpu/drm/omapdrm/dss/dispc.c
+++ b/drivers/gpu/drm/omapdrm/dss/dispc.c
@@ -828,6 +828,12 @@ static void dispc_ovl_set_scale_coef(struct dispc_device *dispc,
        h_coef = dispc_ovl_get_scale_coef(fir_hinc, true);
        v_coef = dispc_ovl_get_scale_coef(fir_vinc, five_taps);
+        if (!h_coef || !v_coef) {
+                dev_err(&dispc->pdev->dev, "%s: failed to find scale coefs\n",
+                        __func__);
+                return;
+        }
        for (i = 0; i < 8; i++) {
                u32 h, hv;
@@ -2342,7 +2348,7 @@ static int dispc_ovl_calc_scaling_24xx(struct dispc_device *dispc,
        }
        if (in_width > maxsinglelinewidth) {
-                DSSERR("Cannot scale max input width exceeded");
+                DSSERR("Cannot scale max input width exceeded\n");
                return -EINVAL;
        }
        return 0;
@@ -2424,13 +2430,13 @@ again:
        }
        if (in_width > (maxsinglelinewidth * 2)) {
-                DSSERR("Cannot setup scaling");
+                DSSERR("Cannot setup scaling\n");
-                DSSERR("width exceeds maximum width possible");
+                DSSERR("width exceeds maximum width possible\n");
                return -EINVAL;
        }
        if (in_width > maxsinglelinewidth && *five_taps) {
-                DSSERR("cannot setup scaling with five taps");
+                DSSERR("cannot setup scaling with five taps\n");
                return -EINVAL;
        }
        return 0;
@@ -2472,7 +2478,7 @@ static int dispc_ovl_calc_scaling_44xx(struct dispc_device *dispc,
                        in_width > maxsinglelinewidth && ++*decim_x);
        if (in_width > maxsinglelinewidth) {
-                DSSERR("Cannot scale width exceeds max line width");
+                DSSERR("Cannot scale width exceeds max line width\n");
                return -EINVAL;
        }
@@ -2490,7 +2496,7 @@ static int dispc_ovl_calc_scaling_44xx(struct dispc_device *dispc,
                 * bandwidth. Despite what theory says this appears to
                 * be true also for 16-bit color formats.
                 */
-                DSSERR("Not enough bandwidth, too much downscaling (x-decimation factor %d > 4)", *decim_x);
+                DSSERR("Not enough bandwidth, too much downscaling (x-decimation factor %d > 4)\n", *decim_x);
                return -EINVAL;
        }
@@ -4633,7 +4639,7 @@ static int dispc_errata_i734_wa_init(struct dispc_device *dispc)
                                                i734_buf.size, &i734_buf.paddr,
                                                GFP_KERNEL);
        if (!i734_buf.vaddr) {
-                dev_err(&dispc->pdev->dev, "%s: dma_alloc_writecombine failed",
+                dev_err(&dispc->pdev->dev, "%s: dma_alloc_writecombine failed\n",
                        __func__);
                return -ENOMEM;
        }
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
index 97c88861d67a..5879f45f6fc9 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
@@ -679,7 +679,7 @@ static int hdmi_audio_config(struct device *dev,
                             struct omap_dss_audio *dss_audio)
 {
        struct omap_hdmi *hd = dev_get_drvdata(dev);
-        int ret;
+        int ret = 0;
        mutex_lock(&hd->lock);
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
index 35ed2add6189..813ba42f2753 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
@@ -922,8 +922,13 @@ int hdmi4_core_init(struct platform_device *pdev, struct hdmi_core_data *core)
 {
        const struct hdmi4_features *features;
        struct resource *res;
+        const struct soc_device_attribute *soc;
-        features = soc_device_match(hdmi4_soc_devices)->data;
+        soc = soc_device_match(hdmi4_soc_devices);
+        if (!soc)
+                return -ENODEV;
+        features = soc->data;
        core->cts_swmode = features->cts_swmode;
        core->audio_use_mclk = features->audio_use_mclk;
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
index d28da9ac3e90..ae1a001d1b83 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
@@ -671,7 +671,7 @@ static int hdmi_audio_config(struct device *dev,
                             struct omap_dss_audio *dss_audio)
 {
        struct omap_hdmi *hd = dev_get_drvdata(dev);
-        int ret;
+        int ret = 0;
        mutex_lock(&hd->lock);
diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c
index a0d7b1d905e8..5cde26ac937b 100644
--- a/drivers/gpu/drm/omapdrm/omap_connector.c
+++ b/drivers/gpu/drm/omapdrm/omap_connector.c
@@ -121,6 +121,9 @@ static int omap_connector_get_modes(struct drm_connector *connector)
        if (dssdrv->read_edid) {
                void *edid = kzalloc(MAX_EDID, GFP_KERNEL);
+                if (!edid)
+                        return 0;
                if ((dssdrv->read_edid(dssdev, edid, MAX_EDID) > 0) &&
                                drm_edid_is_valid(edid)) {
                        drm_mode_connector_update_edid_property(
@@ -139,6 +142,9 @@ static int omap_connector_get_modes(struct drm_connector *connector)
                struct drm_display_mode *mode = drm_mode_create(dev);
                struct videomode vm = {0};
+                if (!mode)
+                        return 0;
                dssdrv->get_timings(dssdev, &vm);
                drm_display_mode_from_videomode(&vm, mode);
@@ -200,6 +206,10 @@ static int omap_connector_mode_valid(struct drm_connector *connector,
        if (!r) {
                /* check if vrefresh is still valid */
                new_mode = drm_mode_duplicate(dev, mode);
+                if (!new_mode)
+                        return MODE_BAD;
                new_mode->clock = vm.pixelclock / 1000;
                new_mode->vrefresh = 0;
                if (mode->vrefresh == drm_mode_vrefresh(new_mode))
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index f9fa1c90b35c..401c02e9e6b2 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -401,12 +401,16 @@ int tiler_unpin(struct tiler_block *block)
 struct tiler_block *tiler_reserve_2d(enum tiler_fmt fmt, u16 w,
                u16 h, u16 align)
 {
-        struct tiler_block *block = kzalloc(sizeof(*block), GFP_KERNEL);
+        struct tiler_block *block;
        u32 min_align = 128;
        int ret;
        unsigned long flags;
        u32 slot_bytes;
+        block = kzalloc(sizeof(*block), GFP_KERNEL);
+        if (!block)
+                return ERR_PTR(-ENOMEM);
        BUG_ON(!validfmt(fmt));
        /* convert width/height to slots */
diff --git a/drivers/gpu/drm/omapdrm/tcm-sita.c b/drivers/gpu/drm/omapdrm/tcm-sita.c
index d7f7bc9f061a..817be3c41863 100644
--- a/drivers/gpu/drm/omapdrm/tcm-sita.c
+++ b/drivers/gpu/drm/omapdrm/tcm-sita.c
@@ -90,7 +90,7 @@ static int l2r_t2b(u16 w, u16 h, u16 a, s16 offset,
 {
        int i;
        unsigned long index;
-        bool area_free;
+        bool area_free = false;
        unsigned long slots_per_band = PAGE_SIZE / slot_bytes;
        unsigned long bit_offset = (offset > 0) ? offset / slot_bytes : 0;
        unsigned long curr_bit = bit_offset;
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index f0481b7b60c5..06c94e3a5f15 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -910,7 +910,8 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
                        while (npages >= HPAGE_PMD_NR) {
                                gfp_t huge_flags = gfp_flags;
-                                huge_flags |= GFP_TRANSHUGE;
+                                huge_flags |= GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+                                        __GFP_KSWAPD_RECLAIM;
                                huge_flags &= ~__GFP_MOVABLE;
                                huge_flags &= ~__GFP_COMP;
                                p = alloc_pages(huge_flags, HPAGE_PMD_ORDER);
@@ -1027,11 +1028,15 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
                                  GFP_USER | GFP_DMA32, "uc dma", 0);
        ttm_page_pool_init_locked(&_manager->wc_pool_huge,
-                                  GFP_TRANSHUGE & ~(__GFP_MOVABLE | __GFP_COMP),
+                                  (GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+                                   __GFP_KSWAPD_RECLAIM) &
+                                  ~(__GFP_MOVABLE | __GFP_COMP),
                                  "wc huge", order);
        ttm_page_pool_init_locked(&_manager->uc_pool_huge,
-                                  GFP_TRANSHUGE & ~(__GFP_MOVABLE | __GFP_COMP)
+                                  (GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+                                   __GFP_KSWAPD_RECLAIM) &
+                                  ~(__GFP_MOVABLE | __GFP_COMP)
                                  , "uc huge", order);
        _manager->options.max_size = max_pages;
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 8a25d1974385..f63d99c302e4 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -910,7 +910,8 @@ static gfp_t ttm_dma_pool_gfp_flags(struct ttm_dma_tt *ttm_dma, bool huge)
                gfp_flags |= __GFP_ZERO;
        if (huge) {
-                gfp_flags |= GFP_TRANSHUGE;
+                gfp_flags |= GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+                        __GFP_KSWAPD_RECLAIM;
                gfp_flags &= ~__GFP_MOVABLE;
                gfp_flags &= ~__GFP_COMP;
        }
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index bf4667481935..c61dff594195 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -760,6 +760,7 @@ static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 struct vc4_async_flip_state {
        struct drm_crtc *crtc;
        struct drm_framebuffer *fb;
+        struct drm_framebuffer *old_fb;
        struct drm_pending_vblank_event *event;
        struct vc4_seqno_cb cb;
@@ -789,6 +790,23 @@ vc4_async_page_flip_complete(struct vc4_seqno_cb *cb)
        drm_crtc_vblank_put(crtc);
        drm_framebuffer_put(flip_state->fb);
+        /* Decrement the BO usecnt in order to keep the inc/dec calls balanced
+         * when the planes are updated through the async update path.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made cleanup_fb()
+         * logic.
+         */
+        if (flip_state->old_fb) {
+                struct drm_gem_cma_object *cma_bo;
+                struct vc4_bo *bo;
+                cma_bo = drm_fb_cma_get_gem_obj(flip_state->old_fb, 0);
+                bo = to_vc4_bo(&cma_bo->base);
+                vc4_bo_dec_usecnt(bo);
+                drm_framebuffer_put(flip_state->old_fb);
+        }
        kfree(flip_state);
        up(&vc4->async_modeset);
@@ -813,9 +831,22 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
        struct drm_gem_cma_object *cma_bo = drm_fb_cma_get_gem_obj(fb, 0);
        struct vc4_bo *bo = to_vc4_bo(&cma_bo->base);
+        /* Increment the BO usecnt here, so that we never end up with an
+         * unbalanced number of vc4_bo_{dec,inc}_usecnt() calls when the
+         * plane is later updated through the non-async path.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made prepare_fb()
+         * logic.
+         */
+        ret = vc4_bo_inc_usecnt(bo);
+        if (ret)
+                return ret;
        flip_state = kzalloc(sizeof(*flip_state), GFP_KERNEL);
-        if (!flip_state)
+        if (!flip_state) {
+                vc4_bo_dec_usecnt(bo);
                return -ENOMEM;
+        }
        drm_framebuffer_get(fb);
        flip_state->fb = fb;
@@ -826,10 +857,23 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
        ret = down_interruptible(&vc4->async_modeset);
        if (ret) {
                drm_framebuffer_put(fb);
+                vc4_bo_dec_usecnt(bo);
                kfree(flip_state);
                return ret;
        }
+        /* Save the current FB before it's replaced by the new one in
+         * drm_atomic_set_fb_for_plane(). We'll need the old FB in
+         * vc4_async_page_flip_complete() to decrement the BO usecnt and keep
+         * it consistent.
+         * FIXME: we should move to generic async-page-flip when it's
+         * available, so that we can get rid of this hand-made cleanup_fb()
+         * logic.
+         */
+        flip_state->old_fb = plane->state->fb;
+        if (flip_state->old_fb)
+                drm_framebuffer_get(flip_state->old_fb);
        WARN_ON(drm_crtc_vblank_get(crtc) != 0);
        /* Immediately update the plane's legacy fb pointer, so that later
diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c
index 72c9dbd81d7f..f185812970da 100644
--- a/drivers/gpu/drm/vc4/vc4_dpi.c
+++ b/drivers/gpu/drm/vc4/vc4_dpi.c
@@ -96,7 +96,6 @@ struct vc4_dpi {
        struct platform_device *pdev;
        struct drm_encoder *encoder;
-        struct drm_connector *connector;
        void __iomem *regs;
@@ -164,14 +163,31 @@ static void vc4_dpi_encoder_disable(struct drm_encoder *encoder)
 static void vc4_dpi_encoder_enable(struct drm_encoder *encoder)
 {
+        struct drm_device *dev = encoder->dev;
        struct drm_display_mode *mode = &encoder->crtc->mode;
        struct vc4_dpi_encoder *vc4_encoder = to_vc4_dpi_encoder(encoder);
        struct vc4_dpi *dpi = vc4_encoder->dpi;
+        struct drm_connector_list_iter conn_iter;
+        struct drm_connector *connector = NULL, *connector_scan;
        u32 dpi_c = DPI_ENABLE | DPI_OUTPUT_ENABLE_MODE;
        int ret;
-        if (dpi->connector->display_info.num_bus_formats) {
+        /* Look up the connector attached to DPI so we can get the
-                u32 bus_format = dpi->connector->display_info.bus_formats[0];
+         * bus_format.  Ideally the bridge would tell us the
+         * bus_format we want, but it doesn't yet, so assume that it's
+         * uniform throughout the bridge chain.
+         */
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        drm_for_each_connector_iter(connector_scan, &conn_iter) {
+                if (connector_scan->encoder == encoder) {
+                        connector = connector_scan;
+                        break;
+                }
+        }
+        drm_connector_list_iter_end(&conn_iter);
+        if (connector && connector->display_info.num_bus_formats) {
+                u32 bus_format = connector->display_info.bus_formats[0];
                switch (bus_format) {
                case MEDIA_BUS_FMT_RGB888_1X24:
@@ -199,6 +215,9 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder)
                        DRM_ERROR("Unknown media bus format %d\n", bus_format);
                        break;
                }
+        } else {
+                /* Default to 24bit if no connector found. */
+                dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, DPI_FORMAT);
        }
        if (mode->flags & DRM_MODE_FLAG_NHSYNC)
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index ce39390be389..13dcaad06798 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -503,7 +503,7 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
         * the scl fields here.
         */
        if (num_planes == 1) {
-                scl0 = vc4_get_scl_field(state, 1);
+                scl0 = vc4_get_scl_field(state, 0);
                scl1 = scl0;
        } else {
                scl0 = vc4_get_scl_field(state, 1);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 2582ffd36bb5..ba0cdb743c3e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -441,11 +441,11 @@ static int vmwgfx_set_config_internal(struct drm_mode_set *set)
        struct drm_crtc *crtc = set->crtc;
        struct drm_framebuffer *fb;
        struct drm_crtc *tmp;
-        struct drm_modeset_acquire_ctx *ctx;
        struct drm_device *dev = set->crtc->dev;
+        struct drm_modeset_acquire_ctx ctx;
        int ret;
-        ctx = dev->mode_config.acquire_ctx;
+        drm_modeset_acquire_init(&ctx, 0);
 restart:
        /*
@@ -458,7 +458,7 @@ restart:
        fb = set->fb;
-        ret = crtc->funcs->set_config(set, ctx);
+        ret = crtc->funcs->set_config(set, &ctx);
        if (ret == 0) {
                crtc->primary->crtc = crtc;
                crtc->primary->fb = fb;
@@ -473,20 +473,13 @@ restart:
        }
        if (ret == -EDEADLK) {
-                dev->mode_config.acquire_ctx = NULL;
+                drm_modeset_backoff(&ctx);
-retry_locking:
-                drm_modeset_backoff(ctx);
-                ret = drm_modeset_lock_all_ctx(dev, ctx);
-                if (ret)
-                        goto retry_locking;
-                dev->mode_config.acquire_ctx = ctx;
                goto restart;
        }
+        drm_modeset_drop_locks(&ctx);
+        drm_modeset_acquire_fini(&ctx);
        return ret;
 }
@@ -624,7 +617,6 @@ static int vmw_fb_set_par(struct fb_info *info)
        }
        mutex_lock(&par->bo_mutex);
-        drm_modeset_lock_all(vmw_priv->dev);
        ret = vmw_fb_kms_framebuffer(info);
        if (ret)
                goto out_unlock;
@@ -657,7 +649,6 @@ out_unlock:
                drm_mode_destroy(vmw_priv->dev, old_mode);
        par->set_mode = mode;
-        drm_modeset_unlock_all(vmw_priv->dev);
        mutex_unlock(&par->bo_mutex);
        return ret;
@@ -713,18 +704,14 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
        par->max_width = fb_width;
        par->max_height = fb_height;
-        drm_modeset_lock_all(vmw_priv->dev);
        ret = vmw_kms_fbdev_init_data(vmw_priv, 0, par->max_width,
                                      par->max_height, &par->con,
                                      &par->crtc, &init_mode);
-        if (ret) {
+        if (ret)
-                drm_modeset_unlock_all(vmw_priv->dev);
                goto err_kms;
-        }
        info->var.xres = init_mode->hdisplay;
        info->var.yres = init_mode->vdisplay;
-        drm_modeset_unlock_all(vmw_priv->dev);
        /*
         * Create buffers and alloc memory
@@ -832,7 +819,9 @@ int vmw_fb_close(struct vmw_private *vmw_priv)
        cancel_delayed_work_sync(&par->local_work);
        unregister_framebuffer(info);
+        mutex_lock(&par->bo_mutex);
        (void) vmw_fb_kms_detach(par, true, true);
+        mutex_unlock(&par->bo_mutex);
        vfree(par->vmalloc);
        framebuffer_release(info);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index f11601b6fd74..96fd7a03d2f8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2595,6 +2595,7 @@ void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
                vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf,
                                             out_fence, NULL);
+        vmw_dmabuf_unreference(&ctx->buf);
        vmw_resource_unreserve(res, false, NULL, 0);
        mutex_unlock(&res->dev_priv->cmdbuf_mutex);
 }
@@ -2680,7 +2681,9 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
        struct vmw_display_unit *du;
        struct drm_display_mode *mode;
        int i = 0;
+        int ret = 0;
+        mutex_lock(&dev_priv->dev->mode_config.mutex);
        list_for_each_entry(con, &dev_priv->dev->mode_config.connector_list,
                            head) {
                if (i == unit)
@@ -2691,7 +2694,8 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
        if (i != unit) {
                DRM_ERROR("Could not find initial display unit.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
        }
        if (list_empty(&con->modes))
@@ -2699,7 +2703,8 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
        if (list_empty(&con->modes)) {
                DRM_ERROR("Could not find initial display mode.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
        }
        du = vmw_connector_to_du(con);
@@ -2720,7 +2725,10 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
                                           head);
        }
-        return 0;
+ out_unlock:
+        mutex_unlock(&dev_priv->dev->mode_config.mutex);
+        return ret;
 }
 /**
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 60252fd796f6..0000434a1fbd 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -462,10 +462,11 @@ config HID_LENOVO
        select NEW_LEDS
        select LEDS_CLASS
        ---help---
-        Support for Lenovo devices that are not fully compliant with HID standard.
+        Support for IBM/Lenovo devices that are not fully compliant with HID standard.
-        Say Y if you want support for the non-compliant features of the Lenovo
+        Say Y if you want support for horizontal scrolling of the IBM/Lenovo
-        Thinkpad standalone keyboards, e.g:
+        Scrollpoint mice or the non-compliant features of the Lenovo Thinkpad
+        standalone keyboards, e.g:
        - ThinkPad USB Keyboard with TrackPoint (supports extra LEDs and trackpoint
          configuration)
        - ThinkPad Compact Bluetooth Keyboard with TrackPoint (supports Fn keys)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 0b5cc910f62e..46f5ecd11bf7 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -552,6 +552,13 @@
 #define USB_VENDOR_ID_HUION             0x256c
 #define USB_DEVICE_ID_HUION_TABLET      0x006e
+#define USB_VENDOR_ID_IBM                                       0x04b3
+#define USB_DEVICE_ID_IBM_SCROLLPOINT_III                       0x3100
+#define USB_DEVICE_ID_IBM_SCROLLPOINT_PRO                       0x3103
+#define USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL                   0x3105
+#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL            0x3108
+#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO        0x3109
 #define USB_VENDOR_ID_IDEACOM           0x1cb6
 #define USB_DEVICE_ID_IDEACOM_IDC6650   0x6650
 #define USB_DEVICE_ID_IDEACOM_IDC6651   0x6651
@@ -684,6 +691,7 @@
 #define USB_DEVICE_ID_LENOVO_TPKBD      0x6009
 #define USB_DEVICE_ID_LENOVO_CUSBKBD    0x6047
 #define USB_DEVICE_ID_LENOVO_CBTKBD     0x6048
+#define USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL        0x6049
 #define USB_DEVICE_ID_LENOVO_TPPRODOCK  0x6067
 #define USB_DEVICE_ID_LENOVO_X1_COVER   0x6085
 #define USB_DEVICE_ID_LENOVO_X1_TAB     0x60a3
@@ -964,6 +972,7 @@
 #define USB_DEVICE_ID_SIS817_TOUCH      0x0817
 #define USB_DEVICE_ID_SIS_TS            0x1013
 #define USB_DEVICE_ID_SIS1030_TOUCH     0x1030
+#define USB_DEVICE_ID_SIS10FB_TOUCH     0x10fb
 #define USB_VENDOR_ID_SKYCABLE                  0x1223
 #define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER       0x3F07
diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 1ac4ff4d57a6..643b6eb54442 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -6,6 +6,17 @@
 *
 *  Copyright (c) 2012 Bernhard Seibold
 *  Copyright (c) 2014 Jamie Lentin <jm@lentin.co.uk>
+ *
+ * Linux IBM/Lenovo Scrollpoint mouse driver:
+ * - IBM Scrollpoint III
+ * - IBM Scrollpoint Pro
+ * - IBM Scrollpoint Optical
+ * - IBM Scrollpoint Optical 800dpi
+ * - IBM Scrollpoint Optical 800dpi Pro
+ * - Lenovo Scrollpoint Optical
+ *
+ *  Copyright (c) 2012 Peter De Wachter <pdewacht@gmail.com>
+ *  Copyright (c) 2018 Peter Ganzhorn <peter.ganzhorn@gmail.com>
 */
 /*
@@ -160,6 +171,17 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev,
        return 0;
 }
+static int lenovo_input_mapping_scrollpoint(struct hid_device *hdev,
+                struct hid_input *hi, struct hid_field *field,
+                struct hid_usage *usage, unsigned long **bit, int *max)
+{
+        if (usage->hid == HID_GD_Z) {
+                hid_map_usage(hi, usage, bit, max, EV_REL, REL_HWHEEL);
+                return 1;
+        }
+        return 0;
+}
 static int lenovo_input_mapping(struct hid_device *hdev,
                struct hid_input *hi, struct hid_field *field,
                struct hid_usage *usage, unsigned long **bit, int *max)
@@ -172,6 +194,14 @@ static int lenovo_input_mapping(struct hid_device *hdev,
        case USB_DEVICE_ID_LENOVO_CBTKBD:
                return lenovo_input_mapping_cptkbd(hdev, hi, field,
                                                        usage, bit, max);
+        case USB_DEVICE_ID_IBM_SCROLLPOINT_III:
+        case USB_DEVICE_ID_IBM_SCROLLPOINT_PRO:
+        case USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL:
+        case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL:
+        case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO:
+        case USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL:
+                return lenovo_input_mapping_scrollpoint(hdev, hi, field,
+                                                        usage, bit, max);
        default:
                return 0;
        }
@@ -883,6 +913,12 @@ static const struct hid_device_id lenovo_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_III) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL) },
        { }
 };
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 963328674e93..cc33622253aa 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -174,6 +174,8 @@ static const struct i2c_hid_quirks {
                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
        { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_3118,
                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
+        { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH,
+                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
        { 0, 0 }
 };
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index 157b44aacdff..acc2536c8094 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -77,21 +77,21 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
        struct ishtp_cl_data *client_data = hid_ishtp_cl->client_data;
        int curr_hid_dev = client_data->cur_hid_dev;
-        if (data_len < sizeof(struct hostif_msg_hdr)) {
-                dev_err(&client_data->cl_device->dev,
-                        "[hid-ish]: error, received %u which is less than data header %u\n",
-                        (unsigned int)data_len,
-                        (unsigned int)sizeof(struct hostif_msg_hdr));
-                ++client_data->bad_recv_cnt;
-                ish_hw_reset(hid_ishtp_cl->dev);
-                return;
-        }
        payload = recv_buf + sizeof(struct hostif_msg_hdr);
        total_len = data_len;
        cur_pos = 0;
        do {
+                if (cur_pos + sizeof(struct hostif_msg) > total_len) {
+                        dev_err(&client_data->cl_device->dev,
+                                "[hid-ish]: error, received %u which is less than data header %u\n",
+                                (unsigned int)data_len,
+                                (unsigned int)sizeof(struct hostif_msg_hdr));
+                        ++client_data->bad_recv_cnt;
+                        ish_hw_reset(hid_ishtp_cl->dev);
+                        break;
+                }
                recv_msg = (struct hostif_msg *)(recv_buf + cur_pos);
                payload_len = recv_msg->hdr.size;
@@ -412,9 +412,7 @@ void hid_ishtp_get_report(struct hid_device *hid, int report_id,
 {
        struct ishtp_hid_data *hid_data =  hid->driver_data;
        struct ishtp_cl_data *client_data = hid_data->client_data;
-        static unsigned char    buf[10];
+        struct hostif_msg_to_sensor msg = {};
-        unsigned int    len;
-        struct hostif_msg_to_sensor *msg = (struct hostif_msg_to_sensor *)buf;
        int     rv;
        int     i;
@@ -426,14 +424,11 @@ void hid_ishtp_get_report(struct hid_device *hid, int report_id,
                return;
        }
-        len = sizeof(struct hostif_msg_to_sensor);
+        msg.hdr.command = (report_type == HID_FEATURE_REPORT) ?
-        memset(msg, 0, sizeof(struct hostif_msg_to_sensor));
-        msg->hdr.command = (report_type == HID_FEATURE_REPORT) ?
                HOSTIF_GET_FEATURE_REPORT : HOSTIF_GET_INPUT_REPORT;
        for (i = 0; i < client_data->num_hid_devices; ++i) {
                if (hid == client_data->hid_sensor_hubs[i]) {
-                        msg->hdr.device_id =
+                        msg.hdr.device_id =
                                client_data->hid_devices[i].dev_id;
                        break;
                }
@@ -442,8 +437,9 @@ void hid_ishtp_get_report(struct hid_device *hid, int report_id,
        if (i == client_data->num_hid_devices)
                return;
-        msg->report_id = report_id;
+        msg.report_id = report_id;
-        rv = ishtp_cl_send(client_data->hid_ishtp_cl, buf, len);
+        rv = ishtp_cl_send(client_data->hid_ishtp_cl, (uint8_t *)&msg,
+                            sizeof(msg));
        if (rv)
                hid_ishtp_trace(client_data,  "%s hid %p send failed\n",
                                __func__, hid);
diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c
index f272cdd9bd55..2623a567ffba 100644
--- a/drivers/hid/intel-ish-hid/ishtp/bus.c
+++ b/drivers/hid/intel-ish-hid/ishtp/bus.c
@@ -418,7 +418,7 @@ static struct ishtp_cl_device *ishtp_bus_add_device(struct ishtp_device *dev,
                list_del(&device->device_link);
                spin_unlock_irqrestore(&dev->device_list_lock, flags);
                dev_err(dev->devc, "Failed to register ISHTP client device\n");
-                kfree(device);
+                put_device(&device->dev);
                return NULL;
        }
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index b54ef1ffcbec..ee7a37eb159a 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -1213,8 +1213,10 @@ static int __wacom_devm_sysfs_create_group(struct wacom *wacom,
        devres->root = root;
        error = sysfs_create_group(devres->root, group);
-        if (error)
+        if (error) {
+                devres_free(devres);
                return error;
+        }
        devres_add(&wacom->hdev->dev, devres);
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index ee270e065ba9..2a972ed6851b 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -61,9 +61,12 @@ config INFINIBAND_ON_DEMAND_PAGING
          pages on demand instead.
 config INFINIBAND_ADDR_TRANS
-        bool
+        bool "RDMA/CM"
        depends on INFINIBAND
        default y
+        ---help---
+          Support for RDMA communication manager (CM).
+          This allows for a generic connection abstraction over RDMA.
 config INFINIBAND_ADDR_TRANS_CONFIGFS
        bool
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index e337b08de2ff..fb2d347f760f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -291,14 +291,18 @@ static int find_gid(struct ib_gid_table *table, const union ib_gid *gid,
                 * so lookup free slot only if requested.
                 */
                if (pempty && empty < 0) {
-                        if (data->props & GID_TABLE_ENTRY_INVALID) {
+                        if (data->props & GID_TABLE_ENTRY_INVALID &&
-                                /* Found an invalid (free) entry; allocate it */
+                            (default_gid ==
-                                if (data->props & GID_TABLE_ENTRY_DEFAULT) {
+                             !!(data->props & GID_TABLE_ENTRY_DEFAULT))) {
-                                        if (default_gid)
+                                /*
-                                                empty = curr_index;
+                                 * Found an invalid (free) entry; allocate it.
-                                } else {
+                                 * If default GID is requested, then our
-                                        empty = curr_index;
+                                 * found slot must be one of the DEFAULT
-                                }
+                                 * reserved slots or we fail.
+                                 * This ensures that only DEFAULT reserved
+                                 * slots are used for default property GIDs.
+                                 */
+                                empty = curr_index;
                        }
                }
@@ -420,8 +424,10 @@ int ib_cache_gid_add(struct ib_device *ib_dev, u8 port,
        return ret;
 }
-int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+static int
-                     union ib_gid *gid, struct ib_gid_attr *attr)
+_ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+                  union ib_gid *gid, struct ib_gid_attr *attr,
+                  unsigned long mask, bool default_gid)
 {
        struct ib_gid_table *table;
        int ret = 0;
@@ -431,11 +437,7 @@ int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
        mutex_lock(&table->lock);
-        ix = find_gid(table, gid, attr, false,
+        ix = find_gid(table, gid, attr, default_gid, mask, NULL);
-                      GID_ATTR_FIND_MASK_GID      |
-                      GID_ATTR_FIND_MASK_GID_TYPE |
-                      GID_ATTR_FIND_MASK_NETDEV,
-                      NULL);
        if (ix < 0) {
                ret = -EINVAL;
                goto out_unlock;
@@ -452,6 +454,17 @@ out_unlock:
        return ret;
 }
+int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+                     union ib_gid *gid, struct ib_gid_attr *attr)
+{
+        unsigned long mask = GID_ATTR_FIND_MASK_GID       |
+                             GID_ATTR_FIND_MASK_GID_TYPE |
+                             GID_ATTR_FIND_MASK_DEFAULT  |
+                             GID_ATTR_FIND_MASK_NETDEV;
+        return _ib_cache_gid_del(ib_dev, port, gid, attr, mask, false);
+}
 int ib_cache_gid_del_all_netdev_gids(struct ib_device *ib_dev, u8 port,
                                     struct net_device *ndev)
 {
@@ -728,7 +741,7 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
                                  unsigned long gid_type_mask,
                                  enum ib_cache_gid_default_mode mode)
 {
-        union ib_gid gid;
+        union ib_gid gid = { };
        struct ib_gid_attr gid_attr;
        struct ib_gid_table *table;
        unsigned int gid_type;
@@ -736,7 +749,9 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
        table = ib_dev->cache.ports[port - rdma_start_port(ib_dev)].gid;
-        make_default_gid(ndev, &gid);
+        mask = GID_ATTR_FIND_MASK_GID_TYPE |
+               GID_ATTR_FIND_MASK_DEFAULT |
+               GID_ATTR_FIND_MASK_NETDEV;
        memset(&gid_attr, 0, sizeof(gid_attr));
        gid_attr.ndev = ndev;
@@ -747,12 +762,12 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
                gid_attr.gid_type = gid_type;
                if (mode == IB_CACHE_GID_DEFAULT_MODE_SET) {
-                        mask = GID_ATTR_FIND_MASK_GID_TYPE |
+                        make_default_gid(ndev, &gid);
-                               GID_ATTR_FIND_MASK_DEFAULT;
                        __ib_cache_gid_add(ib_dev, port, &gid,
                                           &gid_attr, mask, true);
                } else if (mode == IB_CACHE_GID_DEFAULT_MODE_DELETE) {
-                        ib_cache_gid_del(ib_dev, port, &gid, &gid_attr);
+                        _ib_cache_gid_del(ib_dev, port, &gid,
+                                          &gid_attr, mask, true);
                }
        }
 }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 51a641002e10..a693fcd4c513 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -382,6 +382,8 @@ struct cma_hdr {
 #define CMA_VERSION 0x00
 struct cma_req_info {
+        struct sockaddr_storage listen_addr_storage;
+        struct sockaddr_storage src_addr_storage;
        struct ib_device *device;
        int port;
        union ib_gid local_gid;
@@ -866,7 +868,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv,
 {
        struct ib_qp_attr qp_attr;
        int qp_attr_mask, ret;
-        union ib_gid sgid;
        mutex_lock(&id_priv->qp_mutex);
        if (!id_priv->id.qp) {
@@ -889,12 +890,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv,
        if (ret)
                goto out;
-        ret = ib_query_gid(id_priv->id.device, id_priv->id.port_num,
-                           rdma_ah_read_grh(&qp_attr.ah_attr)->sgid_index,
-                           &sgid, NULL);
-        if (ret)
-                goto out;
        BUG_ON(id_priv->cma_dev->device != id_priv->id.device);
        if (conn_param)
@@ -1340,11 +1335,11 @@ static bool validate_net_dev(struct net_device *net_dev,
 }
 static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event,
-                                          const struct cma_req_info *req)
+                                          struct cma_req_info *req)
 {
-        struct sockaddr_storage listen_addr_storage, src_addr_storage;
+        struct sockaddr *listen_addr =
-        struct sockaddr *listen_addr = (struct sockaddr *)&listen_addr_storage,
+                        (struct sockaddr *)&req->listen_addr_storage;
-                        *src_addr = (struct sockaddr *)&src_addr_storage;
+        struct sockaddr *src_addr = (struct sockaddr *)&req->src_addr_storage;
        struct net_device *net_dev;
        const union ib_gid *gid = req->has_gid ? &req->local_gid : NULL;
        int err;
@@ -1359,11 +1354,6 @@ static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event,
        if (!net_dev)
                return ERR_PTR(-ENODEV);
-        if (!validate_net_dev(net_dev, listen_addr, src_addr)) {
-                dev_put(net_dev);
-                return ERR_PTR(-EHOSTUNREACH);
-        }
        return net_dev;
 }
@@ -1490,15 +1480,51 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id,
                }
        }
+        /*
+         * Net namespace might be getting deleted while route lookup,
+         * cm_id lookup is in progress. Therefore, perform netdevice
+         * validation, cm_id lookup under rcu lock.
+         * RCU lock along with netdevice state check, synchronizes with
+         * netdevice migrating to different net namespace and also avoids
+         * case where net namespace doesn't get deleted while lookup is in
+         * progress.
+         * If the device state is not IFF_UP, its properties such as ifindex
+         * and nd_net cannot be trusted to remain valid without rcu lock.
+         * net/core/dev.c change_net_namespace() ensures to synchronize with
+         * ongoing operations on net device after device is closed using
+         * synchronize_net().
+         */
+        rcu_read_lock();
+        if (*net_dev) {
+                /*
+                 * If netdevice is down, it is likely that it is administratively
+                 * down or it might be migrating to different namespace.
+                 * In that case avoid further processing, as the net namespace
+                 * or ifindex may change.
+                 */
+                if (((*net_dev)->flags & IFF_UP) == 0) {
+                        id_priv = ERR_PTR(-EHOSTUNREACH);
+                        goto err;
+                }
+                if (!validate_net_dev(*net_dev,
+                                 (struct sockaddr *)&req.listen_addr_storage,
+                                 (struct sockaddr *)&req.src_addr_storage)) {
+                        id_priv = ERR_PTR(-EHOSTUNREACH);
+                        goto err;
+                }
+        }
        bind_list = cma_ps_find(*net_dev ? dev_net(*net_dev) : &init_net,
                                rdma_ps_from_service_id(req.service_id),
                                cma_port_from_service_id(req.service_id));
        id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev);
+err:
+        rcu_read_unlock();
        if (IS_ERR(id_priv) && *net_dev) {
                dev_put(*net_dev);
                *net_dev = NULL;
        }
        return id_priv;
 }
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index 9821ae900f6d..da12da1c36f6 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -114,7 +114,7 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr,
                        struct sockaddr_storage *mapped_sockaddr,
                        u8 nl_client)
 {
-        struct hlist_head *hash_bucket_head;
+        struct hlist_head *hash_bucket_head = NULL;
        struct iwpm_mapping_info *map_info;
        unsigned long flags;
        int ret = -EINVAL;
@@ -142,6 +142,9 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr,
                }
        }
        spin_unlock_irqrestore(&iwpm_mapinfo_lock, flags);
+        if (!hash_bucket_head)
+                kfree(map_info);
        return ret;
 }
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index c50596f7f98a..b28452a55a08 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -59,7 +59,7 @@ module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
 MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
 static struct list_head ib_mad_port_list;
-static u32 ib_mad_client_id = 0;
+static atomic_t ib_mad_client_id = ATOMIC_INIT(0);
 /* Port list lock */
 static DEFINE_SPINLOCK(ib_mad_port_list_lock);
@@ -377,7 +377,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
        }
        spin_lock_irqsave(&port_priv->reg_lock, flags);
-        mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
+        mad_agent_priv->agent.hi_tid = atomic_inc_return(&ib_mad_client_id);
        /*
         * Make sure MAD registration (if supplied)
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index cc2966380c0c..c0e4fd55e2cc 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -255,6 +255,7 @@ static void bond_delete_netdev_default_gids(struct ib_device *ib_dev,
                                            struct net_device *rdma_ndev)
 {
        struct net_device *real_dev = rdma_vlan_dev_real_dev(event_ndev);
+        unsigned long gid_type_mask;
        if (!rdma_ndev)
                return;
@@ -264,21 +265,22 @@ static void bond_delete_netdev_default_gids(struct ib_device *ib_dev,
        rcu_read_lock();
-        if (rdma_is_upper_dev_rcu(rdma_ndev, event_ndev) &&
+        if (((rdma_ndev != event_ndev &&
-            is_eth_active_slave_of_bonding_rcu(rdma_ndev, real_dev) ==
+              !rdma_is_upper_dev_rcu(rdma_ndev, event_ndev)) ||
-            BONDING_SLAVE_STATE_INACTIVE) {
+             is_eth_active_slave_of_bonding_rcu(rdma_ndev, real_dev)
-                unsigned long gid_type_mask;
+                                                 ==
+             BONDING_SLAVE_STATE_INACTIVE)) {
                rcu_read_unlock();
+                return;
+        }
-                gid_type_mask = roce_gid_type_mask_support(ib_dev, port);
+        rcu_read_unlock();
-                ib_cache_gid_set_default_gid(ib_dev, port, rdma_ndev,
+        gid_type_mask = roce_gid_type_mask_support(ib_dev, port);
-                                             gid_type_mask,
-                                             IB_CACHE_GID_DEFAULT_MODE_DELETE);
+        ib_cache_gid_set_default_gid(ib_dev, port, rdma_ndev,
-        } else {
+                                     gid_type_mask,
-                rcu_read_unlock();
+                                     IB_CACHE_GID_DEFAULT_MODE_DELETE);
-        }
 }
 static void enum_netdev_ipv4_ips(struct ib_device *ib_dev,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 74329483af6d..eab43b17e9cf 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -159,6 +159,23 @@ static void ucma_put_ctx(struct ucma_context *ctx)
                complete(&ctx->comp);
 }
+/*
+ * Same as ucm_get_ctx but requires that ->cm_id->device is valid, eg that the
+ * CM_ID is bound.
+ */
+static struct ucma_context *ucma_get_ctx_dev(struct ucma_file *file, int id)
+{
+        struct ucma_context *ctx = ucma_get_ctx(file, id);
+        if (IS_ERR(ctx))
+                return ctx;
+        if (!ctx->cm_id->device) {
+                ucma_put_ctx(ctx);
+                return ERR_PTR(-EINVAL);
+        }
+        return ctx;
+}
 static void ucma_close_event_id(struct work_struct *work)
 {
        struct ucma_event *uevent_close =  container_of(work, struct ucma_event, close_work);
@@ -683,7 +700,7 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        if (!rdma_addr_size_in6(&cmd.src_addr) ||
+        if ((cmd.src_addr.sin6_family && !rdma_addr_size_in6(&cmd.src_addr)) ||
            !rdma_addr_size_in6(&cmd.dst_addr))
                return -EINVAL;
@@ -734,7 +751,7 @@ static ssize_t ucma_resolve_route(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1050,7 +1067,7 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
        if (!cmd.conn_param.valid)
                return -EINVAL;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1092,7 +1109,7 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1120,7 +1137,7 @@ static ssize_t ucma_reject(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1139,7 +1156,7 @@ static ssize_t ucma_disconnect(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1167,15 +1184,10 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
        if (cmd.qp_state > IB_QPS_ERR)
                return -EINVAL;
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
-        if (!ctx->cm_id->device) {
-                ret = -EINVAL;
-                goto out;
-        }
        resp.qp_attr_mask = 0;
        memset(&qp_attr, 0, sizeof qp_attr);
        qp_attr.qp_state = cmd.qp_state;
@@ -1316,13 +1328,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
+        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
+                return -EINVAL;
        ctx = ucma_get_ctx(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
-        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
-                return -EINVAL;
        optval = memdup_user(u64_to_user_ptr(cmd.optval),
                             cmd.optlen);
        if (IS_ERR(optval)) {
@@ -1384,7 +1396,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
        else
                return -EINVAL;
-        ctx = ucma_get_ctx(file, cmd->id);
+        ctx = ucma_get_ctx_dev(file, cmd->id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 13cb5e4deb86..21a887c9523b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -691,6 +691,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
        mr->device  = pd->device;
        mr->pd      = pd;
+        mr->dm      = NULL;
        mr->uobject = uobj;
        atomic_inc(&pd->usecnt);
        mr->res.type = RDMA_RESTRACK_MR;
@@ -765,6 +766,11 @@ ssize_t ib_uverbs_rereg_mr(struct ib_uverbs_file *file,
        mr = uobj->object;
+        if (mr->dm) {
+                ret = -EINVAL;
+                goto put_uobjs;
+        }
        if (cmd.flags & IB_MR_REREG_ACCESS) {
                ret = ib_check_mr_access(cmd.access_flags);
                if (ret)
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c93970dc8f1..8d32c4ae368c 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -234,6 +234,15 @@ static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *met
                        return -EINVAL;
        }
+        for (; i < method_spec->num_buckets; i++) {
+                struct uverbs_attr_spec_hash *attr_spec_bucket =
+                        method_spec->attr_buckets[i];
+                if (!bitmap_empty(attr_spec_bucket->mandatory_attrs_bitmask,
+                                  attr_spec_bucket->num_attrs))
+                        return -EINVAL;
+        }
        return 0;
 }
diff --git a/drivers/infiniband/core/uverbs_std_types_flow_action.c b/drivers/infiniband/core/uverbs_std_types_flow_action.c
index cbcec3da12f6..b4f016dfa23d 100644
--- a/drivers/infiniband/core/uverbs_std_types_flow_action.c
+++ b/drivers/infiniband/core/uverbs_std_types_flow_action.c
@@ -363,28 +363,28 @@ static int UVERBS_HANDLER(UVERBS_METHOD_FLOW_ACTION_ESP_MODIFY)(struct ib_device
 static const struct uverbs_attr_spec uverbs_flow_action_esp_keymat[] = {
        [IB_UVERBS_FLOW_ACTION_ESP_KEYMAT_AES_GCM] = {
-                .ptr = {
+                { .ptr = {
                        .type = UVERBS_ATTR_TYPE_PTR_IN,
                        UVERBS_ATTR_TYPE(struct ib_uverbs_flow_action_esp_keymat_aes_gcm),
                        .flags = UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO,
-                },
+                } },
        },
 };
 static const struct uverbs_attr_spec uverbs_flow_action_esp_replay[] = {
        [IB_UVERBS_FLOW_ACTION_ESP_REPLAY_NONE] = {
-                .ptr = {
+                { .ptr = {
                        .type = UVERBS_ATTR_TYPE_PTR_IN,
                        /* No need to specify any data */
                        .len = 0,
-                }
+                } }
        },
        [IB_UVERBS_FLOW_ACTION_ESP_REPLAY_BMP] = {
-                .ptr = {
+                { .ptr = {
                        .type = UVERBS_ATTR_TYPE_PTR_IN,
                        UVERBS_ATTR_STRUCT(struct ib_uverbs_flow_action_esp_replay_bmp, size),
                        .flags = UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO,
-                }
+                } }
        },
 };
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 7eff3aeffe01..6ddfb1fade79 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1656,6 +1656,7 @@ struct ib_mr *ib_alloc_mr(struct ib_pd *pd,
        if (!IS_ERR(mr)) {
                mr->device  = pd->device;
                mr->pd      = pd;
+                mr->dm      = NULL;
                mr->uobject = NULL;
                atomic_inc(&pd->usecnt);
                mr->need_inval = false;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 6f2b26126c64..2be2e1ac1b5f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -315,7 +315,7 @@ static void advance_oldest_read(struct t4_wq *wq)
 * Deal with out-of-order and/or completions that complete
 * prior unsignalled WRs.
 */
-void c4iw_flush_hw_cq(struct c4iw_cq *chp)
+void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp)
 {
        struct t4_cqe *hw_cqe, *swcqe, read_cqe;
        struct c4iw_qp *qhp;
@@ -339,6 +339,13 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp)
                if (qhp == NULL)
                        goto next_cqe;
+                if (flush_qhp != qhp) {
+                        spin_lock(&qhp->lock);
+                        if (qhp->wq.flushed == 1)
+                                goto next_cqe;
+                }
                if (CQE_OPCODE(hw_cqe) == FW_RI_TERMINATE)
                        goto next_cqe;
@@ -390,6 +397,8 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp)
 next_cqe:
                t4_hwcq_consume(&chp->cq);
                ret = t4_next_hw_cqe(&chp->cq, &hw_cqe);
+                if (qhp && flush_qhp != qhp)
+                        spin_unlock(&qhp->lock);
        }
 }
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index feeb8ee6f4a2..44161ca4d2a8 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -875,6 +875,11 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
        rdev->status_page->db_off = 0;
+        init_completion(&rdev->rqt_compl);
+        init_completion(&rdev->pbl_compl);
+        kref_init(&rdev->rqt_kref);
+        kref_init(&rdev->pbl_kref);
        return 0;
 err_free_status_page_and_wr_log:
        if (c4iw_wr_log && rdev->wr_log)
@@ -893,13 +898,15 @@ destroy_resource:
 static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
-        destroy_workqueue(rdev->free_workq);
        kfree(rdev->wr_log);
        c4iw_release_dev_ucontext(rdev, &rdev->uctx);
        free_page((unsigned long)rdev->status_page);
        c4iw_pblpool_destroy(rdev);
        c4iw_rqtpool_destroy(rdev);
+        wait_for_completion(&rdev->pbl_compl);
+        wait_for_completion(&rdev->rqt_compl);
        c4iw_ocqp_pool_destroy(rdev);
+        destroy_workqueue(rdev->free_workq);
        c4iw_destroy_resource(&rdev->resource);
 }
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index cc929002c05e..831027717121 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -185,6 +185,10 @@ struct c4iw_rdev {
        struct wr_log_entry *wr_log;
        int wr_log_size;
        struct workqueue_struct *free_workq;
+        struct completion rqt_compl;
+        struct completion pbl_compl;
+        struct kref rqt_kref;
+        struct kref pbl_kref;
 };
 static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
@@ -1049,7 +1053,7 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
 u32 c4iw_ocqp_pool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_ocqp_pool_free(struct c4iw_rdev *rdev, u32 addr, int size);
-void c4iw_flush_hw_cq(struct c4iw_cq *chp);
+void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp);
 void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
 int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp);
 int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count);
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index de77b6027d69..ae167b686608 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1343,12 +1343,12 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
        qhp->wq.flushed = 1;
        t4_set_wq_in_error(&qhp->wq);
-        c4iw_flush_hw_cq(rchp);
+        c4iw_flush_hw_cq(rchp, qhp);
        c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count);
        rq_flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
        if (schp != rchp)
-                c4iw_flush_hw_cq(schp);
+                c4iw_flush_hw_cq(schp, qhp);
        sq_flushed = c4iw_flush_sq(qhp);
        spin_unlock(&qhp->lock);
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index 3cf25997ed2b..0ef25ae05e6f 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -260,12 +260,22 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size)
                rdev->stats.pbl.cur += roundup(size, 1 << MIN_PBL_SHIFT);
                if (rdev->stats.pbl.cur > rdev->stats.pbl.max)
                        rdev->stats.pbl.max = rdev->stats.pbl.cur;
+                kref_get(&rdev->pbl_kref);
        } else
                rdev->stats.pbl.fail++;
        mutex_unlock(&rdev->stats.lock);
        return (u32)addr;
 }
+static void destroy_pblpool(struct kref *kref)
+{
+        struct c4iw_rdev *rdev;
+        rdev = container_of(kref, struct c4iw_rdev, pbl_kref);
+        gen_pool_destroy(rdev->pbl_pool);
+        complete(&rdev->pbl_compl);
+}
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
 {
        pr_debug("addr 0x%x size %d\n", addr, size);
@@ -273,6 +283,7 @@ void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
        rdev->stats.pbl.cur -= roundup(size, 1 << MIN_PBL_SHIFT);
        mutex_unlock(&rdev->stats.lock);
        gen_pool_free(rdev->pbl_pool, (unsigned long)addr, size);
+        kref_put(&rdev->pbl_kref, destroy_pblpool);
 }
 int c4iw_pblpool_create(struct c4iw_rdev *rdev)
@@ -310,7 +321,7 @@ int c4iw_pblpool_create(struct c4iw_rdev *rdev)
 void c4iw_pblpool_destroy(struct c4iw_rdev *rdev)
 {
-        gen_pool_destroy(rdev->pbl_pool);
+        kref_put(&rdev->pbl_kref, destroy_pblpool);
 }
 /*
@@ -331,12 +342,22 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
                rdev->stats.rqt.cur += roundup(size << 6, 1 << MIN_RQT_SHIFT);
                if (rdev->stats.rqt.cur > rdev->stats.rqt.max)
                        rdev->stats.rqt.max = rdev->stats.rqt.cur;
+                kref_get(&rdev->rqt_kref);
        } else
                rdev->stats.rqt.fail++;
        mutex_unlock(&rdev->stats.lock);
        return (u32)addr;
 }
+static void destroy_rqtpool(struct kref *kref)
+{
+        struct c4iw_rdev *rdev;
+        rdev = container_of(kref, struct c4iw_rdev, rqt_kref);
+        gen_pool_destroy(rdev->rqt_pool);
+        complete(&rdev->rqt_compl);
+}
 void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
 {
        pr_debug("addr 0x%x size %d\n", addr, size << 6);
@@ -344,6 +365,7 @@ void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
        rdev->stats.rqt.cur -= roundup(size << 6, 1 << MIN_RQT_SHIFT);
        mutex_unlock(&rdev->stats.lock);
        gen_pool_free(rdev->rqt_pool, (unsigned long)addr, size << 6);
+        kref_put(&rdev->rqt_kref, destroy_rqtpool);
 }
 int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
@@ -380,7 +402,7 @@ int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
 void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev)
 {
-        gen_pool_destroy(rdev->rqt_pool);
+        kref_put(&rdev->rqt_kref, destroy_rqtpool);
 }
 /*
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index a97055dd4fbd..b5fab55cc275 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -412,7 +412,6 @@ static void hfi1_cleanup_sdma_notifier(struct hfi1_msix_entry *msix)
 static int get_irq_affinity(struct hfi1_devdata *dd,
                            struct hfi1_msix_entry *msix)
 {
-        int ret;
        cpumask_var_t diff;
        struct hfi1_affinity_node *entry;
        struct cpu_mask_set *set = NULL;
@@ -424,10 +423,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
        extra[0] = '\0';
        cpumask_clear(&msix->mask);
-        ret = zalloc_cpumask_var(&diff, GFP_KERNEL);
-        if (!ret)
-                return -ENOMEM;
        entry = node_affinity_lookup(dd->node);
        switch (msix->type) {
@@ -458,6 +453,9 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
         * finds its CPU here.
         */
        if (cpu == -1 && set) {
+                if (!zalloc_cpumask_var(&diff, GFP_KERNEL))
+                        return -ENOMEM;
                if (cpumask_equal(&set->mask, &set->used)) {
                        /*
                         * We've used up all the CPUs, bump up the generation
@@ -469,6 +467,8 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
                cpumask_andnot(diff, &set->mask, &set->used);
                cpu = cpumask_first(diff);
                cpumask_set_cpu(cpu, &set->used);
+                free_cpumask_var(diff);
        }
        cpumask_set_cpu(cpu, &msix->mask);
@@ -482,7 +482,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
                hfi1_setup_sdma_notifier(msix);
        }
-        free_cpumask_var(diff);
        return 0;
 }
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 46d1475b2154..bd837a048bf4 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -433,31 +433,43 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
                               bool do_cnp)
 {
        struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
+        struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
        struct ib_other_headers *ohdr = pkt->ohdr;
        struct ib_grh *grh = pkt->grh;
        u32 rqpn = 0, bth1;
-        u16 pkey, rlid, dlid = ib_get_dlid(pkt->hdr);
+        u16 pkey;
+        u32 rlid, slid, dlid = 0;
        u8 hdr_type, sc, svc_type;
        bool is_mcast = false;
+        /* can be called from prescan */
        if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
                is_mcast = hfi1_is_16B_mcast(dlid);
                pkey = hfi1_16B_get_pkey(pkt->hdr);
                sc = hfi1_16B_get_sc(pkt->hdr);
+                dlid = hfi1_16B_get_dlid(pkt->hdr);
+                slid = hfi1_16B_get_slid(pkt->hdr);
                hdr_type = HFI1_PKT_TYPE_16B;
        } else {
                is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
                           (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
                pkey = ib_bth_get_pkey(ohdr);
                sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
+                dlid = ib_get_dlid(pkt->hdr);
+                slid = ib_get_slid(pkt->hdr);
                hdr_type = HFI1_PKT_TYPE_9B;
        }
        switch (qp->ibqp.qp_type) {
+        case IB_QPT_UD:
+                dlid = ppd->lid;
+                rlid = slid;
+                rqpn = ib_get_sqpn(pkt->ohdr);
+                svc_type = IB_CC_SVCTYPE_UD;
+                break;
        case IB_QPT_SMI:
        case IB_QPT_GSI:
-        case IB_QPT_UD:
+                rlid = slid;
-                rlid = ib_get_slid(pkt->hdr);
                rqpn = ib_get_sqpn(pkt->ohdr);
                svc_type = IB_CC_SVCTYPE_UD;
                break;
@@ -482,7 +494,6 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
                                              dlid, rlid, sc, grh);
        if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
-                struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
                u32 lqpn = bth1 & RVT_QPN_MASK;
                u8 sl = ibp->sc_to_sl[sc];
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 32c48265405e..cac2c62bc42d 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1537,13 +1537,13 @@ void set_link_ipg(struct hfi1_pportdata *ppd);
 void process_becn(struct hfi1_pportdata *ppd, u8 sl, u32 rlid, u32 lqpn,
                  u32 rqpn, u8 svc_type);
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-                u32 pkey, u32 slid, u32 dlid, u8 sc5,
+                u16 pkey, u32 slid, u32 dlid, u8 sc5,
                const struct ib_grh *old_grh);
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                    u8 sc5, const struct ib_grh *old_grh);
 typedef void (*hfi1_handle_cnp)(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                                u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                                u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                                u8 sc5, const struct ib_grh *old_grh);
 #define PKEY_CHECK_INVALID -1
@@ -2437,7 +2437,7 @@ static inline void hfi1_make_16b_hdr(struct hfi1_16b_header *hdr,
                ((slid >> OPA_16B_SLID_SHIFT) << OPA_16B_SLID_HIGH_SHIFT);
        lrh2 = (lrh2 & ~OPA_16B_DLID_MASK) |
                ((dlid >> OPA_16B_DLID_SHIFT) << OPA_16B_DLID_HIGH_SHIFT);
-        lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | (pkey << OPA_16B_PKEY_SHIFT);
+        lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | ((u32)pkey << OPA_16B_PKEY_SHIFT);
        lrh2 = (lrh2 & ~OPA_16B_L4_MASK) | l4;
        hdr->lrh[0] = lrh0;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 33eba2356742..6309edf811df 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -88,9 +88,9 @@
 * pio buffers per ctxt, etc.)  Zero means use one user context per CPU.
 */
 int num_user_contexts = -1;
-module_param_named(num_user_contexts, num_user_contexts, uint, S_IRUGO);
+module_param_named(num_user_contexts, num_user_contexts, int, 0444);
 MODULE_PARM_DESC(
-        num_user_contexts, "Set max number of user contexts to use");
+        num_user_contexts, "Set max number of user contexts to use (default: -1 will use the real (non-HT) CPU count)");
 uint krcvqs[RXE_NUM_DATA_VL];
 int krcvqsset;
@@ -1209,30 +1209,49 @@ static void finalize_asic_data(struct hfi1_devdata *dd,
        kfree(ad);
 }
-static void __hfi1_free_devdata(struct kobject *kobj)
+/**
+ * hfi1_clean_devdata - cleans up per-unit data structure
+ * @dd: pointer to a valid devdata structure
+ *
+ * It cleans up all data structures set up by
+ * by hfi1_alloc_devdata().
+ */
+static void hfi1_clean_devdata(struct hfi1_devdata *dd)
 {
-        struct hfi1_devdata *dd =
-                container_of(kobj, struct hfi1_devdata, kobj);
        struct hfi1_asic_data *ad;
        unsigned long flags;
        spin_lock_irqsave(&hfi1_devs_lock, flags);
-        idr_remove(&hfi1_unit_table, dd->unit);
+        if (!list_empty(&dd->list)) {
-        list_del(&dd->list);
+                idr_remove(&hfi1_unit_table, dd->unit);
+                list_del_init(&dd->list);
+        }
        ad = release_asic_data(dd);
        spin_unlock_irqrestore(&hfi1_devs_lock, flags);
-        if (ad)
-                finalize_asic_data(dd, ad);
+        finalize_asic_data(dd, ad);
        free_platform_config(dd);
        rcu_barrier(); /* wait for rcu callbacks to complete */
        free_percpu(dd->int_counter);
        free_percpu(dd->rcv_limit);
        free_percpu(dd->send_schedule);
        free_percpu(dd->tx_opstats);
+        dd->int_counter   = NULL;
+        dd->rcv_limit     = NULL;
+        dd->send_schedule = NULL;
+        dd->tx_opstats    = NULL;
        sdma_clean(dd, dd->num_sdma);
        rvt_dealloc_device(&dd->verbs_dev.rdi);
 }
+static void __hfi1_free_devdata(struct kobject *kobj)
+{
+        struct hfi1_devdata *dd =
+                container_of(kobj, struct hfi1_devdata, kobj);
+        hfi1_clean_devdata(dd);
+}
 static struct kobj_type hfi1_devdata_type = {
        .release = __hfi1_free_devdata,
 };
@@ -1265,6 +1284,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
                return ERR_PTR(-ENOMEM);
        dd->num_pports = nports;
        dd->pport = (struct hfi1_pportdata *)(dd + 1);
+        dd->pcidev = pdev;
+        pci_set_drvdata(pdev, dd);
        INIT_LIST_HEAD(&dd->list);
        idr_preload(GFP_KERNEL);
@@ -1331,9 +1352,7 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
        return dd;
 bail:
-        if (!list_empty(&dd->list))
+        hfi1_clean_devdata(dd);
-                list_del_init(&dd->list);
-        rvt_dealloc_device(&dd->verbs_dev.rdi);
        return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 83d66e862207..c1c982908b4b 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -163,9 +163,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
        resource_size_t addr;
        int ret = 0;
-        dd->pcidev = pdev;
-        pci_set_drvdata(pdev, dd);
        addr = pci_resource_start(pdev, 0);
        len = pci_resource_len(pdev, 0);
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index d486355880cb..cbf7faa5038c 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -199,6 +199,7 @@ void free_platform_config(struct hfi1_devdata *dd)
 {
        /* Release memory allocated for eprom or fallback file read. */
        kfree(dd->platform_config.data);
+        dd->platform_config.data = NULL;
 }
 void get_port_type(struct hfi1_pportdata *ppd)
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index 1869f639c3ae..b5966991d647 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -204,6 +204,8 @@ static void clean_i2c_bus(struct hfi1_i2c_bus *bus)
 void clean_up_i2c(struct hfi1_devdata *dd, struct hfi1_asic_data *ad)
 {
+        if (!ad)
+                return;
        clean_i2c_bus(ad->i2c_bus0);
        ad->i2c_bus0 = NULL;
        clean_i2c_bus(ad->i2c_bus1);
diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c
index 3daa94bdae3a..c0071ca4147a 100644
--- a/drivers/infiniband/hw/hfi1/ruc.c
+++ b/drivers/infiniband/hw/hfi1/ruc.c
@@ -733,6 +733,20 @@ static inline void hfi1_make_ruc_bth(struct rvt_qp *qp,
        ohdr->bth[2] = cpu_to_be32(bth2);
 }
+/**
+ * hfi1_make_ruc_header_16B - build a 16B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
                                            struct ib_other_headers *ohdr,
                                            u32 bth0, u32 bth2, int middle,
@@ -777,6 +791,12 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
        else
                middle = 0;
+        if (qp->s_flags & RVT_S_ECN) {
+                qp->s_flags &= ~RVT_S_ECN;
+                /* we recently received a FECN, so return a BECN */
+                becn = true;
+                middle = 0;
+        }
        if (middle)
                build_ahg(qp, bth2);
        else
@@ -784,11 +804,6 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
        bth0 |= pkey;
        bth0 |= extra_bytes << 20;
-        if (qp->s_flags & RVT_S_ECN) {
-                qp->s_flags &= ~RVT_S_ECN;
-                /* we recently received a FECN, so return a BECN */
-                becn = true;
-        }
        hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
        if (!ppd->lid)
@@ -806,6 +821,20 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
                          pkey, becn, 0, l4, priv->s_sc);
 }
+/**
+ * hfi1_make_ruc_header_9B - build a 9B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
                                           struct ib_other_headers *ohdr,
                                           u32 bth0, u32 bth2, int middle,
@@ -839,6 +868,12 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
        else
                middle = 0;
+        if (qp->s_flags & RVT_S_ECN) {
+                qp->s_flags &= ~RVT_S_ECN;
+                /* we recently received a FECN, so return a BECN */
+                bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
+                middle = 0;
+        }
        if (middle)
                build_ahg(qp, bth2);
        else
@@ -846,11 +881,6 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
        bth0 |= pkey;
        bth0 |= extra_bytes << 20;
-        if (qp->s_flags & RVT_S_ECN) {
-                qp->s_flags &= ~RVT_S_ECN;
-                /* we recently received a FECN, so return a BECN */
-                bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
-        }
        hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
        hfi1_make_ib_hdr(&ps->s_txreq->phdr.hdr.ibh,
                         lrh0,
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index bcf3b0bebac8..69c17a5ef038 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -628,7 +628,7 @@ int hfi1_lookup_pkey_idx(struct hfi1_ibport *ibp, u16 pkey)
 }
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                    u8 sc5, const struct ib_grh *old_grh)
 {
        u64 pbc, pbc_flags = 0;
@@ -687,7 +687,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 }
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-                u32 pkey, u32 slid, u32 dlid, u8 sc5,
+                u16 pkey, u32 slid, u32 dlid, u8 sc5,
                const struct ib_grh *old_grh)
 {
        u64 pbc, pbc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index 0eeabfbee192..63b5b3edabcb 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -912,7 +912,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                obj_per_chunk = buf_chunk_size / obj_size;
                num_hem = (nobj + obj_per_chunk - 1) / obj_per_chunk;
                bt_chunk_num = bt_chunk_size / 8;
-                if (table->type >= HEM_TYPE_MTT)
+                if (type >= HEM_TYPE_MTT)
                        num_bt_l0 = bt_chunk_num;
                table->hem = kcalloc(num_hem, sizeof(*table->hem),
@@ -920,7 +920,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                if (!table->hem)
                        goto err_kcalloc_hem_buf;
-                if (check_whether_bt_num_3(table->type, hop_num)) {
+                if (check_whether_bt_num_3(type, hop_num)) {
                        unsigned long num_bt_l1;
                        num_bt_l1 = (num_hem + bt_chunk_num - 1) /
@@ -939,8 +939,8 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                                goto err_kcalloc_l1_dma;
                }
-                if (check_whether_bt_num_2(table->type, hop_num) ||
+                if (check_whether_bt_num_2(type, hop_num) ||
-                        check_whether_bt_num_3(table->type, hop_num)) {
+                        check_whether_bt_num_3(type, hop_num)) {
                        table->bt_l0 = kcalloc(num_bt_l0, sizeof(*table->bt_l0),
                                               GFP_KERNEL);
                        if (!table->bt_l0)
@@ -1039,14 +1039,14 @@ void hns_roce_cleanup_hem_table(struct hns_roce_dev *hr_dev,
 void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
 {
        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->cq_table.table);
-        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.irrl_table);
        if (hr_dev->caps.trrl_entry_sz)
                hns_roce_cleanup_hem_table(hr_dev,
                                           &hr_dev->qp_table.trrl_table);
+        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.irrl_table);
        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.qp_table);
        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtpt_table);
-        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtt_table);
        if (hns_roce_check_whether_mhop(hr_dev, HEM_TYPE_CQE))
                hns_roce_cleanup_hem_table(hr_dev,
                                           &hr_dev->mr_table.mtt_cqe_table);
+        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtt_table);
 }
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 8b84ab7800d8..25916e8522ed 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -71,6 +71,11 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        return -EINVAL;
                }
+                if (wr->opcode == IB_WR_RDMA_READ) {
+                        dev_err(hr_dev->dev, "Not support inline data!\n");
+                        return -EINVAL;
+                }
                for (i = 0; i < wr->num_sge; i++) {
                        memcpy(wqe, ((void *)wr->sg_list[i].addr),
                               wr->sg_list[i].length);
@@ -148,7 +153,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                     ibqp->qp_type != IB_QPT_GSI &&
                     ibqp->qp_type != IB_QPT_UD)) {
                dev_err(dev, "Not supported QP(0x%x)type!\n", ibqp->qp_type);
-                *bad_wr = NULL;
+                *bad_wr = wr;
                return -EOPNOTSUPP;
        }
@@ -182,7 +187,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                qp->sq.wrid[(qp->sq.head + nreq) & (qp->sq.wqe_cnt - 1)] =
                                                                      wr->wr_id;
-                owner_bit = ~(qp->sq.head >> ilog2(qp->sq.wqe_cnt)) & 0x1;
+                owner_bit =
+                       ~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1);
                /* Corresponding to the QP type, wqe process separately */
                if (ibqp->qp_type == IB_QPT_GSI) {
@@ -456,6 +462,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                } else {
                        dev_err(dev, "Illegal qp_type(0x%x)\n", ibqp->qp_type);
                        spin_unlock_irqrestore(&qp->sq.lock, flags);
+                        *bad_wr = wr;
                        return -EOPNOTSUPP;
                }
        }
@@ -2592,10 +2599,12 @@ static void modify_qp_init_to_init(struct ib_qp *ibqp,
        roce_set_field(qpc_mask->byte_4_sqpn_tst, V2_QPC_BYTE_4_SQPN_M,
                       V2_QPC_BYTE_4_SQPN_S, 0);
-        roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+        if (attr_mask & IB_QP_DEST_QPN) {
-                       V2_QPC_BYTE_56_DQPN_S, hr_qp->qpn);
+                roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-        roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+                               V2_QPC_BYTE_56_DQPN_S, hr_qp->qpn);
-                       V2_QPC_BYTE_56_DQPN_S, 0);
+                roce_set_field(qpc_mask->byte_56_dqpn_err,
+                               V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+        }
        roce_set_field(context->byte_168_irrl_idx,
                       V2_QPC_BYTE_168_SQ_SHIFT_BAK_M,
                       V2_QPC_BYTE_168_SQ_SHIFT_BAK_S,
@@ -2650,8 +2659,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
                return -EINVAL;
        }
-        if ((attr_mask & IB_QP_ALT_PATH) || (attr_mask & IB_QP_ACCESS_FLAGS) ||
+        if (attr_mask & IB_QP_ALT_PATH) {
-            (attr_mask & IB_QP_PKEY_INDEX) || (attr_mask & IB_QP_QKEY)) {
                dev_err(dev, "INIT2RTR attr_mask (0x%x) error\n", attr_mask);
                return -EINVAL;
        }
@@ -2800,10 +2808,12 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
                               V2_QPC_BYTE_140_RR_MAX_S, 0);
        }
-        roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+        if (attr_mask & IB_QP_DEST_QPN) {
-                       V2_QPC_BYTE_56_DQPN_S, attr->dest_qp_num);
+                roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-        roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+                               V2_QPC_BYTE_56_DQPN_S, attr->dest_qp_num);
-                       V2_QPC_BYTE_56_DQPN_S, 0);
+                roce_set_field(qpc_mask->byte_56_dqpn_err,
+                               V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+        }
        /* Configure GID index */
        port_num = rdma_ah_get_port_num(&attr->ah_attr);
@@ -2845,7 +2855,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
        if (ibqp->qp_type == IB_QPT_GSI || ibqp->qp_type == IB_QPT_UD)
                roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
                               V2_QPC_BYTE_24_MTU_S, IB_MTU_4096);
-        else
+        else if (attr_mask & IB_QP_PATH_MTU)
                roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
                               V2_QPC_BYTE_24_MTU_S, attr->path_mtu);
@@ -2922,11 +2932,9 @@ static int modify_qp_rtr_to_rts(struct ib_qp *ibqp,
                return -EINVAL;
        }
-        /* If exist optional param, return error */
+        /* Not support alternate path and path migration */
-        if ((attr_mask & IB_QP_ALT_PATH) || (attr_mask & IB_QP_ACCESS_FLAGS) ||
+        if ((attr_mask & IB_QP_ALT_PATH) ||
-            (attr_mask & IB_QP_QKEY) || (attr_mask & IB_QP_PATH_MIG_STATE) ||
+            (attr_mask & IB_QP_PATH_MIG_STATE)) {
-            (attr_mask & IB_QP_CUR_STATE) ||
-            (attr_mask & IB_QP_MIN_RNR_TIMER)) {
                dev_err(dev, "RTR2RTS attr_mask (0x%x)error\n", attr_mask);
                return -EINVAL;
        }
@@ -3161,7 +3169,8 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
                   (cur_state == IB_QPS_RTR && new_state == IB_QPS_ERR) ||
                   (cur_state == IB_QPS_RTS && new_state == IB_QPS_ERR) ||
                   (cur_state == IB_QPS_SQD && new_state == IB_QPS_ERR) ||
-                   (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR)) {
+                   (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR) ||
+                   (cur_state == IB_QPS_ERR && new_state == IB_QPS_ERR)) {
                /* Nothing */
                ;
        } else {
@@ -4478,7 +4487,7 @@ static int hns_roce_v2_create_eq(struct hns_roce_dev *hr_dev,
        ret = hns_roce_cmd_mbox(hr_dev, mailbox->dma, 0, eq->eqn, 0,
                                eq_cmd, HNS_ROCE_CMD_TIMEOUT_MSECS);
        if (ret) {
-                dev_err(dev, "[mailbox cmd] creat eqc failed.\n");
+                dev_err(dev, "[mailbox cmd] create eqc failed.\n");
                goto err_cmd_mbox;
        }
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index e289a924e789..d4aad34c21e2 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -620,7 +620,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
                                        to_hr_ucontext(ib_pd->uobject->context),
                                        ucmd.db_addr, &hr_qp->rdb);
                        if (ret) {
-                                dev_err(dev, "rp record doorbell map failed!\n");
+                                dev_err(dev, "rq record doorbell map failed!\n");
                                goto err_mtt;
                        }
                }
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 17f4f151a97f..61d8b06375bb 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -346,7 +346,7 @@ int mlx4_ib_umem_calc_optimal_mtt_size(struct ib_umem *umem, u64 start_va,
        /* Add to the first block the misalignment that it suffers from. */
        total_len += (first_block_start & ((1ULL << block_shift) - 1ULL));
        last_block_end = current_block_start + current_block_len;
-        last_block_aligned_end = round_up(last_block_end, 1 << block_shift);
+        last_block_aligned_end = round_up(last_block_end, 1ULL << block_shift);
        total_len += (last_block_aligned_end - last_block_end);
        if (total_len & ((1ULL << block_shift) - 1ULL))
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 50af8915e7ec..199648adac74 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -673,7 +673,8 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                                          MLX4_IB_RX_HASH_SRC_PORT_TCP  |
                                          MLX4_IB_RX_HASH_DST_PORT_TCP  |
                                          MLX4_IB_RX_HASH_SRC_PORT_UDP  |
-                                          MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+                                          MLX4_IB_RX_HASH_DST_PORT_UDP  |
+                                          MLX4_IB_RX_HASH_INNER)) {
                pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
                         ucmd->rx_hash_fields_mask);
                return (-EOPNOTSUPP);
diff --git a/drivers/infiniband/hw/mlx5/Kconfig b/drivers/infiniband/hw/mlx5/Kconfig
index bce263b92821..fb4d77be019b 100644
--- a/drivers/infiniband/hw/mlx5/Kconfig
+++ b/drivers/infiniband/hw/mlx5/Kconfig
@@ -1,6 +1,7 @@
 config MLX5_INFINIBAND
        tristate "Mellanox Connect-IB HCA support"
        depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on INFINIBAND_USER_ACCESS || INFINIBAND_USER_ACCESS=n
        ---help---
          This driver provides low-level InfiniBand support for
          Mellanox Connect-IB PCI Express host channel adapters (HCAs).
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 241cf4ff9901..b4d8ff8ab807 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -52,7 +52,6 @@
 #include <linux/mlx5/port.h>
 #include <linux/mlx5/vport.h>
 #include <linux/mlx5/fs.h>
-#include <linux/mlx5/fs_helpers.h>
 #include <linux/list.h>
 #include <rdma/ib_smi.h>
 #include <rdma/ib_umem.h>
@@ -180,7 +179,7 @@ static int mlx5_netdev_event(struct notifier_block *this,
                        if (rep_ndev == ndev)
                                roce->netdev = (event == NETDEV_UNREGISTER) ?
                                        NULL : ndev;
-                } else if (ndev->dev.parent == &ibdev->mdev->pdev->dev) {
+                } else if (ndev->dev.parent == &mdev->pdev->dev) {
                        roce->netdev = (event == NETDEV_UNREGISTER) ?
                                NULL : ndev;
                }
@@ -5427,9 +5426,7 @@ static void mlx5_ib_stage_cong_debugfs_cleanup(struct mlx5_ib_dev *dev)
 static int mlx5_ib_stage_uar_init(struct mlx5_ib_dev *dev)
 {
        dev->mdev->priv.uar = mlx5_get_uars_page(dev->mdev);
-        if (!dev->mdev->priv.uar)
+        return PTR_ERR_OR_ZERO(dev->mdev->priv.uar);
-                return -ENOMEM;
-        return 0;
 }
 static void mlx5_ib_stage_uar_cleanup(struct mlx5_ib_dev *dev)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 1520a2f20f98..90a9c461cedc 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -866,25 +866,28 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
                       int *order)
 {
        struct mlx5_ib_dev *dev = to_mdev(pd->device);
+        struct ib_umem *u;
        int err;
-        *umem = ib_umem_get(pd->uobject->context, start, length,
+        *umem = NULL;
-                            access_flags, 0);
-        err = PTR_ERR_OR_ZERO(*umem);
+        u = ib_umem_get(pd->uobject->context, start, length, access_flags, 0);
+        err = PTR_ERR_OR_ZERO(u);
        if (err) {
-                *umem = NULL;
+                mlx5_ib_dbg(dev, "umem get failed (%d)\n", err);
-                mlx5_ib_err(dev, "umem get failed (%d)\n", err);
                return err;
        }
-        mlx5_ib_cont_pages(*umem, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages,
+        mlx5_ib_cont_pages(u, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages,
                           page_shift, ncont, order);
        if (!*npages) {
                mlx5_ib_warn(dev, "avoid zero region\n");
-                ib_umem_release(*umem);
+                ib_umem_release(u);
                return -EINVAL;
        }
+        *umem = u;
        mlx5_ib_dbg(dev, "npages %d, ncont %d, order %d, page_shift %d\n",
                    *npages, *ncont, *order, *page_shift);
@@ -1458,13 +1461,12 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
        int access_flags = flags & IB_MR_REREG_ACCESS ?
                            new_access_flags :
                            mr->access_flags;
-        u64 addr = (flags & IB_MR_REREG_TRANS) ? virt_addr : mr->umem->address;
-        u64 len = (flags & IB_MR_REREG_TRANS) ? length : mr->umem->length;
        int page_shift = 0;
        int upd_flags = 0;
        int npages = 0;
        int ncont = 0;
        int order = 0;
+        u64 addr, len;
        int err;
        mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
@@ -1472,6 +1474,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
        atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
+        if (!mr->umem)
+                return -EINVAL;
+        if (flags & IB_MR_REREG_TRANS) {
+                addr = virt_addr;
+                len = length;
+        } else {
+                addr = mr->umem->address;
+                len = mr->umem->length;
+        }
        if (flags != IB_MR_REREG_PD) {
                /*
                 * Replace umem. This needs to be done whether or not UMR is
@@ -1479,6 +1492,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 */
                flags |= IB_MR_REREG_TRANS;
                ib_umem_release(mr->umem);
+                mr->umem = NULL;
                err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                  &npages, &page_shift, &ncont, &order);
                if (err)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 7ed4b70f6447..87b7c1be2a11 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -259,7 +259,11 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
        } else {
                if (ucmd) {
                        qp->rq.wqe_cnt = ucmd->rq_wqe_count;
+                        if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
+                                return -EINVAL;
                        qp->rq.wqe_shift = ucmd->rq_wqe_shift;
+                        if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig)
+                                return -EINVAL;
                        qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
                        qp->rq.max_post = qp->rq.wqe_cnt;
                } else {
@@ -2451,18 +2455,18 @@ enum {
 static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate)
 {
-        if (rate == IB_RATE_PORT_CURRENT) {
+        if (rate == IB_RATE_PORT_CURRENT)
                return 0;
-        } else if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS) {
+        if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS)
                return -EINVAL;
-        } else {
-                while (rate != IB_RATE_2_5_GBPS &&
-                       !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
-                         MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
-                        --rate;
-        }
-        return rate + MLX5_STAT_RATE_OFFSET;
+        while (rate != IB_RATE_PORT_CURRENT &&
+               !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
+                 MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
+                --rate;
+        return rate ? rate + MLX5_STAT_RATE_OFFSET : rate;
 }
 static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 0a75164cedea..007d5e8a0121 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -461,7 +461,7 @@ static bool nes_nic_send(struct sk_buff *skb, struct net_device *netdev)
 /**
 * nes_netdev_start_xmit
 */
-static int nes_netdev_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+static netdev_tx_t nes_netdev_start_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
        struct nes_vnic *nesvnic = netdev_priv(netdev);
        struct nes_device *nesdev = nesvnic->nesdev;
diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c
index 61927c165b59..4cf11063e0b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_opcode.c
+++ b/drivers/infiniband/sw/rxe/rxe_opcode.c
@@ -390,7 +390,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = {
                .name   = "IB_OPCODE_RC_SEND_ONLY_INV",
                .mask   = RXE_IETH_MASK | RXE_PAYLOAD_MASK | RXE_REQ_MASK
                                | RXE_COMP_MASK | RXE_RWR_MASK | RXE_SEND_MASK
-                                | RXE_END_MASK,
+                                | RXE_END_MASK  | RXE_START_MASK,
                .length = RXE_BTH_BYTES + RXE_IETH_BYTES,
                .offset = {
                        [RXE_BTH]       = 0,
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 7bdaf71b8221..785199990457 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -728,7 +728,6 @@ next_wqe:
                rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
                if (ret == -EAGAIN) {
-                        kfree_skb(skb);
                        rxe_run_task(&qp->req.task, 1);
                        goto exit;
                }
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index a65c9969f7fc..955ff3b6da9c 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -742,7 +742,6 @@ static enum resp_states read_reply(struct rxe_qp *qp,
        err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb);
        if (err) {
                pr_err("Failed sending RDMA reply.\n");
-                kfree_skb(skb);
                return RESPST_ERR_RNR;
        }
@@ -954,10 +953,8 @@ static int send_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
        }
        err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb);
-        if (err) {
+        if (err)
                pr_err_ratelimited("Failed sending ack\n");
-                kfree_skb(skb);
-        }
 err1:
        return err;
@@ -1141,7 +1138,6 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                        if (rc) {
                                pr_err("Failed resending result. This flow is not handled - skb ignored\n");
                                rxe_drop_ref(qp);
-                                kfree_skb(skb_copy);
                                rc = RESPST_CLEANUP;
                                goto out;
                        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 161ba8c76285..cf291f90b58f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1094,7 +1094,7 @@ drop_and_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
 }
-static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
        struct rdma_netdev *rn = netdev_priv(dev);
diff --git a/drivers/infiniband/ulp/srp/Kconfig b/drivers/infiniband/ulp/srp/Kconfig
index c74ee9633041..99db8fe5173a 100644
--- a/drivers/infiniband/ulp/srp/Kconfig
+++ b/drivers/infiniband/ulp/srp/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRP
        tristate "InfiniBand SCSI RDMA Protocol"
-        depends on SCSI
+        depends on SCSI && INFINIBAND_ADDR_TRANS
        select SCSI_SRP_ATTRS
        ---help---
          Support for the SCSI RDMA Protocol over InfiniBand.  This
diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig
index 31ee83d528d9..fb8b7182f05e 100644
--- a/drivers/infiniband/ulp/srpt/Kconfig
+++ b/drivers/infiniband/ulp/srpt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRPT
        tristate "InfiniBand SCSI RDMA Protocol target support"
-        depends on INFINIBAND && TARGET_CORE
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
        ---help---
          Support for the SCSI RDMA Protocol (SRP) Target driver. The
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 2a99f0f14795..8fb8c737fffe 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -83,7 +83,6 @@
 static DEFINE_SPINLOCK(amd_iommu_devtable_lock);
 static DEFINE_SPINLOCK(pd_bitmap_lock);
-static DEFINE_SPINLOCK(iommu_table_lock);
 /* List of all available dev_data structures */
 static LLIST_HEAD(dev_data_list);
@@ -3562,6 +3561,7 @@ EXPORT_SYMBOL(amd_iommu_device_info);
 *****************************************************************************/
 static struct irq_chip amd_ir_chip;
+static DEFINE_SPINLOCK(iommu_table_lock);
 static void set_dte_irq_entry(u16 devid, struct irq_remap_table *table)
 {
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index f05f3cf90756..ddcbbdb5d658 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -167,40 +167,16 @@ EXPORT_SYMBOL(iommu_put_dma_cookie);
 * @list: Reserved region list from iommu_get_resv_regions()
 *
 * IOMMU drivers can use this to implement their .get_resv_regions callback
- * for general non-IOMMU-specific reservations. Currently, this covers host
+ * for general non-IOMMU-specific reservations. Currently, this covers GICv3
- * bridge windows for PCI devices and GICv3 ITS region reservation on ACPI
+ * ITS region reservation on ACPI based ARM platforms that may require HW MSI
- * based ARM platforms that may require HW MSI reservation.
+ * reservation.
 */
 void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list)
 {
-        struct pci_host_bridge *bridge;
-        struct resource_entry *window;
-        if (!is_of_node(dev->iommu_fwspec->iommu_fwnode) &&
-                iort_iommu_msi_get_resv_regions(dev, list) < 0)
-                return;
-        if (!dev_is_pci(dev))
-                return;
-        bridge = pci_find_host_bridge(to_pci_dev(dev)->bus);
-        resource_list_for_each_entry(window, &bridge->windows) {
-                struct iommu_resv_region *region;
-                phys_addr_t start;
-                size_t length;
-                if (resource_type(window->res) != IORESOURCE_MEM)
-                        continue;
-                start = window->res->start - window->offset;
+        if (!is_of_node(dev->iommu_fwspec->iommu_fwnode))
-                length = window->res->end - window->res->start + 1;
+                iort_iommu_msi_get_resv_regions(dev, list);
-                region = iommu_alloc_resv_region(start, length, 0,
-                                IOMMU_RESV_RESERVED);
-                if (!region)
-                        return;
-                list_add_tail(&region->list, list);
-        }
 }
 EXPORT_SYMBOL(iommu_dma_get_resv_regions);
@@ -229,6 +205,23 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie,
        return 0;
 }
+static void iova_reserve_pci_windows(struct pci_dev *dev,
+                struct iova_domain *iovad)
+{
+        struct pci_host_bridge *bridge = pci_find_host_bridge(dev->bus);
+        struct resource_entry *window;
+        unsigned long lo, hi;
+        resource_list_for_each_entry(window, &bridge->windows) {
+                if (resource_type(window->res) != IORESOURCE_MEM)
+                        continue;
+                lo = iova_pfn(iovad, window->res->start - window->offset);
+                hi = iova_pfn(iovad, window->res->end - window->offset);
+                reserve_iova(iovad, lo, hi);
+        }
+}
 static int iova_reserve_iommu_regions(struct device *dev,
                struct iommu_domain *domain)
 {
@@ -238,6 +231,9 @@ static int iova_reserve_iommu_regions(struct device *dev,
        LIST_HEAD(resv_regions);
        int ret = 0;
+        if (dev_is_pci(dev))
+                iova_reserve_pci_windows(to_pci_dev(dev), iovad);
        iommu_get_resv_regions(dev, &resv_regions);
        list_for_each_entry(region, &resv_regions, list) {
                unsigned long lo, hi;
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index accf58388bdb..460bed4fc5b1 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1345,7 +1345,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
        struct qi_desc desc;
        if (mask) {
-                BUG_ON(addr & ((1 << (VTD_PAGE_SHIFT + mask)) - 1));
+                WARN_ON_ONCE(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1));
                addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1;
                desc.high = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE;
        } else
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 66f69af2c219..3062a154a9fb 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -1136,7 +1136,7 @@ static void intel_ir_reconfigure_irte(struct irq_data *irqd, bool force)
        irte->dest_id = IRTE_DEST(cfg->dest_apicid);
        /* Update the hardware only if the interrupt is in remapped mode. */
-        if (!force || ir_data->irq_2_iommu.mode == IRQ_REMAPPING)
+        if (force || ir_data->irq_2_iommu.mode == IRQ_REMAPPING)
                modify_irte(&ir_data->irq_2_iommu, irte);
 }
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 5fc8656c60f9..0468acfa131f 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1098,7 +1098,7 @@ static int rk_iommu_of_xlate(struct device *dev,
        data->iommu = platform_get_drvdata(iommu_dev);
        dev->archdata.iommu = data;
-        of_dev_put(iommu_dev);
+        platform_device_put(iommu_dev);
        return 0;
 }
@@ -1175,8 +1175,15 @@ static int rk_iommu_probe(struct platform_device *pdev)
        for (i = 0; i < iommu->num_clocks; ++i)
                iommu->clocks[i].id = rk_iommu_clocks[i];
+        /*
+         * iommu clocks should be present for all new devices and devicetrees
+         * but there are older devicetrees without clocks out in the wild.
+         * So clocks as optional for the time being.
+         */
        err = devm_clk_bulk_get(iommu->dev, iommu->num_clocks, iommu->clocks);
-        if (err)
+        if (err == -ENOENT)
+                iommu->num_clocks = 0;
+        else if (err)
                return err;
        err = clk_bulk_prepare(iommu->num_clocks, iommu->clocks);
diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
index f31265937439..7f0c0be322e0 100644
--- a/drivers/irqchip/qcom-irq-combiner.c
+++ b/drivers/irqchip/qcom-irq-combiner.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -68,7 +68,7 @@ static void combiner_handle_irq(struct irq_desc *desc)
                bit = readl_relaxed(combiner->regs[reg].addr);
                status = bit & combiner->regs[reg].enabled;
-                if (!status)
+                if (bit && !status)
                        pr_warn_ratelimited("Unexpected IRQ on CPU%d: (%08x %08lx %p)\n",
                                            smp_processor_id(), bit,
                                            combiner->regs[reg].enabled,
diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index 004cc3cc6123..7fa2631b422c 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -290,7 +290,7 @@ do {									\
                if (kthread_should_stop() ||                            \
                    test_bit(CACHE_SET_IO_DISABLE, &ca->set->flags)) {  \
                        set_current_state(TASK_RUNNING);                \
-                        return 0;                                       \
+                        goto out;                                       \
                }                                                       \
                                                                        \
                schedule();                                             \
@@ -378,6 +378,9 @@ retry_invalidate:
                        bch_prio_write(ca);
                }
        }
+out:
+        wait_for_kthread_stop();
+        return 0;
 }
 /* Allocation */
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index d338b7086013..3a0cfb237af9 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -392,6 +392,8 @@ struct cached_dev {
 #define DEFAULT_CACHED_DEV_ERROR_LIMIT  64
        atomic_t                io_errors;
        unsigned                error_limit;
+        char                    backing_dev_name[BDEVNAME_SIZE];
 };
 enum alloc_reserve {
@@ -464,6 +466,8 @@ struct cache {
        atomic_long_t           meta_sectors_written;
        atomic_long_t           btree_sectors_written;
        atomic_long_t           sectors_written;
+        char                    cache_dev_name[BDEVNAME_SIZE];
 };
 struct gc_stat {
diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
index 028f7b386e01..4e63c6f6c04d 100644
--- a/drivers/md/bcache/debug.c
+++ b/drivers/md/bcache/debug.c
@@ -106,7 +106,6 @@ void bch_btree_verify(struct btree *b)
 void bch_data_verify(struct cached_dev *dc, struct bio *bio)
 {
-        char name[BDEVNAME_SIZE];
        struct bio *check;
        struct bio_vec bv, cbv;
        struct bvec_iter iter, citer = { 0 };
@@ -134,7 +133,7 @@ void bch_data_verify(struct cached_dev *dc, struct bio *bio)
                                        bv.bv_len),
                                 dc->disk.c,
                                 "verify failed at dev %s sector %llu",
-                                 bdevname(dc->bdev, name),
+                                 dc->backing_dev_name,
                                 (uint64_t) bio->bi_iter.bi_sector);
                kunmap_atomic(p1);
diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index 7fac97ae036e..2ddf8515e6a5 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -52,7 +52,6 @@ void bch_submit_bbio(struct bio *bio, struct cache_set *c,
 /* IO errors */
 void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
 {
-        char buf[BDEVNAME_SIZE];
        unsigned errors;
        WARN_ONCE(!dc, "NULL pointer of struct cached_dev");
@@ -60,7 +59,7 @@ void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
        errors = atomic_add_return(1, &dc->io_errors);
        if (errors < dc->error_limit)
                pr_err("%s: IO error on backing device, unrecoverable",
-                        bio_devname(bio, buf));
+                        dc->backing_dev_name);
        else
                bch_cached_dev_error(dc);
 }
@@ -105,19 +104,18 @@ void bch_count_io_errors(struct cache *ca,
        }
        if (error) {
-                char buf[BDEVNAME_SIZE];
                unsigned errors = atomic_add_return(1 << IO_ERROR_SHIFT,
                                                    &ca->io_errors);
                errors >>= IO_ERROR_SHIFT;
                if (errors < ca->set->error_limit)
                        pr_err("%s: IO error on %s%s",
-                               bdevname(ca->bdev, buf), m,
+                               ca->cache_dev_name, m,
                               is_read ? ", recovering." : ".");
                else
                        bch_cache_set_error(ca->set,
                                            "%s: too many IO errors %s",
-                                            bdevname(ca->bdev, buf), m);
+                                            ca->cache_dev_name, m);
        }
 }
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index a65e3365eeb9..8e3e8655ed63 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -649,11 +649,8 @@ static void backing_request_endio(struct bio *bio)
                 */
                if (unlikely(s->iop.writeback &&
                             bio->bi_opf & REQ_PREFLUSH)) {
-                        char buf[BDEVNAME_SIZE];
-                        bio_devname(bio, buf);
                        pr_err("Can't flush %s: returned bi_status %i",
-                                buf, bio->bi_status);
+                                dc->backing_dev_name, bio->bi_status);
                } else {
                        /* set to orig_bio->bi_status in bio_complete() */
                        s->iop.status = bio->bi_status;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index d90d9e59ca00..3dea06b41d43 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -936,7 +936,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc)
 static void cached_dev_detach_finish(struct work_struct *w)
 {
        struct cached_dev *dc = container_of(w, struct cached_dev, detach);
-        char buf[BDEVNAME_SIZE];
        struct closure cl;
        closure_init_stack(&cl);
@@ -967,7 +966,7 @@ static void cached_dev_detach_finish(struct work_struct *w)
        mutex_unlock(&bch_register_lock);
-        pr_info("Caching disabled for %s", bdevname(dc->bdev, buf));
+        pr_info("Caching disabled for %s", dc->backing_dev_name);
        /* Drop ref we took in cached_dev_detach() */
        closure_put(&dc->disk.cl);
@@ -999,29 +998,28 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
 {
        uint32_t rtime = cpu_to_le32(get_seconds());
        struct uuid_entry *u;
-        char buf[BDEVNAME_SIZE];
        struct cached_dev *exist_dc, *t;
-        bdevname(dc->bdev, buf);
        if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) ||
            (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)))
                return -ENOENT;
        if (dc->disk.c) {
-                pr_err("Can't attach %s: already attached", buf);
+                pr_err("Can't attach %s: already attached",
+                       dc->backing_dev_name);
                return -EINVAL;
        }
        if (test_bit(CACHE_SET_STOPPING, &c->flags)) {
-                pr_err("Can't attach %s: shutting down", buf);
+                pr_err("Can't attach %s: shutting down",
+                       dc->backing_dev_name);
                return -EINVAL;
        }
        if (dc->sb.block_size < c->sb.block_size) {
                /* Will die */
                pr_err("Couldn't attach %s: block size less than set's block size",
-                       buf);
+                       dc->backing_dev_name);
                return -EINVAL;
        }
@@ -1029,7 +1027,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
                if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
                        pr_err("Tried to attach %s but duplicate UUID already attached",
-                                buf);
+                                dc->backing_dev_name);
                        return -EINVAL;
                }
@@ -1047,13 +1045,15 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        if (!u) {
                if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
-                        pr_err("Couldn't find uuid for %s in set", buf);
+                        pr_err("Couldn't find uuid for %s in set",
+                               dc->backing_dev_name);
                        return -ENOENT;
                }
                u = uuid_find_empty(c);
                if (!u) {
-                        pr_err("Not caching %s, no room for UUID", buf);
+                        pr_err("Not caching %s, no room for UUID",
+                               dc->backing_dev_name);
                        return -EINVAL;
                }
        }
@@ -1112,7 +1112,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        up_write(&dc->writeback_lock);
        pr_info("Caching %s as %s on set %pU",
-                bdevname(dc->bdev, buf), dc->disk.disk->disk_name,
+                dc->backing_dev_name,
+                dc->disk.disk->disk_name,
                dc->disk.c->sb.set_uuid);
        return 0;
 }
@@ -1225,10 +1226,10 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
                                 struct block_device *bdev,
                                 struct cached_dev *dc)
 {
-        char name[BDEVNAME_SIZE];
        const char *err = "cannot allocate memory";
        struct cache_set *c;
+        bdevname(bdev, dc->backing_dev_name);
        memcpy(&dc->sb, sb, sizeof(struct cache_sb));
        dc->bdev = bdev;
        dc->bdev->bd_holder = dc;
@@ -1237,6 +1238,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        bio_first_bvec_all(&dc->sb_bio)->bv_page = sb_page;
        get_page(sb_page);
        if (cached_dev_init(dc, sb->block_size << 9))
                goto err;
@@ -1247,7 +1249,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        if (bch_cache_accounting_add_kobjs(&dc->accounting, &dc->disk.kobj))
                goto err;
-        pr_info("registered backing device %s", bdevname(bdev, name));
+        pr_info("registered backing device %s", dc->backing_dev_name);
        list_add(&dc->list, &uncached_devices);
        list_for_each_entry(c, &bch_cache_sets, list)
@@ -1259,7 +1261,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        return;
 err:
-        pr_notice("error %s: %s", bdevname(bdev, name), err);
+        pr_notice("error %s: %s", dc->backing_dev_name, err);
        bcache_device_stop(&dc->disk);
 }
@@ -1367,7 +1369,7 @@ int bch_flash_dev_create(struct cache_set *c, uint64_t size)
 bool bch_cached_dev_error(struct cached_dev *dc)
 {
-        char name[BDEVNAME_SIZE];
+        struct cache_set *c;
        if (!dc || test_bit(BCACHE_DEV_CLOSING, &dc->disk.flags))
                return false;
@@ -1377,7 +1379,22 @@ bool bch_cached_dev_error(struct cached_dev *dc)
        smp_mb();
        pr_err("stop %s: too many IO errors on backing device %s\n",
-                dc->disk.disk->disk_name, bdevname(dc->bdev, name));
+                dc->disk.disk->disk_name, dc->backing_dev_name);
+        /*
+         * If the cached device is still attached to a cache set,
+         * even dc->io_disable is true and no more I/O requests
+         * accepted, cache device internal I/O (writeback scan or
+         * garbage collection) may still prevent bcache device from
+         * being stopped. So here CACHE_SET_IO_DISABLE should be
+         * set to c->flags too, to make the internal I/O to cache
+         * device rejected and stopped immediately.
+         * If c is NULL, that means the bcache device is not attached
+         * to any cache set, then no CACHE_SET_IO_DISABLE bit to set.
+         */
+        c = dc->disk.c;
+        if (c && test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
+                pr_info("CACHE_SET_IO_DISABLE already set");
        bcache_device_stop(&dc->disk);
        return true;
@@ -1395,7 +1412,7 @@ bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...)
                return false;
        if (test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
-                pr_warn("CACHE_SET_IO_DISABLE already set");
+                pr_info("CACHE_SET_IO_DISABLE already set");
        /* XXX: we can be called from atomic context
        acquire_console_sem();
@@ -1539,6 +1556,20 @@ static void conditional_stop_bcache_device(struct cache_set *c,
                 */
                pr_warn("stop_when_cache_set_failed of %s is \"auto\" and cache is dirty, stop it to avoid potential data corruption.",
                        d->disk->disk_name);
+                        /*
+                         * There might be a small time gap that cache set is
+                         * released but bcache device is not. Inside this time
+                         * gap, regular I/O requests will directly go into
+                         * backing device as no cache set attached to. This
+                         * behavior may also introduce potential inconsistence
+                         * data in writeback mode while cache is dirty.
+                         * Therefore before calling bcache_device_stop() due
+                         * to a broken cache device, dc->io_disable should be
+                         * explicitly set to true.
+                         */
+                        dc->io_disable = true;
+                        /* make others know io_disable is true earlier */
+                        smp_mb();
                        bcache_device_stop(d);
        } else {
                /*
@@ -2003,12 +2034,10 @@ static int cache_alloc(struct cache *ca)
 static int register_cache(struct cache_sb *sb, struct page *sb_page,
                                struct block_device *bdev, struct cache *ca)
 {
-        char name[BDEVNAME_SIZE];
        const char *err = NULL; /* must be set for any error case */
        int ret = 0;
-        bdevname(bdev, name);
+        bdevname(bdev, ca->cache_dev_name);
        memcpy(&ca->sb, sb, sizeof(struct cache_sb));
        ca->bdev = bdev;
        ca->bdev->bd_holder = ca;
@@ -2045,14 +2074,14 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                goto out;
        }
-        pr_info("registered cache device %s", name);
+        pr_info("registered cache device %s", ca->cache_dev_name);
 out:
        kobject_put(&ca->kobj);
 err:
        if (err)
-                pr_notice("error %s: %s", name, err);
+                pr_notice("error %s: %s", ca->cache_dev_name, err);
        return ret;
 }
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 4a9547cdcdc5..ad45ebe1a74b 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -244,8 +244,10 @@ static void dirty_endio(struct bio *bio)
        struct keybuf_key *w = bio->bi_private;
        struct dirty_io *io = w->private;
-        if (bio->bi_status)
+        if (bio->bi_status) {
                SET_KEY_DIRTY(&w->key, false);
+                bch_count_backing_io_errors(io->dc, bio);
+        }
        closure_put(&io->cl);
 }
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 12aa9ca21d8c..dc385b70e4c3 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1681,8 +1681,9 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
        if (block_size <= KMALLOC_MAX_SIZE &&
            (block_size < PAGE_SIZE || !is_power_of_2(block_size))) {
-                snprintf(slab_name, sizeof slab_name, "dm_bufio_cache-%u", c->block_size);
+                unsigned align = min(1U << __ffs(block_size), (unsigned)PAGE_SIZE);
-                c->slab_cache = kmem_cache_create(slab_name, c->block_size, ARCH_KMALLOC_MINALIGN,
+                snprintf(slab_name, sizeof slab_name, "dm_bufio_cache-%u", block_size);
+                c->slab_cache = kmem_cache_create(slab_name, block_size, align,
                                                  SLAB_RECLAIM_ACCOUNT, NULL);
                if (!c->slab_cache) {
                        r = -ENOMEM;
diff --git a/drivers/md/dm-cache-background-tracker.c b/drivers/md/dm-cache-background-tracker.c
index 1d0af0a21fc7..84814e819e4c 100644
--- a/drivers/md/dm-cache-background-tracker.c
+++ b/drivers/md/dm-cache-background-tracker.c
@@ -166,7 +166,7 @@ static bool max_work_reached(struct background_tracker *b)
                atomic_read(&b->pending_demotes) >= b->max_work;
 }
-struct bt_work *alloc_work(struct background_tracker *b)
+static struct bt_work *alloc_work(struct background_tracker *b)
 {
        if (max_work_reached(b))
                return NULL;
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 77d9fe58dae2..514fb4aec5d1 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2440,7 +2440,7 @@ static void dm_integrity_free_journal_scatterlist(struct dm_integrity_c *ic, str
        unsigned i;
        for (i = 0; i < ic->journal_sections; i++)
                kvfree(sl[i]);
-        kfree(sl);
+        kvfree(sl);
 }
 static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_integrity_c *ic, struct page_list *pl)
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 580c49cc8079..5903e492bb34 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -23,6 +23,8 @@
 #define MAX_RECOVERY 1  /* Maximum number of regions recovered in parallel. */
+#define MAX_NR_MIRRORS  (DM_KCOPYD_MAX_REGIONS + 1)
 #define DM_RAID1_HANDLE_ERRORS  0x01
 #define DM_RAID1_KEEP_LOG       0x02
 #define errors_handled(p)       ((p)->features & DM_RAID1_HANDLE_ERRORS)
@@ -255,7 +257,7 @@ static int mirror_flush(struct dm_target *ti)
        unsigned long error_bits;
        unsigned int i;
-        struct dm_io_region io[ms->nr_mirrors];
+        struct dm_io_region io[MAX_NR_MIRRORS];
        struct mirror *m;
        struct dm_io_request io_req = {
                .bi_op = REQ_OP_WRITE,
@@ -651,7 +653,7 @@ static void write_callback(unsigned long error, void *context)
 static void do_write(struct mirror_set *ms, struct bio *bio)
 {
        unsigned int i;
-        struct dm_io_region io[ms->nr_mirrors], *dest = io;
+        struct dm_io_region io[MAX_NR_MIRRORS], *dest = io;
        struct mirror *m;
        struct dm_io_request io_req = {
                .bi_op = REQ_OP_WRITE,
@@ -1083,7 +1085,7 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        argc -= args_used;
        if (!argc || sscanf(argv[0], "%u%c", &nr_mirrors, &dummy) != 1 ||
-            nr_mirrors < 2 || nr_mirrors > DM_KCOPYD_MAX_REGIONS + 1) {
+            nr_mirrors < 2 || nr_mirrors > MAX_NR_MIRRORS) {
                ti->error = "Invalid number of mirrors";
                dm_dirty_log_destroy(dl);
                return -EINVAL;
@@ -1404,7 +1406,7 @@ static void mirror_status(struct dm_target *ti, status_type_t type,
        int num_feature_args = 0;
        struct mirror_set *ms = (struct mirror_set *) ti->private;
        struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
-        char buffer[ms->nr_mirrors + 1];
+        char buffer[MAX_NR_MIRRORS + 1];
        switch (type) {
        case STATUSTYPE_INFO:
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4ea404dbcf0b..0a7b0107ca78 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1020,7 +1020,8 @@ int dm_set_target_max_io_len(struct dm_target *ti, sector_t len)
 EXPORT_SYMBOL_GPL(dm_set_target_max_io_len);
 static struct dm_target *dm_dax_get_live_target(struct mapped_device *md,
-                sector_t sector, int *srcu_idx)
+                                                sector_t sector, int *srcu_idx)
+        __acquires(md->io_barrier)
 {
        struct dm_table *map;
        struct dm_target *ti;
@@ -1037,7 +1038,7 @@ static struct dm_target *dm_dax_get_live_target(struct mapped_device *md,
 }
 static long dm_dax_direct_access(struct dax_device *dax_dev, pgoff_t pgoff,
-                long nr_pages, void **kaddr, pfn_t *pfn)
+                                 long nr_pages, void **kaddr, pfn_t *pfn)
 {
        struct mapped_device *md = dax_get_private(dax_dev);
        sector_t sector = pgoff * PAGE_SECTORS;
@@ -1065,7 +1066,7 @@ static long dm_dax_direct_access(struct dax_device *dax_dev, pgoff_t pgoff,
 }
 static size_t dm_dax_copy_from_iter(struct dax_device *dax_dev, pgoff_t pgoff,
-                void *addr, size_t bytes, struct iov_iter *i)
+                                    void *addr, size_t bytes, struct iov_iter *i)
 {
        struct mapped_device *md = dax_get_private(dax_dev);
        sector_t sector = pgoff * PAGE_SECTORS;
diff --git a/drivers/media/i2c/saa7115.c b/drivers/media/i2c/saa7115.c
index e216cd768409..b07114b5efb2 100644
--- a/drivers/media/i2c/saa7115.c
+++ b/drivers/media/i2c/saa7115.c
@@ -20,7 +20,7 @@
 //
 // VBI support (2004) and cleanups (2005) by Hans Verkuil <hverkuil@xs4all.nl>
 //
-// Copyright (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 //      SAA7111, SAA7113 and SAA7118 support
 #include "saa711x_regs.h"
diff --git a/drivers/media/i2c/saa711x_regs.h b/drivers/media/i2c/saa711x_regs.h
index a50d480e101a..44fabe08234d 100644
--- a/drivers/media/i2c/saa711x_regs.h
+++ b/drivers/media/i2c/saa711x_regs.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0+
 * saa711x - Philips SAA711x video decoder register specifications
 *
- * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #define R_00_CHIP_VERSION                             0x00
diff --git a/drivers/media/i2c/tda7432.c b/drivers/media/i2c/tda7432.c
index 1c5c61d829d6..9b4f21237810 100644
--- a/drivers/media/i2c/tda7432.c
+++ b/drivers/media/i2c/tda7432.c
@@ -8,7 +8,7 @@
 * Muting and tone control by Jonathan Isom <jisom@ematic.com>
 *
 * Copyright (c) 2000 Eric Sandeen <eric_sandeen@bigfoot.com>
- * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 * This code is placed under the terms of the GNU General Public License
 * Based on tda9855.c by Steve VanDeBogart (vandebo@uclink.berkeley.edu)
 * Which was based on tda8425.c by Greg Alexander (c) 1998
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 2476d812f669..1734ed4ede33 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -2,7 +2,7 @@
 //
 // tvp5150 - Texas Instruments TVP5150A/AM1 and TVP5151 video decoder driver
 //
-// Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 #include <dt-bindings/media/tvp5150.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/i2c/tvp5150_reg.h b/drivers/media/i2c/tvp5150_reg.h
index c43b7b844021..d3a764cae1a0 100644
--- a/drivers/media/i2c/tvp5150_reg.h
+++ b/drivers/media/i2c/tvp5150_reg.h
@@ -3,7 +3,7 @@
 *
 * tvp5150 - Texas Instruments TVP5150A/AM1 video decoder registers
 *
- * Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2005,2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #define TVP5150_VD_IN_SRC_SEL_1      0x00 /* Video input source selection #1 */
diff --git a/drivers/media/i2c/tvp7002.c b/drivers/media/i2c/tvp7002.c
index a26c1a3f7183..4599b7e28a8d 100644
--- a/drivers/media/i2c/tvp7002.c
+++ b/drivers/media/i2c/tvp7002.c
@@ -5,7 +5,7 @@
 * Author: Santiago Nunez-Corrales <santiago.nunez@ridgerun.com>
 *
 * This code is partially based upon the TVP5150 driver
- * written by Mauro Carvalho Chehab (mchehab@infradead.org),
+ * written by Mauro Carvalho Chehab <mchehab@kernel.org>,
 * the TVP514x driver written by Vaibhav Hiremath <hvaibhav@ti.com>
 * and the TVP7002 driver in the TI LSP 2.10.00.14. Revisions by
 * Muralidharan Karicheri and Snehaprabha Narnakaje (TI).
diff --git a/drivers/media/i2c/tvp7002_reg.h b/drivers/media/i2c/tvp7002_reg.h
index 3c8c8b0a6a4c..7f56ba689dfe 100644
--- a/drivers/media/i2c/tvp7002_reg.h
+++ b/drivers/media/i2c/tvp7002_reg.h
@@ -5,7 +5,7 @@
 * Author: Santiago Nunez-Corrales <santiago.nunez@ridgerun.com>
 *
 * This code is partially based upon the TVP5150 driver
- * written by Mauro Carvalho Chehab (mchehab@infradead.org),
+ * written by Mauro Carvalho Chehab <mchehab@kernel.org>,
 * the TVP514x driver written by Vaibhav Hiremath <hvaibhav@ti.com>
 * and the TVP7002 driver in the TI LSP 2.10.00.14
 *
diff --git a/drivers/media/media-devnode.c b/drivers/media/media-devnode.c
index 67ac51eff15c..6b87a721dc49 100644
--- a/drivers/media/media-devnode.c
+++ b/drivers/media/media-devnode.c
@@ -4,7 +4,7 @@
 * Copyright (C) 2010 Nokia Corporation
 *
 * Based on drivers/media/video/v4l2_dev.c code authored by
- *      Mauro Carvalho Chehab <mchehab@infradead.org> (version 2)
+ *      Mauro Carvalho Chehab <mchehab@kernel.org> (version 2)
 *      Alan Cox, <alan@lxorguk.ukuu.org.uk> (version 1)
 *
 * Contacts: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
diff --git a/drivers/media/pci/bt8xx/bttv-audio-hook.c b/drivers/media/pci/bt8xx/bttv-audio-hook.c
index 9f1f9169fb5b..346fc7f58839 100644
--- a/drivers/media/pci/bt8xx/bttv-audio-hook.c
+++ b/drivers/media/pci/bt8xx/bttv-audio-hook.c
@@ -1,7 +1,7 @@
 /*
 * Handlers for board audio hooks, splitted from bttv-cards
 *
- * Copyright (c) 2006 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 * This code is placed under the terms of the GNU General Public License
 */
diff --git a/drivers/media/pci/bt8xx/bttv-audio-hook.h b/drivers/media/pci/bt8xx/bttv-audio-hook.h
index 159d07adeff8..be16a537a03a 100644
--- a/drivers/media/pci/bt8xx/bttv-audio-hook.h
+++ b/drivers/media/pci/bt8xx/bttv-audio-hook.h
@@ -1,7 +1,7 @@
 /*
 * Handlers for board audio hooks, splitted from bttv-cards
 *
- * Copyright (c) 2006 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 * This code is placed under the terms of the GNU General Public License
 */
diff --git a/drivers/media/pci/bt8xx/bttv-cards.c b/drivers/media/pci/bt8xx/bttv-cards.c
index 1902732f90e1..2616243b2c49 100644
--- a/drivers/media/pci/bt8xx/bttv-cards.c
+++ b/drivers/media/pci/bt8xx/bttv-cards.c
@@ -2447,7 +2447,7 @@ struct tvcard bttv_tvcards[] = {
        },
                /* ---- card 0x88---------------------------------- */
        [BTTV_BOARD_ACORP_Y878F] = {
-                /* Mauro Carvalho Chehab <mchehab@infradead.org> */
+                /* Mauro Carvalho Chehab <mchehab@kernel.org> */
                .name           = "Acorp Y878F",
                .video_inputs   = 3,
                /* .audio_inputs= 1, */
@@ -2688,7 +2688,7 @@ struct tvcard bttv_tvcards[] = {
        },
        [BTTV_BOARD_ENLTV_FM_2] = {
                /* Encore TV Tuner Pro ENL TV-FM-2
-                   Mauro Carvalho Chehab <mchehab@infradead.org */
+                   Mauro Carvalho Chehab <mchehab@kernel.org> */
                .name           = "Encore ENL TV-FM-2",
                .video_inputs   = 3,
                /* .audio_inputs= 1, */
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index 707f57a9f940..de3f44b8dec6 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -13,7 +13,7 @@
    (c) 2005-2006 Nickolay V. Shmyrev <nshmyrev@yandex.ru>
    Fixes to be fully V4L2 compliant by
-    (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+    (c) 2006 Mauro Carvalho Chehab <mchehab@kernel.org>
    Cropping and overscan support
    Copyright (C) 2005, 2006 Michael H. Schimek <mschimek@gmx.at>
diff --git a/drivers/media/pci/bt8xx/bttv-i2c.c b/drivers/media/pci/bt8xx/bttv-i2c.c
index eccd1e3d717a..c76823eb399d 100644
--- a/drivers/media/pci/bt8xx/bttv-i2c.c
+++ b/drivers/media/pci/bt8xx/bttv-i2c.c
@@ -8,7 +8,7 @@
                           & Marcus Metzler (mocm@thp.uni-koeln.de)
    (c) 1999-2003 Gerd Knorr <kraxel@bytesex.org>
-    (c) 2005 Mauro Carvalho Chehab <mchehab@infradead.org>
+    (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
        - Multituner support and i2c address binding
    This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/pci/cx23885/cx23885-input.c b/drivers/media/pci/cx23885/cx23885-input.c
index be49589a61d2..395ff9bba759 100644
--- a/drivers/media/pci/cx23885/cx23885-input.c
+++ b/drivers/media/pci/cx23885/cx23885-input.c
@@ -13,7 +13,7 @@
 *  Copyright (C) 2008 <srinivasa.deevi at conexant dot com>
 *  Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 *                     Markus Rechberger <mrechberger@gmail.com>
- *                     Mauro Carvalho Chehab <mchehab@infradead.org>
+ *                     Mauro Carvalho Chehab <mchehab@kernel.org>
 *                     Sascha Sommer <saschasommer@freenet.de>
 *  Copyright (C) 2004, 2005 Chris Pascoe
 *  Copyright (C) 2003, 2004 Gerd Knorr
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index ab09bb55cf45..8a28fda703a2 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -4,7 +4,7 @@
 *
 *    (c) 2007 Trent Piepho <xyzzy@speakeasy.org>
 *    (c) 2005,2006 Ricardo Cerqueira <v4l@cerqueira.org>
- *    (c) 2005 Mauro Carvalho Chehab <mchehab@infradead.org>
+ *    (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
 *    Based on a dummy cx88 module by Gerd Knorr <kraxel@bytesex.org>
 *    Based on dummy.c by Jaroslav Kysela <perex@perex.cz>
 *
@@ -103,7 +103,7 @@ MODULE_PARM_DESC(index, "Index value for cx88x capture interface(s).");
 MODULE_DESCRIPTION("ALSA driver module for cx2388x based TV cards");
 MODULE_AUTHOR("Ricardo Cerqueira");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(CX88_VERSION);
diff --git a/drivers/media/pci/cx88/cx88-blackbird.c b/drivers/media/pci/cx88/cx88-blackbird.c
index 0e0952e60795..7a4876cf9f08 100644
--- a/drivers/media/pci/cx88/cx88-blackbird.c
+++ b/drivers/media/pci/cx88/cx88-blackbird.c
@@ -5,7 +5,7 @@
 *    (c) 2004 Jelle Foks <jelle@foks.us>
 *    (c) 2004 Gerd Knorr <kraxel@bytesex.org>
 *
- *    (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ *    (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 *        - video_ioctl2 conversion
 *
 *  Includes parts from the ivtv driver <http://sourceforge.net/projects/ivtv/>
diff --git a/drivers/media/pci/cx88/cx88-core.c b/drivers/media/pci/cx88/cx88-core.c
index 8bfa5b7ed91b..60988e95b637 100644
--- a/drivers/media/pci/cx88/cx88-core.c
+++ b/drivers/media/pci/cx88/cx88-core.c
@@ -4,7 +4,7 @@
 *
 * (c) 2003 Gerd Knorr <kraxel@bytesex.org> [SuSE Labs]
 *
- * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 *     - Multituner support
 *     - video_ioctl2 conversion
 *     - PAL/M fixes
diff --git a/drivers/media/pci/cx88/cx88-i2c.c b/drivers/media/pci/cx88/cx88-i2c.c
index f7692775fb5a..99f88a05a7c9 100644
--- a/drivers/media/pci/cx88/cx88-i2c.c
+++ b/drivers/media/pci/cx88/cx88-i2c.c
@@ -8,7 +8,7 @@
 * (c) 2002 Yurij Sysoev <yurij@naturesoft.net>
 * (c) 1999-2003 Gerd Knorr <kraxel@bytesex.org>
 *
- * (c) 2005 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
 *      - Multituner support and i2c address binding
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 9be682cdb644..7b113bad70d2 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -5,7 +5,7 @@
 *
 * (c) 2003-04 Gerd Knorr <kraxel@bytesex.org> [SuSE Labs]
 *
- * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * (c) 2005-2006 Mauro Carvalho Chehab <mchehab@kernel.org>
 *      - Multituner support
 *      - video_ioctl2 conversion
 *      - PAL/M fixes
diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
index 5ef635e72e10..4c52ac6d8bc5 100644
--- a/drivers/media/radio/radio-aimslab.c
+++ b/drivers/media/radio/radio-aimslab.c
@@ -4,7 +4,7 @@
 * Copyright 1997 M. Kirkwood
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 * Converted to new API by Alan Cox <alan@lxorguk.ukuu.org.uk>
 * Various bugfixes and enhancements by Russell Kroll <rkroll@exploits.org>
 *
diff --git a/drivers/media/radio/radio-aztech.c b/drivers/media/radio/radio-aztech.c
index 9e12c6027359..840b7d60462b 100644
--- a/drivers/media/radio/radio-aztech.c
+++ b/drivers/media/radio/radio-aztech.c
@@ -2,7 +2,7 @@
 * radio-aztech.c - Aztech radio card driver
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@xs4all.nl>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 * Adapted to support the Video for Linux API by
 * Russell Kroll <rkroll@exploits.org>.  Based on original tuner code by:
 *
diff --git a/drivers/media/radio/radio-gemtek.c b/drivers/media/radio/radio-gemtek.c
index 3ff4c4e1435f..f051f8694ab9 100644
--- a/drivers/media/radio/radio-gemtek.c
+++ b/drivers/media/radio/radio-gemtek.c
@@ -15,7 +15,7 @@
 *    Various bugfixes and enhancements by Russell Kroll <rkroll@exploits.org>
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Note: this card seems to swap the left and right audio channels!
 *
diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
index 95f06f3b35dc..e4e758739246 100644
--- a/drivers/media/radio/radio-maxiradio.c
+++ b/drivers/media/radio/radio-maxiradio.c
@@ -27,7 +27,7 @@
 * BUGS:
 *   - card unmutes if you change frequency
 *
- * (c) 2006, 2007 by Mauro Carvalho Chehab <mchehab@infradead.org>:
+ * (c) 2006, 2007 by Mauro Carvalho Chehab <mchehab@kernel.org>:
 *      - Conversion to V4L2 API
 *      - Uses video_ioctl2 for parsing and to add debug support
 */
diff --git a/drivers/media/radio/radio-rtrack2.c b/drivers/media/radio/radio-rtrack2.c
index abeaedd8d437..5a1470eb753e 100644
--- a/drivers/media/radio/radio-rtrack2.c
+++ b/drivers/media/radio/radio-rtrack2.c
@@ -7,7 +7,7 @@
 * Various bugfixes and enhancements by Russell Kroll <rkroll@exploits.org>
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Fully tested with actual hardware and the v4l2-compliance tool.
 */
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index fc4e63d36e4c..4f9b97edd9eb 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -13,7 +13,7 @@
 *  No volume control - only mute/unmute - you have to use line volume
 *  control on SB-part of SF16-FMI/SF16-FMP/SF16-FMD
 *
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/kernel.h>       /* __setup                      */
diff --git a/drivers/media/radio/radio-terratec.c b/drivers/media/radio/radio-terratec.c
index 4f116ea294fb..1af8f29cc7d1 100644
--- a/drivers/media/radio/radio-terratec.c
+++ b/drivers/media/radio/radio-terratec.c
@@ -17,7 +17,7 @@
 *  Volume Control is done digitally
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/module.h>       /* Modules                      */
diff --git a/drivers/media/radio/radio-trust.c b/drivers/media/radio/radio-trust.c
index 26a8c6002121..a4bad322ffff 100644
--- a/drivers/media/radio/radio-trust.c
+++ b/drivers/media/radio/radio-trust.c
@@ -12,7 +12,7 @@
 * Scott McGrath    (smcgrath@twilight.vtc.vsc.edu)
 * William McGrath  (wmcgrath@twilight.vtc.vsc.edu)
 *
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <stdarg.h>
diff --git a/drivers/media/radio/radio-typhoon.c b/drivers/media/radio/radio-typhoon.c
index eb72a4d13758..d0d67ad85b8f 100644
--- a/drivers/media/radio/radio-typhoon.c
+++ b/drivers/media/radio/radio-typhoon.c
@@ -25,7 +25,7 @@
 * The frequency change is necessary since the card never seems to be
 * completely silent.
 *
- * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/module.h>       /* Modules                        */
diff --git a/drivers/media/radio/radio-zoltrix.c b/drivers/media/radio/radio-zoltrix.c
index 026e88eef29c..6007cd09b328 100644
--- a/drivers/media/radio/radio-zoltrix.c
+++ b/drivers/media/radio/radio-zoltrix.c
@@ -27,7 +27,7 @@
 * 2002-07-15 - Fix Stereo typo
 *
 * 2006-07-24 - Converted to V4L2 API
- *              by Mauro Carvalho Chehab <mchehab@infradead.org>
+ *              by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Converted to the radio-isa framework by Hans Verkuil <hans.verkuil@cisco.com>
 *
diff --git a/drivers/media/rc/keymaps/rc-avermedia-m135a.c b/drivers/media/rc/keymaps/rc-avermedia-m135a.c
index f6977df1a75b..d275d98d066a 100644
--- a/drivers/media/rc/keymaps/rc-avermedia-m135a.c
+++ b/drivers/media/rc/keymaps/rc-avermedia-m135a.c
@@ -12,7 +12,7 @@
 *
 * On Avermedia M135A with IR model RM-JX, the same codes exist on both
 * Positivo (BR) and original IR, initial version and remote control codes
- * added by Mauro Carvalho Chehab <mchehab@infradead.org>
+ * added by Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Positivo also ships Avermedia M135A with model RM-K6, extra control
 * codes added by Herton Ronaldo Krzesinski <herton@mandriva.com.br>
diff --git a/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c b/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c
index e4e78c1f4123..057c13b765ef 100644
--- a/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c
+++ b/drivers/media/rc/keymaps/rc-encore-enltv-fm53.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Encore ENLTV-FM v5.3
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 static struct rc_map_table encore_enltv_fm53[] = {
diff --git a/drivers/media/rc/keymaps/rc-encore-enltv2.c b/drivers/media/rc/keymaps/rc-encore-enltv2.c
index c3d4437a6fda..cd0555924456 100644
--- a/drivers/media/rc/keymaps/rc-encore-enltv2.c
+++ b/drivers/media/rc/keymaps/rc-encore-enltv2.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Encore ENLTV2-FM  - silver plastic - "Wand Media" written at the botton
-    Mauro Carvalho Chehab <mchehab@infradead.org> */
+    Mauro Carvalho Chehab <mchehab@kernel.org> */
 static struct rc_map_table encore_enltv2[] = {
        { 0x4c, KEY_POWER2 },
diff --git a/drivers/media/rc/keymaps/rc-kaiomy.c b/drivers/media/rc/keymaps/rc-kaiomy.c
index f0f88df18606..a00051339842 100644
--- a/drivers/media/rc/keymaps/rc-kaiomy.c
+++ b/drivers/media/rc/keymaps/rc-kaiomy.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Kaiomy TVnPC U2
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 static struct rc_map_table kaiomy[] = {
diff --git a/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c b/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c
index 453e04377de7..db5edde3eeb1 100644
--- a/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c
+++ b/drivers/media/rc/keymaps/rc-kworld-plus-tv-analog.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /* Kworld Plus TV Analog Lite PCI IR
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 static struct rc_map_table kworld_plus_tv_analog[] = {
diff --git a/drivers/media/rc/keymaps/rc-pixelview-new.c b/drivers/media/rc/keymaps/rc-pixelview-new.c
index 791130f108ff..e4e34f2ccf74 100644
--- a/drivers/media/rc/keymaps/rc-pixelview-new.c
+++ b/drivers/media/rc/keymaps/rc-pixelview-new.c
@@ -9,7 +9,7 @@
 #include <linux/module.h>
 /*
-   Mauro Carvalho Chehab <mchehab@infradead.org>
+   Mauro Carvalho Chehab <mchehab@kernel.org>
   present on PV MPEG 8000GT
 */
diff --git a/drivers/media/tuners/tea5761.c b/drivers/media/tuners/tea5761.c
index 88b3e80c38ad..d78a2bdb3e36 100644
--- a/drivers/media/tuners/tea5761.c
+++ b/drivers/media/tuners/tea5761.c
@@ -2,7 +2,7 @@
 // For Philips TEA5761 FM Chip
 // I2C address is always 0x20 (0x10 at 7-bit mode).
 //
-// Copyright (c) 2005-2007 Mauro Carvalho Chehab (mchehab@infradead.org)
+// Copyright (c) 2005-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 #include <linux/i2c.h>
 #include <linux/slab.h>
@@ -337,5 +337,5 @@ EXPORT_SYMBOL_GPL(tea5761_attach);
 EXPORT_SYMBOL_GPL(tea5761_autodetection);
 MODULE_DESCRIPTION("Philips TEA5761 FM tuner driver");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/tuners/tea5767.c b/drivers/media/tuners/tea5767.c
index 2b2c064d7dc3..016d0d5ec50b 100644
--- a/drivers/media/tuners/tea5767.c
+++ b/drivers/media/tuners/tea5767.c
@@ -2,7 +2,7 @@
 // For Philips TEA5767 FM Chip used on some TV Cards like Prolink Pixelview
 // I2C address is always 0xC0.
 //
-// Copyright (c) 2005 Mauro Carvalho Chehab (mchehab@infradead.org)
+// Copyright (c) 2005 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // tea5767 autodetection thanks to Torsten Seeboth and Atsushi Nakagawa
 // from their contributions on DScaler.
@@ -469,5 +469,5 @@ EXPORT_SYMBOL_GPL(tea5767_attach);
 EXPORT_SYMBOL_GPL(tea5767_autodetection);
 MODULE_DESCRIPTION("Philips TEA5767 FM tuner driver");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/tuners/tuner-xc2028-types.h b/drivers/media/tuners/tuner-xc2028-types.h
index bb0437c36c03..50d017a4822a 100644
--- a/drivers/media/tuners/tuner-xc2028-types.h
+++ b/drivers/media/tuners/tuner-xc2028-types.h
@@ -5,7 +5,7 @@
 * This file includes internal tipes to be used inside tuner-xc2028.
 * Shouldn't be included outside tuner-xc2028
 *
- * Copyright (c) 2007-2008 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2007-2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 /* xc3028 firmware types */
diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
index fca85e08ebd7..84744e138982 100644
--- a/drivers/media/tuners/tuner-xc2028.c
+++ b/drivers/media/tuners/tuner-xc2028.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tuner-xc2028
 //
-// Copyright (c) 2007-2008 Mauro Carvalho Chehab (mchehab@infradead.org)
+// Copyright (c) 2007-2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig (michel.ludwig@gmail.com)
 //       - frontend interface
@@ -1518,7 +1518,7 @@ EXPORT_SYMBOL(xc2028_attach);
 MODULE_DESCRIPTION("Xceive xc2028/xc3028 tuner driver");
 MODULE_AUTHOR("Michel Ludwig <michel.ludwig@gmail.com>");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
 MODULE_FIRMWARE(XC2028_DEFAULT_FIRMWARE);
 MODULE_FIRMWARE(XC3028L_DEFAULT_FIRMWARE);
diff --git a/drivers/media/tuners/tuner-xc2028.h b/drivers/media/tuners/tuner-xc2028.h
index 03fd6d4233a4..7b58bc06e35c 100644
--- a/drivers/media/tuners/tuner-xc2028.h
+++ b/drivers/media/tuners/tuner-xc2028.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tuner-xc2028
 *
- * Copyright (c) 2007-2008 Mauro Carvalho Chehab (mchehab@infradead.org)
+ * Copyright (c) 2007-2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #ifndef __TUNER_XC2028_H__
diff --git a/drivers/media/usb/em28xx/em28xx-camera.c b/drivers/media/usb/em28xx/em28xx-camera.c
index 3c2694a16ed1..d1e66b503f4d 100644
--- a/drivers/media/usb/em28xx/em28xx-camera.c
+++ b/drivers/media/usb/em28xx/em28xx-camera.c
@@ -2,7 +2,7 @@
 //
 // em28xx-camera.c - driver for Empia EM25xx/27xx/28xx USB video capture devices
 //
-// Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (C) 2009 Mauro Carvalho Chehab <mchehab@kernel.org>
 // Copyright (C) 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
 // This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 6e0e67d23876..7c3203d7044b 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -5,7 +5,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 36d341fb65dd..f28995383090 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -4,7 +4,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
@@ -32,7 +32,7 @@
 #define DRIVER_AUTHOR "Ludovico Cavedon <cavedon@sssup.it>, " \
                      "Markus Rechberger <mrechberger@gmail.com>, " \
-                      "Mauro Carvalho Chehab <mchehab@infradead.org>, " \
+                      "Mauro Carvalho Chehab <mchehab@kernel.org>, " \
                      "Sascha Sommer <saschasommer@freenet.de>"
 MODULE_AUTHOR(DRIVER_AUTHOR);
diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
index a54cb8dc52c9..3f493e0b0716 100644
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -2,7 +2,7 @@
 //
 // DVB device driver for em28xx
 //
-// (c) 2008-2011 Mauro Carvalho Chehab <mchehab@infradead.org>
+// (c) 2008-2011 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // (c) 2008 Devin Heitmueller <devin.heitmueller@gmail.com>
 //      - Fixes for the driver to properly work with HVR-950
@@ -63,7 +63,7 @@
 #include "tc90522.h"
 #include "qm1d1c0042.h"
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION(DRIVER_DESC " - digital TV interface");
 MODULE_VERSION(EM28XX_VERSION);
diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
index 9151bccd859a..6458682bc6e2 100644
--- a/drivers/media/usb/em28xx/em28xx-i2c.c
+++ b/drivers/media/usb/em28xx/em28xx-i2c.c
@@ -4,7 +4,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 2dc1be00b8b8..f84a1208d5d3 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -4,7 +4,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 //
 // This program is free software; you can redistribute it and/or modify
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index d70ee13cc52e..68571bf36d28 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -5,7 +5,7 @@
 //
 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
 //                    Markus Rechberger <mrechberger@gmail.com>
-//                    Mauro Carvalho Chehab <mchehab@infradead.org>
+//                    Mauro Carvalho Chehab <mchehab@kernel.org>
 //                    Sascha Sommer <saschasommer@freenet.de>
 // Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 //
@@ -44,7 +44,7 @@
 #define DRIVER_AUTHOR "Ludovico Cavedon <cavedon@sssup.it>, " \
                      "Markus Rechberger <mrechberger@gmail.com>, " \
-                      "Mauro Carvalho Chehab <mchehab@infradead.org>, " \
+                      "Mauro Carvalho Chehab <mchehab@kernel.org>, " \
                      "Sascha Sommer <saschasommer@freenet.de>"
 static unsigned int isoc_debug;
diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
index 63c7c6124707..b0378e77ddff 100644
--- a/drivers/media/usb/em28xx/em28xx.h
+++ b/drivers/media/usb/em28xx/em28xx.h
@@ -4,7 +4,7 @@
 *
 * Copyright (C) 2005 Markus Rechberger <mrechberger@gmail.com>
 *                    Ludovico Cavedon <cavedon@sssup.it>
- *                    Mauro Carvalho Chehab <mchehab@infradead.org>
+ *                    Mauro Carvalho Chehab <mchehab@kernel.org>
 * Copyright (C) 2012 Frank Schäfer <fschaefer.oss@googlemail.com>
 *
 * Based on the em2800 driver from Sascha Sommer <saschasommer@freenet.de>
diff --git a/drivers/media/usb/gspca/zc3xx-reg.h b/drivers/media/usb/gspca/zc3xx-reg.h
index a1bd94e8ce52..71fda38e85e0 100644
--- a/drivers/media/usb/gspca/zc3xx-reg.h
+++ b/drivers/media/usb/gspca/zc3xx-reg.h
@@ -1,7 +1,7 @@
 /*
 * zc030x registers
 *
- * Copyright (c) 2008 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2008 Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * The register aliases used here came from this driver:
 *      http://zc0302.sourceforge.net/zc0302.php
diff --git a/drivers/media/usb/tm6000/tm6000-cards.c b/drivers/media/usb/tm6000/tm6000-cards.c
index 70939e96b856..23df50aa0a4a 100644
--- a/drivers/media/usb/tm6000/tm6000-cards.c
+++ b/drivers/media/usb/tm6000/tm6000-cards.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-cards.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 #include <linux/init.h>
 #include <linux/module.h>
diff --git a/drivers/media/usb/tm6000/tm6000-core.c b/drivers/media/usb/tm6000/tm6000-core.c
index 23a1332d98e6..d3229aa45fcb 100644
--- a/drivers/media/usb/tm6000/tm6000-core.c
+++ b/drivers/media/usb/tm6000/tm6000-core.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-core.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 //     - DVB-T support
diff --git a/drivers/media/usb/tm6000/tm6000-i2c.c b/drivers/media/usb/tm6000/tm6000-i2c.c
index c9a62bbff27a..659b63febf85 100644
--- a/drivers/media/usb/tm6000/tm6000-i2c.c
+++ b/drivers/media/usb/tm6000/tm6000-i2c.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-i2c.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 //      - Fix SMBus Read Byte command
diff --git a/drivers/media/usb/tm6000/tm6000-regs.h b/drivers/media/usb/tm6000/tm6000-regs.h
index 21587fcf11e3..d10424673db9 100644
--- a/drivers/media/usb/tm6000/tm6000-regs.h
+++ b/drivers/media/usb/tm6000/tm6000-regs.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tm6000-regs.h - driver for TM5600/TM6000/TM6010 USB video capture devices
 *
- * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 /*
diff --git a/drivers/media/usb/tm6000/tm6000-usb-isoc.h b/drivers/media/usb/tm6000/tm6000-usb-isoc.h
index 5c615b0a7a46..b275dbce3a1b 100644
--- a/drivers/media/usb/tm6000/tm6000-usb-isoc.h
+++ b/drivers/media/usb/tm6000/tm6000-usb-isoc.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tm6000-buf.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 *
- * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 */
 #include <linux/videodev2.h>
diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index b2399d4266da..aa85fe31c835 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // tm6000-video.c - driver for TM5600/TM6000/TM6010 USB video capture devices
 //
-// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+// Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 //
 // Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 //      - Fixed module load/unload
diff --git a/drivers/media/usb/tm6000/tm6000.h b/drivers/media/usb/tm6000/tm6000.h
index e1e45770e28d..0864ed7314eb 100644
--- a/drivers/media/usb/tm6000/tm6000.h
+++ b/drivers/media/usb/tm6000/tm6000.h
@@ -2,7 +2,7 @@
 * SPDX-License-Identifier: GPL-2.0
 * tm6000.h - driver for TM5600/TM6000/TM6010 USB video capture devices
 *
- * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@infradead.org>
+ * Copyright (c) 2006-2007 Mauro Carvalho Chehab <mchehab@kernel.org>
 *
 * Copyright (c) 2007 Michel Ludwig <michel.ludwig@gmail.com>
 *      - DVB-T support
diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index 1d0b2208e8fb..c080dcc75393 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -10,7 +10,7 @@
 *      2 of the License, or (at your option) any later version.
 *
 * Authors:     Alan Cox, <alan@lxorguk.ukuu.org.uk> (version 1)
- *              Mauro Carvalho Chehab <mchehab@infradead.org> (version 2)
+ *              Mauro Carvalho Chehab <mchehab@kernel.org> (version 2)
 *
 * Fixes:       20000516  Claudio Matsuoka <claudio@conectiva.com>
 *              - Added procfs support
@@ -1072,7 +1072,7 @@ static void __exit videodev_exit(void)
 subsys_initcall(videodev_init);
 module_exit(videodev_exit)
-MODULE_AUTHOR("Alan Cox, Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Alan Cox, Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_DESCRIPTION("Device registrar for Video4Linux drivers v2");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CHARDEV_MAJOR(VIDEO_MAJOR);
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index f48c505550e0..de5d96dbe69e 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -9,7 +9,7 @@
 * 2 of the License, or (at your option) any later version.
 *
 * Authors:     Alan Cox, <alan@lxorguk.ukuu.org.uk> (version 1)
- *              Mauro Carvalho Chehab <mchehab@infradead.org> (version 2)
+ *              Mauro Carvalho Chehab <mchehab@kernel.org> (version 2)
 */
 #include <linux/mm.h>
diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
index 2b3981842b4b..7491b337002c 100644
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -1,11 +1,11 @@
 /*
 * generic helper functions for handling video4linux capture buffers
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
@@ -38,7 +38,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_DESCRIPTION("helper module to manage video4linux buffers");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 #define dprintk(level, fmt, arg...)                                     \
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
index e02353e340dd..f46132504d88 100644
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -7,7 +7,7 @@
 * Copyright (c) 2008 Magnus Damm
 *
 * Based on videobuf-vmalloc.c,
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index add2edb23eac..7770034aae28 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -6,11 +6,11 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
@@ -48,7 +48,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_DESCRIPTION("helper module to manage video4linux dma sg buffers");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 #define dprintk(level, fmt, arg...)                                     \
diff --git a/drivers/media/v4l2-core/videobuf-vmalloc.c b/drivers/media/v4l2-core/videobuf-vmalloc.c
index 2ff7fcc77b11..45fe781aeeec 100644
--- a/drivers/media/v4l2-core/videobuf-vmalloc.c
+++ b/drivers/media/v4l2-core/videobuf-vmalloc.c
@@ -6,7 +6,7 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -41,7 +41,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_DESCRIPTION("helper module to manage video4linux vmalloc buffers");
-MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
 MODULE_LICENSE("GPL");
 #define dprintk(level, fmt, arg...)                                     \
diff --git a/drivers/mtd/nand/onenand/omap2.c b/drivers/mtd/nand/onenand/omap2.c
index 9c159f0dd9a6..321137158ff3 100644
--- a/drivers/mtd/nand/onenand/omap2.c
+++ b/drivers/mtd/nand/onenand/omap2.c
@@ -375,56 +375,42 @@ static int omap2_onenand_read_bufferram(struct mtd_info *mtd, int area,
 {
        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
        struct onenand_chip *this = mtd->priv;
-        dma_addr_t dma_src, dma_dst;
+        struct device *dev = &c->pdev->dev;
-        int bram_offset;
        void *buf = (void *)buffer;
+        dma_addr_t dma_src, dma_dst;
+        int bram_offset, err;
        size_t xtra;
-        int ret;
        bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset;
-        if (bram_offset & 3 || (size_t)buf & 3 || count < 384)
+        /*
-                goto out_copy;
+         * If the buffer address is not DMA-able, len is not long enough to make
+         * DMA transfers profitable or panic_write() may be in an interrupt
-        /* panic_write() may be in an interrupt context */
+         * context fallback to PIO mode.
-        if (in_interrupt() || oops_in_progress)
+         */
+        if (!virt_addr_valid(buf) || bram_offset & 3 || (size_t)buf & 3 ||
+            count < 384 || in_interrupt() || oops_in_progress )
                goto out_copy;
-        if (buf >= high_memory) {
-                struct page *p1;
-                if (((size_t)buf & PAGE_MASK) !=
-                    ((size_t)(buf + count - 1) & PAGE_MASK))
-                        goto out_copy;
-                p1 = vmalloc_to_page(buf);
-                if (!p1)
-                        goto out_copy;
-                buf = page_address(p1) + ((size_t)buf & ~PAGE_MASK);
-        }
        xtra = count & 3;
        if (xtra) {
                count -= xtra;
                memcpy(buf + count, this->base + bram_offset + count, xtra);
        }
+        dma_dst = dma_map_single(dev, buf, count, DMA_FROM_DEVICE);
        dma_src = c->phys_base + bram_offset;
-        dma_dst = dma_map_single(&c->pdev->dev, buf, count, DMA_FROM_DEVICE);
-        if (dma_mapping_error(&c->pdev->dev, dma_dst)) {
-                dev_err(&c->pdev->dev,
-                        "Couldn't DMA map a %d byte buffer\n",
-                        count);
-                goto out_copy;
-        }
-        ret = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count);
+        if (dma_mapping_error(dev, dma_dst)) {
-        dma_unmap_single(&c->pdev->dev, dma_dst, count, DMA_FROM_DEVICE);
+                dev_err(dev, "Couldn't DMA map a %d byte buffer\n", count);
-        if (ret) {
-                dev_err(&c->pdev->dev, "timeout waiting for DMA\n");
                goto out_copy;
        }
-        return 0;
+        err = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count);
+        dma_unmap_single(dev, dma_dst, count, DMA_FROM_DEVICE);
+        if (!err)
+                return 0;
+        dev_err(dev, "timeout waiting for DMA\n");
 out_copy:
        memcpy(buf, this->base + bram_offset, count);
@@ -437,49 +423,34 @@ static int omap2_onenand_write_bufferram(struct mtd_info *mtd, int area,
 {
        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
        struct onenand_chip *this = mtd->priv;
-        dma_addr_t dma_src, dma_dst;
+        struct device *dev = &c->pdev->dev;
-        int bram_offset;
        void *buf = (void *)buffer;
-        int ret;
+        dma_addr_t dma_src, dma_dst;
+        int bram_offset, err;
        bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset;
-        if (bram_offset & 3 || (size_t)buf & 3 || count < 384)
+        /*
-                goto out_copy;
+         * If the buffer address is not DMA-able, len is not long enough to make
+         * DMA transfers profitable or panic_write() may be in an interrupt
-        /* panic_write() may be in an interrupt context */
+         * context fallback to PIO mode.
-        if (in_interrupt() || oops_in_progress)
+         */
+        if (!virt_addr_valid(buf) || bram_offset & 3 || (size_t)buf & 3 ||
+            count < 384 || in_interrupt() || oops_in_progress )
                goto out_copy;
-        if (buf >= high_memory) {
+        dma_src = dma_map_single(dev, buf, count, DMA_TO_DEVICE);
-                struct page *p1;
-                if (((size_t)buf & PAGE_MASK) !=
-                    ((size_t)(buf + count - 1) & PAGE_MASK))
-                        goto out_copy;
-                p1 = vmalloc_to_page(buf);
-                if (!p1)
-                        goto out_copy;
-                buf = page_address(p1) + ((size_t)buf & ~PAGE_MASK);
-        }
-        dma_src = dma_map_single(&c->pdev->dev, buf, count, DMA_TO_DEVICE);
        dma_dst = c->phys_base + bram_offset;
-        if (dma_mapping_error(&c->pdev->dev, dma_src)) {
+        if (dma_mapping_error(dev, dma_src)) {
-                dev_err(&c->pdev->dev,
+                dev_err(dev, "Couldn't DMA map a %d byte buffer\n", count);
-                        "Couldn't DMA map a %d byte buffer\n",
-                        count);
-                return -1;
-        }
-        ret = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count);
-        dma_unmap_single(&c->pdev->dev, dma_src, count, DMA_TO_DEVICE);
-        if (ret) {
-                dev_err(&c->pdev->dev, "timeout waiting for DMA\n");
                goto out_copy;
        }
-        return 0;
+        err = omap2_onenand_dma_transfer(c, dma_src, dma_dst, count);
+        dma_unmap_page(dev, dma_src, count, DMA_TO_DEVICE);
+        if (!err)
+                return 0;
+        dev_err(dev, "timeout waiting for DMA\n");
 out_copy:
        memcpy(this->base + bram_offset, buf, count);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 1d779a35ac8e..db5ec4e8bde9 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1074,7 +1074,7 @@ static int marvell_nfc_hw_ecc_hmg_do_write_page(struct nand_chip *chip,
                return ret;
        ret = marvell_nfc_wait_op(chip,
-                                  chip->data_interface.timings.sdr.tPROG_max);
+                                  PSEC_TO_MSEC(chip->data_interface.timings.sdr.tPROG_max));
        return ret;
 }
@@ -1408,6 +1408,7 @@ marvell_nfc_hw_ecc_bch_write_chunk(struct nand_chip *chip, int chunk,
        struct marvell_nand_chip *marvell_nand = to_marvell_nand(chip);
        struct marvell_nfc *nfc = to_marvell_nfc(chip->controller);
        const struct marvell_hw_ecc_layout *lt = to_marvell_nand(chip)->layout;
+        u32 xtype;
        int ret;
        struct marvell_nfc_op nfc_op = {
                .ndcb[0] = NDCB0_CMD_TYPE(TYPE_WRITE) | NDCB0_LEN_OVRD,
@@ -1423,7 +1424,12 @@ marvell_nfc_hw_ecc_bch_write_chunk(struct nand_chip *chip, int chunk,
         * last naked write.
         */
        if (chunk == 0) {
-                nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(XTYPE_WRITE_DISPATCH) |
+                if (lt->nchunks == 1)
+                        xtype = XTYPE_MONOLITHIC_RW;
+                else
+                        xtype = XTYPE_WRITE_DISPATCH;
+                nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(xtype) |
                                  NDCB0_ADDR_CYC(marvell_nand->addr_cyc) |
                                  NDCB0_CMD1(NAND_CMD_SEQIN);
                nfc_op.ndcb[1] |= NDCB1_ADDRS_PAGE(page);
@@ -1494,7 +1500,7 @@ static int marvell_nfc_hw_ecc_bch_write_page(struct mtd_info *mtd,
        }
        ret = marvell_nfc_wait_op(chip,
-                                  chip->data_interface.timings.sdr.tPROG_max);
+                                  PSEC_TO_MSEC(chip->data_interface.timings.sdr.tPROG_max));
        marvell_nfc_disable_hw_ecc(chip);
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index 72f3a89da513..f28c3a555861 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -706,12 +706,17 @@ static void nand_wait_status_ready(struct mtd_info *mtd, unsigned long timeo)
 */
 int nand_soft_waitrdy(struct nand_chip *chip, unsigned long timeout_ms)
 {
+        const struct nand_sdr_timings *timings;
        u8 status = 0;
        int ret;
        if (!chip->exec_op)
                return -ENOTSUPP;
+        /* Wait tWB before polling the STATUS reg. */
+        timings = nand_get_sdr_timings(&chip->data_interface);
+        ndelay(PSEC_TO_NSEC(timings->tWB_max));
        ret = nand_status_op(chip, NULL);
        if (ret)
                return ret;
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 601f67872e58..a8f60982d483 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -450,7 +450,7 @@ static void rlb_update_client(struct rlb_client_info *client_info)
 {
        int i;
-        if (!client_info->slave)
+        if (!client_info->slave || !is_valid_ether_addr(client_info->mac_dst))
                return;
        for (i = 0; i < RLB_ARP_BURST_SIZE; i++) {
@@ -943,6 +943,10 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[],
        skb->priority = TC_PRIO_CONTROL;
        skb->dev = slave->dev;
+        netdev_dbg(slave->bond->dev,
+                   "Send learning packet: dev %s mac %pM vlan %d\n",
+                   slave->dev->name, mac_addr, vid);
        if (vid)
                __vlan_hwaccel_put_tag(skb, vlan_proto, vid);
@@ -965,14 +969,13 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data)
        u8 *mac_addr = data->mac_addr;
        struct bond_vlan_tag *tags;
-        if (is_vlan_dev(upper) && vlan_get_encap_level(upper) == 0) {
+        if (is_vlan_dev(upper) &&
-                if (strict_match &&
+            bond->nest_level == vlan_get_encap_level(upper) - 1) {
-                    ether_addr_equal_64bits(mac_addr,
+                if (upper->addr_assign_type == NET_ADDR_STOLEN) {
-                                            upper->dev_addr)) {
                        alb_send_lp_vid(slave, mac_addr,
                                        vlan_dev_vlan_proto(upper),
                                        vlan_dev_vlan_id(upper));
-                } else if (!strict_match) {
+                } else {
                        alb_send_lp_vid(slave, upper->dev_addr,
                                        vlan_dev_vlan_proto(upper),
                                        vlan_dev_vlan_id(upper));
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 966d09183744..4176e1d95f47 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1738,6 +1738,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
        if (bond_mode_uses_xmit_hash(bond))
                bond_update_slave_arr(bond, NULL);
+        bond->nest_level = dev_get_nest_level(bond_dev);
        netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n",
                    slave_dev->name,
                    bond_is_active_slave(new_slave) ? "an active" : "a backup",
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index b1779566c5bb..3c71f1cb205f 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -605,7 +605,7 @@ void can_bus_off(struct net_device *dev)
 {
        struct can_priv *priv = netdev_priv(dev);
-        netdev_dbg(dev, "bus-off\n");
+        netdev_info(dev, "bus-off\n");
        netif_carrier_off(dev);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 634c51e6b8ae..d53a45bf2a72 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -200,6 +200,7 @@
 #define FLEXCAN_QUIRK_DISABLE_MECR      BIT(4) /* Disable Memory error detection */
 #define FLEXCAN_QUIRK_USE_OFF_TIMESTAMP BIT(5) /* Use timestamp based offloading */
 #define FLEXCAN_QUIRK_BROKEN_PERR_STATE BIT(6) /* No interrupt for error passive */
+#define FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN        BIT(7) /* default to BE register access */
 /* Structure of the message buffer */
 struct flexcan_mb {
@@ -288,6 +289,12 @@ struct flexcan_priv {
 static const struct flexcan_devtype_data fsl_p1010_devtype_data = {
        .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE |
+                FLEXCAN_QUIRK_BROKEN_PERR_STATE |
+                FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN,
+};
+static const struct flexcan_devtype_data fsl_imx25_devtype_data = {
+        .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE |
                FLEXCAN_QUIRK_BROKEN_PERR_STATE,
 };
@@ -1251,9 +1258,9 @@ static void unregister_flexcandev(struct net_device *dev)
 static const struct of_device_id flexcan_of_match[] = {
        { .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, },
        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
-        { .compatible = "fsl,imx53-flexcan", .data = &fsl_p1010_devtype_data, },
+        { .compatible = "fsl,imx53-flexcan", .data = &fsl_imx25_devtype_data, },
-        { .compatible = "fsl,imx35-flexcan", .data = &fsl_p1010_devtype_data, },
+        { .compatible = "fsl,imx35-flexcan", .data = &fsl_imx25_devtype_data, },
-        { .compatible = "fsl,imx25-flexcan", .data = &fsl_p1010_devtype_data, },
+        { .compatible = "fsl,imx25-flexcan", .data = &fsl_imx25_devtype_data, },
        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
        { .compatible = "fsl,vf610-flexcan", .data = &fsl_vf610_devtype_data, },
        { .compatible = "fsl,ls1021ar2-flexcan", .data = &fsl_ls1021a_r2_devtype_data, },
@@ -1337,18 +1344,13 @@ static int flexcan_probe(struct platform_device *pdev)
        priv = netdev_priv(dev);
-        if (of_property_read_bool(pdev->dev.of_node, "big-endian")) {
+        if (of_property_read_bool(pdev->dev.of_node, "big-endian") ||
+            devtype_data->quirks & FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN) {
                priv->read = flexcan_read_be;
                priv->write = flexcan_write_be;
        } else {
-                if (of_device_is_compatible(pdev->dev.of_node,
+                priv->read = flexcan_read_le;
-                                            "fsl,p1010-flexcan")) {
+                priv->write = flexcan_write_le;
-                        priv->read = flexcan_read_be;
-                        priv->write = flexcan_write_be;
-                } else {
-                        priv->read = flexcan_read_le;
-                        priv->write = flexcan_write_le;
-                }
        }
        priv->can.clock.freq = clock_freq;
diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
index 5590c559a8ca..53e320c92a8b 100644
--- a/drivers/net/can/spi/hi311x.c
+++ b/drivers/net/can/spi/hi311x.c
@@ -91,6 +91,7 @@
 #define HI3110_STAT_BUSOFF BIT(2)
 #define HI3110_STAT_ERRP BIT(3)
 #define HI3110_STAT_ERRW BIT(4)
+#define HI3110_STAT_TXMTY BIT(7)
 #define HI3110_BTR0_SJW_SHIFT 6
 #define HI3110_BTR0_BRP_SHIFT 0
@@ -427,8 +428,10 @@ static int hi3110_get_berr_counter(const struct net_device *net,
        struct hi3110_priv *priv = netdev_priv(net);
        struct spi_device *spi = priv->spi;
+        mutex_lock(&priv->hi3110_lock);
        bec->txerr = hi3110_read(spi, HI3110_READ_TEC);
        bec->rxerr = hi3110_read(spi, HI3110_READ_REC);
+        mutex_unlock(&priv->hi3110_lock);
        return 0;
 }
@@ -735,10 +738,7 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)
                        }
                }
-                if (intf == 0)
+                if (priv->tx_len && statf & HI3110_STAT_TXMTY) {
-                        break;
-                if (intf & HI3110_INT_TXCPLT) {
                        net->stats.tx_packets++;
                        net->stats.tx_bytes += priv->tx_len - 1;
                        can_led_event(net, CAN_LED_EVENT_TX);
@@ -748,6 +748,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)
                        }
                        netif_wake_queue(net);
                }
+                if (intf == 0)
+                        break;
        }
        mutex_unlock(&priv->hi3110_lock);
        return IRQ_HANDLED;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 63587b8e6825..daed57d3d209 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -1179,7 +1179,7 @@ static void kvaser_usb_rx_can_msg(const struct kvaser_usb *dev,
        skb = alloc_can_skb(priv->netdev, &cf);
        if (!skb) {
-                stats->tx_dropped++;
+                stats->rx_dropped++;
                return;
        }
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 1cebde80b101..2910f68c0e5c 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3518,6 +3518,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3539,6 +3540,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 0,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3558,6 +3560,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 8,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3579,6 +3582,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3600,6 +3604,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 0,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3620,6 +3625,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 11,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x10,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
@@ -3641,6 +3647,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3662,6 +3669,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 0,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3683,6 +3691,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3705,6 +3714,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 15,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3726,6 +3736,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3748,6 +3759,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 15,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3769,6 +3781,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 0,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3789,6 +3802,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 16,
                .max_vid = 8191,
                .port_base_addr = 0x0,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .tag_protocol = DSA_TAG_PROTO_DSA,
@@ -3811,6 +3825,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 16,
                .max_vid = 8191,
                .port_base_addr = 0x0,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
@@ -3832,6 +3847,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 11,
                .max_vid = 8191,
                .port_base_addr = 0x0,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
@@ -3855,6 +3871,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 15,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3878,6 +3895,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 16,
                .max_vid = 8191,
                .port_base_addr = 0x0,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
@@ -3901,6 +3919,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 15,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3924,6 +3943,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 15,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3946,6 +3966,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 11,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x10,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
@@ -3968,6 +3989,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -3989,6 +4011,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_internal_phys = 5,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -4011,6 +4034,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 15,
                .max_vid = 4095,
                .port_base_addr = 0x10,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 15000,
@@ -4033,6 +4057,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 16,
                .max_vid = 8191,
                .port_base_addr = 0x0,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
@@ -4055,6 +4080,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                .num_gpio = 16,
                .max_vid = 8191,
                .port_base_addr = 0x0,
+                .phy_base_addr = 0x0,
                .global1_addr = 0x1b,
                .global2_addr = 0x1c,
                .age_time_coeff = 3750,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index a1bedb0a888b..8eb5dfe17f5c 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -110,6 +110,7 @@ struct mv88e6xxx_info {
        unsigned int num_gpio;
        unsigned int max_vid;
        unsigned int port_base_addr;
+        unsigned int phy_base_addr;
        unsigned int global1_addr;
        unsigned int global2_addr;
        unsigned int age_time_coeff;
diff --git a/drivers/net/dsa/mv88e6xxx/global2.c b/drivers/net/dsa/mv88e6xxx/global2.c
index e6d658181b27..f9bde011a3e6 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.c
+++ b/drivers/net/dsa/mv88e6xxx/global2.c
@@ -1098,7 +1098,7 @@ int mv88e6xxx_g2_irq_mdio_setup(struct mv88e6xxx_chip *chip,
                        err = irq;
                        goto out;
                }
-                bus->irq[chip->info->port_base_addr + phy] = irq;
+                bus->irq[chip->info->phy_base_addr + phy] = irq;
        }
        return 0;
 out:
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 32f6d2e24d66..1a1a6380c128 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -95,6 +95,7 @@ void aq_nic_cfg_start(struct aq_nic_s *self)
        /*rss rings */
        cfg->vecs = min(cfg->aq_hw_caps->vecs, AQ_CFG_VECS_DEF);
        cfg->vecs = min(cfg->vecs, num_online_cpus());
+        cfg->vecs = min(cfg->vecs, self->irqvecs);
        /* cfg->vecs should be power of 2 for RSS */
        if (cfg->vecs >= 8U)
                cfg->vecs = 8U;
@@ -246,6 +247,8 @@ void aq_nic_ndev_init(struct aq_nic_s *self)
        self->ndev->hw_features |= aq_hw_caps->hw_features;
        self->ndev->features = aq_hw_caps->hw_features;
+        self->ndev->vlan_features |= NETIF_F_HW_CSUM | NETIF_F_RXCSUM |
+                                     NETIF_F_RXHASH | NETIF_F_SG | NETIF_F_LRO;
        self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
        self->ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 219b550d1665..faa533a0ec47 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -80,6 +80,7 @@ struct aq_nic_s {
        struct pci_dev *pdev;
        unsigned int msix_entry_mask;
+        u32 irqvecs;
 };
 static inline struct device *aq_nic_get_dev(struct aq_nic_s *self)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index ecc6306f940f..a50e08bb4748 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -267,16 +267,16 @@ static int aq_pci_probe(struct pci_dev *pdev,
        numvecs = min(numvecs, num_online_cpus());
        /*enable interrupts */
 #if !AQ_CFG_FORCE_LEGACY_INT
-        err = pci_alloc_irq_vectors(self->pdev, numvecs, numvecs,
+        numvecs = pci_alloc_irq_vectors(self->pdev, 1, numvecs,
-                                    PCI_IRQ_MSIX);
+                                        PCI_IRQ_MSIX | PCI_IRQ_MSI |
+                                        PCI_IRQ_LEGACY);
-        if (err < 0) {
-                err = pci_alloc_irq_vectors(self->pdev, 1, 1,
+        if (numvecs < 0) {
-                                            PCI_IRQ_MSI | PCI_IRQ_LEGACY);
+                err = numvecs;
-                if (err < 0)
+                goto err_hwinit;
-                        goto err_hwinit;
        }
 #endif
+        self->irqvecs = numvecs;
        /* net device init */
        aq_nic_cfg_start(self);
@@ -298,9 +298,9 @@ err_free_aq_hw:
        kfree(self->aq_hw);
 err_ioremap:
        free_netdev(ndev);
-err_pci_func:
-        pci_release_regions(pdev);
 err_ndev:
+        pci_release_regions(pdev);
+err_pci_func:
        pci_disable_device(pdev);
        return err;
 }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 08bbb639be1a..9f59b1270a7c 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8733,14 +8733,15 @@ static void tg3_free_consistent(struct tg3 *tp)
        tg3_mem_rx_release(tp);
        tg3_mem_tx_release(tp);
-        /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
+        /* tp->hw_stats can be referenced safely:
-        tg3_full_lock(tp, 0);
+         *     1. under rtnl_lock
+         *     2. or under tp->lock if TG3_FLAG_INIT_COMPLETE is set.
+         */
        if (tp->hw_stats) {
                dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
                                  tp->hw_stats, tp->stats_mapping);
                tp->hw_stats = NULL;
        }
-        tg3_full_unlock(tp);
 }
 /*
@@ -14178,7 +14179,7 @@ static void tg3_get_stats64(struct net_device *dev,
        struct tg3 *tp = netdev_priv(dev);
        spin_lock_bh(&tp->lock);
-        if (!tp->hw_stats) {
+        if (!tp->hw_stats || !tg3_flag(tp, INIT_COMPLETE)) {
                *stats = tp->net_stats_prev;
                spin_unlock_bh(&tp->lock);
                return;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 3e4c533c1622..c54fd189d835 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3433,8 +3433,8 @@ static int adap_config_hma(struct adapter *adapter)
        sgl = adapter->hma.sgt->sgl;
        node = dev_to_node(adapter->pdev_dev);
        for_each_sg(sgl, iter, sgt->orig_nents, i) {
-                newpage = alloc_pages_node(node, __GFP_NOWARN | GFP_KERNEL,
+                newpage = alloc_pages_node(node, __GFP_NOWARN | GFP_KERNEL |
-                                           page_order);
+                                           __GFP_ZERO, page_order);
                if (!newpage) {
                        dev_err(adapter->pdev_dev,
                                "Not enough memory for HMA page allocation\n");
@@ -5489,6 +5489,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        spin_lock_init(&adapter->mbox_lock);
        INIT_LIST_HEAD(&adapter->mlist.list);
+        adapter->mbox_log->size = T4_OS_LOG_MBOX_CMDS;
        pci_set_drvdata(pdev, adapter);
        if (func != ent->driver_data) {
@@ -5523,8 +5524,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto out_free_adapter;
        }
-        adapter->mbox_log->size = T4_OS_LOG_MBOX_CMDS;
        /* PCI device has been enabled */
        adapter->flags |= DEV_ENABLED;
        memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
index 5909a4407e38..7c511f144ed6 100644
--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
+++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
@@ -1014,10 +1014,10 @@ ice_clean_rq_elem(struct ice_hw *hw, struct ice_ctl_q_info *cq,
        desc = ICE_CTL_Q_DESC(cq->rq, ntc);
        desc_idx = ntc;
+        cq->rq_last_status = (enum ice_aq_err)le16_to_cpu(desc->retval);
        flags = le16_to_cpu(desc->flags);
        if (flags & ICE_AQ_FLAG_ERR) {
                ret_code = ICE_ERR_AQ_ERROR;
-                cq->rq_last_status = (enum ice_aq_err)le16_to_cpu(desc->retval);
                ice_debug(hw, ICE_DBG_AQ_MSG,
                          "Control Receive Queue Event received with error 0x%x\n",
                          cq->rq_last_status);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index 41af2b81e960..195c0b65eee2 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -919,8 +919,8 @@ err2:
        kfree(ipsec->ip_tbl);
        kfree(ipsec->rx_tbl);
        kfree(ipsec->tx_tbl);
+        kfree(ipsec);
 err1:
-        kfree(adapter->ipsec);
        netdev_err(adapter->netdev, "Unable to allocate memory for SA tables");
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
index 959a37599a6b..ac71ed76a54b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
@@ -3407,6 +3407,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw)
                hw->phy.sfp_setup_needed = false;
        }
+        if (status == IXGBE_ERR_SFP_NOT_SUPPORTED)
+                return status;
        /* Reset PHY */
        if (!hw->phy.reset_disable && hw->phy.ops.reset)
                hw->phy.ops.reset(hw);
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index e91c3d1a43ce..1ccce6cd51fc 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -4114,7 +4114,7 @@ out_drop:
        return NETDEV_TX_OK;
 }
-static int ixgbevf_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+static netdev_tx_t ixgbevf_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 {
        struct ixgbevf_adapter *adapter = netdev_priv(netdev);
        struct ixgbevf_ring *tx_ring;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index a30a2e95d13f..f11b45001cad 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1027,6 +1027,22 @@ static int mlx4_en_set_coalesce(struct net_device *dev,
        if (!coal->tx_max_coalesced_frames_irq)
                return -EINVAL;
+        if (coal->tx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME ||
+            coal->rx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME ||
+            coal->rx_coalesce_usecs_low > MLX4_EN_MAX_COAL_TIME ||
+            coal->rx_coalesce_usecs_high > MLX4_EN_MAX_COAL_TIME) {
+                netdev_info(dev, "%s: maximum coalesce time supported is %d usecs\n",
+                            __func__, MLX4_EN_MAX_COAL_TIME);
+                return -ERANGE;
+        }
+        if (coal->tx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS ||
+            coal->rx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS) {
+                netdev_info(dev, "%s: maximum coalesced frames supported is %d\n",
+                            __func__, MLX4_EN_MAX_COAL_PKTS);
+                return -ERANGE;
+        }
        priv->rx_frames = (coal->rx_max_coalesced_frames ==
                           MLX4_EN_AUTO_CONF) ?
                                MLX4_EN_RX_COAL_TARGET :
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index e0adac4a9a19..9670b33fc9b1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -3324,12 +3324,11 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                                           MAX_TX_RINGS, GFP_KERNEL);
                if (!priv->tx_ring[t]) {
                        err = -ENOMEM;
-                        goto err_free_tx;
+                        goto out;
                }
                priv->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
                                         MAX_TX_RINGS, GFP_KERNEL);
                if (!priv->tx_cq[t]) {
-                        kfree(priv->tx_ring[t]);
                        err = -ENOMEM;
                        goto out;
                }
@@ -3582,11 +3581,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        return 0;
-err_free_tx:
-        while (t--) {
-                kfree(priv->tx_ring[t]);
-                kfree(priv->tx_cq[t]);
-        }
 out:
        mlx4_en_destroy_netdev(dev);
        return err;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index f7c81133594f..ace6545f82e6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -132,6 +132,9 @@
 #define MLX4_EN_TX_COAL_PKTS    16
 #define MLX4_EN_TX_COAL_TIME    0x10
+#define MLX4_EN_MAX_COAL_PKTS   U16_MAX
+#define MLX4_EN_MAX_COAL_TIME   U16_MAX
 #define MLX4_EN_RX_RATE_LOW             400000
 #define MLX4_EN_RX_COAL_TIME_LOW        0
 #define MLX4_EN_RX_RATE_HIGH            450000
@@ -552,8 +555,8 @@ struct mlx4_en_priv {
        u16 rx_usecs_low;
        u32 pkt_rate_high;
        u16 rx_usecs_high;
-        u16 sample_interval;
+        u32 sample_interval;
-        u16 adaptive_rx_coal;
+        u32 adaptive_rx_coal;
        u32 msg_enable;
        u32 loopback_ok;
        u32 validate_loopback;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3c534fc43400..b94276db3ce9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1261,6 +1261,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                                                  f->mask);
                addr_type = key->addr_type;
+                /* the HW doesn't support frag first/later */
+                if (mask->flags & FLOW_DIS_FIRST_FRAG)
+                        return -EOPNOTSUPP;
                if (mask->flags & FLOW_DIS_IS_FRAGMENT) {
                        MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1);
                        MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index c1c94974e16b..1814f803bd2c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -34,6 +34,9 @@
 #include <linux/module.h>
 #include <linux/mlx5/driver.h>
 #include <linux/mlx5/cmd.h>
+#ifdef CONFIG_RFS_ACCEL
+#include <linux/cpu_rmap.h>
+#endif
 #include "mlx5_core.h"
 #include "fpga/core.h"
 #include "eswitch.h"
@@ -923,3 +926,28 @@ int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
        MLX5_SET(query_eq_in, in, eq_number, eq->eqn);
        return mlx5_cmd_exec(dev, in, sizeof(in), out, outlen);
 }
+/* This function should only be called after mlx5_cmd_force_teardown_hca */
+void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev)
+{
+        struct mlx5_eq_table *table = &dev->priv.eq_table;
+        struct mlx5_eq *eq;
+#ifdef CONFIG_RFS_ACCEL
+        if (dev->rmap) {
+                free_irq_cpu_rmap(dev->rmap);
+                dev->rmap = NULL;
+        }
+#endif
+        list_for_each_entry(eq, &table->comp_eqs_list, list)
+                free_irq(eq->irqn, eq);
+        free_irq(table->pages_eq.irqn, &table->pages_eq);
+        free_irq(table->async_eq.irqn, &table->async_eq);
+        free_irq(table->cmd_eq.irqn, &table->cmd_eq);
+#ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
+        if (MLX5_CAP_GEN(dev, pg))
+                free_irq(table->pfault_eq.irqn, &table->pfault_eq);
+#endif
+        pci_free_irq_vectors(dev->pdev);
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 332bc56306bf..1352d13eedb3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -2175,26 +2175,35 @@ int mlx5_eswitch_get_vport_stats(struct mlx5_eswitch *esw,
        memset(vf_stats, 0, sizeof(*vf_stats));
        vf_stats->rx_packets =
                MLX5_GET_CTR(out, received_eth_unicast.packets) +
+                MLX5_GET_CTR(out, received_ib_unicast.packets) +
                MLX5_GET_CTR(out, received_eth_multicast.packets) +
+                MLX5_GET_CTR(out, received_ib_multicast.packets) +
                MLX5_GET_CTR(out, received_eth_broadcast.packets);
        vf_stats->rx_bytes =
                MLX5_GET_CTR(out, received_eth_unicast.octets) +
+                MLX5_GET_CTR(out, received_ib_unicast.octets) +
                MLX5_GET_CTR(out, received_eth_multicast.octets) +
+                MLX5_GET_CTR(out, received_ib_multicast.octets) +
                MLX5_GET_CTR(out, received_eth_broadcast.octets);
        vf_stats->tx_packets =
                MLX5_GET_CTR(out, transmitted_eth_unicast.packets) +
+                MLX5_GET_CTR(out, transmitted_ib_unicast.packets) +
                MLX5_GET_CTR(out, transmitted_eth_multicast.packets) +
+                MLX5_GET_CTR(out, transmitted_ib_multicast.packets) +
                MLX5_GET_CTR(out, transmitted_eth_broadcast.packets);
        vf_stats->tx_bytes =
                MLX5_GET_CTR(out, transmitted_eth_unicast.octets) +
+                MLX5_GET_CTR(out, transmitted_ib_unicast.octets) +
                MLX5_GET_CTR(out, transmitted_eth_multicast.octets) +
+                MLX5_GET_CTR(out, transmitted_ib_multicast.octets) +
                MLX5_GET_CTR(out, transmitted_eth_broadcast.octets);
        vf_stats->multicast =
-                MLX5_GET_CTR(out, received_eth_multicast.packets);
+                MLX5_GET_CTR(out, received_eth_multicast.packets) +
+                MLX5_GET_CTR(out, received_ib_multicast.packets);
        vf_stats->broadcast =
                MLX5_GET_CTR(out, received_eth_broadcast.packets);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index b865597630ba..615005e63819 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1598,6 +1598,14 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)
        mlx5_enter_error_state(dev, true);
+        /* Some platforms requiring freeing the IRQ's in the shutdown
+         * flow. If they aren't freed they can't be allocated after
+         * kexec. There is no need to cleanup the mlx5_core software
+         * contexts.
+         */
+        mlx5_irq_clear_affinity_hints(dev);
+        mlx5_core_eq_free_irqs(dev);
        return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 7d001fe6e631..023882d9a22e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -128,6 +128,8 @@ int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
                       u32 *out, int outlen);
 int mlx5_start_eqs(struct mlx5_core_dev *dev);
 void mlx5_stop_eqs(struct mlx5_core_dev *dev);
+/* This function should only be called after mlx5_cmd_force_teardown_hca */
+void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev);
 struct mlx5_eq *mlx5_eqn2eq(struct mlx5_core_dev *dev, int eqn);
 u32 mlx5_eq_poll_irq_disabled(struct mlx5_eq *eq);
 void mlx5_cq_tasklet_cb(unsigned long data);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 93ea56620a24..e13ac3b8dff7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -1100,11 +1100,11 @@ err_emad_init:
 err_alloc_lag_mapping:
        mlxsw_ports_fini(mlxsw_core);
 err_ports_init:
-        mlxsw_bus->fini(bus_priv);
-err_bus_init:
        if (!reload)
                devlink_resources_unregister(devlink, NULL);
 err_register_resources:
+        mlxsw_bus->fini(bus_priv);
+err_bus_init:
        if (!reload)
                devlink_free(devlink);
 err_devlink_alloc:
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index a997e34bcec2..84e3b9f5abb1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -52,8 +52,6 @@
 #define NFP_FLOWER_ALLOWED_VER 0x0001000000010000UL
-#define NFP_FLOWER_FRAME_HEADROOM       158
 static const char *nfp_flower_extra_cap(struct nfp_app *app, struct nfp_net *nn)
 {
        return "FLOWER";
@@ -559,22 +557,6 @@ static void nfp_flower_clean(struct nfp_app *app)
        app->priv = NULL;
 }
-static int
-nfp_flower_check_mtu(struct nfp_app *app, struct net_device *netdev,
-                     int new_mtu)
-{
-        /* The flower fw reserves NFP_FLOWER_FRAME_HEADROOM bytes of the
-         * supported max MTU to allow for appending tunnel headers. To prevent
-         * unexpected behaviour this needs to be accounted for.
-         */
-        if (new_mtu > netdev->max_mtu - NFP_FLOWER_FRAME_HEADROOM) {
-                nfp_err(app->cpp, "New MTU (%d) is not valid\n", new_mtu);
-                return -EINVAL;
-        }
-        return 0;
-}
 static bool nfp_flower_check_ack(struct nfp_flower_priv *app_priv)
 {
        bool ret;
@@ -656,7 +638,6 @@ const struct nfp_app_type app_flower = {
        .init           = nfp_flower_init,
        .clean          = nfp_flower_clean,
-        .check_mtu      = nfp_flower_check_mtu,
        .repr_change_mtu  = nfp_flower_repr_change_mtu,
        .vnic_alloc     = nfp_flower_vnic_alloc,
diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index 27364b7572fc..b092894dd128 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -1170,7 +1170,7 @@ static void *nixge_get_nvmem_address(struct device *dev)
        cell = nvmem_cell_get(dev, "address");
        if (IS_ERR(cell))
-                return cell;
+                return NULL;
        mac = nvmem_cell_read(cell, &cell_size);
        nvmem_cell_put(cell);
@@ -1183,7 +1183,7 @@ static int nixge_probe(struct platform_device *pdev)
        struct nixge_priv *priv;
        struct net_device *ndev;
        struct resource *dmares;
-        const char *mac_addr;
+        const u8 *mac_addr;
        int err;
        ndev = alloc_etherdev(sizeof(*priv));
@@ -1202,10 +1202,12 @@ static int nixge_probe(struct platform_device *pdev)
        ndev->max_mtu = NIXGE_JUMBO_MTU;
        mac_addr = nixge_get_nvmem_address(&pdev->dev);
-        if (mac_addr && is_valid_ether_addr(mac_addr))
+        if (mac_addr && is_valid_ether_addr(mac_addr)) {
                ether_addr_copy(ndev->dev_addr, mac_addr);
-        else
+                kfree(mac_addr);
+        } else {
                eth_hw_addr_random(ndev);
+        }
        priv = netdev_priv(ndev);
        priv->ndev = ndev;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 8b1b7e8ca56c..5e655c3601cf 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -115,8 +115,7 @@ int qed_l2_alloc(struct qed_hwfn *p_hwfn)
 void qed_l2_setup(struct qed_hwfn *p_hwfn)
 {
-        if (p_hwfn->hw_info.personality != QED_PCI_ETH &&
+        if (!QED_IS_L2_PERSONALITY(p_hwfn))
-            p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE)
                return;
        mutex_init(&p_hwfn->p_l2_info->lock);
@@ -126,8 +125,7 @@ void qed_l2_free(struct qed_hwfn *p_hwfn)
 {
        u32 i;
-        if (p_hwfn->hw_info.personality != QED_PCI_ETH &&
+        if (!QED_IS_L2_PERSONALITY(p_hwfn))
-            p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE)
                return;
        if (!p_hwfn->p_l2_info)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 70bc5634675c..9feed3b79cd4 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -680,7 +680,7 @@ static int qed_nic_stop(struct qed_dev *cdev)
                        tasklet_disable(p_hwfn->sp_dpc);
                        p_hwfn->b_sp_dpc_enabled = false;
                        DP_VERBOSE(cdev, NETIF_MSG_IFDOWN,
-                                   "Disabled sp taskelt [hwfn %d] at %p\n",
+                                   "Disabled sp tasklet [hwfn %d] at %p\n",
                                   i, p_hwfn->sp_dpc);
                }
        }
diff --git a/drivers/net/ethernet/qlogic/qede/qede_rdma.c b/drivers/net/ethernet/qlogic/qede/qede_rdma.c
index 50b142fad6b8..1900bf7e67d1 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_rdma.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_rdma.c
@@ -238,7 +238,7 @@ qede_rdma_get_free_event_node(struct qede_dev *edev)
        }
        if (!found) {
-                event_node = kzalloc(sizeof(*event_node), GFP_KERNEL);
+                event_node = kzalloc(sizeof(*event_node), GFP_ATOMIC);
                if (!event_node) {
                        DP_NOTICE(edev,
                                  "qedr: Could not allocate memory for rdma work\n");
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 6d99b141a7aa..2c2f0c5b3f94 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4662,6 +4662,9 @@ static void r8168_phy_power_up(struct rtl8169_private *tp)
                break;
        }
        rtl_writephy(tp, MII_BMCR, BMCR_ANENABLE);
+        /* give MAC/PHY some time to resume */
+        msleep(20);
 }
 static void r8168_phy_power_down(struct rtl8169_private *tp)
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index f081de4f38d7..88c12474a0c3 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -3443,7 +3443,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                len = (val & RCR_ENTRY_L2_LEN) >>
                        RCR_ENTRY_L2_LEN_SHIFT;
-                len -= ETH_FCS_LEN;
+                append_size = len + ETH_HLEN + ETH_FCS_LEN;
                addr = (val & RCR_ENTRY_PKT_BUF_ADDR) <<
                        RCR_ENTRY_PKT_BUF_ADDR_SHIFT;
@@ -3453,7 +3453,6 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                                         RCR_ENTRY_PKTBUFSZ_SHIFT];
                off = addr & ~PAGE_MASK;
-                append_size = rcr_size;
                if (num_rcr == 1) {
                        int ptype;
@@ -3466,7 +3465,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                        else
                                skb_checksum_none_assert(skb);
                } else if (!(val & RCR_ENTRY_MULTI))
-                        append_size = len - skb->len;
+                        append_size = append_size - skb->len;
                niu_rx_skb_append(skb, page, off, append_size, rcr_size);
                if ((page->index + rp->rbr_block_size) - rcr_size == addr) {
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index ecc84954c511..da07ccdf84bf 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1840,7 +1840,8 @@ static int netvsc_vf_join(struct net_device *vf_netdev,
                goto rx_handler_failed;
        }
-        ret = netdev_upper_dev_link(vf_netdev, ndev, NULL);
+        ret = netdev_master_upper_dev_link(vf_netdev, ndev,
+                                           NULL, NULL, NULL);
        if (ret != 0) {
                netdev_err(vf_netdev,
                           "can not set master device %s (err = %d)\n",
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 3cb2c4666b2c..7f3dab4b4cbc 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1316,7 +1316,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
                   rndis_device->link_state ? "down" : "up");
        if (net_device->nvsp_version < NVSP_PROTOCOL_VERSION_5)
-                return net_device;
+                goto out;
        rndis_filter_query_link_speed(rndis_device, net_device);
diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 9fb9b565a002..4f684cbcdc57 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -1045,7 +1045,7 @@ static int atusb_probe(struct usb_interface *interface,
        atusb->tx_dr.bRequest = ATUSB_TX;
        atusb->tx_dr.wValue = cpu_to_le16(0);
-        atusb->tx_urb = usb_alloc_urb(0, GFP_ATOMIC);
+        atusb->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!atusb->tx_urb)
                goto fail;
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index 55a22c761808..de0d7f28a181 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -1267,7 +1267,7 @@ mcr20a_probe(struct spi_device *spi)
        ret = mcr20a_get_platform_data(spi, pdata);
        if (ret < 0) {
                dev_crit(&spi->dev, "mcr20a_get_platform_data failed.\n");
-                return ret;
+                goto free_pdata;
        }
        /* init reset gpio */
@@ -1275,7 +1275,7 @@ mcr20a_probe(struct spi_device *spi)
                ret = devm_gpio_request_one(&spi->dev, pdata->rst_gpio,
                                            GPIOF_OUT_INIT_HIGH, "reset");
                if (ret)
-                        return ret;
+                        goto free_pdata;
        }
        /* reset mcr20a */
@@ -1291,7 +1291,8 @@ mcr20a_probe(struct spi_device *spi)
        hw = ieee802154_alloc_hw(sizeof(*lp), &mcr20a_hw_ops);
        if (!hw) {
                dev_crit(&spi->dev, "ieee802154_alloc_hw failed\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto free_pdata;
        }
        /* init mcr20a local data */
@@ -1308,8 +1309,10 @@ mcr20a_probe(struct spi_device *spi)
        /* init buf */
        lp->buf = devm_kzalloc(&spi->dev, SPI_COMMAND_BUFFER, GFP_KERNEL);
-        if (!lp->buf)
+        if (!lp->buf) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto free_dev;
+        }
        mcr20a_setup_tx_spi_messages(lp);
        mcr20a_setup_rx_spi_messages(lp);
@@ -1366,6 +1369,8 @@ mcr20a_probe(struct spi_device *spi)
 free_dev:
        ieee802154_free_hw(lp->hw);
+free_pdata:
+        kfree(pdata);
        return ret;
 }
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index 3bb6b66dc7bf..f9c25912eb98 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -720,6 +720,15 @@ static struct phy_driver broadcom_drivers[] = {
        .get_strings    = bcm_phy_get_strings,
        .get_stats      = bcm53xx_phy_get_stats,
        .probe          = bcm53xx_phy_probe,
+}, {
+        .phy_id         = PHY_ID_BCM89610,
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "Broadcom BCM89610",
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = bcm54xx_config_init,
+        .ack_interrupt  = bcm_phy_ack_intr,
+        .config_intr    = bcm_phy_config_intr,
 } };
 module_phy_driver(broadcom_drivers);
@@ -741,6 +750,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
        { PHY_ID_BCMAC131, 0xfffffff0 },
        { PHY_ID_BCM5241, 0xfffffff0 },
        { PHY_ID_BCM5395, 0xfffffff0 },
+        { PHY_ID_BCM89610, 0xfffffff0 },
        { }
 };
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index b2f4519dfb84..d437f4f5ed52 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -125,7 +125,7 @@ void sfp_parse_support(struct sfp_bus *bus, const struct sfp_eeprom_id *id,
        if (id->base.br_nominal) {
                if (id->base.br_nominal != 255) {
                        br_nom = id->base.br_nominal * 100;
-                        br_min = br_nom + id->base.br_nominal * id->ext.br_min;
+                        br_min = br_nom - id->base.br_nominal * id->ext.br_min;
                        br_max = br_nom + id->base.br_nominal * id->ext.br_max;
                } else if (id->ext.br_max) {
                        br_nom = 250 * id->ext.br_max;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 96d26cfae90b..4a017a0d71ea 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3236,6 +3236,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
                        GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
                        NL_SET_BAD_ATTR(info->extack,
                                        info->attrs[HWSIM_ATTR_PERM_ADDR]);
+                        kfree(hwname);
                        return -EINVAL;
                }
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index b979cf3bce65..88a8b5916624 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -27,7 +27,7 @@ config NVME_FABRICS
 config NVME_RDMA
        tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND && BLOCK
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK
        select NVME_CORE
        select NVME_FABRICS
        select SG_POOL
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9df4f71e58ca..a3771c5729f5 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -764,6 +764,7 @@ static int nvme_submit_user_cmd(struct request_queue *q,
                                ret = PTR_ERR(meta);
                                goto out_unmap;
                        }
+                        req->cmd_flags |= REQ_INTEGRITY;
                }
        }
@@ -2997,31 +2998,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
        if (nvme_init_ns_head(ns, nsid, id))
                goto out_free_id;
        nvme_setup_streams_ns(ctrl, ns);
-        
+        nvme_set_disk_name(disk_name, ns, ctrl, &flags);
-#ifdef CONFIG_NVME_MULTIPATH
-        /*
-         * If multipathing is enabled we need to always use the subsystem
-         * instance number for numbering our devices to avoid conflicts
-         * between subsystems that have multiple controllers and thus use
-         * the multipath-aware subsystem node and those that have a single
-         * controller and use the controller node directly.
-         */
-        if (ns->head->disk) {
-                sprintf(disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
-                                ctrl->cntlid, ns->head->instance);
-                flags = GENHD_FL_HIDDEN;
-        } else {
-                sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance,
-                                ns->head->instance);
-        }
-#else
-        /*
-         * But without the multipath code enabled, multiple controller per
-         * subsystems are visible as devices and thus we cannot use the
-         * subsystem instance.
-         */
-        sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
-#endif
        if ((ctrl->quirks & NVME_QUIRK_LIGHTNVM) && id->vs[0] == 0x1) {
                if (nvme_nvm_register(ns, disk_name, node)) {
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 124c458806df..7ae732a77fe8 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -668,6 +668,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->transport);
                        opts->transport = p;
                        break;
                case NVMF_OPT_NQN:
@@ -676,6 +677,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->subsysnqn);
                        opts->subsysnqn = p;
                        nqnlen = strlen(opts->subsysnqn);
                        if (nqnlen >= NVMF_NQN_SIZE) {
@@ -698,6 +700,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->traddr);
                        opts->traddr = p;
                        break;
                case NVMF_OPT_TRSVCID:
@@ -706,6 +709,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->trsvcid);
                        opts->trsvcid = p;
                        break;
                case NVMF_OPT_QUEUE_SIZE:
@@ -792,6 +796,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -EINVAL;
                                goto out;
                        }
+                        nvmf_host_put(opts->host);
                        opts->host = nvmf_host_add(p);
                        kfree(p);
                        if (!opts->host) {
@@ -817,6 +822,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -ENOMEM;
                                goto out;
                        }
+                        kfree(opts->host_traddr);
                        opts->host_traddr = p;
                        break;
                case NVMF_OPT_HOST_ID:
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 956e0b8e9c4d..d7b664ae5923 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -15,10 +15,32 @@
 #include "nvme.h"
 static bool multipath = true;
-module_param(multipath, bool, 0644);
+module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
        "turn on native support for multiple controllers per subsystem");
+/*
+ * If multipathing is enabled we need to always use the subsystem instance
+ * number for numbering our devices to avoid conflicts between subsystems that
+ * have multiple controllers and thus use the multipath-aware subsystem node
+ * and those that have a single controller and use the controller node
+ * directly.
+ */
+void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+                        struct nvme_ctrl *ctrl, int *flags)
+{
+        if (!multipath) {
+                sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
+        } else if (ns->head->disk) {
+                sprintf(disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
+                                ctrl->cntlid, ns->head->instance);
+                *flags = GENHD_FL_HIDDEN;
+        } else {
+                sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance,
+                                ns->head->instance);
+        }
+}
 void nvme_failover_req(struct request *req)
 {
        struct nvme_ns *ns = req->q->queuedata;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 061fecfd44f5..7ded7a51c430 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -436,6 +436,8 @@ extern const struct attribute_group nvme_ns_id_attr_group;
 extern const struct block_device_operations nvme_ns_head_ops;
 #ifdef CONFIG_NVME_MULTIPATH
+void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+                        struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
 bool nvme_req_needs_failover(struct request *req, blk_status_t error);
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
@@ -461,6 +463,16 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
 }
 #else
+/*
+ * Without the multipath code enabled, multiple controller per subsystems are
+ * visible as devices and thus we cannot use the subsystem instance.
+ */
+static inline void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+                                      struct nvme_ctrl *ctrl, int *flags)
+{
+        sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
+}
 static inline void nvme_failover_req(struct request *req)
 {
 }
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 5f4f8b16685f..3c7b61ddb0d1 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP
 config NVME_TARGET_RDMA
        tristate "NVMe over Fabrics RDMA target support"
-        depends on INFINIBAND
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
        depends on NVME_TARGET
        select SGL_ALLOC
        help
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 31fdfba556a8..27a8561c0cb9 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -469,6 +469,12 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
        nvme_stop_ctrl(&ctrl->ctrl);
        nvme_loop_shutdown_ctrl(ctrl);
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+                /* state change failure should never happen */
+                WARN_ON_ONCE(1);
+                return;
+        }
        ret = nvme_loop_configure_admin_queue(ctrl);
        if (ret)
                goto out_disable;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index b35fe88f1851..7baa53e5b1d7 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -102,12 +102,28 @@ static DEFINE_IDR(ovcs_idr);
 static BLOCKING_NOTIFIER_HEAD(overlay_notify_chain);
+/**
+ * of_overlay_notifier_register() - Register notifier for overlay operations
+ * @nb:         Notifier block to register
+ *
+ * Register for notification on overlay operations on device tree nodes. The
+ * reported actions definied by @of_reconfig_change. The notifier callback
+ * furthermore receives a pointer to the affected device tree node.
+ *
+ * Note that a notifier callback is not supposed to store pointers to a device
+ * tree node or its content beyond @OF_OVERLAY_POST_REMOVE corresponding to the
+ * respective node it received.
+ */
 int of_overlay_notifier_register(struct notifier_block *nb)
 {
        return blocking_notifier_chain_register(&overlay_notify_chain, nb);
 }
 EXPORT_SYMBOL_GPL(of_overlay_notifier_register);
+/**
+ * of_overlay_notifier_register() - Unregister notifier for overlay operations
+ * @nb:         Notifier block to unregister
+ */
 int of_overlay_notifier_unregister(struct notifier_block *nb)
 {
        return blocking_notifier_chain_unregister(&overlay_notify_chain, nb);
@@ -671,17 +687,13 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs)
                of_node_put(ovcs->fragments[i].overlay);
        }
        kfree(ovcs->fragments);
        /*
-         * TODO
+         * There should be no live pointers into ovcs->overlay_tree and
-         *
+         * ovcs->fdt due to the policy that overlay notifiers are not allowed
-         * would like to: kfree(ovcs->overlay_tree);
+         * to retain pointers into the overlay devicetree.
-         * but can not since drivers may have pointers into this data
-         *
-         * would like to: kfree(ovcs->fdt);
-         * but can not since drivers may have pointers into this data
         */
+        kfree(ovcs->overlay_tree);
+        kfree(ovcs->fdt);
        kfree(ovcs);
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a04197ce767d..dbfe7c4f3776 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1910,7 +1910,7 @@ void pci_pme_active(struct pci_dev *dev, bool enable)
 EXPORT_SYMBOL(pci_pme_active);
 /**
- * pci_enable_wake - enable PCI device as wakeup event source
+ * __pci_enable_wake - enable PCI device as wakeup event source
 * @dev: PCI device affected
 * @state: PCI state from which device will issue wakeup events
 * @enable: True to enable event generation; false to disable
@@ -1928,7 +1928,7 @@ EXPORT_SYMBOL(pci_pme_active);
 * Error code depending on the platform is returned if both the platform and
 * the native mechanism fail to enable the generation of wake-up events
 */
-int pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable)
+static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable)
 {
        int ret = 0;
@@ -1969,6 +1969,23 @@ int pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable)
        return ret;
 }
+/**
+ * pci_enable_wake - change wakeup settings for a PCI device
+ * @pci_dev: Target device
+ * @state: PCI state from which device will issue wakeup events
+ * @enable: Whether or not to enable event generation
+ *
+ * If @enable is set, check device_may_wakeup() for the device before calling
+ * __pci_enable_wake() for it.
+ */
+int pci_enable_wake(struct pci_dev *pci_dev, pci_power_t state, bool enable)
+{
+        if (enable && !device_may_wakeup(&pci_dev->dev))
+                return -EINVAL;
+        return __pci_enable_wake(pci_dev, state, enable);
+}
 EXPORT_SYMBOL(pci_enable_wake);
 /**
@@ -1981,9 +1998,9 @@ EXPORT_SYMBOL(pci_enable_wake);
 * should not be called twice in a row to enable wake-up due to PCI PM vs ACPI
 * ordering constraints.
 *
- * This function only returns error code if the device is not capable of
+ * This function only returns error code if the device is not allowed to wake
- * generating PME# from both D3_hot and D3_cold, and the platform is unable to
+ * up the system from sleep or it is not capable of generating PME# from both
- * enable wake-up power for it.
+ * D3_hot and D3_cold and the platform is unable to enable wake-up power for it.
 */
 int pci_wake_from_d3(struct pci_dev *dev, bool enable)
 {
@@ -2114,7 +2131,7 @@ int pci_finish_runtime_suspend(struct pci_dev *dev)
        dev->runtime_d3cold = target_state == PCI_D3cold;
-        pci_enable_wake(dev, target_state, pci_dev_run_wake(dev));
+        __pci_enable_wake(dev, target_state, pci_dev_run_wake(dev));
        error = pci_set_power_state(dev, target_state);
@@ -2138,16 +2155,16 @@ bool pci_dev_run_wake(struct pci_dev *dev)
 {
        struct pci_bus *bus = dev->bus;
-        if (device_can_wakeup(&dev->dev))
-                return true;
        if (!dev->pme_support)
                return false;
        /* PME-capable in principle, but not from the target power state */
-        if (!pci_pme_capable(dev, pci_target_state(dev, false)))
+        if (!pci_pme_capable(dev, pci_target_state(dev, true)))
                return false;
+        if (device_can_wakeup(&dev->dev))
+                return true;
        while (bus->parent) {
                struct pci_dev *bridge = bus->self;
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index b1ae1618fefe..fee9225ca559 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1622,22 +1622,30 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
        if (!need_valid_mask) {
                irq_base = devm_irq_alloc_descs(pctrl->dev, -1, 0,
-                                                chip->ngpio, NUMA_NO_NODE);
+                                                community->npins, NUMA_NO_NODE);
                if (irq_base < 0) {
                        dev_err(pctrl->dev, "Failed to allocate IRQ numbers\n");
                        return irq_base;
                }
-        } else {
-                irq_base = 0;
        }
-        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, irq_base,
+        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
                                   handle_bad_irq, IRQ_TYPE_NONE);
        if (ret) {
                dev_err(pctrl->dev, "failed to add IRQ chip\n");
                return ret;
        }
+        if (!need_valid_mask) {
+                for (i = 0; i < community->ngpio_ranges; i++) {
+                        range = &community->gpio_ranges[i];
+                        irq_domain_associate_many(chip->irq.domain, irq_base,
+                                                  range->base, range->npins);
+                        irq_base += range->npins;
+                }
+        }
        gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
                                     chv_gpio_irq_handler);
        return 0;
diff --git a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
index 8870a4100164..fee3435a6f15 100644
--- a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
+++ b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
@@ -36,6 +36,27 @@
                .npins = ((e) - (s) + 1),               \
        }
+#define SPTH_GPP(r, s, e, g)                            \
+        {                                               \
+                .reg_num = (r),                         \
+                .base = (s),                            \
+                .size = ((e) - (s) + 1),                \
+                .gpio_base = (g),                       \
+        }
+#define SPTH_COMMUNITY(b, s, e, g)                      \
+        {                                               \
+                .barno = (b),                           \
+                .padown_offset = SPT_PAD_OWN,           \
+                .padcfglock_offset = SPT_PADCFGLOCK,    \
+                .hostown_offset = SPT_HOSTSW_OWN,       \
+                .ie_offset = SPT_GPI_IE,                \
+                .pin_base = (s),                        \
+                .npins = ((e) - (s) + 1),               \
+                .gpps = (g),                            \
+                .ngpps = ARRAY_SIZE(g),                 \
+        }
 /* Sunrisepoint-LP */
 static const struct pinctrl_pin_desc sptlp_pins[] = {
        /* GPP_A */
@@ -531,10 +552,28 @@ static const struct intel_function spth_functions[] = {
        FUNCTION("i2c2", spth_i2c2_groups),
 };
+static const struct intel_padgroup spth_community0_gpps[] = {
+        SPTH_GPP(0, 0, 23, 0),          /* GPP_A */
+        SPTH_GPP(1, 24, 47, 24),        /* GPP_B */
+};
+static const struct intel_padgroup spth_community1_gpps[] = {
+        SPTH_GPP(0, 48, 71, 48),        /* GPP_C */
+        SPTH_GPP(1, 72, 95, 72),        /* GPP_D */
+        SPTH_GPP(2, 96, 108, 96),       /* GPP_E */
+        SPTH_GPP(3, 109, 132, 120),     /* GPP_F */
+        SPTH_GPP(4, 133, 156, 144),     /* GPP_G */
+        SPTH_GPP(5, 157, 180, 168),     /* GPP_H */
+};
+static const struct intel_padgroup spth_community3_gpps[] = {
+        SPTH_GPP(0, 181, 191, 192),     /* GPP_I */
+};
 static const struct intel_community spth_communities[] = {
-        SPT_COMMUNITY(0, 0, 47),
+        SPTH_COMMUNITY(0, 0, 47, spth_community0_gpps),
-        SPT_COMMUNITY(1, 48, 180),
+        SPTH_COMMUNITY(1, 48, 180, spth_community1_gpps),
-        SPT_COMMUNITY(2, 181, 191),
+        SPTH_COMMUNITY(2, 181, 191, spth_community3_gpps),
 };
 static const struct intel_pinctrl_soc_data spth_soc_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson-axg.c b/drivers/pinctrl/meson/pinctrl-meson-axg.c
index 4b91ff74779b..99a6ceac8e53 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-axg.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-axg.c
@@ -898,7 +898,7 @@ static struct meson_bank meson_axg_periphs_banks[] = {
 static struct meson_bank meson_axg_aobus_banks[] = {
        /*   name    first      last      irq   pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0,  GPIOAO_9, 0, 13, 0,  16,  0, 0,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0,  GPIOAO_13, 0, 13, 0,  16,  0, 0,  0,  0,  0, 16,  1,  0),
 };
 static struct meson_pmx_bank meson_axg_periphs_pmx_banks[] = {
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 39d06dd1f63a..bc309c5327ff 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -154,7 +154,7 @@ config DELL_LAPTOP
        depends on ACPI_VIDEO || ACPI_VIDEO = n
        depends on RFKILL || RFKILL = n
        depends on SERIO_I8042
-        select DELL_SMBIOS
+        depends on DELL_SMBIOS
        select POWER_SUPPLY
        select LEDS_CLASS
        select NEW_LEDS
diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
index d4aeac3477f5..f086469ea740 100644
--- a/drivers/platform/x86/asus-wireless.c
+++ b/drivers/platform/x86/asus-wireless.c
@@ -178,8 +178,10 @@ static int asus_wireless_remove(struct acpi_device *adev)
 {
        struct asus_wireless_data *data = acpi_driver_data(adev);
-        if (data->wq)
+        if (data->wq) {
+                devm_led_classdev_unregister(&adev->dev, &data->led);
                destroy_workqueue(data->wq);
+        }
        return 0;
 }
diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
index 8e70a627e0bb..cbbafdcaaecb 100644
--- a/drivers/remoteproc/qcom_q6v5_pil.c
+++ b/drivers/remoteproc/qcom_q6v5_pil.c
@@ -1083,6 +1083,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
                dev_err(qproc->dev, "unable to resolve mba region\n");
                return ret;
        }
+        of_node_put(node);
        qproc->mba_phys = r.start;
        qproc->mba_size = resource_size(&r);
@@ -1100,6 +1101,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
                dev_err(qproc->dev, "unable to resolve mpss region\n");
                return ret;
        }
+        of_node_put(node);
        qproc->mpss_phys = qproc->mpss_reloc = r.start;
        qproc->mpss_size = resource_size(&r);
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 6d9c5832ce47..a9609d971f7f 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1163,7 +1163,7 @@ int rproc_trigger_recovery(struct rproc *rproc)
        if (ret)
                return ret;
-        ret = rproc_stop(rproc, false);
+        ret = rproc_stop(rproc, true);
        if (ret)
                goto unlock_mutex;
@@ -1316,7 +1316,7 @@ void rproc_shutdown(struct rproc *rproc)
        if (!atomic_dec_and_test(&rproc->power))
                goto out;
-        ret = rproc_stop(rproc, true);
+        ret = rproc_stop(rproc, false);
        if (ret) {
                atomic_inc(&rproc->power);
                goto out;
diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 64b6de9763ee..1efdf9ff8679 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -581,4 +581,6 @@ static void rpmsg_chrdev_exit(void)
        unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX);
 }
 module_exit(rpmsg_chrdev_exit);
+MODULE_ALIAS("rpmsg:rpmsg_chrdev");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
index 16cab40156ca..aeab05f682d9 100644
--- a/drivers/staging/media/imx/imx-media-csi.c
+++ b/drivers/staging/media/imx/imx-media-csi.c
@@ -1799,7 +1799,7 @@ static int imx_csi_probe(struct platform_device *pdev)
        priv->dev->of_node = pdata->of_node;
        pinctrl = devm_pinctrl_get_select_default(priv->dev);
        if (IS_ERR(pinctrl)) {
-                ret = PTR_ERR(priv->vdev);
+                ret = PTR_ERR(pinctrl);
                dev_dbg(priv->dev,
                        "devm_pinctrl_get_select_default() failed: %d\n", ret);
                if (ret != -ENODEV)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index c821b4b9647e..7b5cb28ffb35 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -191,7 +191,9 @@ static const unsigned short full_speed_maxpacket_maxes[4] = {
 static const unsigned short high_speed_maxpacket_maxes[4] = {
        [USB_ENDPOINT_XFER_CONTROL] = 64,
        [USB_ENDPOINT_XFER_ISOC] = 1024,
-        [USB_ENDPOINT_XFER_BULK] = 512,
+        /* Bulk should be 512, but some devices use 1024: we will warn below */
+        [USB_ENDPOINT_XFER_BULK] = 1024,
        [USB_ENDPOINT_XFER_INT] = 1024,
 };
 static const unsigned short super_speed_maxpacket_maxes[4] = {
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index d83be5651f87..a666e0758a99 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -985,6 +985,7 @@ struct dwc2_hsotg {
        /* DWC OTG HW Release versions */
 #define DWC2_CORE_REV_2_71a     0x4f54271a
+#define DWC2_CORE_REV_2_72a     0x4f54272a
 #define DWC2_CORE_REV_2_80a     0x4f54280a
 #define DWC2_CORE_REV_2_90a     0x4f54290a
 #define DWC2_CORE_REV_2_91a     0x4f54291a
@@ -992,6 +993,7 @@ struct dwc2_hsotg {
 #define DWC2_CORE_REV_2_94a     0x4f54294a
 #define DWC2_CORE_REV_3_00a     0x4f54300a
 #define DWC2_CORE_REV_3_10a     0x4f54310a
+#define DWC2_CORE_REV_4_00a     0x4f54400a
 #define DWC2_FS_IOT_REV_1_00a   0x5531100a
 #define DWC2_HS_IOT_REV_1_00a   0x5532100a
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 6c32bf26e48e..83cb5577a52f 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3928,6 +3928,27 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
        if (index && !hs_ep->isochronous)
                epctrl |= DXEPCTL_SETD0PID;
+        /* WA for Full speed ISOC IN in DDMA mode.
+         * By Clear NAK status of EP, core will send ZLP
+         * to IN token and assert NAK interrupt relying
+         * on TxFIFO status only
+         */
+        if (hsotg->gadget.speed == USB_SPEED_FULL &&
+            hs_ep->isochronous && dir_in) {
+                /* The WA applies only to core versions from 2.72a
+                 * to 4.00a (including both). Also for FS_IOT_1.00a
+                 * and HS_IOT_1.00a.
+                 */
+                u32 gsnpsid = dwc2_readl(hsotg->regs + GSNPSID);
+                if ((gsnpsid >= DWC2_CORE_REV_2_72a &&
+                     gsnpsid <= DWC2_CORE_REV_4_00a) ||
+                     gsnpsid == DWC2_FS_IOT_REV_1_00a ||
+                     gsnpsid == DWC2_HS_IOT_REV_1_00a)
+                        epctrl |= DXEPCTL_CNAK;
+        }
        dev_dbg(hsotg->dev, "%s: write DxEPCTL=0x%08x\n",
                __func__, epctrl);
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 190f95964000..c51b73b3e048 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -358,9 +358,14 @@ static void dwc2_gusbcfg_init(struct dwc2_hsotg *hsotg)
 static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg)
 {
+        int ret;
        hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus");
-        if (IS_ERR(hsotg->vbus_supply))
+        if (IS_ERR(hsotg->vbus_supply)) {
-                return 0;
+                ret = PTR_ERR(hsotg->vbus_supply);
+                hsotg->vbus_supply = NULL;
+                return ret == -ENODEV ? 0 : ret;
+        }
        return regulator_enable(hsotg->vbus_supply);
 }
@@ -4342,9 +4347,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
        spin_unlock_irqrestore(&hsotg->lock, flags);
-        dwc2_vbus_supply_init(hsotg);
+        return dwc2_vbus_supply_init(hsotg);
-        return 0;
 }
 /*
diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
index 7f21747007f1..bea2e8ec0369 100644
--- a/drivers/usb/dwc2/pci.c
+++ b/drivers/usb/dwc2/pci.c
@@ -141,8 +141,10 @@ static int dwc2_pci_probe(struct pci_dev *pci,
                goto err;
        glue = devm_kzalloc(dev, sizeof(*glue), GFP_KERNEL);
-        if (!glue)
+        if (!glue) {
+                ret = -ENOMEM;
                goto err;
+        }
        ret = platform_device_add(dwc2);
        if (ret) {
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8796a5ee9bb9..0dedf8a799f4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -166,7 +166,7 @@ static void dwc3_ep_inc_deq(struct dwc3_ep *dep)
        dwc3_ep_inc_trb(&dep->trb_dequeue);
 }
-void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
+static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
                struct dwc3_request *req, int status)
 {
        struct dwc3                     *dwc = dep->dwc;
@@ -1424,7 +1424,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                                        dwc->lock);
                        if (!r->trb)
-                                goto out1;
+                                goto out0;
                        if (r->num_pending_sgs) {
                                struct dwc3_trb *trb;
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index 7889bcc0509a..8b72b192c747 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -221,7 +221,7 @@ static void pn_tx_complete(struct usb_ep *ep, struct usb_request *req)
        netif_wake_queue(dev);
 }
-static int pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct phonet_port *port = netdev_priv(dev);
        struct f_phonet *fp;
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 4c6c08b675b5..21307d862af6 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -73,9 +73,10 @@ static struct ehci_qh *ehci_qh_alloc (struct ehci_hcd *ehci, gfp_t flags)
        if (!qh)
                goto done;
        qh->hw = (struct ehci_qh_hw *)
-                dma_pool_zalloc(ehci->qh_pool, flags, &dma);
+                dma_pool_alloc(ehci->qh_pool, flags, &dma);
        if (!qh->hw)
                goto fail;
+        memset(qh->hw, 0, sizeof *qh->hw);
        qh->qh_dma = dma;
        // INIT_LIST_HEAD (&qh->qh_list);
        INIT_LIST_HEAD (&qh->qtd_list);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 28e2a338b481..e56db44708bc 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1287,7 +1287,7 @@ itd_urb_transaction(
                } else {
 alloc_itd:
                        spin_unlock_irqrestore(&ehci->lock, flags);
-                        itd = dma_pool_zalloc(ehci->itd_pool, mem_flags,
+                        itd = dma_pool_alloc(ehci->itd_pool, mem_flags,
                                        &itd_dma);
                        spin_lock_irqsave(&ehci->lock, flags);
                        if (!itd) {
@@ -1297,6 +1297,7 @@ itd_urb_transaction(
                        }
                }
+                memset(itd, 0, sizeof(*itd));
                itd->itd_dma = itd_dma;
                itd->frame = NO_FRAME;
                list_add(&itd->itd_list, &sched->td_list);
@@ -2080,7 +2081,7 @@ sitd_urb_transaction(
                } else {
 alloc_sitd:
                        spin_unlock_irqrestore(&ehci->lock, flags);
-                        sitd = dma_pool_zalloc(ehci->sitd_pool, mem_flags,
+                        sitd = dma_pool_alloc(ehci->sitd_pool, mem_flags,
                                        &sitd_dma);
                        spin_lock_irqsave(&ehci->lock, flags);
                        if (!sitd) {
@@ -2090,6 +2091,7 @@ sitd_urb_transaction(
                        }
                }
+                memset(sitd, 0, sizeof(*sitd));
                sitd->sitd_dma = sitd_dma;
                sitd->frame = NO_FRAME;
                list_add(&sitd->sitd_list, &iso_sched->td_list);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 9b27798ecce5..711da3306b14 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3621,6 +3621,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
                del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
        }
        xhci_debugfs_remove_slot(xhci, udev->slot_id);
+        virt_dev->udev = NULL;
        ret = xhci_disable_slot(xhci, udev->slot_id);
        if (ret)
                xhci_free_virt_device(xhci, udev->slot_id);
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index e564695c6c8d..71c5835ea9cd 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -417,7 +417,6 @@ void musb_g_tx(struct musb *musb, u8 epnum)
        req = next_request(musb_ep);
        request = &req->request;
-        trace_musb_req_tx(req);
        csr = musb_readw(epio, MUSB_TXCSR);
        musb_dbg(musb, "<== %s, txcsr %04x", musb_ep->end_point.name, csr);
@@ -456,6 +455,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                u8      is_dma = 0;
                bool    short_packet = false;
+                trace_musb_req_tx(req);
                if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
                        is_dma = 1;
                        csr |= MUSB_TXCSR_P_WZC_BITS;
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 4fa372c845e1..e7f99d55922a 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -990,7 +990,9 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
                        /* set tx_reinit and schedule the next qh */
                        ep->tx_reinit = 1;
                }
-                musb_start_urb(musb, is_in, next_qh);
+                if (next_qh)
+                        musb_start_urb(musb, is_in, next_qh);
        }
 }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c3f252283ab9..2058852a87fa 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,6 +233,8 @@ static void option_instat_callback(struct urb *urb);
 /* These Quectel products use Qualcomm's vendor ID */
 #define QUECTEL_PRODUCT_UC20                    0x9003
 #define QUECTEL_PRODUCT_UC15                    0x9090
+/* These u-blox products use Qualcomm's vendor ID */
+#define UBLOX_PRODUCT_R410M                     0x90b2
 /* These Yuga products use Qualcomm's vendor ID */
 #define YUGA_PRODUCT_CLM920_NC5                 0x9625
@@ -1065,6 +1067,9 @@ static const struct usb_device_id option_ids[] = {
        /* Yuga products use Qualcomm vendor ID */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5),
          .driver_info = RSVD(1) | RSVD(4) },
+        /* u-blox products using Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+          .driver_info = RSVD(1) | RSVD(3) },
        /* Quectel products using Quectel vendor ID */
        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
          .driver_info = RSVD(4) },
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index f5373ed2cd45..8ddbecc25d89 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -335,47 +335,48 @@ static int palm_os_3_probe(struct usb_serial *serial,
                goto exit;
        }
-        if (retval == sizeof(*connection_info)) {
+        if (retval != sizeof(*connection_info)) {
-                        connection_info = (struct visor_connection_info *)
+                dev_err(dev, "Invalid connection information received from device\n");
-                                                        transfer_buffer;
+                retval = -ENODEV;
+                goto exit;
-                num_ports = le16_to_cpu(connection_info->num_ports);
-                for (i = 0; i < num_ports; ++i) {
-                        switch (
-                           connection_info->connections[i].port_function_id) {
-                        case VISOR_FUNCTION_GENERIC:
-                                string = "Generic";
-                                break;
-                        case VISOR_FUNCTION_DEBUGGER:
-                                string = "Debugger";
-                                break;
-                        case VISOR_FUNCTION_HOTSYNC:
-                                string = "HotSync";
-                                break;
-                        case VISOR_FUNCTION_CONSOLE:
-                                string = "Console";
-                                break;
-                        case VISOR_FUNCTION_REMOTE_FILE_SYS:
-                                string = "Remote File System";
-                                break;
-                        default:
-                                string = "unknown";
-                                break;
-                        }
-                        dev_info(dev, "%s: port %d, is for %s use\n",
-                                serial->type->description,
-                                connection_info->connections[i].port, string);
-                }
        }
-        /*
-        * Handle devices that report invalid stuff here.
+        connection_info = (struct visor_connection_info *)transfer_buffer;
-        */
+        num_ports = le16_to_cpu(connection_info->num_ports);
+        /* Handle devices that report invalid stuff here. */
        if (num_ports == 0 || num_ports > 2) {
                dev_warn(dev, "%s: No valid connect info available\n",
                        serial->type->description);
                num_ports = 2;
        }
+        for (i = 0; i < num_ports; ++i) {
+                switch (connection_info->connections[i].port_function_id) {
+                case VISOR_FUNCTION_GENERIC:
+                        string = "Generic";
+                        break;
+                case VISOR_FUNCTION_DEBUGGER:
+                        string = "Debugger";
+                        break;
+                case VISOR_FUNCTION_HOTSYNC:
+                        string = "HotSync";
+                        break;
+                case VISOR_FUNCTION_CONSOLE:
+                        string = "Console";
+                        break;
+                case VISOR_FUNCTION_REMOTE_FILE_SYS:
+                        string = "Remote File System";
+                        break;
+                default:
+                        string = "unknown";
+                        break;
+                }
+                dev_info(dev, "%s: port %d, is for %s use\n",
+                        serial->type->description,
+                        connection_info->connections[i].port, string);
+        }
        dev_info(dev, "%s: Number of ports: %d\n", serial->type->description,
                num_ports);
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 677d12138dbd..ded49e3bf2b0 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -3725,6 +3725,7 @@ void tcpm_unregister_port(struct tcpm_port *port)
        for (i = 0; i < ARRAY_SIZE(port->port_altmode); i++)
                typec_unregister_altmode(port->port_altmode[i]);
        typec_unregister_port(port->typec_port);
+        usb_role_switch_put(port->role_sw);
        tcpm_debugfs_exit(port);
        destroy_workqueue(port->wq);
 }
diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
index 8b8406867c02..4b4c8d271b27 100644
--- a/drivers/usb/typec/tps6598x.c
+++ b/drivers/usb/typec/tps6598x.c
@@ -73,6 +73,7 @@ struct tps6598x {
        struct device *dev;
        struct regmap *regmap;
        struct mutex lock; /* device lock */
+        u8 i2c_protocol:1;
        struct typec_port *port;
        struct typec_partner *partner;
@@ -80,19 +81,39 @@ struct tps6598x {
        struct typec_capability typec_cap;
 };
+static int
+tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
+{
+        u8 data[len + 1];
+        int ret;
+        if (!tps->i2c_protocol)
+                return regmap_raw_read(tps->regmap, reg, val, len);
+        ret = regmap_raw_read(tps->regmap, reg, data, sizeof(data));
+        if (ret)
+                return ret;
+        if (data[0] < len)
+                return -EIO;
+        memcpy(val, &data[1], len);
+        return 0;
+}
 static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val)
 {
-        return regmap_raw_read(tps->regmap, reg, val, sizeof(u16));
+        return tps6598x_block_read(tps, reg, val, sizeof(u16));
 }
 static inline int tps6598x_read32(struct tps6598x *tps, u8 reg, u32 *val)
 {
-        return regmap_raw_read(tps->regmap, reg, val, sizeof(u32));
+        return tps6598x_block_read(tps, reg, val, sizeof(u32));
 }
 static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val)
 {
-        return regmap_raw_read(tps->regmap, reg, val, sizeof(u64));
+        return tps6598x_block_read(tps, reg, val, sizeof(u64));
 }
 static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val)
@@ -121,8 +142,8 @@ static int tps6598x_read_partner_identity(struct tps6598x *tps)
        struct tps6598x_rx_identity_reg id;
        int ret;
-        ret = regmap_raw_read(tps->regmap, TPS_REG_RX_IDENTITY_SOP,
+        ret = tps6598x_block_read(tps, TPS_REG_RX_IDENTITY_SOP,
-                              &id, sizeof(id));
+                                  &id, sizeof(id));
        if (ret)
                return ret;
@@ -224,13 +245,13 @@ static int tps6598x_exec_cmd(struct tps6598x *tps, const char *cmd,
        } while (val);
        if (out_len) {
-                ret = regmap_raw_read(tps->regmap, TPS_REG_DATA1,
+                ret = tps6598x_block_read(tps, TPS_REG_DATA1,
-                                      out_data, out_len);
+                                          out_data, out_len);
                if (ret)
                        return ret;
                val = out_data[0];
        } else {
-                ret = regmap_read(tps->regmap, TPS_REG_DATA1, &val);
+                ret = tps6598x_block_read(tps, TPS_REG_DATA1, &val, sizeof(u8));
                if (ret)
                        return ret;
        }
@@ -385,6 +406,16 @@ static int tps6598x_probe(struct i2c_client *client)
        if (!vid)
                return -ENODEV;
+        /*
+         * Checking can the adapter handle SMBus protocol. If it can not, the
+         * driver needs to take care of block reads separately.
+         *
+         * FIXME: Testing with I2C_FUNC_I2C. regmap-i2c uses I2C protocol
+         * unconditionally if the adapter has I2C_FUNC_I2C set.
+         */
+        if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
+                tps->i2c_protocol = true;
        ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
        if (ret < 0)
                return ret;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e2f16b68fcbf..51b5e2da708c 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3142,7 +3142,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
        struct rb_node *node;
        int ret = 0;
+        spin_lock(&root->fs_info->trans_lock);
        cur_trans = root->fs_info->running_transaction;
+        if (cur_trans)
+                refcount_inc(&cur_trans->use_count);
+        spin_unlock(&root->fs_info->trans_lock);
        if (!cur_trans)
                return 0;
@@ -3151,6 +3155,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
        head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
        if (!head) {
                spin_unlock(&delayed_refs->lock);
+                btrfs_put_transaction(cur_trans);
                return 0;
        }
@@ -3167,6 +3172,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
                mutex_lock(&head->mutex);
                mutex_unlock(&head->mutex);
                btrfs_put_delayed_ref_head(head);
+                btrfs_put_transaction(cur_trans);
                return -EAGAIN;
        }
        spin_unlock(&delayed_refs->lock);
@@ -3199,6 +3205,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
        }
        spin_unlock(&head->lock);
        mutex_unlock(&head->mutex);
+        btrfs_put_transaction(cur_trans);
        return ret;
 }
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 00b7d3231821..b041b945a7ae 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1841,7 +1841,7 @@ again:
                old_bytenr = btrfs_node_blockptr(parent, slot);
                blocksize = fs_info->nodesize;
                old_ptr_gen = btrfs_node_ptr_generation(parent, slot);
-                btrfs_node_key_to_cpu(parent, &key, slot);
+                btrfs_node_key_to_cpu(parent, &first_key, slot);
                if (level <= max_level) {
                        eb = path->nodes[level];
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 221e5cdb060b..c0074d2d7d6d 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5236,6 +5236,10 @@ static int send_write_or_clone(struct send_ctx *sctx,
                len = btrfs_file_extent_num_bytes(path->nodes[0], ei);
        }
+        if (offset >= sctx->cur_inode_size) {
+                ret = 0;
+                goto out;
+        }
        if (offset + len > sctx->cur_inode_size)
                len = sctx->cur_inode_size - offset;
        if (len == 0) {
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index f85040d73e3d..cf0e45b10121 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -70,69 +70,104 @@ static __le32 ceph_flags_sys2wire(u32 flags)
 */
 /*
- * Calculate the length sum of direct io vectors that can
+ * How many pages to get in one call to iov_iter_get_pages().  This
- * be combined into one page vector.
+ * determines the size of the on-stack array used as a buffer.
 */
-static size_t dio_get_pagev_size(const struct iov_iter *it)
+#define ITER_GET_BVECS_PAGES    64
+static ssize_t __iter_get_bvecs(struct iov_iter *iter, size_t maxsize,
+                                struct bio_vec *bvecs)
 {
-    const struct iovec *iov = it->iov;
+        size_t size = 0;
-    const struct iovec *iovend = iov + it->nr_segs;
+        int bvec_idx = 0;
-    size_t size;
+        if (maxsize > iov_iter_count(iter))
-    size = iov->iov_len - it->iov_offset;
+                maxsize = iov_iter_count(iter);
-    /*
-     * An iov can be page vectored when both the current tail
+        while (size < maxsize) {
-     * and the next base are page aligned.
+                struct page *pages[ITER_GET_BVECS_PAGES];
-     */
+                ssize_t bytes;
-    while (PAGE_ALIGNED((iov->iov_base + iov->iov_len)) &&
+                size_t start;
-           (++iov < iovend && PAGE_ALIGNED((iov->iov_base)))) {
+                int idx = 0;
-        size += iov->iov_len;
-    }
+                bytes = iov_iter_get_pages(iter, pages, maxsize - size,
-    dout("dio_get_pagevlen len = %zu\n", size);
+                                           ITER_GET_BVECS_PAGES, &start);
-    return size;
+                if (bytes < 0)
+                        return size ?: bytes;
+                iov_iter_advance(iter, bytes);
+                size += bytes;
+                for ( ; bytes; idx++, bvec_idx++) {
+                        struct bio_vec bv = {
+                                .bv_page = pages[idx],
+                                .bv_len = min_t(int, bytes, PAGE_SIZE - start),
+                                .bv_offset = start,
+                        };
+                        bvecs[bvec_idx] = bv;
+                        bytes -= bv.bv_len;
+                        start = 0;
+                }
+        }
+        return size;
 }
 /*
- * Allocate a page vector based on (@it, @nbytes).
+ * iov_iter_get_pages() only considers one iov_iter segment, no matter
- * The return value is the tuple describing a page vector,
+ * what maxsize or maxpages are given.  For ITER_BVEC that is a single
- * that is (@pages, @page_align, @num_pages).
+ * page.
+ *
+ * Attempt to get up to @maxsize bytes worth of pages from @iter.
+ * Return the number of bytes in the created bio_vec array, or an error.
 */
-static struct page **
+static ssize_t iter_get_bvecs_alloc(struct iov_iter *iter, size_t maxsize,
-dio_get_pages_alloc(const struct iov_iter *it, size_t nbytes,
+                                    struct bio_vec **bvecs, int *num_bvecs)
-                    size_t *page_align, int *num_pages)
 {
-        struct iov_iter tmp_it = *it;
+        struct bio_vec *bv;
-        size_t align;
+        size_t orig_count = iov_iter_count(iter);
-        struct page **pages;
+        ssize_t bytes;
-        int ret = 0, idx, npages;
+        int npages;
-        align = (unsigned long)(it->iov->iov_base + it->iov_offset) &
+        iov_iter_truncate(iter, maxsize);
-                (PAGE_SIZE - 1);
+        npages = iov_iter_npages(iter, INT_MAX);
-        npages = calc_pages_for(align, nbytes);
+        iov_iter_reexpand(iter, orig_count);
-        pages = kvmalloc(sizeof(*pages) * npages, GFP_KERNEL);
-        if (!pages)
-                return ERR_PTR(-ENOMEM);
-        for (idx = 0; idx < npages; ) {
+        /*
-                size_t start;
+         * __iter_get_bvecs() may populate only part of the array -- zero it
-                ret = iov_iter_get_pages(&tmp_it, pages + idx, nbytes,
+         * out.
-                                         npages - idx, &start);
+         */
-                if (ret < 0)
+        bv = kvmalloc_array(npages, sizeof(*bv), GFP_KERNEL | __GFP_ZERO);
-                        goto fail;
+        if (!bv)
+                return -ENOMEM;
-                iov_iter_advance(&tmp_it, ret);
+        bytes = __iter_get_bvecs(iter, maxsize, bv);
-                nbytes -= ret;
+        if (bytes < 0) {
-                idx += (ret + start + PAGE_SIZE - 1) / PAGE_SIZE;
+                /*
+                 * No pages were pinned -- just free the array.
+                 */
+                kvfree(bv);
+                return bytes;
        }
-        BUG_ON(nbytes != 0);
+        *bvecs = bv;
-        *num_pages = npages;
+        *num_bvecs = npages;
-        *page_align = align;
+        return bytes;
-        dout("dio_get_pages_alloc: got %d pages align %zu\n", npages, align);
+}
-        return pages;
-fail:
+static void put_bvecs(struct bio_vec *bvecs, int num_bvecs, bool should_dirty)
-        ceph_put_page_vector(pages, idx, false);
+{
-        return ERR_PTR(ret);
+        int i;
+        for (i = 0; i < num_bvecs; i++) {
+                if (bvecs[i].bv_page) {
+                        if (should_dirty)
+                                set_page_dirty_lock(bvecs[i].bv_page);
+                        put_page(bvecs[i].bv_page);
+                }
+        }
+        kvfree(bvecs);
 }
 /*
@@ -746,11 +781,12 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
        struct inode *inode = req->r_inode;
        struct ceph_aio_request *aio_req = req->r_priv;
        struct ceph_osd_data *osd_data = osd_req_op_extent_osd_data(req, 0);
-        int num_pages = calc_pages_for((u64)osd_data->alignment,
-                                       osd_data->length);
-        dout("ceph_aio_complete_req %p rc %d bytes %llu\n",
+        BUG_ON(osd_data->type != CEPH_OSD_DATA_TYPE_BVECS);
-             inode, rc, osd_data->length);
+        BUG_ON(!osd_data->num_bvecs);
+        dout("ceph_aio_complete_req %p rc %d bytes %u\n",
+             inode, rc, osd_data->bvec_pos.iter.bi_size);
        if (rc == -EOLDSNAPC) {
                struct ceph_aio_work *aio_work;
@@ -768,9 +804,10 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
        } else if (!aio_req->write) {
                if (rc == -ENOENT)
                        rc = 0;
-                if (rc >= 0 && osd_data->length > rc) {
+                if (rc >= 0 && osd_data->bvec_pos.iter.bi_size > rc) {
-                        int zoff = osd_data->alignment + rc;
+                        struct iov_iter i;
-                        int zlen = osd_data->length - rc;
+                        int zlen = osd_data->bvec_pos.iter.bi_size - rc;
                        /*
                         * If read is satisfied by single OSD request,
                         * it can pass EOF. Otherwise read is within
@@ -785,13 +822,16 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
                                aio_req->total_len = rc + zlen;
                        }
-                        if (zlen > 0)
+                        iov_iter_bvec(&i, ITER_BVEC, osd_data->bvec_pos.bvecs,
-                                ceph_zero_page_vector_range(zoff, zlen,
+                                      osd_data->num_bvecs,
-                                                            osd_data->pages);
+                                      osd_data->bvec_pos.iter.bi_size);
+                        iov_iter_advance(&i, rc);
+                        iov_iter_zero(zlen, &i);
                }
        }
-        ceph_put_page_vector(osd_data->pages, num_pages, aio_req->should_dirty);
+        put_bvecs(osd_data->bvec_pos.bvecs, osd_data->num_bvecs,
+                  aio_req->should_dirty);
        ceph_osdc_put_request(req);
        if (rc < 0)
@@ -879,7 +919,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
        struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
        struct ceph_vino vino;
        struct ceph_osd_request *req;
-        struct page **pages;
+        struct bio_vec *bvecs;
        struct ceph_aio_request *aio_req = NULL;
        int num_pages = 0;
        int flags;
@@ -914,10 +954,14 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
        }
        while (iov_iter_count(iter) > 0) {
-                u64 size = dio_get_pagev_size(iter);
+                u64 size = iov_iter_count(iter);
-                size_t start = 0;
                ssize_t len;
+                if (write)
+                        size = min_t(u64, size, fsc->mount_options->wsize);
+                else
+                        size = min_t(u64, size, fsc->mount_options->rsize);
                vino = ceph_vino(inode);
                req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
                                            vino, pos, &size, 0,
@@ -933,18 +977,14 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                        break;
                }
-                if (write)
+                len = iter_get_bvecs_alloc(iter, size, &bvecs, &num_pages);
-                        size = min_t(u64, size, fsc->mount_options->wsize);
+                if (len < 0) {
-                else
-                        size = min_t(u64, size, fsc->mount_options->rsize);
-                len = size;
-                pages = dio_get_pages_alloc(iter, len, &start, &num_pages);
-                if (IS_ERR(pages)) {
                        ceph_osdc_put_request(req);
-                        ret = PTR_ERR(pages);
+                        ret = len;
                        break;
                }
+                if (len != size)
+                        osd_req_op_extent_update(req, 0, len);
                /*
                 * To simplify error handling, allow AIO when IO within i_size
@@ -977,8 +1017,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                        req->r_mtime = mtime;
                }
-                osd_req_op_extent_osd_data_pages(req, 0, pages, len, start,
+                osd_req_op_extent_osd_data_bvecs(req, 0, bvecs, num_pages, len);
-                                                 false, false);
                if (aio_req) {
                        aio_req->total_len += len;
@@ -991,7 +1030,6 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                        list_add_tail(&req->r_unsafe_item, &aio_req->osd_reqs);
                        pos += len;
-                        iov_iter_advance(iter, len);
                        continue;
                }
@@ -1004,25 +1042,26 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                        if (ret == -ENOENT)
                                ret = 0;
                        if (ret >= 0 && ret < len && pos + ret < size) {
+                                struct iov_iter i;
                                int zlen = min_t(size_t, len - ret,
                                                 size - pos - ret);
-                                ceph_zero_page_vector_range(start + ret, zlen,
-                                                            pages);
+                                iov_iter_bvec(&i, ITER_BVEC, bvecs, num_pages,
+                                              len);
+                                iov_iter_advance(&i, ret);
+                                iov_iter_zero(zlen, &i);
                                ret += zlen;
                        }
                        if (ret >= 0)
                                len = ret;
                }
-                ceph_put_page_vector(pages, num_pages, should_dirty);
+                put_bvecs(bvecs, num_pages, should_dirty);
                ceph_osdc_put_request(req);
                if (ret < 0)
                        break;
                pos += len;
-                iov_iter_advance(iter, len);
                if (!write && pos >= size)
                        break;
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 741749a98614..5f132d59dfc2 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -197,7 +197,7 @@ config CIFS_SMB311
 config CIFS_SMB_DIRECT
        bool "SMB Direct support (Experimental)"
-        depends on CIFS=m && INFINIBAND || CIFS=y && INFINIBAND=y
+        depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
        help
          Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1.
          SMB Direct allows transferring SMB packets over RDMA. If unsure,
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 47d7c151fcba..471d863958bc 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1961,7 +1961,7 @@ void wb_workfn(struct work_struct *work)
        }
        if (!list_empty(&wb->work_list))
-                mod_delayed_work(bdi_wq, &wb->dwork, 0);
+                wb_wakeup(wb);
        else if (wb_has_dirty_io(wb) && dirty_writeback_interval)
                wb_wakeup_delayed(wb);
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index eed073cc4778..e70fb8ccecea 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -880,8 +880,18 @@ xfs_file_dedupe_range(
        struct file     *dst_file,
        u64             dst_loff)
 {
+        struct inode    *srci = file_inode(src_file);
+        u64             max_dedupe;
        int             error;
+        /*
+         * Since we have to read all these pages in to compare them, cut
+         * it off at MAX_RW_COUNT/2 rounded down to the nearest block.
+         * That means we won't do more than MAX_RW_COUNT IO per request.
+         */
+        max_dedupe = (MAX_RW_COUNT >> 1) & ~(i_blocksize(srci) - 1);
+        if (len > max_dedupe)
+                len = max_dedupe;
        error = xfs_reflink_remap_range(src_file, loff, dst_file, dst_loff,
                                     len, true);
        if (error)
diff --git a/include/dt-bindings/clock/stm32mp1-clks.h b/include/dt-bindings/clock/stm32mp1-clks.h
index 86e3ec662ef4..90ec780bfc68 100644
--- a/include/dt-bindings/clock/stm32mp1-clks.h
+++ b/include/dt-bindings/clock/stm32mp1-clks.h
@@ -76,7 +76,7 @@
 #define I2C6            63
 #define USART1          64
 #define RTCAPB          65
-#define TZC             66
+#define TZC1            66
 #define TZPC            67
 #define IWDG1           68
 #define BSEC            69
@@ -123,6 +123,7 @@
 #define CRC1            110
 #define USBH            111
 #define ETHSTP          112
+#define TZC2            113
 /* Kernel clocks */
 #define SDMMC1_K        118
@@ -228,7 +229,6 @@
 #define CK_MCO2         212
 /* TRACE & DEBUG clocks */
-#define DBG             213
 #define CK_DBG          214
 #define CK_TRACE        215
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 24f03941ada8..e7efe12a81bd 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -131,6 +131,7 @@ struct vgic_irq {
                u32 mpidr;                      /* GICv3 target VCPU */
        };
        u8 source;                      /* GICv2 SGIs only */
+        u8 active_source;               /* GICv2 SGIs only */
        u8 priority;
        enum vgic_irq_config config;    /* Level or edge */
diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
index d3339dd48b1a..b324e01ccf2d 100644
--- a/include/linux/brcmphy.h
+++ b/include/linux/brcmphy.h
@@ -25,6 +25,7 @@
 #define PHY_ID_BCM54612E                0x03625e60
 #define PHY_ID_BCM54616S                0x03625d10
 #define PHY_ID_BCM57780                 0x03625d90
+#define PHY_ID_BCM89610                 0x03625cd0
 #define PHY_ID_BCM7250                  0xae025280
 #define PHY_ID_BCM7260                  0xae025190
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 528ccc943cee..96bb32285989 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -77,7 +77,10 @@ struct ceph_osd_data {
                        u32                     bio_length;
                };
 #endif /* CONFIG_BLOCK */
-                struct ceph_bvec_iter   bvec_pos;
+                struct {
+                        struct ceph_bvec_iter   bvec_pos;
+                        u32                     num_bvecs;
+                };
        };
 };
@@ -412,6 +415,10 @@ void osd_req_op_extent_osd_data_bio(struct ceph_osd_request *osd_req,
                                    struct ceph_bio_iter *bio_pos,
                                    u32 bio_length);
 #endif /* CONFIG_BLOCK */
+void osd_req_op_extent_osd_data_bvecs(struct ceph_osd_request *osd_req,
+                                      unsigned int which,
+                                      struct bio_vec *bvecs, u32 num_bvecs,
+                                      u32 bytes);
 void osd_req_op_extent_osd_data_bvec_pos(struct ceph_osd_request *osd_req,
                                         unsigned int which,
                                         struct ceph_bvec_iter *bvec_pos);
@@ -426,7 +433,8 @@ extern void osd_req_op_cls_request_data_pages(struct ceph_osd_request *,
                                        bool own_pages);
 void osd_req_op_cls_request_data_bvecs(struct ceph_osd_request *osd_req,
                                       unsigned int which,
-                                       struct bio_vec *bvecs, u32 bytes);
+                                       struct bio_vec *bvecs, u32 num_bvecs,
+                                       u32 bytes);
 extern void osd_req_op_cls_response_data_pages(struct ceph_osd_request *,
                                        unsigned int which,
                                        struct page **pages, u64 length,
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 210a890008f9..1d25e149c1c5 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -765,6 +765,9 @@ int __clk_mux_determine_rate(struct clk_hw *hw,
 int __clk_determine_rate(struct clk_hw *core, struct clk_rate_request *req);
 int __clk_mux_determine_rate_closest(struct clk_hw *hw,
                                     struct clk_rate_request *req);
+int clk_mux_determine_rate_flags(struct clk_hw *hw,
+                                 struct clk_rate_request *req,
+                                 unsigned long flags);
 void clk_hw_reparent(struct clk_hw *hw, struct clk_hw *new_parent);
 void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate,
                           unsigned long max_rate);
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index c826b0b5232a..6cb8a5789668 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -368,7 +368,9 @@ static inline void free_part_stats(struct hd_struct *part)
        part_stat_add(cpu, gendiskp, field, -subnd)
 void part_in_flight(struct request_queue *q, struct hd_struct *part,
-                        unsigned int inflight[2]);
+                    unsigned int inflight[2]);
+void part_in_flight_rw(struct request_queue *q, struct hd_struct *part,
+                       unsigned int inflight[2]);
 void part_dec_in_flight(struct request_queue *q, struct hd_struct *part,
                        int rw);
 void part_inc_in_flight(struct request_queue *q, struct hd_struct *part,
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index d09a9c7af109..dfdaede9139e 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -569,7 +569,7 @@ static inline struct rproc *vdev_to_rproc(struct virtio_device *vdev)
 void rproc_add_subdev(struct rproc *rproc,
                      struct rproc_subdev *subdev,
                      int (*probe)(struct rproc_subdev *subdev),
-                      void (*remove)(struct rproc_subdev *subdev, bool graceful));
+                      void (*remove)(struct rproc_subdev *subdev, bool crashed));
 void rproc_remove_subdev(struct rproc *rproc, struct rproc_subdev *subdev);
diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
index 4b6b9283fa7b..8675e145ea8b 100644
--- a/include/linux/usb/composite.h
+++ b/include/linux/usb/composite.h
@@ -52,7 +52,7 @@
 #define USB_GADGET_DELAYED_STATUS       0x7fff  /* Impossibly large value */
 /* big enough to hold our biggest descriptor */
-#define USB_COMP_EP0_BUFSIZ     1024
+#define USB_COMP_EP0_BUFSIZ     4096
 /* OS feature descriptor length <= 4kB */
 #define USB_COMP_EP0_OS_DESC_BUFSIZ     4096
diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h
index 9318b2166439..2b0072fa5e92 100644
--- a/include/linux/wait_bit.h
+++ b/include/linux/wait_bit.h
@@ -305,4 +305,21 @@ do {									\
        __ret;                                                          \
 })
+/**
+ * clear_and_wake_up_bit - clear a bit and wake up anyone waiting on that bit
+ *
+ * @bit: the bit of the word being waited on
+ * @word: the word being waited on, a kernel virtual address
+ *
+ * You can use this helper if bitflags are manipulated atomically rather than
+ * non-atomically under a lock.
+ */
+static inline void clear_and_wake_up_bit(int bit, void *word)
+{
+        clear_bit_unlock(bit, word);
+        /* See wake_up_bit() for which memory barrier you need to use. */
+        smp_mb__after_atomic();
+        wake_up_bit(word, bit);
+}
 #endif /* _LINUX_WAIT_BIT_H */
diff --git a/include/media/i2c/tvp7002.h b/include/media/i2c/tvp7002.h
index 5ee007c1cead..cb213c136089 100644
--- a/include/media/i2c/tvp7002.h
+++ b/include/media/i2c/tvp7002.h
@@ -5,7 +5,7 @@
 * Author: Santiago Nunez-Corrales <santiago.nunez@ridgerun.com>
 *
 * This code is partially based upon the TVP5150 driver
- * written by Mauro Carvalho Chehab (mchehab@infradead.org),
+ * written by Mauro Carvalho Chehab <mchehab@kernel.org>,
 * the TVP514x driver written by Vaibhav Hiremath <hvaibhav@ti.com>
 * and the TVP7002 driver in the TI LSP 2.10.00.14
 *
diff --git a/include/media/videobuf-core.h b/include/media/videobuf-core.h
index 0bda0adc744f..60a664febba0 100644
--- a/include/media/videobuf-core.h
+++ b/include/media/videobuf-core.h
@@ -1,11 +1,11 @@
 /*
 * generic helper functions for handling video4linux capture buffers
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/include/media/videobuf-dma-sg.h b/include/media/videobuf-dma-sg.h
index d8b27854e3bf..01bd142b979d 100644
--- a/include/media/videobuf-dma-sg.h
+++ b/include/media/videobuf-dma-sg.h
@@ -6,11 +6,11 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * Highly based on video-buf written originally by:
 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
- * (c) 2006 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
 * (c) 2006 Ted Walther and John Sokol
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/include/media/videobuf-vmalloc.h b/include/media/videobuf-vmalloc.h
index 486a97efdb56..36c6a4ad3504 100644
--- a/include/media/videobuf-vmalloc.h
+++ b/include/media/videobuf-vmalloc.h
@@ -6,7 +6,7 @@
 * into PAGE_SIZE chunks).  They also assume the driver does not need
 * to touch the video data.
 *
- * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/include/net/bonding.h b/include/net/bonding.h
index f801fc940b29..b52235158836 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -198,6 +198,7 @@ struct bonding {
        struct   slave __rcu *primary_slave;
        struct   bond_up_slave __rcu *slave_arr; /* Array of usable slaves */
        bool     force_primary;
+        u32      nest_level;
        s32      slave_cnt; /* never change this value outside the attach/detach wrappers */
        int     (*recv_probe)(const struct sk_buff *, struct bonding *,
                              struct slave *);
diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index e2f6e5c928bb..adc24df56b90 100644
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -256,7 +256,7 @@ extern struct flow_dissector flow_keys_basic_dissector;
 * This structure is used to hold a digest of the full flow keys. This is a
 * larger "hash" of a flow to allow definitively matching specific flows where
 * the 32 bit skb->hash is not large enough. The size is limited to 16 bytes so
- * that it can by used in CB of skb (see sch_choke for an example).
+ * that it can be used in CB of skb (see sch_choke for an example).
 */
 #define FLOW_KEYS_DIGEST_LEN    16
 struct flow_keys_digest {
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index d2279b2d61aa..b2f3a0c018e7 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -2080,7 +2080,7 @@ struct ieee80211_txq {
 *      virtual interface might not be given air time for the transmission of
 *      the frame, as it is not synced with the AP/P2P GO yet, and thus the
 *      deauthentication frame might not be transmitted.
- >
+ *
 * @IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP: The driver (or firmware) doesn't
 *      support QoS NDP for AP probing - that's most likely a driver bug.
 *
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index a872379b69da..45e75c36b738 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -375,6 +375,7 @@ struct xfrm_input_afinfo {
 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
+void xfrm_flush_gc(void);
 void xfrm_state_delete_tunnel(struct xfrm_state *x);
 struct xfrm_type {
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 9e96c2fe2793..077e664ac9a2 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -15,6 +15,7 @@
 #define _TRACE_RXRPC_H
 #include <linux/tracepoint.h>
+#include <linux/errqueue.h>
 /*
 * Define enums for tracing information.
@@ -210,6 +211,20 @@ enum rxrpc_congest_change {
        rxrpc_cong_saw_nack,
 };
+enum rxrpc_tx_fail_trace {
+        rxrpc_tx_fail_call_abort,
+        rxrpc_tx_fail_call_ack,
+        rxrpc_tx_fail_call_data_frag,
+        rxrpc_tx_fail_call_data_nofrag,
+        rxrpc_tx_fail_call_final_resend,
+        rxrpc_tx_fail_conn_abort,
+        rxrpc_tx_fail_conn_challenge,
+        rxrpc_tx_fail_conn_response,
+        rxrpc_tx_fail_reject,
+        rxrpc_tx_fail_version_keepalive,
+        rxrpc_tx_fail_version_reply,
+};
 #endif /* end __RXRPC_DECLARE_TRACE_ENUMS_ONCE_ONLY */
 /*
@@ -437,6 +452,19 @@ enum rxrpc_congest_change {
        EM(RXRPC_CALL_LOCAL_ERROR,              "LocalError") \
        E_(RXRPC_CALL_NETWORK_ERROR,            "NetError")
+#define rxrpc_tx_fail_traces \
+        EM(rxrpc_tx_fail_call_abort,            "CallAbort") \
+        EM(rxrpc_tx_fail_call_ack,              "CallAck") \
+        EM(rxrpc_tx_fail_call_data_frag,        "CallDataFrag") \
+        EM(rxrpc_tx_fail_call_data_nofrag,      "CallDataNofrag") \
+        EM(rxrpc_tx_fail_call_final_resend,     "CallFinalResend") \
+        EM(rxrpc_tx_fail_conn_abort,            "ConnAbort") \
+        EM(rxrpc_tx_fail_conn_challenge,        "ConnChall") \
+        EM(rxrpc_tx_fail_conn_response,         "ConnResp") \
+        EM(rxrpc_tx_fail_reject,                "Reject") \
+        EM(rxrpc_tx_fail_version_keepalive,     "VerKeepalive") \
+        E_(rxrpc_tx_fail_version_reply,         "VerReply")
 /*
 * Export enum symbols via userspace.
 */
@@ -460,6 +488,7 @@ rxrpc_propose_ack_traces;
 rxrpc_propose_ack_outcomes;
 rxrpc_congest_modes;
 rxrpc_congest_changes;
+rxrpc_tx_fail_traces;
 /*
 * Now redefine the EM() and E_() macros to map the enums to the strings that
@@ -1374,6 +1403,62 @@ TRACE_EVENT(rxrpc_resend,
                      __entry->anno)
            );
+TRACE_EVENT(rxrpc_rx_icmp,
+            TP_PROTO(struct rxrpc_peer *peer, struct sock_extended_err *ee,
+                     struct sockaddr_rxrpc *srx),
+            TP_ARGS(peer, ee, srx),
+            TP_STRUCT__entry(
+                    __field(unsigned int,                       peer    )
+                    __field_struct(struct sock_extended_err,    ee      )
+                    __field_struct(struct sockaddr_rxrpc,       srx     )
+                             ),
+            TP_fast_assign(
+                    __entry->peer = peer->debug_id;
+                    memcpy(&__entry->ee, ee, sizeof(__entry->ee));
+                    memcpy(&__entry->srx, srx, sizeof(__entry->srx));
+                           ),
+            TP_printk("P=%08x o=%u t=%u c=%u i=%u d=%u e=%d %pISp",
+                      __entry->peer,
+                      __entry->ee.ee_origin,
+                      __entry->ee.ee_type,
+                      __entry->ee.ee_code,
+                      __entry->ee.ee_info,
+                      __entry->ee.ee_data,
+                      __entry->ee.ee_errno,
+                      &__entry->srx.transport)
+            );
+TRACE_EVENT(rxrpc_tx_fail,
+            TP_PROTO(unsigned int debug_id, rxrpc_serial_t serial, int ret,
+                     enum rxrpc_tx_fail_trace what),
+            TP_ARGS(debug_id, serial, ret, what),
+            TP_STRUCT__entry(
+                    __field(unsigned int,               debug_id        )
+                    __field(rxrpc_serial_t,             serial          )
+                    __field(int,                        ret             )
+                    __field(enum rxrpc_tx_fail_trace,   what            )
+                             ),
+            TP_fast_assign(
+                    __entry->debug_id = debug_id;
+                    __entry->serial = serial;
+                    __entry->ret = ret;
+                    __entry->what = what;
+                           ),
+            TP_printk("c=%08x r=%x ret=%d %s",
+                      __entry->debug_id,
+                      __entry->serial,
+                      __entry->ret,
+                      __print_symbolic(__entry->what, rxrpc_tx_fail_traces))
+            );
 #endif /* _TRACE_RXRPC_H */
 /* This part must be outside protection */
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 335d87242439..bbb08a3ef5cc 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -224,6 +224,8 @@ TRACE_EVENT(rpc_stats_latency,
        TP_ARGS(task, backlog, rtt, execute),
        TP_STRUCT__entry(
+                __field(unsigned int, task_id)
+                __field(unsigned int, client_id)
                __field(u32, xid)
                __field(int, version)
                __string(progname, task->tk_client->cl_program->name)
@@ -231,13 +233,11 @@ TRACE_EVENT(rpc_stats_latency,
                __field(unsigned long, backlog)
                __field(unsigned long, rtt)
                __field(unsigned long, execute)
-                __string(addr,
-                         task->tk_xprt->address_strings[RPC_DISPLAY_ADDR])
-                __string(port,
-                         task->tk_xprt->address_strings[RPC_DISPLAY_PORT])
        ),
        TP_fast_assign(
+                __entry->client_id = task->tk_client->cl_clid;
+                __entry->task_id = task->tk_pid;
                __entry->xid = be32_to_cpu(task->tk_rqstp->rq_xid);
                __entry->version = task->tk_client->cl_vers;
                __assign_str(progname, task->tk_client->cl_program->name)
@@ -245,14 +245,10 @@ TRACE_EVENT(rpc_stats_latency,
                __entry->backlog = ktime_to_us(backlog);
                __entry->rtt = ktime_to_us(rtt);
                __entry->execute = ktime_to_us(execute);
-                __assign_str(addr,
-                             task->tk_xprt->address_strings[RPC_DISPLAY_ADDR]);
-                __assign_str(port,
-                             task->tk_xprt->address_strings[RPC_DISPLAY_PORT]);
        ),
-        TP_printk("peer=[%s]:%s xid=0x%08x %sv%d %s backlog=%lu rtt=%lu execute=%lu",
+        TP_printk("task:%u@%d xid=0x%08x %sv%d %s backlog=%lu rtt=%lu execute=%lu",
-                __get_str(addr), __get_str(port), __entry->xid,
+                __entry->task_id, __entry->client_id, __entry->xid,
                __get_str(progname), __entry->version, __get_str(procname),
                __entry->backlog, __entry->rtt, __entry->execute)
 );
diff --git a/include/uapi/linux/if_infiniband.h b/include/uapi/linux/if_infiniband.h
index 050b92dcf8cf..0fc33bf30e45 100644
--- a/include/uapi/linux/if_infiniband.h
+++ b/include/uapi/linux/if_infiniband.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
 /*
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 15daf5e2638d..9c3630146cec 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2698,6 +2698,8 @@ enum nl80211_attrs {
 #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS
 #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
+#define NL80211_WIPHY_NAME_MAXLEN               128
 #define NL80211_MAX_SUPP_RATES                  32
 #define NL80211_MAX_SUPP_HT_RATES               77
 #define NL80211_MAX_SUPP_REG_RULES              64
diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h
index a66b213de3d7..20c6bd0b0007 100644
--- a/include/uapi/linux/rds.h
+++ b/include/uapi/linux/rds.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2008 Oracle.  All rights reserved.
 *
diff --git a/include/uapi/linux/tls.h b/include/uapi/linux/tls.h
index c6633e97eca4..ff02287495ac 100644
--- a/include/uapi/linux/tls.h
+++ b/include/uapi/linux/tls.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved.
 *
diff --git a/include/uapi/rdma/cxgb3-abi.h b/include/uapi/rdma/cxgb3-abi.h
index 9acb4b7a6246..85aed672f43e 100644
--- a/include/uapi/rdma/cxgb3-abi.h
+++ b/include/uapi/rdma/cxgb3-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
 *
diff --git a/include/uapi/rdma/cxgb4-abi.h b/include/uapi/rdma/cxgb4-abi.h
index 1fefd0140c26..a159ba8dcf8f 100644
--- a/include/uapi/rdma/cxgb4-abi.h
+++ b/include/uapi/rdma/cxgb4-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
 *
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index 7092c8de4bd8..78613b609fa8 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016 Hisilicon Limited.
 *
diff --git a/include/uapi/rdma/ib_user_cm.h b/include/uapi/rdma/ib_user_cm.h
index 4a8f9562f7cd..e2709bb8cb18 100644
--- a/include/uapi/rdma/ib_user_cm.h
+++ b/include/uapi/rdma/ib_user_cm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005 Intel Corporation.  All rights reserved.
diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h
index 04e46ea517d3..625545d862d7 100644
--- a/include/uapi/rdma/ib_user_ioctl_verbs.h
+++ b/include/uapi/rdma/ib_user_ioctl_verbs.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2017-2018, Mellanox Technologies inc.  All rights reserved.
 *
diff --git a/include/uapi/rdma/ib_user_mad.h b/include/uapi/rdma/ib_user_mad.h
index ef92118dad97..90c0cf228020 100644
--- a/include/uapi/rdma/ib_user_mad.h
+++ b/include/uapi/rdma/ib_user_mad.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2004 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
diff --git a/include/uapi/rdma/ib_user_sa.h b/include/uapi/rdma/ib_user_sa.h
index 0d2607f0cd20..435155d6e1c6 100644
--- a/include/uapi/rdma/ib_user_sa.h
+++ b/include/uapi/rdma/ib_user_sa.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Intel Corporation.  All rights reserved.
 *
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 9be07394fdbe..6aeb03315b0b 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
diff --git a/include/uapi/rdma/mlx4-abi.h b/include/uapi/rdma/mlx4-abi.h
index 04f64bc4045f..f74557528175 100644
--- a/include/uapi/rdma/mlx4-abi.h
+++ b/include/uapi/rdma/mlx4-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2007 Cisco Systems, Inc. All rights reserved.
 * Copyright (c) 2007, 2008 Mellanox Technologies. All rights reserved.
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index cb4a02c4a1ce..fdaf00e20649 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2013-2015, Mellanox Technologies. All rights reserved.
 *
diff --git a/include/uapi/rdma/mthca-abi.h b/include/uapi/rdma/mthca-abi.h
index ac756cd9e807..91b12e1a6f43 100644
--- a/include/uapi/rdma/mthca-abi.h
+++ b/include/uapi/rdma/mthca-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
 * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
diff --git a/include/uapi/rdma/nes-abi.h b/include/uapi/rdma/nes-abi.h
index 35bfd4015d07..f80495baa969 100644
--- a/include/uapi/rdma/nes-abi.h
+++ b/include/uapi/rdma/nes-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2006 - 2011 Intel Corporation.  All rights reserved.
 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
diff --git a/include/uapi/rdma/qedr-abi.h b/include/uapi/rdma/qedr-abi.h
index 8ba098900e9a..24c658b3c790 100644
--- a/include/uapi/rdma/qedr-abi.h
+++ b/include/uapi/rdma/qedr-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /* QLogic qedr NIC Driver
 * Copyright (c) 2015-2016  QLogic Corporation
 *
diff --git a/include/uapi/rdma/rdma_user_cm.h b/include/uapi/rdma/rdma_user_cm.h
index e1269024af47..0d1e78ebad05 100644
--- a/include/uapi/rdma/rdma_user_cm.h
+++ b/include/uapi/rdma/rdma_user_cm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2005-2006 Intel Corporation.  All rights reserved.
 *
diff --git a/include/uapi/rdma/rdma_user_ioctl.h b/include/uapi/rdma/rdma_user_ioctl.h
index d223f4164a0f..d92d2721b28c 100644
--- a/include/uapi/rdma/rdma_user_ioctl.h
+++ b/include/uapi/rdma/rdma_user_ioctl.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016 Mellanox Technologies, LTD. All rights reserved.
 *
diff --git a/include/uapi/rdma/rdma_user_rxe.h b/include/uapi/rdma/rdma_user_rxe.h
index 1f8a9e7daea4..44ef6a3b7afc 100644
--- a/include/uapi/rdma/rdma_user_rxe.h
+++ b/include/uapi/rdma/rdma_user_rxe.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
 *
diff --git a/init/main.c b/init/main.c
index b795aa341a3a..a404936d85d8 100644
--- a/init/main.c
+++ b/init/main.c
@@ -423,7 +423,7 @@ static noinline void __ref rest_init(void)
        /*
         * Enable might_sleep() and smp_processor_id() checks.
-         * They cannot be enabled earlier because with CONFIG_PRREMPT=y
+         * They cannot be enabled earlier because with CONFIG_PREEMPT=y
         * kernel_thread() would trigger might_sleep() splats. With
         * CONFIG_PREEMPT_VOLUNTARY=y the init task might have scheduled
         * already, but it's stuck on the kthreadd_done completion.
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 9b87198deea2..c286e75ec087 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -28,6 +28,7 @@
 #include <linux/timekeeping.h>
 #include <linux/ctype.h>
 #include <linux/btf.h>
+#include <linux/nospec.h>
 #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \
                           (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
@@ -104,12 +105,14 @@ const struct bpf_map_ops bpf_map_offload_ops = {
 static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
 {
        const struct bpf_map_ops *ops;
+        u32 type = attr->map_type;
        struct bpf_map *map;
        int err;
-        if (attr->map_type >= ARRAY_SIZE(bpf_map_types))
+        if (type >= ARRAY_SIZE(bpf_map_types))
                return ERR_PTR(-EINVAL);
-        ops = bpf_map_types[attr->map_type];
+        type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types));
+        ops = bpf_map_types[type];
        if (!ops)
                return ERR_PTR(-EINVAL);
@@ -124,7 +127,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
        if (IS_ERR(map))
                return map;
        map->ops = ops;
-        map->map_type = attr->map_type;
+        map->map_type = type;
        return map;
 }
@@ -897,11 +900,17 @@ static const struct bpf_prog_ops * const bpf_prog_types[] = {
 static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
 {
-        if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type])
+        const struct bpf_prog_ops *ops;
+        if (type >= ARRAY_SIZE(bpf_prog_types))
+                return -EINVAL;
+        type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types));
+        ops = bpf_prog_types[type];
+        if (!ops)
                return -EINVAL;
        if (!bpf_prog_is_dev_bound(prog->aux))
-                prog->aux->ops = bpf_prog_types[type];
+                prog->aux->ops = ops;
        else
                prog->aux->ops = &bpf_offload_prog_ops;
        prog->type = type;
diff --git a/kernel/compat.c b/kernel/compat.c
index 6d21894806b4..92d8c98c0f57 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp)
 {
        struct compat_timex tx32;
+        memset(txc, 0, sizeof(struct timex));
        if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
                return -EFAULT;
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index d2c6083304b4..e13df951aca7 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -305,7 +305,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         * Do not reduce the frequency if the CPU has not been idle
         * recently, as the reduction is likely to be premature then.
         */
-        if (busy && next_f < sg_policy->next_freq) {
+        if (busy && next_f < sg_policy->next_freq &&
+            sg_policy->next_freq != UINT_MAX) {
                next_f = sg_policy->next_freq;
                /* Reset cached freq as next_freq has changed */
@@ -396,19 +397,6 @@ static void sugov_irq_work(struct irq_work *irq_work)
        sg_policy = container_of(irq_work, struct sugov_policy, irq_work);
-        /*
-         * For RT tasks, the schedutil governor shoots the frequency to maximum.
-         * Special care must be taken to ensure that this kthread doesn't result
-         * in the same behavior.
-         *
-         * This is (mostly) guaranteed by the work_in_progress flag. The flag is
-         * updated only at the end of the sugov_work() function and before that
-         * the schedutil governor rejects all other frequency scaling requests.
-         *
-         * There is a very rare case though, where the RT thread yields right
-         * after the work_in_progress flag is cleared. The effects of that are
-         * neglected for now.
-         */
        kthread_queue_work(&sg_policy->worker, &sg_policy->work);
 }
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 0e974cface0b..84f37420fcf5 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -119,6 +119,16 @@ static DEFINE_SPINLOCK(watchdog_lock);
 static int watchdog_running;
 static atomic_t watchdog_reset_pending;
+static void inline clocksource_watchdog_lock(unsigned long *flags)
+{
+        spin_lock_irqsave(&watchdog_lock, *flags);
+}
+static void inline clocksource_watchdog_unlock(unsigned long *flags)
+{
+        spin_unlock_irqrestore(&watchdog_lock, *flags);
+}
 static int clocksource_watchdog_kthread(void *data);
 static void __clocksource_change_rating(struct clocksource *cs, int rating);
@@ -142,9 +152,19 @@ static void __clocksource_unstable(struct clocksource *cs)
        cs->flags &= ~(CLOCK_SOURCE_VALID_FOR_HRES | CLOCK_SOURCE_WATCHDOG);
        cs->flags |= CLOCK_SOURCE_UNSTABLE;
+        /*
+         * If the clocksource is registered clocksource_watchdog_kthread() will
+         * re-rate and re-select.
+         */
+        if (list_empty(&cs->list)) {
+                cs->rating = 0;
+                return;
+        }
        if (cs->mark_unstable)
                cs->mark_unstable(cs);
+        /* kick clocksource_watchdog_kthread() */
        if (finished_booting)
                schedule_work(&watchdog_work);
 }
@@ -153,10 +173,8 @@ static void __clocksource_unstable(struct clocksource *cs)
 * clocksource_mark_unstable - mark clocksource unstable via watchdog
 * @cs:         clocksource to be marked unstable
 *
- * This function is called instead of clocksource_change_rating from
+ * This function is called by the x86 TSC code to mark clocksources as unstable;
- * cpu hotplug code to avoid a deadlock between the clocksource mutex
+ * it defers demotion and re-selection to a kthread.
- * and the cpu hotplug mutex. It defers the update of the clocksource
- * to the watchdog thread.
 */
 void clocksource_mark_unstable(struct clocksource *cs)
 {
@@ -164,7 +182,7 @@ void clocksource_mark_unstable(struct clocksource *cs)
        spin_lock_irqsave(&watchdog_lock, flags);
        if (!(cs->flags & CLOCK_SOURCE_UNSTABLE)) {
-                if (list_empty(&cs->wd_list))
+                if (!list_empty(&cs->list) && list_empty(&cs->wd_list))
                        list_add(&cs->wd_list, &watchdog_list);
                __clocksource_unstable(cs);
        }
@@ -319,9 +337,8 @@ static void clocksource_resume_watchdog(void)
 static void clocksource_enqueue_watchdog(struct clocksource *cs)
 {
-        unsigned long flags;
+        INIT_LIST_HEAD(&cs->wd_list);
-        spin_lock_irqsave(&watchdog_lock, flags);
        if (cs->flags & CLOCK_SOURCE_MUST_VERIFY) {
                /* cs is a clocksource to be watched. */
                list_add(&cs->wd_list, &watchdog_list);
@@ -331,7 +348,6 @@ static void clocksource_enqueue_watchdog(struct clocksource *cs)
                if (cs->flags & CLOCK_SOURCE_IS_CONTINUOUS)
                        cs->flags |= CLOCK_SOURCE_VALID_FOR_HRES;
        }
-        spin_unlock_irqrestore(&watchdog_lock, flags);
 }
 static void clocksource_select_watchdog(bool fallback)
@@ -373,9 +389,6 @@ static void clocksource_select_watchdog(bool fallback)
 static void clocksource_dequeue_watchdog(struct clocksource *cs)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&watchdog_lock, flags);
        if (cs != watchdog) {
                if (cs->flags & CLOCK_SOURCE_MUST_VERIFY) {
                        /* cs is a watched clocksource. */
@@ -384,21 +397,19 @@ static void clocksource_dequeue_watchdog(struct clocksource *cs)
                        clocksource_stop_watchdog();
                }
        }
-        spin_unlock_irqrestore(&watchdog_lock, flags);
 }
 static int __clocksource_watchdog_kthread(void)
 {
        struct clocksource *cs, *tmp;
        unsigned long flags;
-        LIST_HEAD(unstable);
        int select = 0;
        spin_lock_irqsave(&watchdog_lock, flags);
        list_for_each_entry_safe(cs, tmp, &watchdog_list, wd_list) {
                if (cs->flags & CLOCK_SOURCE_UNSTABLE) {
                        list_del_init(&cs->wd_list);
-                        list_add(&cs->wd_list, &unstable);
+                        __clocksource_change_rating(cs, 0);
                        select = 1;
                }
                if (cs->flags & CLOCK_SOURCE_RESELECT) {
@@ -410,11 +421,6 @@ static int __clocksource_watchdog_kthread(void)
        clocksource_stop_watchdog();
        spin_unlock_irqrestore(&watchdog_lock, flags);
-        /* Needs to be done outside of watchdog lock */
-        list_for_each_entry_safe(cs, tmp, &unstable, wd_list) {
-                list_del_init(&cs->wd_list);
-                __clocksource_change_rating(cs, 0);
-        }
        return select;
 }
@@ -447,6 +453,9 @@ static inline int __clocksource_watchdog_kthread(void) { return 0; }
 static bool clocksource_is_watchdog(struct clocksource *cs) { return false; }
 void clocksource_mark_unstable(struct clocksource *cs) { }
+static void inline clocksource_watchdog_lock(unsigned long *flags) { }
+static void inline clocksource_watchdog_unlock(unsigned long *flags) { }
 #endif /* CONFIG_CLOCKSOURCE_WATCHDOG */
 /**
@@ -779,14 +788,19 @@ EXPORT_SYMBOL_GPL(__clocksource_update_freq_scale);
 */
 int __clocksource_register_scale(struct clocksource *cs, u32 scale, u32 freq)
 {
+        unsigned long flags;
        /* Initialize mult/shift and max_idle_ns */
        __clocksource_update_freq_scale(cs, scale, freq);
        /* Add clocksource to the clocksource list */
        mutex_lock(&clocksource_mutex);
+        clocksource_watchdog_lock(&flags);
        clocksource_enqueue(cs);
        clocksource_enqueue_watchdog(cs);
+        clocksource_watchdog_unlock(&flags);
        clocksource_select();
        clocksource_select_watchdog(false);
        mutex_unlock(&clocksource_mutex);
@@ -808,8 +822,13 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating)
 */
 void clocksource_change_rating(struct clocksource *cs, int rating)
 {
+        unsigned long flags;
        mutex_lock(&clocksource_mutex);
+        clocksource_watchdog_lock(&flags);
        __clocksource_change_rating(cs, rating);
+        clocksource_watchdog_unlock(&flags);
        clocksource_select();
        clocksource_select_watchdog(false);
        mutex_unlock(&clocksource_mutex);
@@ -821,6 +840,8 @@ EXPORT_SYMBOL(clocksource_change_rating);
 */
 static int clocksource_unbind(struct clocksource *cs)
 {
+        unsigned long flags;
        if (clocksource_is_watchdog(cs)) {
                /* Select and try to install a replacement watchdog. */
                clocksource_select_watchdog(true);
@@ -834,8 +855,12 @@ static int clocksource_unbind(struct clocksource *cs)
                if (curr_clocksource == cs)
                        return -EBUSY;
        }
+        clocksource_watchdog_lock(&flags);
        clocksource_dequeue_watchdog(cs);
        list_del_init(&cs->list);
+        clocksource_watchdog_unlock(&flags);
        return 0;
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 16bbf062018f..8d83bcf9ef69 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5514,10 +5514,10 @@ static __init int ftrace_init_dyn_tracefs(struct dentry *d_tracer)
        ftrace_create_filter_files(&global_ops, d_tracer);
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        trace_create_file("set_graph_function", 0444, d_tracer,
+        trace_create_file("set_graph_function", 0644, d_tracer,
                                    NULL,
                                    &ftrace_graph_fops);
-        trace_create_file("set_graph_notrace", 0444, d_tracer,
+        trace_create_file("set_graph_notrace", 0644, d_tracer,
                                    NULL,
                                    &ftrace_graph_notrace_fops);
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 1f951b3df60c..7d306b74230f 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -762,6 +762,9 @@ static int regex_match_full(char *str, struct regex *r, int len)
 static int regex_match_front(char *str, struct regex *r, int len)
 {
+        if (len < r->len)
+                return 0;
        if (strncmp(str, r->pattern, r->len) == 0)
                return 1;
        return 0;
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 3c7bfc4bf5e9..4237eba4ef20 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -472,7 +472,7 @@ static __init int stack_trace_init(void)
                        NULL, &stack_trace_fops);
 #ifdef CONFIG_DYNAMIC_FTRACE
-        trace_create_file("stack_trace_filter", 0444, d_tracer,
+        trace_create_file("stack_trace_filter", 0644, d_tracer,
                          &trace_ops, &stack_trace_filter_fops);
 #endif
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 023190c69dce..7441bd93b732 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -115,6 +115,7 @@ static int bdi_debug_register(struct backing_dev_info *bdi, const char *name)
                                               bdi, &bdi_debug_stats_fops);
        if (!bdi->debug_stats) {
                debugfs_remove(bdi->debug_dir);
+                bdi->debug_dir = NULL;
                return -ENOMEM;
        }
@@ -383,7 +384,7 @@ static void wb_shutdown(struct bdi_writeback *wb)
         * the barrier provided by test_and_clear_bit() above.
         */
        smp_wmb();
-        clear_bit(WB_shutting_down, &wb->state);
+        clear_and_wake_up_bit(WB_shutting_down, &wb->state);
 }
 static void wb_exit(struct bdi_writeback *wb)
diff --git a/mm/mmap.c b/mm/mmap.c
index 9d5968d1e8e3..6fc435760086 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1324,6 +1324,35 @@ static inline int mlock_future_check(struct mm_struct *mm,
        return 0;
 }
+static inline u64 file_mmap_size_max(struct file *file, struct inode *inode)
+{
+        if (S_ISREG(inode->i_mode))
+                return inode->i_sb->s_maxbytes;
+        if (S_ISBLK(inode->i_mode))
+                return MAX_LFS_FILESIZE;
+        /* Special "we do even unsigned file positions" case */
+        if (file->f_mode & FMODE_UNSIGNED_OFFSET)
+                return 0;
+        /* Yes, random drivers might want more. But I'm tired of buggy drivers */
+        return ULONG_MAX;
+}
+static inline bool file_mmap_ok(struct file *file, struct inode *inode,
+                                unsigned long pgoff, unsigned long len)
+{
+        u64 maxsize = file_mmap_size_max(file, inode);
+        if (maxsize && len > maxsize)
+                return false;
+        maxsize -= len;
+        if (pgoff > maxsize >> PAGE_SHIFT)
+                return false;
+        return true;
+}
 /*
 * The caller must hold down_write(&current->mm->mmap_sem).
 */
@@ -1409,6 +1438,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
                struct inode *inode = file_inode(file);
                unsigned long flags_mask;
+                if (!file_mmap_ok(file, inode, pgoff, len))
+                        return -EOVERFLOW;
                flags_mask = LEGACY_MAP_MASK | file->f_op->mmap_supported_flags;
                switch (flags & MAP_TYPE) {
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index 38aa6345bdfa..b718db2085b2 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -16,7 +16,7 @@
 #include <linux/module.h>
 /**
- *  p9_release_req_pages - Release pages after the transaction.
+ *  p9_release_pages - Release pages after the transaction.
 */
 void p9_release_pages(struct page **pages, int nr_pages)
 {
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 0cfba919d167..848969fe7979 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -1092,8 +1092,8 @@ static struct p9_trans_module p9_fd_trans = {
 };
 /**
- * p9_poll_proc - poll worker thread
+ * p9_poll_workfn - poll worker thread
- * @a: thread state and arguments
+ * @work: work queue
 *
 * polls all v9fs transports for new events and queues the appropriate
 * work to the work queue
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 6d8e3031978f..3d414acb7015 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -68,8 +68,6 @@
 * @pd: Protection Domain pointer
 * @qp: Queue Pair pointer
 * @cq: Completion Queue pointer
- * @dm_mr: DMA Memory Region pointer
- * @lkey: The local access only memory region key
 * @timeout: Number of uSecs to wait for connection management events
 * @privport: Whether a privileged port may be used
 * @port: The port to use
@@ -632,7 +630,7 @@ static int p9_rdma_bind_privport(struct p9_trans_rdma *rdma)
 }
 /**
- * trans_create_rdma - Transport method for creating atransport instance
+ * rdma_create_trans - Transport method for creating a transport instance
 * @client: client instance
 * @addr: IP address string
 * @args: Mount options string
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 3aa5a93ad107..4d0372263e5d 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -60,7 +60,6 @@ static atomic_t vp_pinned = ATOMIC_INIT(0);
 /**
 * struct virtio_chan - per-instance transport information
- * @initialized: whether the channel is initialized
 * @inuse: whether the channel is in use
 * @lock: protects multiple elements within this structure
 * @client: client instance
@@ -385,8 +384,8 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
 * @uidata: user bffer that should be ued for zero copy read
 * @uodata: user buffer that shoud be user for zero copy write
 * @inlen: read buffer size
- * @olen: write buffer size
+ * @outlen: write buffer size
- * @hdrlen: reader header size, This is the size of response protocol data
+ * @in_hdr_len: reader header size, This is the size of response protocol data
 *
 */
 static int
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 086a4abdfa7c..0f19960390a6 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -485,7 +485,7 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
 static int xen_9pfs_front_resume(struct xenbus_device *dev)
 {
-        dev_warn(&dev->dev, "suspsend/resume unsupported\n");
+        dev_warn(&dev->dev, "suspend/resume unsupported\n");
        return 0;
 }
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 01d5d20a6eb1..3138a869b5c0 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 };
 #include <linux/module.h>
 #include <linux/init.h>
+/* Hardening for Spectre-v1 */
+#include <linux/nospec.h>
 #include "lec.h"
 #include "lec_arpc.h"
 #include "resources.h"
@@ -687,8 +690,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
        bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));
        if (bytes_left != 0)
                pr_info("copy from user failed for %d bytes\n", bytes_left);
-        if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF ||
+        if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF)
-            !dev_lec[ioc_data.dev_num])
+                return -EINVAL;
+        ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF);
+        if (!dev_lec[ioc_data.dev_num])
                return -EINVAL;
        vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);
        if (!vpriv)
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index ea2a6c9fb7ce..d2667e5dddc3 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -157,10 +157,12 @@ static void ceph_osd_data_bio_init(struct ceph_osd_data *osd_data,
 #endif /* CONFIG_BLOCK */
 static void ceph_osd_data_bvecs_init(struct ceph_osd_data *osd_data,
-                                     struct ceph_bvec_iter *bvec_pos)
+                                     struct ceph_bvec_iter *bvec_pos,
+                                     u32 num_bvecs)
 {
        osd_data->type = CEPH_OSD_DATA_TYPE_BVECS;
        osd_data->bvec_pos = *bvec_pos;
+        osd_data->num_bvecs = num_bvecs;
 }
 #define osd_req_op_data(oreq, whch, typ, fld)                           \
@@ -237,6 +239,22 @@ void osd_req_op_extent_osd_data_bio(struct ceph_osd_request *osd_req,
 EXPORT_SYMBOL(osd_req_op_extent_osd_data_bio);
 #endif /* CONFIG_BLOCK */
+void osd_req_op_extent_osd_data_bvecs(struct ceph_osd_request *osd_req,
+                                      unsigned int which,
+                                      struct bio_vec *bvecs, u32 num_bvecs,
+                                      u32 bytes)
+{
+        struct ceph_osd_data *osd_data;
+        struct ceph_bvec_iter it = {
+                .bvecs = bvecs,
+                .iter = { .bi_size = bytes },
+        };
+        osd_data = osd_req_op_data(osd_req, which, extent, osd_data);
+        ceph_osd_data_bvecs_init(osd_data, &it, num_bvecs);
+}
+EXPORT_SYMBOL(osd_req_op_extent_osd_data_bvecs);
 void osd_req_op_extent_osd_data_bvec_pos(struct ceph_osd_request *osd_req,
                                         unsigned int which,
                                         struct ceph_bvec_iter *bvec_pos)
@@ -244,7 +262,7 @@ void osd_req_op_extent_osd_data_bvec_pos(struct ceph_osd_request *osd_req,
        struct ceph_osd_data *osd_data;
        osd_data = osd_req_op_data(osd_req, which, extent, osd_data);
-        ceph_osd_data_bvecs_init(osd_data, bvec_pos);
+        ceph_osd_data_bvecs_init(osd_data, bvec_pos, 0);
 }
 EXPORT_SYMBOL(osd_req_op_extent_osd_data_bvec_pos);
@@ -287,7 +305,8 @@ EXPORT_SYMBOL(osd_req_op_cls_request_data_pages);
 void osd_req_op_cls_request_data_bvecs(struct ceph_osd_request *osd_req,
                                       unsigned int which,
-                                       struct bio_vec *bvecs, u32 bytes)
+                                       struct bio_vec *bvecs, u32 num_bvecs,
+                                       u32 bytes)
 {
        struct ceph_osd_data *osd_data;
        struct ceph_bvec_iter it = {
@@ -296,7 +315,7 @@ void osd_req_op_cls_request_data_bvecs(struct ceph_osd_request *osd_req,
        };
        osd_data = osd_req_op_data(osd_req, which, cls, request_data);
-        ceph_osd_data_bvecs_init(osd_data, &it);
+        ceph_osd_data_bvecs_init(osd_data, &it, num_bvecs);
        osd_req->r_ops[which].cls.indata_len += bytes;
        osd_req->r_ops[which].indata_len += bytes;
 }
diff --git a/net/ieee802154/6lowpan/6lowpan_i.h b/net/ieee802154/6lowpan/6lowpan_i.h
index b8d95cb71c25..44a7e16bf3b5 100644
--- a/net/ieee802154/6lowpan/6lowpan_i.h
+++ b/net/ieee802154/6lowpan/6lowpan_i.h
@@ -20,8 +20,8 @@ typedef unsigned __bitwise lowpan_rx_result;
 struct frag_lowpan_compare_key {
        u16 tag;
        u16 d_size;
-        const struct ieee802154_addr src;
+        struct ieee802154_addr src;
-        const struct ieee802154_addr dst;
+        struct ieee802154_addr dst;
 };
 /* Equivalent of ipv4 struct ipq
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index 1790b65944b3..2cc224106b69 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -75,14 +75,14 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb,
 {
        struct netns_ieee802154_lowpan *ieee802154_lowpan =
                net_ieee802154_lowpan(net);
-        struct frag_lowpan_compare_key key = {
+        struct frag_lowpan_compare_key key = {};
-                .tag = cb->d_tag,
-                .d_size = cb->d_size,
-                .src = *src,
-                .dst = *dst,
-        };
        struct inet_frag_queue *q;
+        key.tag = cb->d_tag;
+        key.d_size = cb->d_size;
+        key.src = *src;
+        key.dst = *dst;
        q = inet_frag_find(&ieee802154_lowpan->frags, &key);
        if (!q)
                return NULL;
@@ -372,7 +372,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type)
        struct lowpan_frag_queue *fq;
        struct net *net = dev_net(skb->dev);
        struct lowpan_802154_cb *cb = lowpan_802154_cb(skb);
-        struct ieee802154_hdr hdr;
+        struct ieee802154_hdr hdr = {};
        int err;
        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 05e47d777009..56a010622f70 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -775,8 +775,10 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
        ipc.addr = faddr = daddr;
        if (ipc.opt && ipc.opt->opt.srr) {
-                if (!daddr)
+                if (!daddr) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto out_free;
+                }
                faddr = ipc.opt->opt.faddr;
        }
        tos = get_rttos(&ipc, inet);
@@ -842,6 +844,7 @@ back_from_confirm:
 out:
        ip_rt_put(rt);
+out_free:
        if (free)
                kfree(ipc.opt);
        if (!err) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 1412a7baf0b9..29268efad247 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1375,6 +1375,7 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
                        fnhe->fnhe_gw = 0;
                        fnhe->fnhe_pmtu = 0;
                        fnhe->fnhe_expires = 0;
+                        fnhe->fnhe_mtu_locked = false;
                        fnhe_flush_routes(fnhe);
                        orig = NULL;
                }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 229e616fafc5..ff4d4ba67735 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -401,9 +401,9 @@ static int compute_score(struct sock *sk, struct net *net,
                bool dev_match = (sk->sk_bound_dev_if == dif ||
                                  sk->sk_bound_dev_if == sdif);
-                if (exact_dif && !dev_match)
+                if (!dev_match)
                        return -1;
-                if (sk->sk_bound_dev_if && dev_match)
+                if (sk->sk_bound_dev_if)
                        score += 4;
        }
@@ -1015,8 +1015,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
        sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags);
        if (ipc.opt && ipc.opt->opt.srr) {
-                if (!daddr)
+                if (!daddr) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto out_free;
+                }
                faddr = ipc.opt->opt.faddr;
                connected = 0;
        }
@@ -1139,6 +1141,7 @@ do_append_data:
 out:
        ip_rt_put(rt);
+out_free:
        if (free)
                kfree(ipc.opt);
        if (!err)
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 6794ddf0547c..11e4e80cf7e9 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -34,16 +34,15 @@ config IPV6_ROUTE_INFO
        bool "IPv6: Route Information (RFC 4191) support"
        depends on IPV6_ROUTER_PREF
        ---help---
-          This is experimental support of Route Information.
+          Support of Route Information.
          If unsure, say N.
 config IPV6_OPTIMISTIC_DAD
        bool "IPv6: Enable RFC 4429 Optimistic DAD"
        ---help---
-          This is experimental support for optimistic Duplicate
+          Support for optimistic Duplicate Address Detection. It allows for
-          Address Detection.  It allows for autoconfigured addresses
+          autoconfigured addresses to be used more quickly.
-          to be used more quickly.
          If unsure, say N.
@@ -280,7 +279,7 @@ config IPV6_MROUTE
        depends on IPV6
        select IP_MROUTE_COMMON
        ---help---
-          Experimental support for IPv6 multicast forwarding.
+          Support for IPv6 multicast forwarding.
          If unsure, say N.
 config IPV6_MROUTE_MULTIPLE_TABLES
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index deadc4c3703b..b7f28deddaea 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -669,7 +669,7 @@ static void vti6_link_config(struct ip6_tnl *t, bool keep_mtu)
        else
                mtu = ETH_DATA_LEN - LL_MAX_HEADER - sizeof(struct ipv6hdr);
-        dev->mtu = max_t(int, mtu, IPV6_MIN_MTU);
+        dev->mtu = max_t(int, mtu, IPV4_MIN_MTU);
 }
 /**
@@ -881,7 +881,7 @@ static void vti6_dev_setup(struct net_device *dev)
        dev->priv_destructor = vti6_dev_free;
        dev->type = ARPHRD_TUNNEL6;
-        dev->min_mtu = IPV6_MIN_MTU;
+        dev->min_mtu = IPV4_MIN_MTU;
        dev->max_mtu = IP_MAX_MTU - sizeof(struct ipv6hdr);
        dev->flags |= IFF_NOARP;
        dev->addr_len = sizeof(struct in6_addr);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0056ae766d93..2839c1bd1e58 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -148,9 +148,9 @@ static int compute_score(struct sock *sk, struct net *net,
                bool dev_match = (sk->sk_bound_dev_if == dif ||
                                  sk->sk_bound_dev_if == sdif);
-                if (exact_dif && !dev_match)
+                if (!dev_match)
                        return -1;
-                if (sk->sk_bound_dev_if && dev_match)
+                if (sk->sk_bound_dev_if)
                        score++;
        }
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index f85f0d7480ac..4a46df8441c9 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -341,6 +341,9 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        unsigned int i;
+        xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+        xfrm_flush_gc();
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
                WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 7e2e7188e7f4..e62e52e8f141 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -437,6 +437,24 @@ static int verify_address_len(const void *p)
        return 0;
 }
+static inline int sadb_key_len(const struct sadb_key *key)
+{
+        int key_bytes = DIV_ROUND_UP(key->sadb_key_bits, 8);
+        return DIV_ROUND_UP(sizeof(struct sadb_key) + key_bytes,
+                            sizeof(uint64_t));
+}
+static int verify_key_len(const void *p)
+{
+        const struct sadb_key *key = p;
+        if (sadb_key_len(key) > key->sadb_key_len)
+                return -EINVAL;
+        return 0;
+}
 static inline int pfkey_sec_ctx_len(const struct sadb_x_sec_ctx *sec_ctx)
 {
        return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) +
@@ -533,16 +551,25 @@ static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void *
                                return -EINVAL;
                        if (ext_hdrs[ext_type-1] != NULL)
                                return -EINVAL;
-                        if (ext_type == SADB_EXT_ADDRESS_SRC ||
+                        switch (ext_type) {
-                            ext_type == SADB_EXT_ADDRESS_DST ||
+                        case SADB_EXT_ADDRESS_SRC:
-                            ext_type == SADB_EXT_ADDRESS_PROXY ||
+                        case SADB_EXT_ADDRESS_DST:
-                            ext_type == SADB_X_EXT_NAT_T_OA) {
+                        case SADB_EXT_ADDRESS_PROXY:
+                        case SADB_X_EXT_NAT_T_OA:
                                if (verify_address_len(p))
                                        return -EINVAL;
-                        }
+                                break;
-                        if (ext_type == SADB_X_EXT_SEC_CTX) {
+                        case SADB_X_EXT_SEC_CTX:
                                if (verify_sec_ctx_len(p))
                                        return -EINVAL;
+                                break;
+                        case SADB_EXT_KEY_AUTH:
+                        case SADB_EXT_KEY_ENCRYPT:
+                                if (verify_key_len(p))
+                                        return -EINVAL;
+                                break;
+                        default:
+                                break;
                        }
                        ext_hdrs[ext_type-1] = (void *) p;
                }
@@ -1104,14 +1131,12 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
        key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
        if (key != NULL &&
            sa->sadb_sa_auth != SADB_X_AALG_NULL &&
-            ((key->sadb_key_bits+7) / 8 == 0 ||
+            key->sadb_key_bits == 0)
-             (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
                return ERR_PTR(-EINVAL);
        key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
        if (key != NULL &&
            sa->sadb_sa_encrypt != SADB_EALG_NULL &&
-            ((key->sadb_key_bits+7) / 8 == 0 ||
+            key->sadb_key_bits == 0)
-             (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
                return ERR_PTR(-EINVAL);
        x = xfrm_state_alloc(net);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index cb80ebb38311..1beeea9549fa 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -930,6 +930,9 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
        if (size > llc->dev->mtu)
                size = llc->dev->mtu;
        copied = size - hdrlen;
+        rc = -EINVAL;
+        if (copied < 0)
+                goto release;
        release_sock(sk);
        skb = sock_alloc_send_skb(sk, size, noblock, &rc);
        lock_sock(sk);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 595c662a61e8..ac4295296514 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,6 +8,7 @@
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
 * Copyright(c) 2015-2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -970,6 +971,9 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                sta->ampdu_mlme.addba_req_num[tid] = 0;
+                tid_tx->timeout =
+                        le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
                if (tid_tx->timeout) {
                        mod_timer(&tid_tx->session_timer,
                                  TU_TO_EXP_TIME(tid_tx->timeout));
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 69449db7e283..233068756502 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -36,6 +36,7 @@
 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
+#define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
 #define IEEE80211_AUTH_MAX_TRIES        3
 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
@@ -1787,7 +1788,7 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                params[ac].acm = acm;
                params[ac].uapsd = uapsd;
-                if (params->cw_min == 0 ||
+                if (params[ac].cw_min == 0 ||
                    params[ac].cw_min > params[ac].cw_max) {
                        sdata_info(sdata,
                                   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
@@ -3814,16 +3815,19 @@ static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
                            tx_flags);
        if (tx_flags == 0) {
-                auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+                if (auth_data->algorithm == WLAN_AUTH_SAE)
-                auth_data->timeout_started = true;
+                        auth_data->timeout = jiffies +
-                run_again(sdata, auth_data->timeout);
+                                IEEE80211_AUTH_TIMEOUT_SAE;
+                else
+                        auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
        } else {
                auth_data->timeout =
                        round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
-                auth_data->timeout_started = true;
-                run_again(sdata, auth_data->timeout);
        }
+        auth_data->timeout_started = true;
+        run_again(sdata, auth_data->timeout);
        return 0;
 }
@@ -3894,8 +3898,15 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                ifmgd->status_received = false;
                if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
                        if (status_acked) {
-                                ifmgd->auth_data->timeout =
+                                if (ifmgd->auth_data->algorithm ==
-                                        jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
+                                    WLAN_AUTH_SAE)
+                                        ifmgd->auth_data->timeout =
+                                                jiffies +
+                                                IEEE80211_AUTH_TIMEOUT_SAE;
+                                else
+                                        ifmgd->auth_data->timeout =
+                                                jiffies +
+                                                IEEE80211_AUTH_TIMEOUT_SHORT;
                                run_again(sdata, ifmgd->auth_data->timeout);
                        } else {
                                ifmgd->auth_data->timeout = jiffies - 1;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 535de3161a78..05a265cd573d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4,6 +4,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
 * Copyright 2013-2014  Intel Mobile Communications GmbH
+ * Copyright (C) 2018 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -1135,7 +1136,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
        }
        /* reset session timer */
-        if (reset_agg_timer && tid_tx->timeout)
+        if (reset_agg_timer)
                tid_tx->last_tx = jiffies;
        return queued;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 55342c4d5cec..2e2dd88fc79f 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2606,13 +2606,13 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
 {
        if (v == SEQ_START_TOKEN) {
                seq_puts(seq,
-                         "sk       Eth Pid    Groups   "
+                         "sk               Eth Pid        Groups   "
-                         "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
+                         "Rmem     Wmem     Dump  Locks    Drops    Inode\n");
        } else {
                struct sock *s = v;
                struct netlink_sock *nlk = nlk_sk(s);
-                seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
+                seq_printf(seq, "%pK %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8d %-8lu\n",
                           s,
                           s->sk_protocol,
                           nlk->portid,
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index d7da99a0b0b8..9696ef96b719 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -57,6 +57,8 @@ int nsh_pop(struct sk_buff *skb)
                return -ENOMEM;
        nh = (struct nshhdr *)(skb->data);
        length = nsh_hdr_len(nh);
+        if (length < NSH_BASE_HDR_LEN)
+                return -EINVAL;
        inner_proto = tun_p_to_eth_p(nh->np);
        if (!pskb_may_pull(skb, length))
                return -ENOMEM;
@@ -90,6 +92,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
        if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
                goto out;
        nsh_len = nsh_hdr_len(nsh_hdr(skb));
+        if (nsh_len < NSH_BASE_HDR_LEN)
+                goto out;
        if (unlikely(!pskb_may_pull(skb, nsh_len)))
                goto out;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 7322aa1e382e..492ab0c36f7c 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1712,13 +1712,10 @@ static void nlattr_set(struct nlattr *attr, u8 val,
        /* The nlattr stream should already have been validated */
        nla_for_each_nested(nla, attr, rem) {
-                if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) {
+                if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
-                        if (tbl[nla_type(nla)].next)
+                        nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl);
-                                tbl = tbl[nla_type(nla)].next;
+                else
-                        nlattr_set(nla, val, tbl);
-                } else {
                        memset(nla_data(nla), val, nla_len(nla));
-                }
                if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE)
                        *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index 41bd496531d4..00192a996be0 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -137,13 +137,18 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
        ret = rfkill_register(rfkill->rfkill_dev);
        if (ret < 0)
-                return ret;
+                goto err_destroy;
        platform_set_drvdata(pdev, rfkill);
        dev_info(&pdev->dev, "%s device registered.\n", rfkill->name);
        return 0;
+err_destroy:
+        rfkill_destroy(rfkill->rfkill_dev);
+        return ret;
 }
 static int rfkill_gpio_remove(struct platform_device *pdev)
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 9a2c8e7c000e..2b463047dd7b 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -313,7 +313,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
        memset(&cp, 0, sizeof(cp));
        cp.local                = rx->local;
        cp.key                  = key;
-        cp.security_level       = 0;
+        cp.security_level       = rx->min_sec_level;
        cp.exclusive            = false;
        cp.upgrade              = upgrade;
        cp.service_id           = srx->srx_service;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 90d7079e0aa9..19975d2ca9a2 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -476,6 +476,7 @@ enum rxrpc_call_flag {
        RXRPC_CALL_SEND_PING,           /* A ping will need to be sent */
        RXRPC_CALL_PINGING,             /* Ping in process */
        RXRPC_CALL_RETRANS_TIMEOUT,     /* Retransmission due to timeout occurred */
+        RXRPC_CALL_BEGAN_RX_TIMER,      /* We began the expect_rx_by timer */
 };
 /*
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index c717152070df..1350f1be8037 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -40,7 +40,7 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
        } __attribute__((packed)) pkt;
        struct rxrpc_ackinfo ack_info;
        size_t len;
-        int ioc;
+        int ret, ioc;
        u32 serial, mtu, call_id, padding;
        _enter("%d", conn->debug_id);
@@ -135,10 +135,13 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
                break;
        }
-        kernel_sendmsg(conn->params.local->socket, &msg, iov, ioc, len);
+        ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, ioc, len);
        conn->params.peer->last_tx_at = ktime_get_real();
+        if (ret < 0)
+                trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
+                                    rxrpc_tx_fail_call_final_resend);
        _leave("");
-        return;
 }
 /*
@@ -236,6 +239,8 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
        ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
        if (ret < 0) {
+                trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
+                                    rxrpc_tx_fail_conn_abort);
                _debug("sendmsg failed: %d", ret);
                return -EAGAIN;
        }
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 0410d2277ca2..b5fd6381313d 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -971,7 +971,7 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
        if (timo) {
                unsigned long now = jiffies, expect_rx_by;
-                expect_rx_by = jiffies + timo;
+                expect_rx_by = now + timo;
                WRITE_ONCE(call->expect_rx_by, expect_rx_by);
                rxrpc_reduce_call_timer(call, expect_rx_by, now,
                                        rxrpc_timer_set_for_normal);
diff --git a/net/rxrpc/local_event.c b/net/rxrpc/local_event.c
index 93b5d910b4a1..8325f1b86840 100644
--- a/net/rxrpc/local_event.c
+++ b/net/rxrpc/local_event.c
@@ -71,7 +71,8 @@ static void rxrpc_send_version_request(struct rxrpc_local *local,
        ret = kernel_sendmsg(local->socket, &msg, iov, 2, len);
        if (ret < 0)
-                _debug("sendmsg failed: %d", ret);
+                trace_rxrpc_tx_fail(local->debug_id, 0, ret,
+                                    rxrpc_tx_fail_version_reply);
        _leave("");
 }
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 8b54e9531d52..b493e6b62740 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -134,22 +134,49 @@ static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net)
                }
        }
-        /* we want to receive ICMP errors */
+        switch (local->srx.transport.family) {
-        opt = 1;
+        case AF_INET:
-        ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
+                /* we want to receive ICMP errors */
-                                (char *) &opt, sizeof(opt));
+                opt = 1;
-        if (ret < 0) {
+                ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
-                _debug("setsockopt failed");
+                                        (char *) &opt, sizeof(opt));
-                goto error;
+                if (ret < 0) {
-        }
+                        _debug("setsockopt failed");
+                        goto error;
+                }
-        /* we want to set the don't fragment bit */
+                /* we want to set the don't fragment bit */
-        opt = IP_PMTUDISC_DO;
+                opt = IP_PMTUDISC_DO;
-        ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
+                ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
-                                (char *) &opt, sizeof(opt));
+                                        (char *) &opt, sizeof(opt));
-        if (ret < 0) {
+                if (ret < 0) {
-                _debug("setsockopt failed");
+                        _debug("setsockopt failed");
-                goto error;
+                        goto error;
+                }
+                break;
+        case AF_INET6:
+                /* we want to receive ICMP errors */
+                opt = 1;
+                ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR,
+                                        (char *) &opt, sizeof(opt));
+                if (ret < 0) {
+                        _debug("setsockopt failed");
+                        goto error;
+                }
+                /* we want to set the don't fragment bit */
+                opt = IPV6_PMTUDISC_DO;
+                ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
+                                        (char *) &opt, sizeof(opt));
+                if (ret < 0) {
+                        _debug("setsockopt failed");
+                        goto error;
+                }
+                break;
+        default:
+                BUG();
        }
        /* set the socket up */
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 7f1fc04775b3..f03de1c59ba3 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -210,6 +210,9 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
        if (ping)
                call->ping_time = now;
        conn->params.peer->last_tx_at = ktime_get_real();
+        if (ret < 0)
+                trace_rxrpc_tx_fail(call->debug_id, serial, ret,
+                                    rxrpc_tx_fail_call_ack);
        if (call->state < RXRPC_CALL_COMPLETE) {
                if (ret < 0) {
@@ -294,6 +297,10 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
        ret = kernel_sendmsg(conn->params.local->socket,
                             &msg, iov, 1, sizeof(pkt));
        conn->params.peer->last_tx_at = ktime_get_real();
+        if (ret < 0)
+                trace_rxrpc_tx_fail(call->debug_id, serial, ret,
+                                    rxrpc_tx_fail_call_abort);
        rxrpc_put_connection(conn);
        return ret;
@@ -387,6 +394,9 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
        conn->params.peer->last_tx_at = ktime_get_real();
        up_read(&conn->params.local->defrag_sem);
+        if (ret < 0)
+                trace_rxrpc_tx_fail(call->debug_id, serial, ret,
+                                    rxrpc_tx_fail_call_data_nofrag);
        if (ret == -EMSGSIZE)
                goto send_fragmentable;
@@ -414,6 +424,17 @@ done:
                                                        rxrpc_timer_set_for_lost_ack);
                        }
                }
+                if (sp->hdr.seq == 1 &&
+                    !test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER,
+                                      &call->flags)) {
+                        unsigned long nowj = jiffies, expect_rx_by;
+                        expect_rx_by = nowj + call->next_rx_timo;
+                        WRITE_ONCE(call->expect_rx_by, expect_rx_by);
+                        rxrpc_reduce_call_timer(call, expect_rx_by, nowj,
+                                                rxrpc_timer_set_for_normal);
+                }
        }
        rxrpc_set_keepalive(call);
@@ -465,6 +486,10 @@ send_fragmentable:
 #endif
        }
+        if (ret < 0)
+                trace_rxrpc_tx_fail(call->debug_id, serial, ret,
+                                    rxrpc_tx_fail_call_data_frag);
        up_write(&conn->params.local->defrag_sem);
        goto done;
 }
@@ -482,6 +507,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
        struct kvec iov[2];
        size_t size;
        __be32 code;
+        int ret;
        _enter("%d", local->debug_id);
@@ -516,7 +542,10 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
                        whdr.flags      ^= RXRPC_CLIENT_INITIATED;
                        whdr.flags      &= RXRPC_CLIENT_INITIATED;
-                        kernel_sendmsg(local->socket, &msg, iov, 2, size);
+                        ret = kernel_sendmsg(local->socket, &msg, iov, 2, size);
+                        if (ret < 0)
+                                trace_rxrpc_tx_fail(local->debug_id, 0, ret,
+                                                    rxrpc_tx_fail_reject);
                }
                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
@@ -567,7 +596,8 @@ void rxrpc_send_keepalive(struct rxrpc_peer *peer)
        ret = kernel_sendmsg(peer->local->socket, &msg, iov, 2, len);
        if (ret < 0)
-                _debug("sendmsg failed: %d", ret);
+                trace_rxrpc_tx_fail(peer->debug_id, 0, ret,
+                                    rxrpc_tx_fail_version_keepalive);
        peer->last_tx_at = ktime_get_real();
        _leave("");
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index 78c2f95d1f22..0ed8b651cec2 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -28,39 +28,39 @@ static void rxrpc_store_error(struct rxrpc_peer *, struct sock_exterr_skb *);
 * Find the peer associated with an ICMP packet.
 */
 static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local,
-                                                     const struct sk_buff *skb)
+                                                     const struct sk_buff *skb,
+                                                     struct sockaddr_rxrpc *srx)
 {
        struct sock_exterr_skb *serr = SKB_EXT_ERR(skb);
-        struct sockaddr_rxrpc srx;
        _enter("");
-        memset(&srx, 0, sizeof(srx));
+        memset(srx, 0, sizeof(*srx));
-        srx.transport_type = local->srx.transport_type;
+        srx->transport_type = local->srx.transport_type;
-        srx.transport_len = local->srx.transport_len;
+        srx->transport_len = local->srx.transport_len;
-        srx.transport.family = local->srx.transport.family;
+        srx->transport.family = local->srx.transport.family;
        /* Can we see an ICMP4 packet on an ICMP6 listening socket?  and vice
         * versa?
         */
-        switch (srx.transport.family) {
+        switch (srx->transport.family) {
        case AF_INET:
-                srx.transport.sin.sin_port = serr->port;
+                srx->transport.sin.sin_port = serr->port;
                switch (serr->ee.ee_origin) {
                case SO_EE_ORIGIN_ICMP:
                        _net("Rx ICMP");
-                        memcpy(&srx.transport.sin.sin_addr,
+                        memcpy(&srx->transport.sin.sin_addr,
                               skb_network_header(skb) + serr->addr_offset,
                               sizeof(struct in_addr));
                        break;
                case SO_EE_ORIGIN_ICMP6:
                        _net("Rx ICMP6 on v4 sock");
-                        memcpy(&srx.transport.sin.sin_addr,
+                        memcpy(&srx->transport.sin.sin_addr,
                               skb_network_header(skb) + serr->addr_offset + 12,
                               sizeof(struct in_addr));
                        break;
                default:
-                        memcpy(&srx.transport.sin.sin_addr, &ip_hdr(skb)->saddr,
+                        memcpy(&srx->transport.sin.sin_addr, &ip_hdr(skb)->saddr,
                               sizeof(struct in_addr));
                        break;
                }
@@ -68,25 +68,25 @@ static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local,
 #ifdef CONFIG_AF_RXRPC_IPV6
        case AF_INET6:
-                srx.transport.sin6.sin6_port = serr->port;
+                srx->transport.sin6.sin6_port = serr->port;
                switch (serr->ee.ee_origin) {
                case SO_EE_ORIGIN_ICMP6:
                        _net("Rx ICMP6");
-                        memcpy(&srx.transport.sin6.sin6_addr,
+                        memcpy(&srx->transport.sin6.sin6_addr,
                               skb_network_header(skb) + serr->addr_offset,
                               sizeof(struct in6_addr));
                        break;
                case SO_EE_ORIGIN_ICMP:
                        _net("Rx ICMP on v6 sock");
-                        srx.transport.sin6.sin6_addr.s6_addr32[0] = 0;
+                        srx->transport.sin6.sin6_addr.s6_addr32[0] = 0;
-                        srx.transport.sin6.sin6_addr.s6_addr32[1] = 0;
+                        srx->transport.sin6.sin6_addr.s6_addr32[1] = 0;
-                        srx.transport.sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
+                        srx->transport.sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
-                        memcpy(srx.transport.sin6.sin6_addr.s6_addr + 12,
+                        memcpy(srx->transport.sin6.sin6_addr.s6_addr + 12,
                               skb_network_header(skb) + serr->addr_offset,
                               sizeof(struct in_addr));
                        break;
                default:
-                        memcpy(&srx.transport.sin6.sin6_addr,
+                        memcpy(&srx->transport.sin6.sin6_addr,
                               &ipv6_hdr(skb)->saddr,
                               sizeof(struct in6_addr));
                        break;
@@ -98,7 +98,7 @@ static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local,
                BUG();
        }
-        return rxrpc_lookup_peer_rcu(local, &srx);
+        return rxrpc_lookup_peer_rcu(local, srx);
 }
 /*
@@ -146,6 +146,7 @@ static void rxrpc_adjust_mtu(struct rxrpc_peer *peer, struct sock_exterr_skb *se
 void rxrpc_error_report(struct sock *sk)
 {
        struct sock_exterr_skb *serr;
+        struct sockaddr_rxrpc srx;
        struct rxrpc_local *local = sk->sk_user_data;
        struct rxrpc_peer *peer;
        struct sk_buff *skb;
@@ -166,7 +167,7 @@ void rxrpc_error_report(struct sock *sk)
        }
        rcu_read_lock();
-        peer = rxrpc_lookup_peer_icmp_rcu(local, skb);
+        peer = rxrpc_lookup_peer_icmp_rcu(local, skb, &srx);
        if (peer && !rxrpc_get_peer_maybe(peer))
                peer = NULL;
        if (!peer) {
@@ -176,6 +177,8 @@ void rxrpc_error_report(struct sock *sk)
                return;
        }
+        trace_rxrpc_rx_icmp(peer, &serr->ee, &srx);
        if ((serr->ee.ee_origin == SO_EE_ORIGIN_ICMP &&
             serr->ee.ee_type == ICMP_DEST_UNREACH &&
             serr->ee.ee_code == ICMP_FRAG_NEEDED)) {
@@ -209,9 +212,6 @@ static void rxrpc_store_error(struct rxrpc_peer *peer,
        ee = &serr->ee;
-        _net("Rx Error o=%d t=%d c=%d e=%d",
-             ee->ee_origin, ee->ee_type, ee->ee_code, ee->ee_errno);
        err = ee->ee_errno;
        switch (ee->ee_origin) {
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 588fea0dd362..6c0ae27fff84 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -664,7 +664,8 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
        ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
        if (ret < 0) {
-                _debug("sendmsg failed: %d", ret);
+                trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
+                                    rxrpc_tx_fail_conn_challenge);
                return -EAGAIN;
        }
@@ -719,7 +720,8 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
        ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 3, len);
        if (ret < 0) {
-                _debug("sendmsg failed: %d", ret);
+                trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
+                                    rxrpc_tx_fail_conn_response);
                return -EAGAIN;
        }
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 206e802ccbdc..be01f9c5d963 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -223,6 +223,15 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
        ret = rxrpc_send_data_packet(call, skb, false);
        if (ret < 0) {
+                switch (ret) {
+                case -ENETUNREACH:
+                case -EHOSTUNREACH:
+                case -ECONNREFUSED:
+                        rxrpc_set_call_completion(call,
+                                                  RXRPC_CALL_LOCAL_ERROR,
+                                                  0, ret);
+                        goto out;
+                }
                _debug("need instant resend %d", ret);
                rxrpc_instant_resend(call, ix);
        } else {
@@ -241,6 +250,7 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
                                        rxrpc_timer_set_for_send);
        }
+out:
        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
        _leave("");
 }
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index ddf69fc01bdf..6138d1d71900 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -121,7 +121,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                return 0;
        if (!flags) {
-                tcf_idr_release(*a, bind);
+                if (exists)
+                        tcf_idr_release(*a, bind);
                return -EINVAL;
        }
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index bbcbdce732cc..ad050d7d4b46 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -131,8 +131,11 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
        if (exists && bind)
                return 0;
-        if (!lflags)
+        if (!lflags) {
+                if (exists)
+                        tcf_idr_release(*a, bind);
                return -EINVAL;
+        }
        if (!exists) {
                ret = tcf_idr_create(tn, parm->index, est, a,
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index b66754f52a9f..963e4bf0aab8 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -152,8 +152,8 @@ static struct tcf_proto *tcf_proto_create(const char *kind, u32 protocol,
                        NL_SET_ERR_MSG(extack, "TC classifier not found");
                        err = -ENOENT;
                }
-                goto errout;
 #endif
+                goto errout;
        }
        tp->classify = tp->ops->classify;
        tp->protocol = protocol;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 039fdb862b17..5d5a16204d50 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -986,8 +986,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
        struct sctp_endpoint *ep;
        struct sctp_chunk *chunk;
        struct sctp_inq *inqueue;
-        int state;
+        int first_time = 1;     /* is this the first time through the loop */
        int error = 0;
+        int state;
        /* The association should be held so we should be safe. */
        ep = asoc->ep;
@@ -998,6 +999,30 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
                state = asoc->state;
                subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type);
+                /* If the first chunk in the packet is AUTH, do special
+                 * processing specified in Section 6.3 of SCTP-AUTH spec
+                 */
+                if (first_time && subtype.chunk == SCTP_CID_AUTH) {
+                        struct sctp_chunkhdr *next_hdr;
+                        next_hdr = sctp_inq_peek(inqueue);
+                        if (!next_hdr)
+                                goto normal;
+                        /* If the next chunk is COOKIE-ECHO, skip the AUTH
+                         * chunk while saving a pointer to it so we can do
+                         * Authentication later (during cookie-echo
+                         * processing).
+                         */
+                        if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
+                                chunk->auth_chunk = skb_clone(chunk->skb,
+                                                              GFP_ATOMIC);
+                                chunk->auth = 1;
+                                continue;
+                        }
+                }
+normal:
                /* SCTP-AUTH, Section 6.3:
                 *    The receiver has a list of chunk types which it expects
                 *    to be received only after an AUTH-chunk.  This list has
@@ -1036,6 +1061,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
                /* If there is an error on chunk, discard this packet. */
                if (error && chunk)
                        chunk->pdiscard = 1;
+                if (first_time)
+                        first_time = 0;
        }
        sctp_association_put(asoc);
 }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 4d7b3ccea078..4a4fd1971255 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1131,7 +1131,7 @@ struct sctp_chunk *sctp_make_violation_max_retrans(
                                        const struct sctp_association *asoc,
                                        const struct sctp_chunk *chunk)
 {
-        static const char error[] = "Association exceeded its max_retans count";
+        static const char error[] = "Association exceeded its max_retrans count";
        size_t payload_len = sizeof(error) + sizeof(struct sctp_errhdr);
        struct sctp_chunk *retval;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 28c070e187c2..c9ae3404b1bb 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -153,10 +153,7 @@ static enum sctp_disposition sctp_sf_violation_chunk(
                                        struct sctp_cmd_seq *commands);
 static enum sctp_ierror sctp_sf_authenticate(
-                                        struct net *net,
-                                        const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
-                                        const union sctp_subtype type,
                                        struct sctp_chunk *chunk);
 static enum sctp_disposition __sctp_sf_do_9_1_abort(
@@ -626,6 +623,38 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
        return SCTP_DISPOSITION_CONSUME;
 }
+static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
+                                   const struct sctp_association *asoc)
+{
+        struct sctp_chunk auth;
+        if (!chunk->auth_chunk)
+                return true;
+        /* SCTP-AUTH:  auth_chunk pointer is only set when the cookie-echo
+         * is supposed to be authenticated and we have to do delayed
+         * authentication.  We've just recreated the association using
+         * the information in the cookie and now it's much easier to
+         * do the authentication.
+         */
+        /* Make sure that we and the peer are AUTH capable */
+        if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
+                return false;
+        /* set-up our fake chunk so that we can process it */
+        auth.skb = chunk->auth_chunk;
+        auth.asoc = chunk->asoc;
+        auth.sctp_hdr = chunk->sctp_hdr;
+        auth.chunk_hdr = (struct sctp_chunkhdr *)
+                                skb_push(chunk->auth_chunk,
+                                         sizeof(struct sctp_chunkhdr));
+        skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
+        auth.transport = chunk->transport;
+        return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR;
+}
 /*
 * Respond to a normal COOKIE ECHO chunk.
 * We are the side that is being asked for an association.
@@ -763,37 +792,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
        if (error)
                goto nomem_init;
-        /* SCTP-AUTH:  auth_chunk pointer is only set when the cookie-echo
+        if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) {
-         * is supposed to be authenticated and we have to do delayed
+                sctp_association_free(new_asoc);
-         * authentication.  We've just recreated the association using
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-         * the information in the cookie and now it's much easier to
-         * do the authentication.
-         */
-        if (chunk->auth_chunk) {
-                struct sctp_chunk auth;
-                enum sctp_ierror ret;
-                /* Make sure that we and the peer are AUTH capable */
-                if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
-                        sctp_association_free(new_asoc);
-                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-                }
-                /* set-up our fake chunk so that we can process it */
-                auth.skb = chunk->auth_chunk;
-                auth.asoc = chunk->asoc;
-                auth.sctp_hdr = chunk->sctp_hdr;
-                auth.chunk_hdr = (struct sctp_chunkhdr *)
-                                        skb_push(chunk->auth_chunk,
-                                                 sizeof(struct sctp_chunkhdr));
-                skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
-                auth.transport = chunk->transport;
-                ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
-                if (ret != SCTP_IERROR_NO_ERROR) {
-                        sctp_association_free(new_asoc);
-                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-                }
        }
        repl = sctp_make_cookie_ack(new_asoc, chunk);
@@ -1797,13 +1798,15 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
                goto nomem;
+        if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
+                return SCTP_DISPOSITION_DISCARD;
        /* Make sure no new addresses are being added during the
         * restart.  Though this is a pretty complicated attack
         * since you'd have to get inside the cookie.
         */
-        if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
+        if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands))
                return SCTP_DISPOSITION_CONSUME;
-        }
        /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
         * the peer has restarted (Action A), it MUST NOT setup a new
@@ -1912,6 +1915,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_b(
        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
                goto nomem;
+        if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
+                return SCTP_DISPOSITION_DISCARD;
        /* Update the content of current association.  */
        sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
@@ -2009,6 +2015,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_d(
         * a COOKIE ACK.
         */
+        if (!sctp_auth_chunk_verify(net, chunk, asoc))
+                return SCTP_DISPOSITION_DISCARD;
        /* Don't accidentally move back into established state. */
        if (asoc->state < SCTP_STATE_ESTABLISHED) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
@@ -4171,10 +4180,7 @@ gen_shutdown:
 * The return value is the disposition of the chunk.
 */
 static enum sctp_ierror sctp_sf_authenticate(
-                                        struct net *net,
-                                        const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
-                                        const union sctp_subtype type,
                                        struct sctp_chunk *chunk)
 {
        struct sctp_shared_key *sh_key = NULL;
@@ -4275,7 +4281,7 @@ enum sctp_disposition sctp_sf_eat_auth(struct net *net,
                                                  commands);
        auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
-        error = sctp_sf_authenticate(net, ep, asoc, type, chunk);
+        error = sctp_sf_authenticate(asoc, chunk);
        switch (error) {
        case SCTP_IERROR_AUTH_BAD_HMAC:
                /* Generate the ERROR chunk and discard the rest
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 84207ad33e8e..8cb7d9858270 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -715,7 +715,6 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
        return event;
 fail_mark:
-        sctp_chunk_put(chunk);
        kfree_skb(skb);
 fail:
        return NULL;
diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c
index 5cc68a824f45..f2f63959fddd 100644
--- a/net/sunrpc/xprtrdma/fmr_ops.c
+++ b/net/sunrpc/xprtrdma/fmr_ops.c
@@ -72,6 +72,7 @@ fmr_op_init_mr(struct rpcrdma_ia *ia, struct rpcrdma_mr *mr)
        if (IS_ERR(mr->fmr.fm_mr))
                goto out_fmr_err;
+        INIT_LIST_HEAD(&mr->mr_list);
        return 0;
 out_fmr_err:
@@ -102,10 +103,6 @@ fmr_op_release_mr(struct rpcrdma_mr *mr)
        LIST_HEAD(unmap_list);
        int rc;
-        /* Ensure MW is not on any rl_registered list */
-        if (!list_empty(&mr->mr_list))
-                list_del(&mr->mr_list);
        kfree(mr->fmr.fm_physaddrs);
        kfree(mr->mr_sg);
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index c5743a0960be..c59c5c788db0 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -110,6 +110,7 @@ frwr_op_init_mr(struct rpcrdma_ia *ia, struct rpcrdma_mr *mr)
        if (!mr->mr_sg)
                goto out_list_err;
+        INIT_LIST_HEAD(&mr->mr_list);
        sg_init_table(mr->mr_sg, depth);
        init_completion(&frwr->fr_linv_done);
        return 0;
@@ -133,10 +134,6 @@ frwr_op_release_mr(struct rpcrdma_mr *mr)
 {
        int rc;
-        /* Ensure MR is not on any rl_registered list */
-        if (!list_empty(&mr->mr_list))
-                list_del(&mr->mr_list);
        rc = ib_dereg_mr(mr->frwr.fr_mr);
        if (rc)
                pr_err("rpcrdma: final ib_dereg_mr for %p returned %i\n",
@@ -195,7 +192,7 @@ frwr_op_recover_mr(struct rpcrdma_mr *mr)
        return;
 out_release:
-        pr_err("rpcrdma: FRWR reset failed %d, %p release\n", rc, mr);
+        pr_err("rpcrdma: FRWR reset failed %d, %p released\n", rc, mr);
        r_xprt->rx_stats.mrs_orphaned++;
        spin_lock(&r_xprt->rx_buf.rb_mrlock);
@@ -476,7 +473,7 @@ frwr_op_reminv(struct rpcrdma_rep *rep, struct list_head *mrs)
        list_for_each_entry(mr, mrs, mr_list)
                if (mr->mr_handle == rep->rr_inv_rkey) {
-                        list_del(&mr->mr_list);
+                        list_del_init(&mr->mr_list);
                        trace_xprtrdma_remoteinv(mr);
                        mr->frwr.fr_state = FRWR_IS_INVALID;
                        rpcrdma_mr_unmap_and_put(mr);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index fe5eaca2d197..c345d365af88 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1254,6 +1254,11 @@ rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf)
                list_del(&mr->mr_all);
                spin_unlock(&buf->rb_mrlock);
+                /* Ensure MW is not on any rl_registered list */
+                if (!list_empty(&mr->mr_list))
+                        list_del(&mr->mr_list);
                ia->ri_ops->ro_release_mr(mr);
                count++;
                spin_lock(&buf->rb_mrlock);
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 3d3b423fa9c1..cb41b12a3bf8 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -380,7 +380,7 @@ rpcrdma_mr_pop(struct list_head *list)
        struct rpcrdma_mr *mr;
        mr = list_first_entry(list, struct rpcrdma_mr, mr_list);
-        list_del(&mr->mr_list);
+        list_del_init(&mr->mr_list);
        return mr;
 }
diff --git a/net/tipc/node.c b/net/tipc/node.c
index b0b840084f0a..6a44eb812baf 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1977,6 +1977,7 @@ out:
 int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info)
 {
        struct net *net = genl_info_net(info);
+        struct nlattr *attrs[TIPC_NLA_LINK_MAX + 1];
        struct tipc_nl_msg msg;
        char *name;
        int err;
@@ -1984,9 +1985,19 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info)
        msg.portid = info->snd_portid;
        msg.seq = info->snd_seq;
-        if (!info->attrs[TIPC_NLA_LINK_NAME])
+        if (!info->attrs[TIPC_NLA_LINK])
                return -EINVAL;
-        name = nla_data(info->attrs[TIPC_NLA_LINK_NAME]);
+        err = nla_parse_nested(attrs, TIPC_NLA_LINK_MAX,
+                               info->attrs[TIPC_NLA_LINK],
+                               tipc_nl_link_policy, info->extack);
+        if (err)
+                return err;
+        if (!attrs[TIPC_NLA_LINK_NAME])
+                return -EINVAL;
+        name = nla_data(attrs[TIPC_NLA_LINK_NAME]);
        msg.skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
        if (!msg.skb)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index c4992002fd68..930852c54d7a 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1516,10 +1516,10 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
        srcaddr->sock.family = AF_TIPC;
        srcaddr->sock.addrtype = TIPC_ADDR_ID;
+        srcaddr->sock.scope = 0;
        srcaddr->sock.addr.id.ref = msg_origport(hdr);
        srcaddr->sock.addr.id.node = msg_orignode(hdr);
        srcaddr->sock.addr.name.domain = 0;
-        srcaddr->sock.scope = 0;
        m->msg_namelen = sizeof(struct sockaddr_tipc);
        if (!msg_in_group(hdr))
@@ -1528,6 +1528,7 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
        /* Group message users may also want to know sending member's id */
        srcaddr->member.family = AF_TIPC;
        srcaddr->member.addrtype = TIPC_ADDR_NAME;
+        srcaddr->member.scope = 0;
        srcaddr->member.addr.name.name.type = msg_nametype(hdr);
        srcaddr->member.addr.name.name.instance = TIPC_SKB_CB(skb)->orig_member;
        srcaddr->member.addr.name.domain = 0;
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 4b57ddd72f34..301f22430469 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -135,6 +135,7 @@ retry:
                        offset -= sg->offset;
                        ctx->partially_sent_offset = offset;
                        ctx->partially_sent_record = (void *)sg;
+                        ctx->in_tcp_sendpages = false;
                        return ret;
                }
@@ -248,16 +249,14 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
        struct tls_context *ctx = tls_get_ctx(sk);
        long timeo = sock_sndtimeo(sk, 0);
        void (*sk_proto_close)(struct sock *sk, long timeout);
+        bool free_ctx = false;
        lock_sock(sk);
        sk_proto_close = ctx->sk_proto_close;
-        if (ctx->tx_conf == TLS_HW_RECORD && ctx->rx_conf == TLS_HW_RECORD)
+        if ((ctx->tx_conf == TLS_HW_RECORD && ctx->rx_conf == TLS_HW_RECORD) ||
-                goto skip_tx_cleanup;
+            (ctx->tx_conf == TLS_BASE && ctx->rx_conf == TLS_BASE)) {
+                free_ctx = true;
-        if (ctx->tx_conf == TLS_BASE && ctx->rx_conf == TLS_BASE) {
-                kfree(ctx);
-                ctx = NULL;
                goto skip_tx_cleanup;
        }
@@ -305,8 +304,7 @@ skip_tx_cleanup:
        /* free ctx for TLS_HW_RECORD, used by tcp_set_state
         * for sk->sk_prot->unhash [tls_hw_unhash]
         */
-        if (ctx && ctx->tx_conf == TLS_HW_RECORD &&
+        if (free_ctx)
-            ctx->rx_conf == TLS_HW_RECORD)
                kfree(ctx);
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a6f3cac8c640..c0fd8a85e7f7 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -95,6 +95,9 @@ static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,
        ASSERT_RTNL();
+        if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)
+                return -EINVAL;
        /* prohibit calling the thing phy%d when %d is not its number */
        sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
        if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ff28f8feeb09..a052693c2e85 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9214,6 +9214,7 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
        if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
                if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
+                        kzfree(connkeys);
                        GENL_SET_ERR_MSG(info,
                                         "external auth requires connection ownership");
                        return -EINVAL;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 16c7e4ef5820..ac3e12c32aa3 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1026,6 +1026,7 @@ static int regdb_query_country(const struct fwdb_header *db,
                        if (!tmp_rd) {
                                kfree(regdom);
+                                kfree(wmm_ptrs);
                                return -ENOMEM;
                        }
                        regdom = tmp_rd;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f595797a20ce..8308281f3253 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2176,6 +2176,12 @@ struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
        return afinfo;
 }
+void xfrm_flush_gc(void)
+{
+        flush_work(&xfrm_state_gc_work);
+}
+EXPORT_SYMBOL(xfrm_flush_gc);
 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
 void xfrm_state_delete_tunnel(struct xfrm_state *x)
 {
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index b2a95af7df18..7f5c86246138 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -14,7 +14,7 @@ ifdef CONFIG_GCC_PLUGINS
  endif
  ifdef CONFIG_GCC_PLUGIN_SANCOV
-    ifeq ($(CFLAGS_KCOV),)
+    ifeq ($(strip $(CFLAGS_KCOV)),)
      # It is needed because of the gcc-plugin.sh and gcc version checks.
      gcc-plugin-$(CONFIG_GCC_PLUGIN_SANCOV)           += sancov_plugin.so
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 07d07409f16f..5af34a2b0cd9 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -196,7 +196,7 @@ $(obj)/%.tab.c: $(src)/%.y FORCE
        $(call if_changed,bison)
 quiet_cmd_bison_h = YACC    $@
-      cmd_bison_h = bison -o/dev/null --defines=$@ -t -l $<
+      cmd_bison_h = $(YACC) -o/dev/null --defines=$@ -t -l $<
 $(obj)/%.tab.h: $(src)/%.y FORCE
        $(call if_changed,bison_h)
diff --git a/scripts/dtc/checks.c b/scripts/dtc/checks.c
index c07ba4da9e36..815eaf140ab5 100644
--- a/scripts/dtc/checks.c
+++ b/scripts/dtc/checks.c
@@ -787,10 +787,9 @@ static void check_pci_bridge(struct check *c, struct dt_info *dti, struct node *
                FAIL(c, dti, node, "incorrect #size-cells for PCI bridge");
        prop = get_property(node, "bus-range");
-        if (!prop) {
+        if (!prop)
-                FAIL(c, dti, node, "missing bus-range for PCI bridge");
                return;
-        }
        if (prop->val.len != (sizeof(cell_t) * 2)) {
                FAIL_PROP(c, dti, node, prop, "value must be 2 cells");
                return;
diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
index 61d9b256c658..a1c51b7e4baf 100755
--- a/scripts/extract_xc3028.pl
+++ b/scripts/extract_xc3028.pl
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
-# Copyright (c) Mauro Carvalho Chehab <mchehab@infradead.org>
+# Copyright (c) Mauro Carvalho Chehab <mchehab@kernel.org>
 # Released under GPLv2
 #
 # In order to use, you need to:
diff --git a/scripts/genksyms/Makefile b/scripts/genksyms/Makefile
index ef0287e42957..03b7ce97de14 100644
--- a/scripts/genksyms/Makefile
+++ b/scripts/genksyms/Makefile
@@ -14,14 +14,14 @@ genksyms-objs	:= genksyms.o parse.tab.o lex.lex.o
 # so that 'bison: not found' will be displayed if it is missing.
 ifeq ($(findstring 1,$(KBUILD_ENABLE_EXTRA_GCC_CHECKS)),)
-quiet_cmd_bison_no_warn = $(quet_cmd_bison)
+quiet_cmd_bison_no_warn = $(quiet_cmd_bison)
      cmd_bison_no_warn = $(YACC) --version >/dev/null; \
                          $(cmd_bison) 2>/dev/null
 $(obj)/parse.tab.c: $(src)/parse.y FORCE
        $(call if_changed,bison_no_warn)
-quiet_cmd_bison_h_no_warn = $(quet_cmd_bison_h)
+quiet_cmd_bison_h_no_warn = $(quiet_cmd_bison_h)
      cmd_bison_h_no_warn = $(YACC) --version >/dev/null; \
                            $(cmd_bison_h) 2>/dev/null
diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index 944418da9fe3..0f6dcb4011a8 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -330,14 +330,7 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
                goto out;
        }
-        /* There will be a line like so:
+        /* Sum all files in the same dir or subdirs. */
-                deps_drivers/net/dummy.o := \
-                  drivers/net/dummy.c \
-                    $(wildcard include/config/net/fastroute.h) \
-                  include/linux/module.h \
-           Sum all files in the same dir or subdirs.
-        */
        while ((line = get_next_line(&pos, file, flen)) != NULL) {
                char* p = line;
diff --git a/scripts/split-man.pl b/scripts/split-man.pl
index bfe16cbe42df..c3db607ee9ec 100755
--- a/scripts/split-man.pl
+++ b/scripts/split-man.pl
@@ -1,7 +1,7 @@
 #!/usr/bin/perl
 # SPDX-License-Identifier: GPL-2.0
 #
-# Author: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+# Author: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
 #
 # Produce manpages from kernel-doc.
 # See Documentation/doc-guide/kernel-doc.rst for instructions
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 06d7c40af570..6491afbb5fd5 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -423,6 +423,8 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
                return -ENOTTY;
        if (substream->stream != dir)
                return -EINVAL;
+        if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN)
+                return -EBADFD;
        if ((ch = substream->runtime->channels) > 128)
                return -EINVAL;
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index f48a4cd24ffc..289ae6bb81d9 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -174,12 +174,12 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
                        }
                        return;
                }
+                spin_lock_irqsave(&substream->runtime->lock, flags);
                if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
                        if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
-                                return;
+                                goto out;
                        vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
                }
-                spin_lock_irqsave(&substream->runtime->lock, flags);
                while (1) {
                        count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
                        if (count <= 0)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 58e349fc893f..eab7f594ebe7 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -831,9 +831,11 @@ static int loopback_rate_shift_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].rate_shift;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
@@ -865,9 +867,11 @@ static int loopback_notify_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].notify;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
@@ -879,12 +883,14 @@ static int loopback_notify_put(struct snd_kcontrol *kcontrol,
        int change = 0;
        val = ucontrol->value.integer.value[0] ? 1 : 0;
+        mutex_lock(&loopback->cable_lock);
        if (val != loopback->setup[kcontrol->id.subdevice]
                                [kcontrol->id.device].notify) {
                loopback->setup[kcontrol->id.subdevice]
                        [kcontrol->id.device].notify = val;
                change = 1;
        }
+        mutex_unlock(&loopback->cable_lock);
        return change;
 }
@@ -892,15 +898,18 @@ static int loopback_active_get(struct snd_kcontrol *kcontrol,
                               struct snd_ctl_elem_value *ucontrol)
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
-        struct loopback_cable *cable = loopback->cables
+        struct loopback_cable *cable;
-                        [kcontrol->id.subdevice][kcontrol->id.device ^ 1];
        unsigned int val = 0;
+        mutex_lock(&loopback->cable_lock);
+        cable = loopback->cables[kcontrol->id.subdevice][kcontrol->id.device ^ 1];
        if (cable != NULL) {
                unsigned int running = cable->running ^ cable->pause;
                val = (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) ? 1 : 0;
        }
+        mutex_unlock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] = val;
        return 0;
 }
@@ -943,9 +952,11 @@ static int loopback_rate_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].rate;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
@@ -965,9 +976,11 @@ static int loopback_channels_get(struct snd_kcontrol *kcontrol,
 {
        struct loopback *loopback = snd_kcontrol_chip(kcontrol);
        
+        mutex_lock(&loopback->cable_lock);
        ucontrol->value.integer.value[0] =
                loopback->setup[kcontrol->id.subdevice]
                               [kcontrol->id.device].channels;
+        mutex_unlock(&loopback->cable_lock);
        return 0;
 }
diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
index 4a1dc145327b..cb9acfe60f6a 100644
--- a/sound/firewire/amdtp-stream.c
+++ b/sound/firewire/amdtp-stream.c
@@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(struct fw_iso_context *context,
        u32 cycle;
        unsigned int packets;
-        s->max_payload_length = amdtp_stream_get_max_payload(s);
        /*
         * For in-stream, first packet has come.
         * For out-stream, prepared to transmit first packet
@@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed)
        amdtp_stream_update(s);
+        if (s->direction == AMDTP_IN_STREAM)
+                s->max_payload_length = amdtp_stream_get_max_payload(s);
        if (s->flags & CIP_NO_HEADER)
                s->tag = TAG_NO_CIP_HEADER;
        else
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 8c238e51bb5a..2dd34dd77447 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3832,7 +3832,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec,
        }
 }
-#if IS_REACHABLE(INPUT)
+#if IS_REACHABLE(CONFIG_INPUT)
 static void gpio2_mic_hotkey_event(struct hda_codec *codec,
                                   struct hda_jack_callback *event)
 {
diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
index 2cccbba64418..f304be71c278 100644
--- a/tools/power/acpi/Makefile.config
+++ b/tools/power/acpi/Makefile.config
@@ -56,6 +56,7 @@ INSTALL_SCRIPT = ${INSTALL_PROGRAM}
 # to compile vs uClibc, that can be done here as well.
 CROSS = #/usr/i386-linux-uclibc/usr/bin/i386-uclibc-
 CROSS_COMPILE ?= $(CROSS)
+LD = $(CC)
 HOSTCC = gcc
 # check if compiler option is supported
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 73af45773938..e60dddbf963c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,9 +5,9 @@ CFLAGS =  -Wall -Wl,--no-as-needed -O2 -g
 CFLAGS += -I../../../../usr/include/
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
-TEST_PROGS += fib_tests.sh fib-onlink-tests.sh in_netns.sh pmtu.sh udpgso.sh
+TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh udpgso.sh
 TEST_PROGS += udpgso_bench.sh
-TEST_GEN_PROGS_EXTENDED := in_netns.sh
+TEST_PROGS_EXTENDED := in_netns.sh
 TEST_GEN_FILES =  socket
 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
 TEST_GEN_FILES += tcp_mmap tcp_inq
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json b/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
index 5b012f4981d4..6f289a49e5ec 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
@@ -66,7 +66,7 @@
        "cmdUnderTest": "$TC action add action bpf object-file _b.o index 667",
        "expExitCode": "0",
        "verifyCmd": "$TC action get action bpf index 667",
-        "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9]* tag 3b185187f1855c4c default-action pipe.*index 667 ref",
+        "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9]* tag 3b185187f1855c4c( jited)? default-action pipe.*index 667 ref",
        "matchCount": "1",
        "teardown": [
            "$TC action flush action bpf",
@@ -92,10 +92,15 @@
        "cmdUnderTest": "$TC action add action bpf object-file _c.o index 667",
        "expExitCode": "255",
        "verifyCmd": "$TC action get action bpf index 667",
-        "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9].*index 667 ref",
+        "matchPattern": "action order [0-9]*: bpf _c.o:\\[action\\] id [0-9].*index 667 ref",
        "matchCount": "0",
        "teardown": [
-            "$TC action flush action bpf",
+            [
+                "$TC action flush action bpf",
+                0,
+                1,
+                255
+            ],
            "rm -f _c.o"
        ]
    },
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 68378fe17a0e..e07156c30323 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -423,7 +423,7 @@ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
         * We cannot rely on the vgic maintenance interrupt to be
         * delivered synchronously. This means we can only use it to
         * exit the VM, and we perform the handling of EOIed
-         * interrupts on the exit path (see vgic_process_maintenance).
+         * interrupts on the exit path (see vgic_fold_lr_state).
         */
        return IRQ_HANDLED;
 }
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index dbe99d635c80..ff9655cfeb2f 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -289,10 +289,16 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
               irq->vcpu->cpu != -1) /* VCPU thread is running */
                cond_resched_lock(&irq->irq_lock);
-        if (irq->hw)
+        if (irq->hw) {
                vgic_hw_irq_change_active(vcpu, irq, active, !requester_vcpu);
-        else
+        } else {
+                u32 model = vcpu->kvm->arch.vgic.vgic_model;
                irq->active = active;
+                if (model == KVM_DEV_TYPE_ARM_VGIC_V2 &&
+                    active && vgic_irq_is_sgi(irq->intid))
+                        irq->active_source = requester_vcpu->vcpu_id;
+        }
        if (irq->active)
                vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 45aa433f018f..a5f2e44f1c33 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -37,13 +37,6 @@ void vgic_v2_init_lrs(void)
                vgic_v2_write_lr(i, 0);
 }
-void vgic_v2_set_npie(struct kvm_vcpu *vcpu)
-{
-        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
-        cpuif->vgic_hcr |= GICH_HCR_NPIE;
-}
 void vgic_v2_set_underflow(struct kvm_vcpu *vcpu)
 {
        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
@@ -71,13 +64,18 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
        int lr;
        unsigned long flags;
-        cpuif->vgic_hcr &= ~(GICH_HCR_UIE | GICH_HCR_NPIE);
+        cpuif->vgic_hcr &= ~GICH_HCR_UIE;
        for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                u32 val = cpuif->vgic_lr[lr];
-                u32 intid = val & GICH_LR_VIRTUALID;
+                u32 cpuid, intid = val & GICH_LR_VIRTUALID;
                struct vgic_irq *irq;
+                /* Extract the source vCPU id from the LR */
+                cpuid = val & GICH_LR_PHYSID_CPUID;
+                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
+                cpuid &= 7;
                /* Notify fds when the guest EOI'ed a level-triggered SPI */
                if (lr_signals_eoi_mi(val) && vgic_valid_spi(vcpu->kvm, intid))
                        kvm_notify_acked_irq(vcpu->kvm, 0,
@@ -90,17 +88,16 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
                /* Always preserve the active bit */
                irq->active = !!(val & GICH_LR_ACTIVE_BIT);
+                if (irq->active && vgic_irq_is_sgi(intid))
+                        irq->active_source = cpuid;
                /* Edge is the only case where we preserve the pending bit */
                if (irq->config == VGIC_CONFIG_EDGE &&
                    (val & GICH_LR_PENDING_BIT)) {
                        irq->pending_latch = true;
-                        if (vgic_irq_is_sgi(intid)) {
+                        if (vgic_irq_is_sgi(intid))
-                                u32 cpuid = val & GICH_LR_PHYSID_CPUID;
-                                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
                                irq->source |= (1 << cpuid);
-                        }
                }
                /*
@@ -152,8 +149,15 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
        u32 val = irq->intid;
        bool allow_pending = true;
-        if (irq->active)
+        if (irq->active) {
                val |= GICH_LR_ACTIVE_BIT;
+                if (vgic_irq_is_sgi(irq->intid))
+                        val |= irq->active_source << GICH_LR_PHYSID_CPUID_SHIFT;
+                if (vgic_irq_is_multi_sgi(irq)) {
+                        allow_pending = false;
+                        val |= GICH_LR_EOI;
+                }
+        }
        if (irq->hw) {
                val |= GICH_LR_HW;
@@ -190,8 +194,10 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
                        BUG_ON(!src);
                        val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
                        irq->source &= ~(1 << (src - 1));
-                        if (irq->source)
+                        if (irq->source) {
                                irq->pending_latch = true;
+                                val |= GICH_LR_EOI;
+                        }
                }
        }
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 8195f52ae6f0..c7423f3768e5 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -27,13 +27,6 @@ static bool group1_trap;
 static bool common_trap;
 static bool gicv4_enable;
-void vgic_v3_set_npie(struct kvm_vcpu *vcpu)
-{
-        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
-        cpuif->vgic_hcr |= ICH_HCR_NPIE;
-}
 void vgic_v3_set_underflow(struct kvm_vcpu *vcpu)
 {
        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
@@ -55,17 +48,23 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
        int lr;
        unsigned long flags;
-        cpuif->vgic_hcr &= ~(ICH_HCR_UIE | ICH_HCR_NPIE);
+        cpuif->vgic_hcr &= ~ICH_HCR_UIE;
        for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                u64 val = cpuif->vgic_lr[lr];
-                u32 intid;
+                u32 intid, cpuid;
                struct vgic_irq *irq;
+                bool is_v2_sgi = false;
-                if (model == KVM_DEV_TYPE_ARM_VGIC_V3)
+                cpuid = val & GICH_LR_PHYSID_CPUID;
+                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
+                if (model == KVM_DEV_TYPE_ARM_VGIC_V3) {
                        intid = val & ICH_LR_VIRTUAL_ID_MASK;
-                else
+                } else {
                        intid = val & GICH_LR_VIRTUALID;
+                        is_v2_sgi = vgic_irq_is_sgi(intid);
+                }
                /* Notify fds when the guest EOI'ed a level-triggered IRQ */
                if (lr_signals_eoi_mi(val) && vgic_valid_spi(vcpu->kvm, intid))
@@ -81,18 +80,16 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
                /* Always preserve the active bit */
                irq->active = !!(val & ICH_LR_ACTIVE_BIT);
+                if (irq->active && is_v2_sgi)
+                        irq->active_source = cpuid;
                /* Edge is the only case where we preserve the pending bit */
                if (irq->config == VGIC_CONFIG_EDGE &&
                    (val & ICH_LR_PENDING_BIT)) {
                        irq->pending_latch = true;
-                        if (vgic_irq_is_sgi(intid) &&
+                        if (is_v2_sgi)
-                            model == KVM_DEV_TYPE_ARM_VGIC_V2) {
-                                u32 cpuid = val & GICH_LR_PHYSID_CPUID;
-                                cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
                                irq->source |= (1 << cpuid);
-                        }
                }
                /*
@@ -133,10 +130,20 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
 {
        u32 model = vcpu->kvm->arch.vgic.vgic_model;
        u64 val = irq->intid;
-        bool allow_pending = true;
+        bool allow_pending = true, is_v2_sgi;
-        if (irq->active)
+        is_v2_sgi = (vgic_irq_is_sgi(irq->intid) &&
+                     model == KVM_DEV_TYPE_ARM_VGIC_V2);
+        if (irq->active) {
                val |= ICH_LR_ACTIVE_BIT;
+                if (is_v2_sgi)
+                        val |= irq->active_source << GICH_LR_PHYSID_CPUID_SHIFT;
+                if (vgic_irq_is_multi_sgi(irq)) {
+                        allow_pending = false;
+                        val |= ICH_LR_EOI;
+                }
+        }
        if (irq->hw) {
                val |= ICH_LR_HW;
@@ -174,8 +181,10 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
                        BUG_ON(!src);
                        val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
                        irq->source &= ~(1 << (src - 1));
-                        if (irq->source)
+                        if (irq->source) {
                                irq->pending_latch = true;
+                                val |= ICH_LR_EOI;
+                        }
                }
        }
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 702936cbe173..97bfba8d9a59 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -725,14 +725,6 @@ static inline void vgic_set_underflow(struct kvm_vcpu *vcpu)
                vgic_v3_set_underflow(vcpu);
 }
-static inline void vgic_set_npie(struct kvm_vcpu *vcpu)
-{
-        if (kvm_vgic_global_state.type == VGIC_V2)
-                vgic_v2_set_npie(vcpu);
-        else
-                vgic_v3_set_npie(vcpu);
-}
 /* Requires the ap_list_lock to be held. */
 static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
                                 bool *multi_sgi)
@@ -746,17 +738,15 @@ static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
        DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock));
        list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
+                int w;
                spin_lock(&irq->irq_lock);
                /* GICv2 SGIs can count for more than one... */
-                if (vgic_irq_is_sgi(irq->intid) && irq->source) {
+                w = vgic_irq_get_lr_count(irq);
-                        int w = hweight8(irq->source);
-                        count += w;
-                        *multi_sgi |= (w > 1);
-                } else {
-                        count++;
-                }
                spin_unlock(&irq->irq_lock);
+                count += w;
+                *multi_sgi |= (w > 1);
        }
        return count;
 }
@@ -767,7 +757,6 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        struct vgic_irq *irq;
        int count;
-        bool npie = false;
        bool multi_sgi;
        u8 prio = 0xff;
@@ -797,10 +786,8 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
                if (likely(vgic_target_oracle(irq) == vcpu)) {
                        vgic_populate_lr(vcpu, irq, count++);
-                        if (irq->source) {
+                        if (irq->source)
-                                npie = true;
                                prio = irq->priority;
-                        }
                }
                spin_unlock(&irq->irq_lock);
@@ -813,9 +800,6 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
                }
        }
-        if (npie)
-                vgic_set_npie(vcpu);
        vcpu->arch.vgic_cpu.used_lrs = count;
        /* Nuke remaining LRs */
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index 830e815748a0..32c25d42c93f 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -110,6 +110,20 @@ static inline bool vgic_irq_is_mapped_level(struct vgic_irq *irq)
        return irq->config == VGIC_CONFIG_LEVEL && irq->hw;
 }
+static inline int vgic_irq_get_lr_count(struct vgic_irq *irq)
+{
+        /* Account for the active state as an interrupt */
+        if (vgic_irq_is_sgi(irq->intid) && irq->source)
+                return hweight8(irq->source) + irq->active;
+        return irq_is_pending(irq) || irq->active;
+}
+static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq)
+{
+        return vgic_irq_get_lr_count(irq) > 1;
+}
 /*
 * This struct provides an intermediate representation of the fields contained
 * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC