909 files changed, 9480 insertions, 4915 deletions

diff --git a/.clang-format b/.clang-format
index f49620f506f1..f3923a1f9858 100644
--- a/.clang-format
+++ b/.clang-format
@@ -78,6 +78,8 @@ ForEachMacros:
   - 'ata_qc_for_each_with_internal'
   - 'ax25_for_each'
   - 'ax25_uid_for_each'
+  - '__bio_for_each_bvec'
+  - 'bio_for_each_bvec'
   - 'bio_for_each_integrity_vec'
   - '__bio_for_each_segment'
   - 'bio_for_each_segment'
@@ -118,10 +120,12 @@ ForEachMacros:
   - 'drm_for_each_legacy_plane'
   - 'drm_for_each_plane'
   - 'drm_for_each_plane_mask'
+  - 'drm_for_each_privobj'
   - 'drm_mm_for_each_hole'
   - 'drm_mm_for_each_node'
   - 'drm_mm_for_each_node_in_range'
   - 'drm_mm_for_each_node_safe'
+  - 'flow_action_for_each'
   - 'for_each_active_drhd_unit'
   - 'for_each_active_iommu'
   - 'for_each_available_child_of_node'
@@ -158,6 +162,9 @@ ForEachMacros:
   - 'for_each_dss_dev'
   - 'for_each_efi_memory_desc'
   - 'for_each_efi_memory_desc_in_map'
+  - 'for_each_element'
+  - 'for_each_element_extid'
+  - 'for_each_element_id'
   - 'for_each_endpoint_of_node'
   - 'for_each_evictable_lru'
   - 'for_each_fib6_node_rt_rcu'
@@ -195,6 +202,7 @@ ForEachMacros:
   - 'for_each_net_rcu'
   - 'for_each_new_connector_in_state'
   - 'for_each_new_crtc_in_state'
+  - 'for_each_new_mst_mgr_in_state'
   - 'for_each_new_plane_in_state'
   - 'for_each_new_private_obj_in_state'
   - 'for_each_node'
@@ -210,8 +218,10 @@ ForEachMacros:
   - 'for_each_of_pci_range'
   - 'for_each_old_connector_in_state'
   - 'for_each_old_crtc_in_state'
+  - 'for_each_old_mst_mgr_in_state'
   - 'for_each_oldnew_connector_in_state'
   - 'for_each_oldnew_crtc_in_state'
+  - 'for_each_oldnew_mst_mgr_in_state'
   - 'for_each_oldnew_plane_in_state'
   - 'for_each_oldnew_plane_in_state_reverse'
   - 'for_each_oldnew_private_obj_in_state'
@@ -243,6 +253,9 @@ ForEachMacros:
   - 'for_each_sg_dma_page'
   - 'for_each_sg_page'
   - 'for_each_sibling_event'
+  - 'for_each_subelement'
+  - 'for_each_subelement_extid'
+  - 'for_each_subelement_id'
   - '__for_each_thread'
   - 'for_each_thread'
   - 'for_each_zone'
@@ -252,6 +265,8 @@ ForEachMacros:
   - 'fwnode_for_each_child_node'
   - 'fwnode_graph_for_each_endpoint'
   - 'gadget_for_each_ep'
+  - 'genradix_for_each'
+  - 'genradix_for_each_from'
   - 'hash_for_each'
   - 'hash_for_each_possible'
   - 'hash_for_each_possible_rcu'
@@ -293,7 +308,11 @@ ForEachMacros:
   - 'key_for_each'
   - 'key_for_each_safe'
   - 'klp_for_each_func'
+  - 'klp_for_each_func_safe'
+  - 'klp_for_each_func_static'
   - 'klp_for_each_object'
+  - 'klp_for_each_object_safe'
+  - 'klp_for_each_object_static'
   - 'kvm_for_each_memslot'
   - 'kvm_for_each_vcpu'
   - 'list_for_each'
@@ -324,6 +343,8 @@ ForEachMacros:
   - 'media_device_for_each_intf'
   - 'media_device_for_each_link'
   - 'media_device_for_each_pad'
+  - 'mp_bvec_for_each_page'
+  - 'mp_bvec_for_each_segment'
   - 'nanddev_io_for_each_page'
   - 'netdev_for_each_lower_dev'
   - 'netdev_for_each_lower_private'
@@ -375,6 +396,7 @@ ForEachMacros:
   - 'rht_for_each_rcu'
   - 'rht_for_each_rcu_continue'
   - '__rq_for_each_bio'
+  - 'rq_for_each_bvec'
   - 'rq_for_each_segment'
   - 'scsi_for_each_prot_sg'
   - 'scsi_for_each_sg'
@@ -410,6 +432,8 @@ ForEachMacros:
   - 'v4l2_m2m_for_each_src_buf_safe'
   - 'virtio_device_for_each_vq'
   - 'xa_for_each'
+  - 'xa_for_each_marked'
+  - 'xa_for_each_start'
   - 'xas_for_each'
   - 'xas_for_each_conflict'
   - 'xas_for_each_marked'
diff --git a/.mailmap b/.mailmap
index b2cde8668dcc..ae2bcad06f4b 100644
--- a/.mailmap
+++ b/.mailmap
@@ -156,6 +156,8 @@ Morten Welinder <welinder@darter.rentec.com>
 Morten Welinder <welinder@troll.com>
 Mythri P K <mythripk@ti.com>
 Nguyen Anh Quynh <aquynh@gmail.com>
+Nicolas Pitre <nico@fluxnic.net> <nicolas.pitre@linaro.org>
+Nicolas Pitre <nico@fluxnic.net> <nico@linaro.org>
 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
 Patrick Mochel <mochel@digitalimplant.org>
 Paul Burton <paul.burton@mips.com> <paul.burton@imgtec.com>
diff --git a/Documentation/accounting/psi.txt b/Documentation/accounting/psi.txt
index b8ca28b60215..7e71c9c1d8e9 100644
--- a/Documentation/accounting/psi.txt
+++ b/Documentation/accounting/psi.txt
@@ -56,12 +56,12 @@ situation from a state where some tasks are stalled but the CPU is
 still doing productive work. As such, time spent in this subset of the
 stall state is tracked separately and exported in the "full" averages.
 
-The ratios are tracked as recent trends over ten, sixty, and three
-hundred second windows, which gives insight into short term events as
-well as medium and long term trends. The total absolute stall time is
-tracked and exported as well, to allow detection of latency spikes
-which wouldn't necessarily make a dent in the time averages, or to
-average trends over custom time frames.
+The ratios (in %) are tracked as recent trends over ten, sixty, and
+three hundred second windows, which gives insight into short term events
+as well as medium and long term trends. The total absolute stall time
+(in us) is tracked and exported as well, to allow detection of latency
+spikes which wouldn't necessarily make a dent in the time averages,
+or to average trends over custom time frames.
 
 Cgroup2 interface
 =================
diff --git a/Documentation/bpf/btf.rst b/Documentation/bpf/btf.rst
index 9a60a5d60e38..7313d354f20e 100644
--- a/Documentation/bpf/btf.rst
+++ b/Documentation/bpf/btf.rst
@@ -148,16 +148,16 @@ The ``btf_type.size * 8`` must be equal to or greater than ``BTF_INT_BITS()``
 for the type. The maximum value of ``BTF_INT_BITS()`` is 128.
 
 The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values
-for this int. For example, a bitfield struct member has: * btf member bit
-offset 100 from the start of the structure, * btf member pointing to an int
-type, * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
+for this int. For example, a bitfield struct member has:
+ * btf member bit offset 100 from the start of the structure,
+ * btf member pointing to an int type,
+ * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
 
 Then in the struct memory layout, this member will occupy ``4`` bits starting
 from bits ``100 + 2 = 102``.
 
 Alternatively, the bitfield struct member can be the following to access the
 same bits as the above:
-
  * btf member bit offset 102,
  * btf member pointing to an int type,
  * the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``
diff --git a/Documentation/devicetree/bindings/arm/cpus.yaml b/Documentation/devicetree/bindings/arm/cpus.yaml
index 365dcf384d73..82dd7582e945 100644
--- a/Documentation/devicetree/bindings/arm/cpus.yaml
+++ b/Documentation/devicetree/bindings/arm/cpus.yaml
@@ -228,7 +228,7 @@ patternProperties:
                 - renesas,r9a06g032-smp
                 - rockchip,rk3036-smp
                 - rockchip,rk3066-smp
-                - socionext,milbeaut-m10v-smp
+                - socionext,milbeaut-m10v-smp
                 - ste,dbx500-smp
 
       cpu-release-addr:
diff --git a/Documentation/devicetree/bindings/hwmon/adc128d818.txt b/Documentation/devicetree/bindings/hwmon/adc128d818.txt
index 08bab0e94d25..d0ae46d7bac3 100644
--- a/Documentation/devicetree/bindings/hwmon/adc128d818.txt
+++ b/Documentation/devicetree/bindings/hwmon/adc128d818.txt
@@ -26,7 +26,7 @@ Required node properties:
 
 Optional node properties:
 
- - ti,mode:     Operation mode (see above).
+ - ti,mode:     Operation mode (u8) (see above).
 
 
 Example (operation mode 2):
@@ -34,5 +34,5 @@ Example (operation mode 2):
         adc128d818@1d {
                 compatible = "ti,adc128d818";
                 reg = <0x1d>;
-                ti,mode = <2>;
+                ti,mode = /bits/ 8 <2>;
         };
diff --git a/Documentation/devicetree/bindings/net/davinci_emac.txt b/Documentation/devicetree/bindings/net/davinci_emac.txt
index 24c5cdaba8d2..ca83dcc84fb8 100644
--- a/Documentation/devicetree/bindings/net/davinci_emac.txt
+++ b/Documentation/devicetree/bindings/net/davinci_emac.txt
@@ -20,6 +20,8 @@ Required properties:
 Optional properties:
 - phy-handle: See ethernet.txt file in the same directory.
               If absent, davinci_emac driver defaults to 100/FULL.
+- nvmem-cells: phandle, reference to an nvmem node for the MAC address
+- nvmem-cell-names: string, should be "mac-address" if nvmem is to be used
 - ti,davinci-rmii-en: 1 byte, 1 means use RMII
 - ti,davinci-no-bd-ram: boolean, does EMAC have BD RAM?
 
diff --git a/Documentation/devicetree/bindings/net/ethernet.txt b/Documentation/devicetree/bindings/net/ethernet.txt
index cfc376bc977a..a68621580584 100644
--- a/Documentation/devicetree/bindings/net/ethernet.txt
+++ b/Documentation/devicetree/bindings/net/ethernet.txt
@@ -10,15 +10,14 @@ Documentation/devicetree/bindings/phy/phy-bindings.txt.
   the boot program; should be used in cases where the MAC address assigned to
   the device by the boot program is different from the "local-mac-address"
   property;
-- nvmem-cells: phandle, reference to an nvmem node for the MAC address;
-- nvmem-cell-names: string, should be "mac-address" if nvmem is to be used;
 - max-speed: number, specifies maximum speed in Mbit/s supported by the device;
 - max-frame-size: number, maximum transfer unit (IEEE defined MTU), rather than
   the maximum frame size (there's contradiction in the Devicetree
   Specification).
 - phy-mode: string, operation mode of the PHY interface. This is now a de-facto
   standard property; supported values are:
-  * "internal"
+  * "internal" (Internal means there is not a standard bus between the MAC and
+     the PHY, something proprietary is being used to embed the PHY in the MAC.)
   * "mii"
   * "gmii"
   * "sgmii"
diff --git a/Documentation/devicetree/bindings/net/macb.txt b/Documentation/devicetree/bindings/net/macb.txt
index 174f292d8a3e..8b80515729d7 100644
--- a/Documentation/devicetree/bindings/net/macb.txt
+++ b/Documentation/devicetree/bindings/net/macb.txt
@@ -26,6 +26,10 @@ Required properties:
         Optional elements: 'tsu_clk'
 - clocks: Phandles to input clocks.
 
+Optional properties:
+- nvmem-cells: phandle, reference to an nvmem node for the MAC address
+- nvmem-cell-names: string, should be "mac-address" if nvmem is to be used
+
 Optional properties for PHY child node:
 - reset-gpios : Should specify the gpio for phy reset
 - magic-packet : If present, indicates that the hardware supports waking
diff --git a/Documentation/lzo.txt b/Documentation/lzo.txt
index f79934225d8d..ca983328976b 100644
--- a/Documentation/lzo.txt
+++ b/Documentation/lzo.txt
@@ -102,9 +102,11 @@ Byte sequences
                 dictionary which is empty, and that it will always be
                 invalid at this place.
 
-      17      : bitstream version. If the first byte is 17, the next byte
-                gives the bitstream version (version 1 only). If the first byte
-                is not 17, the bitstream version is 0.
+      17      : bitstream version. If the first byte is 17, and compressed
+                stream length is at least 5 bytes (length of shortest possible
+                versioned bitstream), the next byte gives the bitstream version
+                (version 1 only).
+                Otherwise, the bitstream version is 0.
 
       18..21  : copy 0..3 literals
                 state = (byte - 17) = 0..3  [ copy <state> literals ]
diff --git a/Documentation/media/uapi/rc/rc-tables.rst b/Documentation/media/uapi/rc/rc-tables.rst
index f460031d8531..177ac44fa0fa 100644
--- a/Documentation/media/uapi/rc/rc-tables.rst
+++ b/Documentation/media/uapi/rc/rc-tables.rst
@@ -623,7 +623,7 @@ the remote via /dev/input/event devices.
 
     -  .. row 78
 
-       -  ``KEY_SCREEN``
+       -  ``KEY_ASPECT_RATIO``
 
        -  Select screen aspect ratio
 
@@ -631,7 +631,7 @@ the remote via /dev/input/event devices.
 
     -  .. row 79
 
-       -  ``KEY_ZOOM``
+       -  ``KEY_FULL_SCREEN``
 
        -  Put device into zoom/full screen mode
 
diff --git a/Documentation/networking/bpf_flow_dissector.rst b/Documentation/networking/bpf_flow_dissector.rst
new file mode 100644
index 000000000000..b375ae2ec2c4
--- /dev/null
+++ b/Documentation/networking/bpf_flow_dissector.rst
@@ -0,0 +1,126 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==================
+BPF Flow Dissector
+==================
+
+Overview
+========
+
+Flow dissector is a routine that parses metadata out of the packets. It's
+used in the various places in the networking subsystem (RFS, flow hash, etc).
+
+BPF flow dissector is an attempt to reimplement C-based flow dissector logic
+in BPF to gain all the benefits of BPF verifier (namely, limits on the
+number of instructions and tail calls).
+
+API
+===
+
+BPF flow dissector programs operate on an ``__sk_buff``. However, only the
+limited set of fields is allowed: ``data``, ``data_end`` and ``flow_keys``.
+``flow_keys`` is ``struct bpf_flow_keys`` and contains flow dissector input
+and output arguments.
+
+The inputs are:
+  * ``nhoff`` - initial offset of the networking header
+  * ``thoff`` - initial offset of the transport header, initialized to nhoff
+  * ``n_proto`` - L3 protocol type, parsed out of L2 header
+
+Flow dissector BPF program should fill out the rest of the ``struct
+bpf_flow_keys`` fields. Input arguments ``nhoff/thoff/n_proto`` should be
+also adjusted accordingly.
+
+The return code of the BPF program is either BPF_OK to indicate successful
+dissection, or BPF_DROP to indicate parsing error.
+
+__sk_buff->data
+===============
+
+In the VLAN-less case, this is what the initial state of the BPF flow
+dissector looks like::
+
+  +------+------+------------+-----------+
+  | DMAC | SMAC | ETHER_TYPE | L3_HEADER |
+  +------+------+------------+-----------+
+                              ^
+                              |
+                              +-- flow dissector starts here
+
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point to the first byte of L3_HEADER
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = ETHER_TYPE
+
+In case of VLAN, flow dissector can be called with the two different states.
+
+Pre-VLAN parsing::
+
+  +------+------+------+-----+-----------+-----------+
+  | DMAC | SMAC | TPID | TCI |ETHER_TYPE | L3_HEADER |
+  +------+------+------+-----+-----------+-----------+
+                        ^
+                        |
+                        +-- flow dissector starts here
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point the to first byte of TCI
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = TPID
+
+Please note that TPID can be 802.1AD and, hence, BPF program would
+have to parse VLAN information twice for double tagged packets.
+
+
+Post-VLAN parsing::
+
+  +------+------+------+-----+-----------+-----------+
+  | DMAC | SMAC | TPID | TCI |ETHER_TYPE | L3_HEADER |
+  +------+------+------+-----+-----------+-----------+
+                                          ^
+                                          |
+                                          +-- flow dissector starts here
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point the to first byte of L3_HEADER
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = ETHER_TYPE
+
+In this case VLAN information has been processed before the flow dissector
+and BPF flow dissector is not required to handle it.
+
+
+The takeaway here is as follows: BPF flow dissector program can be called with
+the optional VLAN header and should gracefully handle both cases: when single
+or double VLAN is present and when it is not present. The same program
+can be called for both cases and would have to be written carefully to
+handle both cases.
+
+
+Reference Implementation
+========================
+
+See ``tools/testing/selftests/bpf/progs/bpf_flow.c`` for the reference
+implementation and ``tools/testing/selftests/bpf/flow_dissector_load.[hc]``
+for the loader. bpftool can be used to load BPF flow dissector program as well.
+
+The reference implementation is organized as follows:
+  * ``jmp_table`` map that contains sub-programs for each supported L3 protocol
+  * ``_dissect`` routine - entry point; it does input ``n_proto`` parsing and
+    does ``bpf_tail_call`` to the appropriate L3 handler
+
+Since BPF at this point doesn't support looping (or any jumping back),
+jmp_table is used instead to handle multiple levels of encapsulation (and
+IPv6 options).
+
+
+Current Limitations
+===================
+BPF flow dissector doesn't support exporting all the metadata that in-kernel
+C-based implementation can export. Notable example is single VLAN (802.1Q)
+and double VLAN (802.1AD) tags. Please refer to the ``struct bpf_flow_keys``
+for a set of information that's currently can be exported from the BPF context.
diff --git a/Documentation/networking/decnet.txt b/Documentation/networking/decnet.txt
index e12a4900cf72..d192f8b9948b 100644
--- a/Documentation/networking/decnet.txt
+++ b/Documentation/networking/decnet.txt
@@ -22,8 +22,6 @@ you'll need the following options as well...
     CONFIG_DECNET_ROUTER (to be able to add/delete routes)
     CONFIG_NETFILTER (will be required for the DECnet routing daemon)
 
-    CONFIG_DECNET_ROUTE_FWMARK is optional
-
 Don't turn on SIOCGIFCONF support for DECnet unless you are really sure
 that you need it, in general you won't and it can cause ifconfig to
 malfunction.
diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
index 5449149be496..984e68f9e026 100644
--- a/Documentation/networking/index.rst
+++ b/Documentation/networking/index.rst
@@ -9,6 +9,7 @@ Contents:
    netdev-FAQ
    af_xdp
    batman-adv
+   bpf_flow_dissector
    can
    can_ucan_protocol
    device_drivers/freescale/dpaa2/index
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index acdfb5d2bcaa..e2142fe40cda 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -422,6 +422,7 @@ tcp_min_rtt_wlen - INTEGER
         minimum RTT when it is moved to a longer path (e.g., due to traffic
         engineering). A longer window makes the filter more resistant to RTT
         inflations such as transient congestion. The unit is seconds.
+        Possible values: 0 - 86400 (1 day)
         Default: 300
 
 tcp_moderate_rcvbuf - BOOLEAN
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 2df5894353d6..cd7303d7fa25 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -1009,16 +1009,18 @@ The kernel interface functions are as follows:
 
  (*) Check call still alive.
 
-        u32 rxrpc_kernel_check_life(struct socket *sock,
-                                    struct rxrpc_call *call);
+        bool rxrpc_kernel_check_life(struct socket *sock,
+                                     struct rxrpc_call *call,
+                                     u32 *_life);
         void rxrpc_kernel_probe_life(struct socket *sock,
                                      struct rxrpc_call *call);
 
-     The first function returns a number that is updated when ACKs are received
-     from the peer (notably including PING RESPONSE ACKs which we can elicit by
-     sending PING ACKs to see if the call still exists on the server).  The
-     caller should compare the numbers of two calls to see if the call is still
-     alive after waiting for a suitable interval.
+     The first function passes back in *_life a number that is updated when
+     ACKs are received from the peer (notably including PING RESPONSE ACKs
+     which we can elicit by sending PING ACKs to see if the call still exists
+     on the server).  The caller should compare the numbers of two calls to see
+     if the call is still alive after waiting for a suitable interval.  It also
+     returns true as long as the call hasn't yet reached the completed state.
 
      This allows the caller to work out if the server is still contactable and
      if the call is still alive on the server while waiting for the server to
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 6af24cdb25cc..3f13d8599337 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -866,14 +866,14 @@ The intent is that compaction has less work to do in the future and to
 increase the success rate of future high-order allocations such as SLUB
 allocations, THP and hugetlbfs pages.
 
-To make it sensible with respect to the watermark_scale_factor parameter,
-the unit is in fractions of 10,000. The default value of 15,000 means
-that up to 150% of the high watermark will be reclaimed in the event of
-a pageblock being mixed due to fragmentation. The level of reclaim is
-determined by the number of fragmentation events that occurred in the
-recent past. If this value is smaller than a pageblock then a pageblocks
-worth of pages will be reclaimed (e.g.  2MB on 64-bit x86). A boost factor
-of 0 will disable the feature.
+To make it sensible with respect to the watermark_scale_factor
+parameter, the unit is in fractions of 10,000. The default value of
+15,000 on !DISCONTIGMEM configurations means that up to 150% of the high
+watermark will be reclaimed in the event of a pageblock being mixed due
+to fragmentation. The level of reclaim is determined by the number of
+fragmentation events that occurred in the recent past. If this value is
+smaller than a pageblock then a pageblocks worth of pages will be reclaimed
+(e.g.  2MB on 64-bit x86). A boost factor of 0 will disable the feature.
 
 =============================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 43b36dbed48e..5c38f21aee78 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1893,14 +1893,15 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-nomadik.git
 ARM/NUVOTON NPCM ARCHITECTURE
 M:      Avi Fishman <avifishman70@gmail.com>
 M:      Tomer Maimon <tmaimon77@gmail.com>
+M:      Tali Perry <tali.perry1@gmail.com>
 R:      Patrick Venture <venture@google.com>
 R:      Nancy Yuen <yuenn@google.com>
-R:      Brendan Higgins <brendanhiggins@google.com>
+R:      Benjamin Fair <benjaminfair@google.com>
 L:      openbmc@lists.ozlabs.org (moderated for non-subscribers)
 S:      Supported
 F:      arch/arm/mach-npcm/
 F:      arch/arm/boot/dts/nuvoton-npcm*
-F:      include/dt-bindings/clock/nuvoton,npcm7xx-clks.h
+F:      include/dt-bindings/clock/nuvoton,npcm7xx-clock.h
 F:      drivers/*/*npcm*
 F:      Documentation/devicetree/bindings/*/*npcm*
 F:      Documentation/devicetree/bindings/*/*/*npcm*
@@ -3120,6 +3121,7 @@ F:	drivers/cpufreq/bmips-cpufreq.c
 BROADCOM BMIPS MIPS ARCHITECTURE
 M:      Kevin Cernekee <cernekee@gmail.com>
 M:      Florian Fainelli <f.fainelli@gmail.com>
+L:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-mips@vger.kernel.org
 T:      git git://github.com/broadcom/stblinux.git
 S:      Maintained
@@ -4129,7 +4131,7 @@ F:	drivers/cpuidle/*
 F:      include/linux/cpuidle.h
 
 CRAMFS FILESYSTEM
-M:      Nicolas Pitre <nico@linaro.org>
+M:      Nicolas Pitre <nico@fluxnic.net>
 S:      Maintained
 F:      Documentation/filesystems/cramfs.txt
 F:      fs/cramfs/
@@ -5833,7 +5835,7 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
 F:      Documentation/devicetree/bindings/net/mdio*
-F:      Documentation/networking/phy.txt
+F:      Documentation/networking/phy.rst
 F:      drivers/net/phy/
 F:      drivers/of/of_mdio.c
 F:      drivers/of/of_net.c
@@ -7332,7 +7334,6 @@ F:	Documentation/devicetree/bindings/i3c/
 F:      Documentation/driver-api/i3c
 F:      drivers/i3c/
 F:      include/linux/i3c/
-F:      include/dt-bindings/i3c/
 
 I3C DRIVER FOR SYNOPSYS DESIGNWARE
 M:      Vitor Soares <vitor.soares@synopsys.com>
@@ -7515,7 +7516,7 @@ F:	include/net/mac802154.h
 F:      include/net/af_ieee802154.h
 F:      include/net/cfg802154.h
 F:      include/net/ieee802154_netdev.h
-F:      Documentation/networking/ieee802154.txt
+F:      Documentation/networking/ieee802154.rst
 
 IFE PROTOCOL
 M:      Yotam Gigi <yotam.gi@gmail.com>
@@ -8707,6 +8708,7 @@ F:	scripts/leaking_addresses.pl
 LED SUBSYSTEM
 M:      Jacek Anaszewski <jacek.anaszewski@gmail.com>
 M:      Pavel Machek <pavel@ucw.cz>
+R:      Dan Murphy <dmurphy@ti.com>
 L:      linux-leds@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds.git
 S:      Maintained
@@ -10144,7 +10146,7 @@ F:	drivers/spi/spi-at91-usart.c
 F:      Documentation/devicetree/bindings/mfd/atmel-usart.txt
 
 MICROCHIP KSZ SERIES ETHERNET SWITCH DRIVER
-M:      Woojung Huh <Woojung.Huh@microchip.com>
+M:      Woojung Huh <woojung.huh@microchip.com>
 M:      Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -13981,7 +13983,7 @@ F:	drivers/media/rc/serial_ir.c
 SFC NETWORK DRIVER
 M:      Solarflare linux maintainers <linux-net-drivers@solarflare.com>
 M:      Edward Cree <ecree@solarflare.com>
-M:      Bert Kenward <bkenward@solarflare.com>
+M:      Martin Habets <mhabets@solarflare.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/sfc/
@@ -16508,7 +16510,7 @@ F:	drivers/char/virtio_console.c
 F:      include/linux/virtio_console.h
 F:      include/uapi/linux/virtio_console.h
 
-VIRTIO CORE, NET AND BLOCK DRIVERS
+VIRTIO CORE AND NET DRIVERS
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 M:      Jason Wang <jasowang@redhat.com>
 L:      virtualization@lists.linux-foundation.org
@@ -16523,6 +16525,19 @@ F:	include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
 F:      mm/balloon_compaction.c
 
+VIRTIO BLOCK AND SCSI DRIVERS
+M:      "Michael S. Tsirkin" <mst@redhat.com>
+M:      Jason Wang <jasowang@redhat.com>
+R:      Paolo Bonzini <pbonzini@redhat.com>
+R:      Stefan Hajnoczi <stefanha@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+S:      Maintained
+F:      drivers/block/virtio_blk.c
+F:      drivers/scsi/virtio_scsi.c
+F:      include/uapi/linux/virtio_blk.h
+F:      include/uapi/linux/virtio_scsi.h
+F:      drivers/vhost/scsi.c
+
 VIRTIO CRYPTO DRIVER
 M:      Gonglei <arei.gonglei@huawei.com>
 L:      virtualization@lists.linux-foundation.org
diff --git a/Makefile b/Makefile
index 026fbc450906..2b99679148dc 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc7
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/syscalls/syscall.tbl b/arch/alpha/kernel/syscalls/syscall.tbl
index 63ed39cbd3bd..165f268beafc 100644
--- a/arch/alpha/kernel/syscalls/syscall.tbl
+++ b/arch/alpha/kernel/syscalls/syscall.tbl
@@ -463,3 +463,7 @@
 532     common  getppid                         sys_getppid
 # all other architectures have common numbers for new syscall, alpha
 # is the exception.
+534     common  pidfd_send_signal               sys_pidfd_send_signal
+535     common  io_uring_setup                  sys_io_uring_setup
+536     common  io_uring_enter                  sys_io_uring_enter
+537     common  io_uring_register               sys_io_uring_register
diff --git a/arch/arc/include/asm/syscall.h b/arch/arc/include/asm/syscall.h
index 29de09804306..c7a4201ed62b 100644
--- a/arch/arc/include/asm/syscall.h
+++ b/arch/arc/include/asm/syscall.h
@@ -55,12 +55,11 @@ syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  */
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
         unsigned long *inside_ptregs = &(regs->r0);
-        inside_ptregs -= i;
-
-        BUG_ON((i + n) > 6);
+        unsigned int n = 6;
+        unsigned int i = 0;
 
         while (n--) {
                 args[i++] = (*inside_ptregs);
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 850b4805e2d1..9aed25a6019b 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -73,7 +73,7 @@ config ARM
         select HAVE_EFFICIENT_UNALIGNED_ACCESS if (CPU_V6 || CPU_V6K || CPU_V7) && MMU
         select HAVE_EXIT_THREAD
         select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL
-        select HAVE_FUNCTION_GRAPH_TRACER if !THUMB2_KERNEL
+        select HAVE_FUNCTION_GRAPH_TRACER if !THUMB2_KERNEL && !CC_IS_CLANG
         select HAVE_FUNCTION_TRACER if !XIP_KERNEL
         select HAVE_GCC_PLUGINS
         select HAVE_HW_BREAKPOINT if PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7)
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 6d6e0330930b..e388af4594a6 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -47,8 +47,8 @@ config DEBUG_WX
 
 choice
         prompt "Choose kernel unwinder"
-        default UNWINDER_ARM if AEABI && !FUNCTION_GRAPH_TRACER
-        default UNWINDER_FRAME_POINTER if !AEABI || FUNCTION_GRAPH_TRACER
+        default UNWINDER_ARM if AEABI
+        default UNWINDER_FRAME_POINTER if !AEABI
         help
           This determines which method will be used for unwinding kernel stack
           traces for panics, oopses, bugs, warnings, perf, /proc/<pid>/stack,
@@ -65,7 +65,7 @@ config UNWINDER_FRAME_POINTER
 
 config UNWINDER_ARM
         bool "ARM EABI stack unwinder"
-        depends on AEABI
+        depends on AEABI && !FUNCTION_GRAPH_TRACER
         select ARM_UNWIND
         help
           This option enables stack unwinding support in the kernel
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 6c7ccb428c07..7135820f76d4 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -1438,7 +1438,21 @@ ENTRY(efi_stub_entry)
 
                 @ Preserve return value of efi_entry() in r4
                 mov     r4, r0
-                bl      cache_clean_flush
+
+                @ our cache maintenance code relies on CP15 barrier instructions
+                @ but since we arrived here with the MMU and caches configured
+                @ by UEFI, we must check that the CP15BEN bit is set in SCTLR.
+                @ Note that this bit is RAO/WI on v6 and earlier, so the ISB in
+                @ the enable path will be executed on v7+ only.
+                mrc     p15, 0, r1, c1, c0, 0   @ read SCTLR
+                tst     r1, #(1 << 5)           @ CP15BEN bit set?
+                bne     0f
+                orr     r1, r1, #(1 << 5)       @ CP15 barrier instructions
+                mcr     p15, 0, r1, c1, c0, 0   @ write SCTLR
+ ARM(           .inst   0xf57ff06f              @ v7+ isb       )
+ THUMB(         isb                                             )
+
+0:              bl      cache_clean_flush
                 bl      cache_off
 
                 @ Set parameters for booting zImage according to boot protocol
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index dce5be5df97b..edcff79879e7 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -57,6 +57,24 @@
                 enable-active-high;
         };
 
+        /* TPS79501 */
+        v1_8d_reg: fixedregulator-v1_8d {
+                compatible = "regulator-fixed";
+                regulator-name = "v1_8d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+
+        /* TPS79501 */
+        v3_3d_reg: fixedregulator-v3_3d {
+                compatible = "regulator-fixed";
+                regulator-name = "v3_3d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+        };
+
         matrix_keypad: matrix_keypad0 {
                 compatible = "gpio-matrix-keypad";
                 debounce-delay-ms = <5>;
@@ -499,10 +517,10 @@
                 status = "okay";
 
                 /* Regulators */
-                AVDD-supply = <&vaux2_reg>;
-                IOVDD-supply = <&vaux2_reg>;
-                DRVDD-supply = <&vaux2_reg>;
-                DVDD-supply = <&vbat>;
+                AVDD-supply = <&v3_3d_reg>;
+                IOVDD-supply = <&v3_3d_reg>;
+                DRVDD-supply = <&v3_3d_reg>;
+                DVDD-supply = <&v1_8d_reg>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index b128998097ce..2c2d8b5b8cf5 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -73,6 +73,24 @@
                 enable-active-high;
         };
 
+        /* TPS79518 */
+        v1_8d_reg: fixedregulator-v1_8d {
+                compatible = "regulator-fixed";
+                regulator-name = "v1_8d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+
+        /* TPS78633 */
+        v3_3d_reg: fixedregulator-v3_3d {
+                compatible = "regulator-fixed";
+                regulator-name = "v3_3d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+        };
+
         leds {
                 pinctrl-names = "default";
                 pinctrl-0 = <&user_leds_s0>;
@@ -501,10 +519,10 @@
                 status = "okay";
 
                 /* Regulators */
-                AVDD-supply = <&vaux2_reg>;
-                IOVDD-supply = <&vaux2_reg>;
-                DRVDD-supply = <&vaux2_reg>;
-                DVDD-supply = <&vbat>;
+                AVDD-supply = <&v3_3d_reg>;
+                IOVDD-supply = <&v3_3d_reg>;
+                DRVDD-supply = <&v3_3d_reg>;
+                DVDD-supply = <&v1_8d_reg>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi
index f459ec316a22..ca6d9f02a800 100644
--- a/arch/arm/boot/dts/am33xx-l4.dtsi
+++ b/arch/arm/boot/dts/am33xx-l4.dtsi
@@ -1762,7 +1762,7 @@
                         reg = <0xcc000 0x4>;
                         reg-names = "rev";
                         /* Domains (P, C): per_pwrdm, l4ls_clkdm */
-                        clocks = <&l4ls_clkctrl AM3_D_CAN0_CLKCTRL 0>;
+                        clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN0_CLKCTRL 0>;
                         clock-names = "fck";
                         #address-cells = <1>;
                         #size-cells = <1>;
@@ -1785,7 +1785,7 @@
                         reg = <0xd0000 0x4>;
                         reg-names = "rev";
                         /* Domains (P, C): per_pwrdm, l4ls_clkdm */
-                        clocks = <&l4ls_clkctrl AM3_D_CAN1_CLKCTRL 0>;
+                        clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN1_CLKCTRL 0>;
                         clock-names = "fck";
                         #address-cells = <1>;
                         #size-cells = <1>;
diff --git a/arch/arm/boot/dts/rk3288-tinker.dtsi b/arch/arm/boot/dts/rk3288-tinker.dtsi
index aa107ee41b8b..ef653c3209bc 100644
--- a/arch/arm/boot/dts/rk3288-tinker.dtsi
+++ b/arch/arm/boot/dts/rk3288-tinker.dtsi
@@ -254,6 +254,7 @@
                         };
 
                         vccio_sd: LDO_REG5 {
+                                regulator-boot-on;
                                 regulator-min-microvolt = <1800000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-name = "vccio_sd";
@@ -430,7 +431,7 @@
         bus-width = <4>;
         cap-mmc-highspeed;
         cap-sd-highspeed;
-        card-detect-delay = <200>;
+        broken-cd;
         disable-wp;                     /* wp not hooked up */
         pinctrl-names = "default";
         pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
diff --git a/arch/arm/boot/dts/rk3288-veyron.dtsi b/arch/arm/boot/dts/rk3288-veyron.dtsi
index 0bc2409f6903..192dbc089ade 100644
--- a/arch/arm/boot/dts/rk3288-veyron.dtsi
+++ b/arch/arm/boot/dts/rk3288-veyron.dtsi
@@ -25,8 +25,6 @@
 
         gpio_keys: gpio-keys {
                 compatible = "gpio-keys";
-                #address-cells = <1>;
-                #size-cells = <0>;
 
                 pinctrl-names = "default";
                 pinctrl-0 = <&pwr_key_l>;
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index ca7d52daa8fb..a024d1e7e74c 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -70,7 +70,7 @@
                         compatible = "arm,cortex-a12";
                         reg = <0x501>;
                         resets = <&cru SRST_CORE1>;
-                        operating-points = <&cpu_opp_table>;
+                        operating-points-v2 = <&cpu_opp_table>;
                         #cooling-cells = <2>; /* min followed by max */
                         clock-latency = <40000>;
                         clocks = <&cru ARMCLK>;
@@ -80,7 +80,7 @@
                         compatible = "arm,cortex-a12";
                         reg = <0x502>;
                         resets = <&cru SRST_CORE2>;
-                        operating-points = <&cpu_opp_table>;
+                        operating-points-v2 = <&cpu_opp_table>;
                         #cooling-cells = <2>; /* min followed by max */
                         clock-latency = <40000>;
                         clocks = <&cru ARMCLK>;
@@ -90,7 +90,7 @@
                         compatible = "arm,cortex-a12";
                         reg = <0x503>;
                         resets = <&cru SRST_CORE3>;
-                        operating-points = <&cpu_opp_table>;
+                        operating-points-v2 = <&cpu_opp_table>;
                         #cooling-cells = <2>; /* min followed by max */
                         clock-latency = <40000>;
                         clocks = <&cru ARMCLK>;
@@ -1119,8 +1119,6 @@
                 clock-names = "ref", "pclk";
                 power-domains = <&power RK3288_PD_VIO>;
                 rockchip,grf = <&grf>;
-                #address-cells = <1>;
-                #size-cells = <0>;
                 status = "disabled";
 
                 ports {
@@ -1282,27 +1280,27 @@
         gpu_opp_table: gpu-opp-table {
                 compatible = "operating-points-v2";
 
-                opp@100000000 {
+                opp-100000000 {
                         opp-hz = /bits/ 64 <100000000>;
                         opp-microvolt = <950000>;
                 };
-                opp@200000000 {
+                opp-200000000 {
                         opp-hz = /bits/ 64 <200000000>;
                         opp-microvolt = <950000>;
                 };
-                opp@300000000 {
+                opp-300000000 {
                         opp-hz = /bits/ 64 <300000000>;
                         opp-microvolt = <1000000>;
                 };
-                opp@400000000 {
+                opp-400000000 {
                         opp-hz = /bits/ 64 <400000000>;
                         opp-microvolt = <1100000>;
                 };
-                opp@500000000 {
+                opp-500000000 {
                         opp-hz = /bits/ 64 <500000000>;
                         opp-microvolt = <1200000>;
                 };
-                opp@600000000 {
+                opp-600000000 {
                         opp-hz = /bits/ 64 <600000000>;
                         opp-microvolt = <1250000>;
                 };
diff --git a/arch/arm/boot/dts/sama5d2-pinfunc.h b/arch/arm/boot/dts/sama5d2-pinfunc.h
index 1c01a6f843d8..28a2e45752fe 100644
--- a/arch/arm/boot/dts/sama5d2-pinfunc.h
+++ b/arch/arm/boot/dts/sama5d2-pinfunc.h
@@ -518,7 +518,7 @@
 #define PIN_PC9__GPIO                   PINMUX_PIN(PIN_PC9, 0, 0)
 #define PIN_PC9__FIQ                    PINMUX_PIN(PIN_PC9, 1, 3)
 #define PIN_PC9__GTSUCOMP               PINMUX_PIN(PIN_PC9, 2, 1)
-#define PIN_PC9__ISC_D0                 PINMUX_PIN(PIN_PC9, 2, 1)
+#define PIN_PC9__ISC_D0                 PINMUX_PIN(PIN_PC9, 3, 1)
 #define PIN_PC9__TIOA4                  PINMUX_PIN(PIN_PC9, 4, 2)
 #define PIN_PC10                        74
 #define PIN_PC10__GPIO                  PINMUX_PIN(PIN_PC10, 0, 0)
diff --git a/arch/arm/boot/dts/ste-nomadik-nhk15.dts b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
index f2f6558a00f1..04066f9cb8a3 100644
--- a/arch/arm/boot/dts/ste-nomadik-nhk15.dts
+++ b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
@@ -213,13 +213,12 @@
                 gpio-sck = <&gpio0 5 GPIO_ACTIVE_HIGH>;
                 gpio-mosi = <&gpio0 4 GPIO_ACTIVE_HIGH>;
                 /*
-                 * This chipselect is active high. Just setting the flags
-                 * to GPIO_ACTIVE_HIGH is not enough for the SPI DT bindings,
-                 * it will be ignored, only the special "spi-cs-high" flag
-                 * really counts.
+                 * It's not actually active high, but the frameworks assume
+                 * the polarity of the passed-in GPIO is "normal" (active
+                 * high) then actively drives the line low to select the
+                 * chip.
                  */
                 cs-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
-                spi-cs-high;
                 num-chipselects = <1>;
 
                 /*
diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
index 06dea6bce293..080ce70cab12 100644
--- a/arch/arm/include/asm/syscall.h
+++ b/arch/arm/include/asm/syscall.h
@@ -55,53 +55,22 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
-                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
-                pr_warn("%s called with max args %d, handling only %d\n",
-                        __func__, i + n, SYSCALL_MAX_ARGS);
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                args[0] = regs->ARM_ORIG_r0;
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(args, &regs->ARM_r0 + i, n * sizeof(args[0]));
+        args[0] = regs->ARM_ORIG_r0;
+        args++;
+
+        memcpy(args, &regs->ARM_r0 + 1, 5 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                pr_warn("%s called with max args %d, handling only %d\n",
-                        __func__, i + n, SYSCALL_MAX_ARGS);
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                regs->ARM_ORIG_r0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(&regs->ARM_r0 + i, args, n * sizeof(args[0]));
+        regs->ARM_ORIG_r0 = args[0];
+        args++;
+
+        memcpy(&regs->ARM_r0 + 1, args, 5 * sizeof(args[0]));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index c08d2d890f7b..b38bbd011b35 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -133,9 +133,9 @@ __secondary_data:
  */
         .text
 __after_proc_init:
-#ifdef CONFIG_ARM_MPU
 M_CLASS(movw    r12, #:lower16:BASEADDR_V7M_SCB)
 M_CLASS(movt    r12, #:upper16:BASEADDR_V7M_SCB)
+#ifdef CONFIG_ARM_MPU
 M_CLASS(ldr     r3, [r12, 0x50])
 AR_CLASS(mrc    p15, 0, r3, c0, c1, 4)          @ Read ID_MMFR0
         and     r3, r3, #(MMFR0_PMSA)           @ PMSA field
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 51e808adb00c..2a757dcaa1a5 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -591,13 +591,13 @@ static int __init at91_pm_backup_init(void)
 
         np = of_find_compatible_node(NULL, NULL, "atmel,sama5d2-securam");
         if (!np)
-                goto securam_fail;
+                goto securam_fail_no_ref_dev;
 
         pdev = of_find_device_by_node(np);
         of_node_put(np);
         if (!pdev) {
                 pr_warn("%s: failed to find securam device!\n", __func__);
-                goto securam_fail;
+                goto securam_fail_no_ref_dev;
         }
 
         sram_pool = gen_pool_get(&pdev->dev, NULL);
@@ -620,6 +620,8 @@ static int __init at91_pm_backup_init(void)
         return 0;
 
 securam_fail:
+        put_device(&pdev->dev);
+securam_fail_no_ref_dev:
         iounmap(pm_data.sfrbu);
         pm_data.sfrbu = NULL;
         return ret;
diff --git a/arch/arm/mach-iop13xx/setup.c b/arch/arm/mach-iop13xx/setup.c
index 53c316f7301e..fe4932fda01d 100644
--- a/arch/arm/mach-iop13xx/setup.c
+++ b/arch/arm/mach-iop13xx/setup.c
@@ -300,7 +300,7 @@ static struct resource iop13xx_adma_2_resources[] = {
         }
 };
 
-static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(64);
+static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(32);
 static struct iop_adma_platform_data iop13xx_adma_0_data = {
         .hw_id = 0,
         .pool_size = PAGE_SIZE,
@@ -324,7 +324,7 @@ static struct platform_device iop13xx_adma_0_channel = {
         .resource = iop13xx_adma_0_resources,
         .dev = {
                 .dma_mask = &iop13xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop13xx_adma_0_data,
         },
 };
@@ -336,7 +336,7 @@ static struct platform_device iop13xx_adma_1_channel = {
         .resource = iop13xx_adma_1_resources,
         .dev = {
                 .dma_mask = &iop13xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop13xx_adma_1_data,
         },
 };
@@ -348,7 +348,7 @@ static struct platform_device iop13xx_adma_2_channel = {
         .resource = iop13xx_adma_2_resources,
         .dev = {
                 .dma_mask = &iop13xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop13xx_adma_2_data,
         },
 };
diff --git a/arch/arm/mach-iop13xx/tpmi.c b/arch/arm/mach-iop13xx/tpmi.c
index db511ec2b1df..116feb6b261e 100644
--- a/arch/arm/mach-iop13xx/tpmi.c
+++ b/arch/arm/mach-iop13xx/tpmi.c
@@ -152,7 +152,7 @@ static struct resource iop13xx_tpmi_3_resources[] = {
         }
 };
 
-u64 iop13xx_tpmi_mask = DMA_BIT_MASK(64);
+u64 iop13xx_tpmi_mask = DMA_BIT_MASK(32);
 static struct platform_device iop13xx_tpmi_0_device = {
         .name = "iop-tpmi",
         .id = 0,
@@ -160,7 +160,7 @@ static struct platform_device iop13xx_tpmi_0_device = {
         .resource = iop13xx_tpmi_0_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
@@ -171,7 +171,7 @@ static struct platform_device iop13xx_tpmi_1_device = {
         .resource = iop13xx_tpmi_1_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
@@ -182,7 +182,7 @@ static struct platform_device iop13xx_tpmi_2_device = {
         .resource = iop13xx_tpmi_2_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
@@ -193,7 +193,7 @@ static struct platform_device iop13xx_tpmi_3_device = {
         .resource = iop13xx_tpmi_3_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
diff --git a/arch/arm/mach-milbeaut/platsmp.c b/arch/arm/mach-milbeaut/platsmp.c
index 591543c81399..3ea880f5fcb7 100644
--- a/arch/arm/mach-milbeaut/platsmp.c
+++ b/arch/arm/mach-milbeaut/platsmp.c
@@ -65,6 +65,7 @@ static void m10v_smp_init(unsigned int max_cpus)
                 writel(KERNEL_UNBOOT_FLAG, m10v_smp_base + cpu * 4);
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 static void m10v_cpu_die(unsigned int l_cpu)
 {
         gic_cpu_if_down(0);
@@ -83,12 +84,15 @@ static int m10v_cpu_kill(unsigned int l_cpu)
 
         return 1;
 }
+#endif
 
 static struct smp_operations m10v_smp_ops __initdata = {
         .smp_prepare_cpus       = m10v_smp_init,
         .smp_boot_secondary     = m10v_boot_secondary,
+#ifdef CONFIG_HOTPLUG_CPU
         .cpu_die                = m10v_cpu_die,
         .cpu_kill               = m10v_cpu_kill,
+#endif
 };
 CPU_METHOD_OF_DECLARE(m10v_smp, "socionext,milbeaut-m10v-smp", &m10v_smp_ops);
 
diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
index be30c3c061b4..1b15d593837e 100644
--- a/arch/arm/mach-omap1/board-ams-delta.c
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -182,6 +182,7 @@ static struct resource latch1_resources[] = {
 
 static struct bgpio_pdata latch1_pdata = {
         .label  = LATCH1_LABEL,
+        .base   = -1,
         .ngpio  = LATCH1_NGPIO,
 };
 
@@ -219,6 +220,7 @@ static struct resource latch2_resources[] = {
 
 static struct bgpio_pdata latch2_pdata = {
         .label  = LATCH2_LABEL,
+        .base   = -1,
         .ngpio  = LATCH2_NGPIO,
 };
 
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 1444b4b4bd9f..439e143cad7b 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -250,8 +250,10 @@ static int __init omapdss_init_of(void)
         if (!node)
                 return 0;
 
-        if (!of_device_is_available(node))
+        if (!of_device_is_available(node)) {
+                of_node_put(node);
                 return 0;
+        }
 
         pdev = of_find_device_by_node(node);
 
diff --git a/arch/arm/plat-iop/adma.c b/arch/arm/plat-iop/adma.c
index a4d1f8de3b5b..d9612221e484 100644
--- a/arch/arm/plat-iop/adma.c
+++ b/arch/arm/plat-iop/adma.c
@@ -143,7 +143,7 @@ struct platform_device iop3xx_dma_0_channel = {
         .resource = iop3xx_dma_0_resources,
         .dev = {
                 .dma_mask = &iop3xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop3xx_dma_0_data,
         },
 };
@@ -155,7 +155,7 @@ struct platform_device iop3xx_dma_1_channel = {
         .resource = iop3xx_dma_1_resources,
         .dev = {
                 .dma_mask = &iop3xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop3xx_dma_1_data,
         },
 };
@@ -167,7 +167,7 @@ struct platform_device iop3xx_aau_channel = {
         .resource = iop3xx_aau_resources,
         .dev = {
                 .dma_mask = &iop3xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop3xx_aau_data,
         },
 };
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index a6c81ce00f52..8647cb80a93b 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -622,7 +622,7 @@ static struct platform_device orion_xor0_shared = {
         .resource       = orion_xor0_shared_resources,
         .dev            = {
                 .dma_mask               = &orion_xor_dmamask,
-                .coherent_dma_mask      = DMA_BIT_MASK(64),
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
                 .platform_data          = &orion_xor0_pdata,
         },
 };
@@ -683,7 +683,7 @@ static struct platform_device orion_xor1_shared = {
         .resource       = orion_xor1_shared_resources,
         .dev            = {
                 .dma_mask               = &orion_xor_dmamask,
-                .coherent_dma_mask      = DMA_BIT_MASK(64),
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
                 .platform_data          = &orion_xor1_pdata,
         },
 };
diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl
index 9016f4081bb9..0393917eaa57 100644
--- a/arch/arm/tools/syscall.tbl
+++ b/arch/arm/tools/syscall.tbl
@@ -437,3 +437,7 @@
 421     common  rt_sigtimedwait_time64          sys_rt_sigtimedwait
 422     common  futex_time64                    sys_futex
 423     common  sched_rr_get_interval_time64    sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 7c649f6b14cb..cd7c76e58b09 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -162,6 +162,7 @@
                         rx-fifo-depth = <16384>;
                         snps,multicast-filter-bins = <256>;
                         iommus = <&smmu 1>;
+                        altr,sysmgr-syscon = <&sysmgr 0x44 0>;
                         status = "disabled";
                 };
 
@@ -179,6 +180,7 @@
                         rx-fifo-depth = <16384>;
                         snps,multicast-filter-bins = <256>;
                         iommus = <&smmu 2>;
+                        altr,sysmgr-syscon = <&sysmgr 0x48 0>;
                         status = "disabled";
                 };
 
@@ -196,6 +198,7 @@
                         rx-fifo-depth = <16384>;
                         snps,multicast-filter-bins = <256>;
                         iommus = <&smmu 3>;
+                        altr,sysmgr-syscon = <&sysmgr 0x4c 0>;
                         status = "disabled";
                 };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
index 33c44e857247..0e34354b2092 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
@@ -108,8 +108,8 @@
         snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
         snps,reset-active-low;
         snps,reset-delays-us = <0 10000 50000>;
-        tx_delay = <0x25>;
-        rx_delay = <0x11>;
+        tx_delay = <0x24>;
+        rx_delay = <0x18>;
         status = "okay";
 };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
index 2157a528276b..79b4d1d4b5d6 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
@@ -46,8 +46,7 @@
 
         vcc_host1_5v: vcc_otg_5v: vcc-host1-5v-regulator {
                 compatible = "regulator-fixed";
-                enable-active-high;
-                gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>;
+                gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_LOW>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&usb20_host_drv>;
                 regulator-name = "vcc_host1_5v";
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 84f14b132e8f..dabef1a21649 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -1445,11 +1445,11 @@
 
                 sdmmc0 {
                         sdmmc0_clk: sdmmc0-clk {
-                                rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_4ma>;
+                                rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_8ma>;
                         };
 
                         sdmmc0_cmd: sdmmc0-cmd {
-                                rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_4ma>;
+                                rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_8ma>;
                         };
 
                         sdmmc0_dectn: sdmmc0-dectn {
@@ -1461,14 +1461,14 @@
                         };
 
                         sdmmc0_bus1: sdmmc0-bus1 {
-                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>;
+                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>;
                         };
 
                         sdmmc0_bus4: sdmmc0-bus4 {
-                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>,
-                                                <1 RK_PA1 1 &pcfg_pull_up_4ma>,
-                                                <1 RK_PA2 1 &pcfg_pull_up_4ma>,
-                                                <1 RK_PA3 1 &pcfg_pull_up_4ma>;
+                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>,
+                                                <1 RK_PA1 1 &pcfg_pull_up_8ma>,
+                                                <1 RK_PA2 1 &pcfg_pull_up_8ma>,
+                                                <1 RK_PA3 1 &pcfg_pull_up_8ma>;
                         };
 
                         sdmmc0_gpio: sdmmc0-gpio {
@@ -1642,50 +1642,50 @@
                         rgmiim1_pins: rgmiim1-pins {
                                 rockchip,pins =
                                         /* mac_txclk */
-                                        <1 RK_PB4 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PB4 2 &pcfg_pull_none_8ma>,
                                         /* mac_rxclk */
-                                        <1 RK_PB5 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB5 2 &pcfg_pull_none_4ma>,
                                         /* mac_mdio */
-                                        <1 RK_PC3 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC3 2 &pcfg_pull_none_4ma>,
                                         /* mac_txen */
-                                        <1 RK_PD1 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PD1 2 &pcfg_pull_none_8ma>,
                                         /* mac_clk */
-                                        <1 RK_PC5 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC5 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxdv */
-                                        <1 RK_PC6 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC6 2 &pcfg_pull_none_4ma>,
                                         /* mac_mdc */
-                                        <1 RK_PC7 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC7 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxd1 */
-                                        <1 RK_PB2 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB2 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxd0 */
-                                        <1 RK_PB3 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB3 2 &pcfg_pull_none_4ma>,
                                         /* mac_txd1 */
-                                        <1 RK_PB0 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PB0 2 &pcfg_pull_none_8ma>,
                                         /* mac_txd0 */
-                                        <1 RK_PB1 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PB1 2 &pcfg_pull_none_8ma>,
                                         /* mac_rxd3 */
-                                        <1 RK_PB6 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB6 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxd2 */
-                                        <1 RK_PB7 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB7 2 &pcfg_pull_none_4ma>,
                                         /* mac_txd3 */
-                                        <1 RK_PC0 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PC0 2 &pcfg_pull_none_8ma>,
                                         /* mac_txd2 */
-                                        <1 RK_PC1 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PC1 2 &pcfg_pull_none_8ma>,
 
                                         /* mac_txclk */
-                                        <0 RK_PB0 1 &pcfg_pull_none>,
+                                        <0 RK_PB0 1 &pcfg_pull_none_8ma>,
                                         /* mac_txen */
-                                        <0 RK_PB4 1 &pcfg_pull_none>,
+                                        <0 RK_PB4 1 &pcfg_pull_none_8ma>,
                                         /* mac_clk */
-                                        <0 RK_PD0 1 &pcfg_pull_none>,
+                                        <0 RK_PD0 1 &pcfg_pull_none_4ma>,
                                         /* mac_txd1 */
-                                        <0 RK_PC0 1 &pcfg_pull_none>,
+                                        <0 RK_PC0 1 &pcfg_pull_none_8ma>,
                                         /* mac_txd0 */
-                                        <0 RK_PC1 1 &pcfg_pull_none>,
+                                        <0 RK_PC1 1 &pcfg_pull_none_8ma>,
                                         /* mac_txd3 */
-                                        <0 RK_PC7 1 &pcfg_pull_none>,
+                                        <0 RK_PC7 1 &pcfg_pull_none_8ma>,
                                         /* mac_txd2 */
-                                        <0 RK_PC6 1 &pcfg_pull_none>;
+                                        <0 RK_PC6 1 &pcfg_pull_none_8ma>;
                         };
 
                         rmiim1_pins: rmiim1-pins {
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts
index 4a543f2117d4..844eac939a97 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts
@@ -158,6 +158,7 @@
 };
 
 &hdmi {
+        ddc-i2c-bus = <&i2c3>;
         pinctrl-names = "default";
         pinctrl-0 = <&hdmi_cec>;
         status = "okay";
diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index cccb83ad7fa8..c7e1a7837706 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -30,8 +30,8 @@ do {									\
 "       prfm    pstl1strm, %2\n"                                        \
 "1:     ldxr    %w1, %2\n"                                              \
         insn "\n"                                                       \
-"2:     stlxr   %w3, %w0, %2\n"                                         \
-"       cbnz    %w3, 1b\n"                                              \
+"2:     stlxr   %w0, %w3, %2\n"                                         \
+"       cbnz    %w0, 1b\n"                                              \
 "       dmb     ish\n"                                                  \
 "3:\n"                                                                  \
 "       .pushsection .fixup,\"ax\"\n"                                   \
@@ -57,23 +57,23 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
 
         switch (op) {
         case FUTEX_OP_SET:
-                __futex_atomic_op("mov  %w0, %w4",
+                __futex_atomic_op("mov  %w3, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         case FUTEX_OP_ADD:
-                __futex_atomic_op("add  %w0, %w1, %w4",
+                __futex_atomic_op("add  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         case FUTEX_OP_OR:
-                __futex_atomic_op("orr  %w0, %w1, %w4",
+                __futex_atomic_op("orr  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         case FUTEX_OP_ANDN:
-                __futex_atomic_op("and  %w0, %w1, %w4",
+                __futex_atomic_op("and  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, ~oparg);
                 break;
         case FUTEX_OP_XOR:
-                __futex_atomic_op("eor  %w0, %w1, %w4",
+                __futex_atomic_op("eor  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         default:
diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
index 905e1bb0e7bd..cd9f4e9d04d3 100644
--- a/arch/arm64/include/asm/module.h
+++ b/arch/arm64/include/asm/module.h
@@ -73,4 +73,9 @@ static inline bool is_forbidden_offset_for_adrp(void *place)
 struct plt_entry get_plt_entry(u64 dst, void *pc);
 bool plt_entries_equal(const struct plt_entry *a, const struct plt_entry *b);
 
+static inline bool plt_entry_is_initialized(const struct plt_entry *e)
+{
+        return e->adrp || e->add || e->br;
+}
+
 #endif /* __ASM_MODULE_H */
diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
index ad8be16a39c9..a179df3674a1 100644
--- a/arch/arm64/include/asm/syscall.h
+++ b/arch/arm64/include/asm/syscall.h
@@ -65,52 +65,22 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
-                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
-                pr_warning("%s called with max args %d, handling only %d\n",
-                           __func__, i + n, SYSCALL_MAX_ARGS);
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-        }
-
-        if (i == 0) {
-                args[0] = regs->orig_x0;
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(args, &regs->regs[i], n * sizeof(args[0]));
+        args[0] = regs->orig_x0;
+        args++;
+
+        memcpy(args, &regs->regs[1], 5 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                pr_warning("%s called with max args %d, handling only %d\n",
-                           __func__, i + n, SYSCALL_MAX_ARGS);
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                regs->orig_x0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(&regs->regs[i], args, n * sizeof(args[0]));
+        regs->orig_x0 = args[0];
+        args++;
+
+        memcpy(&regs->regs[1], args, 5 * sizeof(args[0]));
 }
 
 /*
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index d1dd93436e1e..f2a83ff6b73c 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE + 5)
 #define __ARM_NR_COMPAT_END             (__ARM_NR_COMPAT_BASE + 0x800)
 
-#define __NR_compat_syscalls            424
+#define __NR_compat_syscalls            428
 #endif
 
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index 5590f2623690..23f1a44acada 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -866,6 +866,14 @@ __SYSCALL(__NR_rt_sigtimedwait_time64, compat_sys_rt_sigtimedwait_time64)
 __SYSCALL(__NR_futex_time64, sys_futex)
 #define __NR_sched_rr_get_interval_time64 423
 __SYSCALL(__NR_sched_rr_get_interval_time64, sys_sched_rr_get_interval)
+#define __NR_pidfd_send_signal 424
+__SYSCALL(__NR_pidfd_send_signal, sys_pidfd_send_signal)
+#define __NR_io_uring_setup 425
+__SYSCALL(__NR_io_uring_setup, sys_io_uring_setup)
+#define __NR_io_uring_enter 426
+__SYSCALL(__NR_io_uring_enter, sys_io_uring_enter)
+#define __NR_io_uring_register 427
+__SYSCALL(__NR_io_uring_register, sys_io_uring_register)
 
 /*
  * Please add new compat syscalls above this comment and update
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 8e4431a8821f..65a51331088e 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -103,12 +103,16 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
                  * to be revisited if support for multiple ftrace entry points
                  * is added in the future, but for now, the pr_err() below
                  * deals with a theoretical issue only.
+                 *
+                 * Note that PLTs are place relative, and plt_entries_equal()
+                 * checks whether they point to the same target. Here, we need
+                 * to check if the actual opcodes are in fact identical,
+                 * regardless of the offset in memory so use memcmp() instead.
                  */
                 trampoline = get_plt_entry(addr, mod->arch.ftrace_trampoline);
-                if (!plt_entries_equal(mod->arch.ftrace_trampoline,
-                                       &trampoline)) {
-                        if (!plt_entries_equal(mod->arch.ftrace_trampoline,
-                                               &(struct plt_entry){})) {
+                if (memcmp(mod->arch.ftrace_trampoline, &trampoline,
+                           sizeof(trampoline))) {
+                        if (plt_entry_is_initialized(mod->arch.ftrace_trampoline)) {
                                 pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
                                 return -EINVAL;
                         }
diff --git a/arch/arm64/kernel/sdei.c b/arch/arm64/kernel/sdei.c
index 5ba4465e44f0..ea94cf8f9dc6 100644
--- a/arch/arm64/kernel/sdei.c
+++ b/arch/arm64/kernel/sdei.c
@@ -94,6 +94,9 @@ static bool on_sdei_normal_stack(unsigned long sp, struct stack_info *info)
         unsigned long low = (unsigned long)raw_cpu_read(sdei_stack_normal_ptr);
         unsigned long high = low + SDEI_STACK_SIZE;
 
+        if (!low)
+                return false;
+
         if (sp < low || sp >= high)
                 return false;
 
@@ -111,6 +114,9 @@ static bool on_sdei_critical_stack(unsigned long sp, struct stack_info *info)
         unsigned long low = (unsigned long)raw_cpu_read(sdei_stack_critical_ptr);
         unsigned long high = low + SDEI_STACK_SIZE;
 
+        if (!low)
+                return false;
+
         if (sp < low || sp >= high)
                 return false;
 
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 8ad119c3f665..29755989f616 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -102,10 +102,16 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
 void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
 {
         struct stackframe frame;
-        int skip;
+        int skip = 0;
 
         pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
 
+        if (regs) {
+                if (user_mode(regs))
+                        return;
+                skip = 1;
+        }
+
         if (!tsk)
                 tsk = current;
 
@@ -126,7 +132,6 @@ void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
         frame.graph = 0;
 #endif
 
-        skip = !!regs;
         printk("Call trace:\n");
         do {
                 /* skip until specified stack frame */
@@ -176,15 +181,13 @@ static int __die(const char *str, int err, struct pt_regs *regs)
                 return ret;
 
         print_modules();
-        __show_regs(regs);
         pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
                  TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk),
                  end_of_stack(tsk));
+        show_regs(regs);
 
-        if (!user_mode(regs)) {
-                dump_backtrace(regs, tsk);
+        if (!user_mode(regs))
                 dump_instr(KERN_EMERG, regs);
-        }
 
         return ret;
 }
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 6bc135042f5e..7cae155e81a5 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -363,7 +363,7 @@ void __init arm64_memblock_init(void)
                  * Otherwise, this is a no-op
                  */
                 u64 base = phys_initrd_start & PAGE_MASK;
-                u64 size = PAGE_ALIGN(phys_initrd_size);
+                u64 size = PAGE_ALIGN(phys_initrd_start + phys_initrd_size) - base;
 
                 /*
                  * We can only add back the initrd memory if we don't end up
diff --git a/arch/c6x/include/asm/syscall.h b/arch/c6x/include/asm/syscall.h
index ae2be315ee9c..15ba8599858e 100644
--- a/arch/c6x/include/asm/syscall.h
+++ b/arch/c6x/include/asm/syscall.h
@@ -46,78 +46,27 @@ static inline void syscall_set_return_value(struct task_struct *task,
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
-                                         struct pt_regs *regs, unsigned int i,
-                                         unsigned int n, unsigned long *args)
+                                         struct pt_regs *regs,
+                                         unsigned long *args)
 {
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                *args++ = regs->a4;
-        case 1:
-                if (!n--)
-                        break;
-                *args++ = regs->b4;
-        case 2:
-                if (!n--)
-                        break;
-                *args++ = regs->a6;
-        case 3:
-                if (!n--)
-                        break;
-                *args++ = regs->b6;
-        case 4:
-                if (!n--)
-                        break;
-                *args++ = regs->a8;
-        case 5:
-                if (!n--)
-                        break;
-                *args++ = regs->b8;
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-        }
+        *args++ = regs->a4;
+        *args++ = regs->b4;
+        *args++ = regs->a6;
+        *args++ = regs->b6;
+        *args++ = regs->a8;
+        *args   = regs->b8;
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                regs->a4 = *args++;
-        case 1:
-                if (!n--)
-                        break;
-                regs->b4 = *args++;
-        case 2:
-                if (!n--)
-                        break;
-                regs->a6 = *args++;
-        case 3:
-                if (!n--)
-                        break;
-                regs->b6 = *args++;
-        case 4:
-                if (!n--)
-                        break;
-                regs->a8 = *args++;
-        case 5:
-                if (!n--)
-                        break;
-                regs->a9 = *args++;
-        case 6:
-                if (!n)
-                        break;
-        default:
-                BUG();
-        }
+        regs->a4 = *args++;
+        regs->b4 = *args++;
+        regs->a6 = *args++;
+        regs->b6 = *args++;
+        regs->a8 = *args++;
+        regs->a9 = *args;
 }
 
 #endif /* __ASM_C6X_SYSCALLS_H */
diff --git a/arch/csky/include/asm/syscall.h b/arch/csky/include/asm/syscall.h
index d637445737b7..bda0a446c63e 100644
--- a/arch/csky/include/asm/syscall.h
+++ b/arch/csky/include/asm/syscall.h
@@ -43,30 +43,20 @@ syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
 
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                args[0] = regs->orig_a0;
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(args, &regs->a1 + i * sizeof(regs->a1), n * sizeof(args[0]));
+        args[0] = regs->orig_a0;
+        args++;
+        memcpy(args, &regs->a1, 5 * sizeof(args[0]));
 }
 
 static inline void
 syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, const unsigned long *args)
+                      const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                regs->orig_a0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
+        regs->orig_a0 = args[0];
+        args++;
+        memcpy(&regs->a1, args, 5 * sizeof(regs->a1));
 }
 
 static inline int
diff --git a/arch/h8300/include/asm/syscall.h b/arch/h8300/include/asm/syscall.h
index 924990401237..ddd483c6ca95 100644
--- a/arch/h8300/include/asm/syscall.h
+++ b/arch/h8300/include/asm/syscall.h
@@ -17,34 +17,14 @@ syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
 
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        while (n > 0) {
-                switch (i) {
-                case 0:
-                        *args++ = regs->er1;
-                        break;
-                case 1:
-                        *args++ = regs->er2;
-                        break;
-                case 2:
-                        *args++ = regs->er3;
-                        break;
-                case 3:
-                        *args++ = regs->er4;
-                        break;
-                case 4:
-                        *args++ = regs->er5;
-                        break;
-                case 5:
-                        *args++ = regs->er6;
-                        break;
-                }
-                i++;
-                n--;
-        }
+        *args++ = regs->er1;
+        *args++ = regs->er2;
+        *args++ = regs->er3;
+        *args++ = regs->er4;
+        *args++ = regs->er5;
+        *args   = regs->er6;
 }
 
 
diff --git a/arch/hexagon/include/asm/syscall.h b/arch/hexagon/include/asm/syscall.h
index 4af9c7b6f13a..ae3a1e24fabd 100644
--- a/arch/hexagon/include/asm/syscall.h
+++ b/arch/hexagon/include/asm/syscall.h
@@ -37,10 +37,8 @@ static inline long syscall_get_nr(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(args, &(&regs->r00)[i], n * sizeof(args[0]));
+        memcpy(args, &(&regs->r00)[0], 6 * sizeof(args[0]));
 }
 #endif
diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index 1d0b875fec44..0d9e7fab4a79 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -59,26 +59,19 @@ static inline void syscall_set_return_value(struct task_struct *task,
 }
 
 extern void ia64_syscall_get_set_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        unsigned long *args, int rw);
+        struct pt_regs *regs, unsigned long *args, int rw);
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        ia64_syscall_get_set_arguments(task, regs, i, n, args, 0);
+        ia64_syscall_get_set_arguments(task, regs, args, 0);
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
+        ia64_syscall_get_set_arguments(task, regs, args, 1);
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 6d50ede0ed69..bf9c24d9ce84 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -2179,12 +2179,11 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data)
 }
 
 void ia64_syscall_get_set_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        unsigned long *args, int rw)
+        struct pt_regs *regs, unsigned long *args, int rw)
 {
         struct syscall_get_set_args data = {
-                .i = i,
-                .n = n,
+                .i = 0,
+                .n = 6,
                 .args = args,
                 .regs = regs,
                 .rw = rw,
diff --git a/arch/ia64/kernel/syscalls/syscall.tbl b/arch/ia64/kernel/syscalls/syscall.tbl
index ab9cda5f6136..56e3d0b685e1 100644
--- a/arch/ia64/kernel/syscalls/syscall.tbl
+++ b/arch/ia64/kernel/syscalls/syscall.tbl
@@ -344,3 +344,7 @@
 332     common  pkey_free                       sys_pkey_free
 333     common  rseq                            sys_rseq
 # 334 through 423 are reserved to sync up with other architectures
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/m68k/kernel/syscalls/syscall.tbl b/arch/m68k/kernel/syscalls/syscall.tbl
index 125c14178979..df4ec3ec71d1 100644
--- a/arch/m68k/kernel/syscalls/syscall.tbl
+++ b/arch/m68k/kernel/syscalls/syscall.tbl
@@ -423,3 +423,7 @@
 421     common  rt_sigtimedwait_time64          sys_rt_sigtimedwait
 422     common  futex_time64                    sys_futex
 423     common  sched_rr_get_interval_time64    sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
index 220decd605a4..833d3a53dab3 100644
--- a/arch/microblaze/include/asm/syscall.h
+++ b/arch/microblaze/include/asm/syscall.h
@@ -82,18 +82,22 @@ static inline void microblaze_set_syscall_arg(struct pt_regs *regs,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
+        unsigned int i = 0;
+        unsigned int n = 6;
+
         while (n--)
                 *args++ = microblaze_get_syscall_arg(regs, i++);
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
+        unsigned int i = 0;
+        unsigned int n = 6;
+
         while (n--)
                 microblaze_set_syscall_arg(regs, i++, *args++);
 }
diff --git a/arch/microblaze/kernel/syscalls/syscall.tbl b/arch/microblaze/kernel/syscalls/syscall.tbl
index 8ee3a8c18498..4964947732af 100644
--- a/arch/microblaze/kernel/syscalls/syscall.tbl
+++ b/arch/microblaze/kernel/syscalls/syscall.tbl
@@ -429,3 +429,7 @@
 421     common  rt_sigtimedwait_time64          sys_rt_sigtimedwait
 422     common  futex_time64                    sys_futex
 423     common  sched_rr_get_interval_time64    sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
index 4a70c5de8c92..25a57895a3a3 100644
--- a/arch/mips/ath79/setup.c
+++ b/arch/mips/ath79/setup.c
@@ -210,12 +210,6 @@ const char *get_system_type(void)
         return ath79_sys_type;
 }
 
-int get_c0_perfcount_int(void)
-{
-        return ATH79_MISC_IRQ(5);
-}
-EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
-
 unsigned int get_c0_compare_int(void)
 {
         return CP0_LEGACY_COMPARE_IRQ;
diff --git a/arch/mips/configs/generic/board-ocelot.config b/arch/mips/configs/generic/board-ocelot.config
index f607888d2483..184eb65a6ba7 100644
--- a/arch/mips/configs/generic/board-ocelot.config
+++ b/arch/mips/configs/generic/board-ocelot.config
@@ -1,6 +1,10 @@
 # require CONFIG_CPU_MIPS32_R2=y
 
 CONFIG_LEGACY_BOARD_OCELOT=y
+CONFIG_FIT_IMAGE_FDT_OCELOT=y
+
+CONFIG_BRIDGE=y
+CONFIG_GENERIC_PHY=y
 
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
@@ -19,6 +23,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 
 CONFIG_NETDEVICES=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NET_DSA=y
 CONFIG_MSCC_OCELOT_SWITCH=y
 CONFIG_MSCC_OCELOT_SWITCH_OCELOT=y
 CONFIG_MDIO_MSCC_MIIM=y
@@ -35,6 +41,8 @@ CONFIG_SPI_DESIGNWARE=y
 CONFIG_SPI_DW_MMIO=y
 CONFIG_SPI_SPIDEV=y
 
+CONFIG_PINCTRL_OCELOT=y
+
 CONFIG_GPIO_SYSFS=y
 
 CONFIG_POWER_RESET=y
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 6cf8ffb5367e..a2b4748655df 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -116,9 +116,10 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
+        unsigned int i = 0;
+        unsigned int n = 6;
         int ret;
 
         /* O32 ABI syscall() */
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 6e574c02e4c3..ea781b29f7f1 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -33,6 +33,7 @@
 #include <asm/processor.h>
 #include <asm/sigcontext.h>
 #include <linux/uaccess.h>
+#include <asm/irq_regs.h>
 
 static struct hard_trap_info {
         unsigned char tt;       /* Trap type code for MIPS R3xxx and R4xxx */
@@ -214,7 +215,7 @@ void kgdb_call_nmi_hook(void *ignored)
         old_fs = get_fs();
         set_fs(KERNEL_DS);
 
-        kgdb_nmicallback(raw_smp_processor_id(), NULL);
+        kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
 
         set_fs(old_fs);
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 0057c910bc2f..3a62f80958e1 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1419,7 +1419,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
 
                 sd.nr = syscall;
                 sd.arch = syscall_get_arch();
-                syscall_get_arguments(current, regs, 0, 6, args);
+                syscall_get_arguments(current, regs, args);
                 for (i = 0; i < 6; i++)
                         sd.args[i] = args[i];
                 sd.instruction_pointer = KSTK_EIP(current);
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index f158c5894a9a..feb2653490df 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -125,7 +125,7 @@ trace_a_syscall:
         subu    t1, v0,  __NR_O32_Linux
         move    a1, v0
         bnez    t1, 1f /* __NR_syscall at offset 0 */
-        lw      a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
+        ld      a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
         .set    pop
 
 1:      jal     syscall_trace_enter
diff --git a/arch/mips/kernel/syscalls/syscall_n32.tbl b/arch/mips/kernel/syscalls/syscall_n32.tbl
index 15f4117900ee..9392dfe33f97 100644
--- a/arch/mips/kernel/syscalls/syscall_n32.tbl
+++ b/arch/mips/kernel/syscalls/syscall_n32.tbl
@@ -362,3 +362,7 @@
 421     n32     rt_sigtimedwait_time64          compat_sys_rt_sigtimedwait_time64
 422     n32     futex_time64                    sys_futex
 423     n32     sched_rr_get_interval_time64    sys_sched_rr_get_interval
+424     n32     pidfd_send_signal               sys_pidfd_send_signal
+425     n32     io_uring_setup                  sys_io_uring_setup
+426     n32     io_uring_enter                  sys_io_uring_enter
+427     n32     io_uring_register               sys_io_uring_register
diff --git a/arch/mips/kernel/syscalls/syscall_n64.tbl b/arch/mips/kernel/syscalls/syscall_n64.tbl
index c85502e67b44..cd0c8aa21fba 100644
--- a/arch/mips/kernel/syscalls/syscall_n64.tbl
+++ b/arch/mips/kernel/syscalls/syscall_n64.tbl
@@ -338,3 +338,7 @@
 327     n64     rseq                            sys_rseq
 328     n64     io_pgetevents                   sys_io_pgetevents
 # 329 through 423 are reserved to sync up with other architectures
+424     n64     pidfd_send_signal               sys_pidfd_send_signal
+425     n64     io_uring_setup                  sys_io_uring_setup
+426     n64     io_uring_enter                  sys_io_uring_enter
+427     n64     io_uring_register               sys_io_uring_register
diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl
index 2e063d0f837e..e849e8ffe4a2 100644
--- a/arch/mips/kernel/syscalls/syscall_o32.tbl
+++ b/arch/mips/kernel/syscalls/syscall_o32.tbl
@@ -411,3 +411,7 @@
 421     o32     rt_sigtimedwait_time64          sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait_time64
 422     o32     futex_time64                    sys_futex                       sys_futex
 423     o32     sched_rr_get_interval_time64    sys_sched_rr_get_interval       sys_sched_rr_get_interval
+424     o32     pidfd_send_signal               sys_pidfd_send_signal
+425     o32     io_uring_setup                  sys_io_uring_setup
+426     o32     io_uring_enter                  sys_io_uring_enter
+427     o32     io_uring_register               sys_io_uring_register
diff --git a/arch/mips/sgi-ip27/ip27-irq.c b/arch/mips/sgi-ip27/ip27-irq.c
index 710a59764b01..a32f843cdbe0 100644
--- a/arch/mips/sgi-ip27/ip27-irq.c
+++ b/arch/mips/sgi-ip27/ip27-irq.c
@@ -118,7 +118,6 @@ static void shutdown_bridge_irq(struct irq_data *d)
 {
         struct hub_irq_data *hd = irq_data_get_irq_chip_data(d);
         struct bridge_controller *bc;
-        int pin = hd->pin;
 
         if (!hd)
                 return;
@@ -126,7 +125,7 @@ static void shutdown_bridge_irq(struct irq_data *d)
         disable_hub_irq(d);
 
         bc = hd->bc;
-        bridge_clr(bc, b_int_enable, (1 << pin));
+        bridge_clr(bc, b_int_enable, (1 << hd->pin));
         bridge_read(bc, b_wid_tflush);
 }
 
diff --git a/arch/nds32/include/asm/syscall.h b/arch/nds32/include/asm/syscall.h
index f7e5e86765fe..671ebd357496 100644
--- a/arch/nds32/include/asm/syscall.h
+++ b/arch/nds32/include/asm/syscall.h
@@ -108,81 +108,41 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  * syscall_get_arguments - extract system call parameter values
  * @task:       task of interest, must be blocked
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array filled with argument values
  *
- * Fetches @n arguments to the system call starting with the @i'th argument
- * (from 0 through 5).  Argument @i is stored in @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Fetches 6 arguments to the system call (from 0 through 5). The first
+ * argument is stored in @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 #define SYSCALL_MAX_ARGS 6
 void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n, unsigned long *args)
+                           unsigned long *args)
 {
-        if (n == 0)
-                return;
-        if (i + n > SYSCALL_MAX_ARGS) {
-                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
-                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
-                pr_warning("%s called with max args %d, handling only %d\n",
-                           __func__, i + n, SYSCALL_MAX_ARGS);
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-        }
-
-        if (i == 0) {
-                args[0] = regs->orig_r0;
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(args, &regs->uregs[0] + i, n * sizeof(args[0]));
+        args[0] = regs->orig_r0;
+        args++;
+        memcpy(args, &regs->uregs[0] + 1, 5 * sizeof(args[0]));
 }
 
 /**
  * syscall_set_arguments - change system call parameter value
  * @task:       task of interest, must be in system call entry tracing
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array of argument values to store
  *
- * Changes @n arguments to the system call starting with the @i'th argument.
- * Argument @i gets value @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Changes 6 arguments to the system call. The first argument gets value
+ * @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n,
                            const unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                pr_warn("%s called with max args %d, handling only %d\n",
-                        __func__, i + n, SYSCALL_MAX_ARGS);
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                regs->orig_r0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
+        regs->orig_r0 = args[0];
+        args++;
 
-        memcpy(&regs->uregs[0] + i, args, n * sizeof(args[0]));
+        memcpy(&regs->uregs[0] + 1, args, 5 * sizeof(args[0]));
 }
 #endif /* _ASM_NDS32_SYSCALL_H */
diff --git a/arch/nios2/include/asm/syscall.h b/arch/nios2/include/asm/syscall.h
index 9de220854c4a..d7624ed06efb 100644
--- a/arch/nios2/include/asm/syscall.h
+++ b/arch/nios2/include/asm/syscall.h
@@ -58,81 +58,25 @@ static inline void syscall_set_return_value(struct task_struct *task,
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        unsigned long *args)
+        struct pt_regs *regs, unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                *args++ = regs->r4;
-        case 1:
-                if (!n--)
-                        break;
-                *args++ = regs->r5;
-        case 2:
-                if (!n--)
-                        break;
-                *args++ = regs->r6;
-        case 3:
-                if (!n--)
-                        break;
-                *args++ = regs->r7;
-        case 4:
-                if (!n--)
-                        break;
-                *args++ = regs->r8;
-        case 5:
-                if (!n--)
-                        break;
-                *args++ = regs->r9;
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-        }
+        *args++ = regs->r4;
+        *args++ = regs->r5;
+        *args++ = regs->r6;
+        *args++ = regs->r7;
+        *args++ = regs->r8;
+        *args   = regs->r9;
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        const unsigned long *args)
+        struct pt_regs *regs, const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                regs->r4 = *args++;
-        case 1:
-                if (!n--)
-                        break;
-                regs->r5 = *args++;
-        case 2:
-                if (!n--)
-                        break;
-                regs->r6 = *args++;
-        case 3:
-                if (!n--)
-                        break;
-                regs->r7 = *args++;
-        case 4:
-                if (!n--)
-                        break;
-                regs->r8 = *args++;
-        case 5:
-                if (!n--)
-                        break;
-                regs->r9 = *args++;
-        case 6:
-                if (!n)
-                        break;
-        default:
-                BUG();
-        }
+        regs->r4 = *args++;
+        regs->r5 = *args++;
+        regs->r6 = *args++;
+        regs->r7 = *args++;
+        regs->r8 = *args++;
+        regs->r9 = *args;
 }
 
 #endif
diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
index 2db9f1cf0694..b4ff07c1baed 100644
--- a/arch/openrisc/include/asm/syscall.h
+++ b/arch/openrisc/include/asm/syscall.h
@@ -56,20 +56,16 @@ syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
 
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        memcpy(args, &regs->gpr[3 + i], n * sizeof(args[0]));
+        memcpy(args, &regs->gpr[3], 6 * sizeof(args[0]));
 }
 
 static inline void
 syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, const unsigned long *args)
+                      const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
+        memcpy(&regs->gpr[3], args, 6 * sizeof(args[0]));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/parisc/include/asm/ptrace.h b/arch/parisc/include/asm/ptrace.h
index 2a27b275ab09..9ff033d261ab 100644
--- a/arch/parisc/include/asm/ptrace.h
+++ b/arch/parisc/include/asm/ptrace.h
@@ -22,13 +22,14 @@ unsigned long profile_pc(struct pt_regs *);
 
 static inline unsigned long regs_return_value(struct pt_regs *regs)
 {
-        return regs->gr[20];
+        return regs->gr[28];
 }
 
 static inline void instruction_pointer_set(struct pt_regs *regs,
                                                 unsigned long val)
 {
-        regs->iaoq[0] = val;
+        regs->iaoq[0] = val;
+        regs->iaoq[1] = val + 4;
 }
 
 /* Query offset/name of register from its name/offset */
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index 8bff1a58c97f..62a6d477fae0 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -18,29 +18,15 @@ static inline long syscall_get_nr(struct task_struct *tsk,
 }
 
 static inline void syscall_get_arguments(struct task_struct *tsk,
-                                         struct pt_regs *regs, unsigned int i,
-                                         unsigned int n, unsigned long *args)
+                                         struct pt_regs *regs,
+                                         unsigned long *args)
 {
-        BUG_ON(i);
-
-        switch (n) {
-        case 6:
-                args[5] = regs->gr[21];
-        case 5:
-                args[4] = regs->gr[22];
-        case 4:
-                args[3] = regs->gr[23];
-        case 3:
-                args[2] = regs->gr[24];
-        case 2:
-                args[1] = regs->gr[25];
-        case 1:
-                args[0] = regs->gr[26];
-        case 0:
-                break;
-        default:
-                BUG();
-        }
+        args[5] = regs->gr[21];
+        args[4] = regs->gr[22];
+        args[3] = regs->gr[23];
+        args[2] = regs->gr[24];
+        args[1] = regs->gr[25];
+        args[0] = regs->gr[26];
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index eb39e7e380d7..841db71958cd 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -210,12 +210,6 @@ void __cpuidle arch_cpu_idle(void)
 
 static int __init parisc_idle_init(void)
 {
-        const char *marker;
-
-        /* check QEMU/SeaBIOS marker in PAGE0 */
-        marker = (char *) &PAGE0->pad0;
-        running_on_qemu = (memcmp(marker, "SeaBIOS", 8) == 0);
-
         if (!running_on_qemu)
                 cpu_idle_poll_ctrl(1);
 
diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
index 15dd9e21be7e..d908058d05c1 100644
--- a/arch/parisc/kernel/setup.c
+++ b/arch/parisc/kernel/setup.c
@@ -397,6 +397,9 @@ void __init start_parisc(void)
         int ret, cpunum;
         struct pdc_coproc_cfg coproc_cfg;
 
+        /* check QEMU/SeaBIOS marker in PAGE0 */
+        running_on_qemu = (memcmp(&PAGE0->pad0, "SeaBIOS", 8) == 0);
+
         cpunum = smp_processor_id();
 
         init_cpu_topology();
diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl
index b26766c6647d..fe8ca623add8 100644
--- a/arch/parisc/kernel/syscalls/syscall.tbl
+++ b/arch/parisc/kernel/syscalls/syscall.tbl
@@ -420,3 +420,7 @@
 421     32      rt_sigtimedwait_time64          sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait_time64
 422     32      futex_time64                    sys_futex                       sys_futex
 423     32      sched_rr_get_interval_time64    sys_sched_rr_get_interval       sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/powerpc/configs/skiroot_defconfig b/arch/powerpc/configs/skiroot_defconfig
index 5ba131c30f6b..1bcd468ab422 100644
--- a/arch/powerpc/configs/skiroot_defconfig
+++ b/arch/powerpc/configs/skiroot_defconfig
@@ -266,6 +266,7 @@ CONFIG_UDF_FS=m
 CONFIG_MSDOS_FS=m
 CONFIG_VFAT_FS=m
 CONFIG_PROC_KCORE=y
+CONFIG_HUGETLBFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 # CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_NLS=y
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index 598cdcdd1355..8ddd4a91bdc1 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -352,7 +352,7 @@ static inline bool strict_kernel_rwx_enabled(void)
 #if defined(CONFIG_SPARSEMEM_VMEMMAP) && defined(CONFIG_SPARSEMEM_EXTREME) &&   \
         defined (CONFIG_PPC_64K_PAGES)
 #define MAX_PHYSMEM_BITS        51
-#elif defined(CONFIG_SPARSEMEM)
+#elif defined(CONFIG_PPC64)
 #define MAX_PHYSMEM_BITS        46
 #endif
 
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index 1a0e7a8b1c81..1243045bad2d 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -65,22 +65,20 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         unsigned long val, mask = -1UL;
-
-        BUG_ON(i + n > 6);
+        unsigned int n = 6;
 
 #ifdef CONFIG_COMPAT
         if (test_tsk_thread_flag(task, TIF_32BIT))
                 mask = 0xffffffff;
 #endif
         while (n--) {
-                if (n == 0 && i == 0)
+                if (n == 0)
                         val = regs->orig_gpr3;
                 else
-                        val = regs->gpr[3 + i + n];
+                        val = regs->gpr[3 + n];
 
                 args[n] = val & mask;
         }
@@ -88,15 +86,12 @@ static inline void syscall_get_arguments(struct task_struct *task,
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
+        memcpy(&regs->gpr[3], args, 6 * sizeof(args[0]));
 
         /* Also copy the first argument into orig_gpr3 */
-        if (i == 0 && n > 0)
-                regs->orig_gpr3 = args[0];
+        regs->orig_gpr3 = args[0];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index a5b8fbae56a0..9481a117e242 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -656,11 +656,17 @@ EXC_COMMON_BEGIN(data_access_slb_common)
         ld      r4,PACA_EXSLB+EX_DAR(r13)
         std     r4,_DAR(r1)
         addi    r3,r1,STACK_FRAME_OVERHEAD
+BEGIN_MMU_FTR_SECTION
+        /* HPT case, do SLB fault */
         bl      do_slb_fault
         cmpdi   r3,0
         bne-    1f
         b       fast_exception_return
 1:      /* Error case */
+MMU_FTR_SECTION_ELSE
+        /* Radix case, access is outside page table range */
+        li      r3,-EFAULT
+ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
         std     r3,RESULT(r1)
         bl      save_nvgprs
         RECONCILE_IRQ_STATE(r10, r11)
@@ -705,11 +711,17 @@ EXC_COMMON_BEGIN(instruction_access_slb_common)
         EXCEPTION_PROLOG_COMMON(0x480, PACA_EXSLB)
         ld      r4,_NIP(r1)
         addi    r3,r1,STACK_FRAME_OVERHEAD
+BEGIN_MMU_FTR_SECTION
+        /* HPT case, do SLB fault */
         bl      do_slb_fault
         cmpdi   r3,0
         bne-    1f
         b       fast_exception_return
 1:      /* Error case */
+MMU_FTR_SECTION_ELSE
+        /* Radix case, access is outside page table range */
+        li      r3,-EFAULT
+ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
         std     r3,RESULT(r1)
         bl      save_nvgprs
         RECONCILE_IRQ_STATE(r10, r11)
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index 48051c8977c5..e25b615e9f9e 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -851,10 +851,6 @@ __secondary_start:
         tophys(r4,r2)
         addi    r4,r4,THREAD    /* phys address of our thread_struct */
         mtspr   SPRN_SPRG_THREAD,r4
-#ifdef CONFIG_PPC_RTAS
-        li      r3,0
-        stw     r3, RTAS_SP(r4)         /* 0 => not in RTAS */
-#endif
         lis     r4, (swapper_pg_dir - PAGE_OFFSET)@h
         ori     r4, r4, (swapper_pg_dir - PAGE_OFFSET)@l
         mtspr   SPRN_SPRG_PGDIR, r4
@@ -941,10 +937,6 @@ start_here:
         tophys(r4,r2)
         addi    r4,r4,THREAD    /* init task's THREAD */
         mtspr   SPRN_SPRG_THREAD,r4
-#ifdef CONFIG_PPC_RTAS
-        li      r3,0
-        stw     r3, RTAS_SP(r4)         /* 0 => not in RTAS */
-#endif
         lis     r4, (swapper_pg_dir - PAGE_OFFSET)@h
         ori     r4, r4, (swapper_pg_dir - PAGE_OFFSET)@l
         mtspr   SPRN_SPRG_PGDIR, r4
diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c
index 683b5b3805bd..cd381e2291df 100644
--- a/arch/powerpc/kernel/kvm.c
+++ b/arch/powerpc/kernel/kvm.c
@@ -22,6 +22,7 @@
 #include <linux/kvm_host.h>
 #include <linux/init.h>
 #include <linux/export.h>
+#include <linux/kmemleak.h>
 #include <linux/kvm_para.h>
 #include <linux/slab.h>
 #include <linux/of.h>
@@ -712,6 +713,12 @@ static void kvm_use_magic_page(void)
 
 static __init void kvm_free_tmp(void)
 {
+        /*
+         * Inform kmemleak about the hole in the .bss section since the
+         * corresponding pages will be unmapped with DEBUG_PAGEALLOC=y.
+         */
+        kmemleak_free_part(&kvm_tmp[kvm_tmp_index],
+                           ARRAY_SIZE(kvm_tmp) - kvm_tmp_index);
         free_reserved_area(&kvm_tmp[kvm_tmp_index],
                            &kvm_tmp[ARRAY_SIZE(kvm_tmp)], -1, NULL);
 }
diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl
index b18abb0c3dae..00f5a63c8d9a 100644
--- a/arch/powerpc/kernel/syscalls/syscall.tbl
+++ b/arch/powerpc/kernel/syscalls/syscall.tbl
@@ -505,3 +505,7 @@
 421     32      rt_sigtimedwait_time64          sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait_time64
 422     32      futex_time64                    sys_futex                       sys_futex
 423     32      sched_rr_get_interval_time64    sys_sched_rr_get_interval       sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
index 1e0bc5955a40..afd516b572f8 100644
--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
@@ -98,7 +98,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
          * can be used, r7 contains NSEC_PER_SEC.
          */
 
-        lwz     r5,WTOM_CLOCK_SEC(r9)
+        lwz     r5,(WTOM_CLOCK_SEC+LOPART)(r9)
         lwz     r6,WTOM_CLOCK_NSEC(r9)
 
         /* We now have our offset in r5,r6. We create a fake dependency
diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c
index e7a9c4f6bfca..8330f135294f 100644
--- a/arch/powerpc/mm/mmu_context_iommu.c
+++ b/arch/powerpc/mm/mmu_context_iommu.c
@@ -95,28 +95,15 @@ static long mm_iommu_do_alloc(struct mm_struct *mm, unsigned long ua,
                               unsigned long entries, unsigned long dev_hpa,
                               struct mm_iommu_table_group_mem_t **pmem)
 {
-        struct mm_iommu_table_group_mem_t *mem;
-        long i, ret, locked_entries = 0;
+        struct mm_iommu_table_group_mem_t *mem, *mem2;
+        long i, ret, locked_entries = 0, pinned = 0;
         unsigned int pageshift;
-
-        mutex_lock(&mem_list_mutex);
-
-        list_for_each_entry_rcu(mem, &mm->context.iommu_group_mem_list,
-                        next) {
-                /* Overlap? */
-                if ((mem->ua < (ua + (entries << PAGE_SHIFT))) &&
-                                (ua < (mem->ua +
-                                       (mem->entries << PAGE_SHIFT)))) {
-                        ret = -EINVAL;
-                        goto unlock_exit;
-                }
-
-        }
+        unsigned long entry, chunk;
 
         if (dev_hpa == MM_IOMMU_TABLE_INVALID_HPA) {
                 ret = mm_iommu_adjust_locked_vm(mm, entries, true);
                 if (ret)
-                        goto unlock_exit;
+                        return ret;
 
                 locked_entries = entries;
         }
@@ -148,17 +135,27 @@ static long mm_iommu_do_alloc(struct mm_struct *mm, unsigned long ua,
         }
 
         down_read(&mm->mmap_sem);
-        ret = get_user_pages_longterm(ua, entries, FOLL_WRITE, mem->hpages, NULL);
+        chunk = (1UL << (PAGE_SHIFT + MAX_ORDER - 1)) /
+                        sizeof(struct vm_area_struct *);
+        chunk = min(chunk, entries);
+        for (entry = 0; entry < entries; entry += chunk) {
+                unsigned long n = min(entries - entry, chunk);
+
+                ret = get_user_pages_longterm(ua + (entry << PAGE_SHIFT), n,
+                                FOLL_WRITE, mem->hpages + entry, NULL);
+                if (ret == n) {
+                        pinned += n;
+                        continue;
+                }
+                if (ret > 0)
+                        pinned += ret;
+                break;
+        }
         up_read(&mm->mmap_sem);
-        if (ret != entries) {
-                /* free the reference taken */
-                for (i = 0; i < ret; i++)
-                        put_page(mem->hpages[i]);
-
-                vfree(mem->hpas);
-                kfree(mem);
-                ret = -EFAULT;
-                goto unlock_exit;
+        if (pinned != entries) {
+                if (!ret)
+                        ret = -EFAULT;
+                goto free_exit;
         }
 
         pageshift = PAGE_SHIFT;
@@ -183,21 +180,43 @@ static long mm_iommu_do_alloc(struct mm_struct *mm, unsigned long ua,
         }
 
 good_exit:
-        ret = 0;
         atomic64_set(&mem->mapped, 1);
         mem->used = 1;
         mem->ua = ua;
         mem->entries = entries;
-        *pmem = mem;
 
-        list_add_rcu(&mem->next, &mm->context.iommu_group_mem_list);
+        mutex_lock(&mem_list_mutex);
 
-unlock_exit:
-        if (locked_entries && ret)
-                mm_iommu_adjust_locked_vm(mm, locked_entries, false);
+        list_for_each_entry_rcu(mem2, &mm->context.iommu_group_mem_list, next) {
+                /* Overlap? */
+                if ((mem2->ua < (ua + (entries << PAGE_SHIFT))) &&
+                                (ua < (mem2->ua +
+                                       (mem2->entries << PAGE_SHIFT)))) {
+                        ret = -EINVAL;
+                        mutex_unlock(&mem_list_mutex);
+                        goto free_exit;
+                }
+        }
+
+        list_add_rcu(&mem->next, &mm->context.iommu_group_mem_list);
 
         mutex_unlock(&mem_list_mutex);
 
+        *pmem = mem;
+
+        return 0;
+
+free_exit:
+        /* free the reference taken */
+        for (i = 0; i < pinned; i++)
+                put_page(mem->hpages[i]);
+
+        vfree(mem->hpas);
+        kfree(mem);
+
+unlock_exit:
+        mm_iommu_adjust_locked_vm(mm, locked_entries, false);
+
         return ret;
 }
 
@@ -266,7 +285,7 @@ static void mm_iommu_release(struct mm_iommu_table_group_mem_t *mem)
 long mm_iommu_put(struct mm_struct *mm, struct mm_iommu_table_group_mem_t *mem)
 {
         long ret = 0;
-        unsigned long entries, dev_hpa;
+        unsigned long unlock_entries = 0;
 
         mutex_lock(&mem_list_mutex);
 
@@ -287,17 +306,17 @@ long mm_iommu_put(struct mm_struct *mm, struct mm_iommu_table_group_mem_t *mem)
                 goto unlock_exit;
         }
 
+        if (mem->dev_hpa == MM_IOMMU_TABLE_INVALID_HPA)
+                unlock_entries = mem->entries;
+
         /* @mapped became 0 so now mappings are disabled, release the region */
-        entries = mem->entries;
-        dev_hpa = mem->dev_hpa;
         mm_iommu_release(mem);
 
-        if (dev_hpa == MM_IOMMU_TABLE_INVALID_HPA)
-                mm_iommu_adjust_locked_vm(mm, entries, false);
-
 unlock_exit:
         mutex_unlock(&mem_list_mutex);
 
+        mm_iommu_adjust_locked_vm(mm, unlock_entries, false);
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(mm_iommu_put);
diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index 842b2c7e156a..50cd09b4e05d 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -324,7 +324,7 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
 
 config PPC_RADIX_MMU
         bool "Radix MMU Support"
-        depends on PPC_BOOK3S_64
+        depends on PPC_BOOK3S_64 && HUGETLB_PAGE
         select ARCH_HAS_GIGANTIC_PAGE if (MEMORY_ISOLATION && COMPACTION) || CMA
         default y
         help
diff --git a/arch/riscv/configs/rv32_defconfig b/arch/riscv/configs/rv32_defconfig
new file mode 100644
index 000000000000..1a911ed8e772
--- /dev/null
+++ b/arch/riscv/configs/rv32_defconfig
@@ -0,0 +1,84 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_CHECKPOINT_RESTORE=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_ARCH_RV32I=y
+CONFIG_SMP=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_XILINX=y
+CONFIG_DEVTMPFS=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_NETDEVICES=y
+CONFIG_VIRTIO_NET=y
+CONFIG_MACB=y
+CONFIG_E1000E=y
+CONFIG_R8169=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
+CONFIG_HVC_RISCV_SBI=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_DRM=y
+CONFIG_DRM_RADEON=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_UAS=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_SIFIVE_PLIC=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_DEV_VIRTIO=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/fixmap.h b/arch/riscv/include/asm/fixmap.h
index 57afe604b495..c207f6634b91 100644
--- a/arch/riscv/include/asm/fixmap.h
+++ b/arch/riscv/include/asm/fixmap.h
@@ -26,7 +26,7 @@ enum fixed_addresses {
 };
 
 #define FIXADDR_SIZE            (__end_of_fixed_addresses * PAGE_SIZE)
-#define FIXADDR_TOP             (PAGE_OFFSET)
+#define FIXADDR_TOP             (VMALLOC_START)
 #define FIXADDR_START           (FIXADDR_TOP - FIXADDR_SIZE)
 
 #define FIXMAP_PAGE_IO          PAGE_KERNEL
diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h
index bba3da6ef157..a3d5273ded7c 100644
--- a/arch/riscv/include/asm/syscall.h
+++ b/arch/riscv/include/asm/syscall.h
@@ -72,32 +72,20 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                args[0] = regs->orig_a0;
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(args, &regs->a1 + i * sizeof(regs->a1), n * sizeof(args[0]));
+        args[0] = regs->orig_a0;
+        args++;
+        memcpy(args, &regs->a1, 5 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                regs->orig_a0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
+        regs->orig_a0 = args[0];
+        args++;
+        memcpy(&regs->a1, args, 5 * sizeof(regs->a1));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index a00168b980d2..fb53a8089e76 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -300,7 +300,7 @@ do {								\
                 "       .balign 4\n"                            \
                 "4:\n"                                          \
                 "       li %0, %6\n"                            \
-                "       jump 2b, %1\n"                          \
+                "       jump 3b, %1\n"                          \
                 "       .previous\n"                            \
                 "       .section __ex_table,\"a\"\n"            \
                 "       .balign " RISCV_SZPTR "\n"                      \
diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
index f13f7f276639..598568168d35 100644
--- a/arch/riscv/kernel/Makefile
+++ b/arch/riscv/kernel/Makefile
@@ -4,7 +4,6 @@
 
 ifdef CONFIG_FTRACE
 CFLAGS_REMOVE_ftrace.o = -pg
-CFLAGS_REMOVE_setup.o = -pg
 endif
 
 extra-y += head.o
@@ -29,8 +28,6 @@ obj-y	+= vdso.o
 obj-y   += cacheinfo.o
 obj-y   += vdso/
 
-CFLAGS_setup.o := -mcmodel=medany
-
 obj-$(CONFIG_FPU)               += fpu.o
 obj-$(CONFIG_SMP)               += smpboot.o
 obj-$(CONFIG_SMP)               += smp.o
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 7dd308129b40..2872edce894d 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -141,7 +141,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
 {
         s32 hi20;
 
-        if (IS_ENABLED(CMODEL_MEDLOW)) {
+        if (IS_ENABLED(CONFIG_CMODEL_MEDLOW)) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
                   me->name, (long long)v, location);
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index ecb654f6a79e..540a331d1376 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -48,14 +48,6 @@ struct screen_info screen_info = {
 };
 #endif
 
-unsigned long va_pa_offset;
-EXPORT_SYMBOL(va_pa_offset);
-unsigned long pfn_base;
-EXPORT_SYMBOL(pfn_base);
-
-unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)] __page_aligned_bss;
-EXPORT_SYMBOL(empty_zero_page);
-
 /* The lucky hart to first increment this variable will boot the other cores */
 atomic_t hart_lottery;
 unsigned long boot_cpu_hartid;
diff --git a/arch/riscv/mm/Makefile b/arch/riscv/mm/Makefile
index eb22ab49b3e0..b68aac701803 100644
--- a/arch/riscv/mm/Makefile
+++ b/arch/riscv/mm/Makefile
@@ -1,3 +1,9 @@
+
+CFLAGS_init.o := -mcmodel=medany
+ifdef CONFIG_FTRACE
+CFLAGS_REMOVE_init.o = -pg
+endif
+
 obj-y += init.o
 obj-y += fault.o
 obj-y += extable.o
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index b379a75ac6a6..bc7b77e34d09 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -25,6 +25,10 @@
 #include <asm/pgtable.h>
 #include <asm/io.h>
 
+unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
+                                                        __page_aligned_bss;
+EXPORT_SYMBOL(empty_zero_page);
+
 static void __init zone_sizes_init(void)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
@@ -117,6 +121,14 @@ void __init setup_bootmem(void)
                          */
                         memblock_reserve(reg->base, vmlinux_end - reg->base);
                         mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET);
+
+                        /*
+                         * Remove memblock from the end of usable area to the
+                         * end of region
+                         */
+                        if (reg->base + mem_size < end)
+                                memblock_remove(reg->base + mem_size,
+                                                end - reg->base - mem_size);
                 }
         }
         BUG_ON(mem_size == 0);
@@ -143,6 +155,11 @@ void __init setup_bootmem(void)
         }
 }
 
+unsigned long va_pa_offset;
+EXPORT_SYMBOL(va_pa_offset);
+unsigned long pfn_base;
+EXPORT_SYMBOL(pfn_base);
+
 pgd_t swapper_pg_dir[PTRS_PER_PGD] __page_aligned_bss;
 pgd_t trampoline_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE);
 
@@ -172,6 +189,25 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
         }
 }
 
+/*
+ * setup_vm() is called from head.S with MMU-off.
+ *
+ * Following requirements should be honoured for setup_vm() to work
+ * correctly:
+ * 1) It should use PC-relative addressing for accessing kernel symbols.
+ *    To achieve this we always use GCC cmodel=medany.
+ * 2) The compiler instrumentation for FTRACE will not work for setup_vm()
+ *    so disable compiler instrumentation when FTRACE is enabled.
+ *
+ * Currently, the above requirements are honoured by using custom CFLAGS
+ * for init.o in mm/Makefile.
+ */
+
+#ifndef __riscv_cmodel_medany
+#error "setup_vm() is called from head.S before relocate so it should "
+        "not use absolute addressing."
+#endif
+
 asmlinkage void __init setup_vm(void)
 {
         extern char _start;
diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c
index 4cb771ba13fa..5d316fe40480 100644
--- a/arch/s390/boot/mem_detect.c
+++ b/arch/s390/boot/mem_detect.c
@@ -25,7 +25,7 @@ static void *mem_detect_alloc_extended(void)
 {
         unsigned long offset = ALIGN(mem_safe_offset(), sizeof(u64));
 
-        if (IS_ENABLED(BLK_DEV_INITRD) && INITRD_START && INITRD_SIZE &&
+        if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && INITRD_START && INITRD_SIZE &&
             INITRD_START < offset + ENTRIES_EXTENDED_MAX)
                 offset = ALIGN(INITRD_START + INITRD_SIZE, sizeof(u64));
 
diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
index 96f9a9151fde..59c3e91f2cdb 100644
--- a/arch/s390/include/asm/syscall.h
+++ b/arch/s390/include/asm/syscall.h
@@ -56,40 +56,32 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         unsigned long mask = -1UL;
+        unsigned int n = 6;
 
-        /*
-         * No arguments for this syscall, there's nothing to do.
-         */
-        if (!n)
-                return;
-
-        BUG_ON(i + n > 6);
 #ifdef CONFIG_COMPAT
         if (test_tsk_thread_flag(task, TIF_31BIT))
                 mask = 0xffffffff;
 #endif
         while (n-- > 0)
-                if (i + n > 0)
-                        args[n] = regs->gprs[2 + i + n] & mask;
-        if (i == 0)
-                args[0] = regs->orig_gpr2 & mask;
+                if (n > 0)
+                        args[n] = regs->gprs[2 + n] & mask;
+
+        args[0] = regs->orig_gpr2 & mask;
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
+        unsigned int n = 6;
+
         while (n-- > 0)
-                if (i + n > 0)
-                        regs->gprs[2 + i + n] = args[n];
-        if (i == 0)
-                regs->orig_gpr2 = args[0];
+                if (n > 0)
+                        regs->gprs[2 + n] = args[n];
+        regs->orig_gpr2 = args[0];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/s390/kernel/fpu.c b/arch/s390/kernel/fpu.c
index 594464f2129d..0da378e2eb25 100644
--- a/arch/s390/kernel/fpu.c
+++ b/arch/s390/kernel/fpu.c
@@ -23,7 +23,7 @@ void __kernel_fpu_begin(struct kernel_fpu *state, u32 flags)
 
         if (flags & KERNEL_FPC)
                 /* Save floating point control */
-                asm volatile("stfpc %0" : "=m" (state->fpc));
+                asm volatile("stfpc %0" : "=Q" (state->fpc));
 
         if (!MACHINE_HAS_VX) {
                 if (flags & KERNEL_VXR_V0V7) {
diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl
index 02579f95f391..061418f787c3 100644
--- a/arch/s390/kernel/syscalls/syscall.tbl
+++ b/arch/s390/kernel/syscalls/syscall.tbl
@@ -426,3 +426,7 @@
 421     32      rt_sigtimedwait_time64  -                               compat_sys_rt_sigtimedwait_time64
 422     32      futex_time64            -                               sys_futex
 423     32      sched_rr_get_interval_time64    -                       sys_sched_rr_get_interval
+424  common     pidfd_send_signal       sys_pidfd_send_signal           sys_pidfd_send_signal
+425  common     io_uring_setup          sys_io_uring_setup              sys_io_uring_setup
+426  common     io_uring_enter          sys_io_uring_enter              sys_io_uring_enter
+427  common     io_uring_register       sys_io_uring_register           sys_io_uring_register
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index a69a0911ed0e..c475ca49cfc6 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -37,7 +37,7 @@ static inline u64 get_vtimer(void)
 {
         u64 timer;
 
-        asm volatile("stpt %0" : "=m" (timer));
+        asm volatile("stpt %0" : "=Q" (timer));
         return timer;
 }
 
@@ -48,7 +48,7 @@ static inline void set_vtimer(u64 expires)
         asm volatile(
                 "       stpt    %0\n"   /* Store current cpu timer value */
                 "       spt     %1"     /* Set new value imm. afterwards */
-                : "=m" (timer) : "m" (expires));
+                : "=Q" (timer) : "Q" (expires));
         S390_lowcore.system_timer += S390_lowcore.last_update_timer - timer;
         S390_lowcore.last_update_timer = expires;
 }
@@ -135,8 +135,8 @@ static int do_account_vtime(struct task_struct *tsk)
 #else
                 "       stck    %1"     /* Store current tod clock value */
 #endif
-                : "=m" (S390_lowcore.last_update_timer),
-                  "=m" (S390_lowcore.last_update_clock));
+                : "=Q" (S390_lowcore.last_update_timer),
+                  "=Q" (S390_lowcore.last_update_clock));
         clock = S390_lowcore.last_update_clock - clock;
         timer -= S390_lowcore.last_update_timer;
 
diff --git a/arch/sh/boards/of-generic.c b/arch/sh/boards/of-generic.c
index 958f46da3a79..d91065e81a4e 100644
--- a/arch/sh/boards/of-generic.c
+++ b/arch/sh/boards/of-generic.c
@@ -164,10 +164,10 @@ static struct sh_machine_vector __initmv sh_of_generic_mv = {
 
 struct sh_clk_ops;
 
-void __init arch_init_clk_ops(struct sh_clk_ops **ops, int idx)
+void __init __weak arch_init_clk_ops(struct sh_clk_ops **ops, int idx)
 {
 }
 
-void __init plat_irq_setup(void)
+void __init __weak plat_irq_setup(void)
 {
 }
diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
index 6e118799831c..8c9d7e5e5dcc 100644
--- a/arch/sh/include/asm/syscall_32.h
+++ b/arch/sh/include/asm/syscall_32.h
@@ -48,51 +48,28 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        /*
-         * Do this simply for now. If we need to start supporting
-         * fetching arguments from arbitrary indices, this will need some
-         * extra logic. Presently there are no in-tree users that depend
-         * on this behaviour.
-         */
-        BUG_ON(i);
 
         /* Argument pattern is: R4, R5, R6, R7, R0, R1 */
-        switch (n) {
-        case 6: args[5] = regs->regs[1];
-        case 5: args[4] = regs->regs[0];
-        case 4: args[3] = regs->regs[7];
-        case 3: args[2] = regs->regs[6];
-        case 2: args[1] = regs->regs[5];
-        case 1: args[0] = regs->regs[4];
-        case 0:
-                break;
-        default:
-                BUG();
-        }
+        args[5] = regs->regs[1];
+        args[4] = regs->regs[0];
+        args[3] = regs->regs[7];
+        args[2] = regs->regs[6];
+        args[1] = regs->regs[5];
+        args[0] = regs->regs[4];
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        /* Same note as above applies */
-        BUG_ON(i);
-
-        switch (n) {
-        case 6: regs->regs[1] = args[5];
-        case 5: regs->regs[0] = args[4];
-        case 4: regs->regs[7] = args[3];
-        case 3: regs->regs[6] = args[2];
-        case 2: regs->regs[5] = args[1];
-        case 1: regs->regs[4] = args[0];
-                break;
-        default:
-                BUG();
-        }
+        regs->regs[1] = args[5];
+        regs->regs[0] = args[4];
+        regs->regs[7] = args[3];
+        regs->regs[6] = args[2];
+        regs->regs[5] = args[1];
+        regs->regs[4] = args[0];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
index 43882580c7f9..22fad97da066 100644
--- a/arch/sh/include/asm/syscall_64.h
+++ b/arch/sh/include/asm/syscall_64.h
@@ -47,20 +47,16 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(args, &regs->regs[2 + i], n * sizeof(args[0]));
+        memcpy(args, &regs->regs[2], 6 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
+        memcpy(&regs->regs[2], args, 6 * sizeof(args[0]));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/sh/kernel/syscalls/syscall.tbl b/arch/sh/kernel/syscalls/syscall.tbl
index bfda678576e4..480b057556ee 100644
--- a/arch/sh/kernel/syscalls/syscall.tbl
+++ b/arch/sh/kernel/syscalls/syscall.tbl
@@ -426,3 +426,7 @@
 421     common  rt_sigtimedwait_time64          sys_rt_sigtimedwait
 422     common  futex_time64                    sys_futex
 423     common  sched_rr_get_interval_time64    sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
index 053989e3f6a6..4d075434e816 100644
--- a/arch/sparc/include/asm/syscall.h
+++ b/arch/sparc/include/asm/syscall.h
@@ -96,11 +96,11 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         int zero_extend = 0;
         unsigned int j;
+        unsigned int n = 6;
 
 #ifdef CONFIG_SPARC64
         if (test_tsk_thread_flag(task, TIF_32BIT))
@@ -108,7 +108,7 @@ static inline void syscall_get_arguments(struct task_struct *task,
 #endif
 
         for (j = 0; j < n; j++) {
-                unsigned long val = regs->u_regs[UREG_I0 + i + j];
+                unsigned long val = regs->u_regs[UREG_I0 + j];
 
                 if (zero_extend)
                         args[j] = (u32) val;
@@ -119,13 +119,12 @@ static inline void syscall_get_arguments(struct task_struct *task,
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        unsigned int j;
+        unsigned int i;
 
-        for (j = 0; j < n; j++)
-                regs->u_regs[UREG_I0 + i + j] = args[j];
+        for (i = 0; i < 6; i++)
+                regs->u_regs[UREG_I0 + i] = args[i];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index a8af6023c126..14b93c5564e3 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -73,6 +73,11 @@ static inline void iommu_batch_start(struct device *dev, unsigned long prot, uns
         p->npages       = 0;
 }
 
+static inline bool iommu_use_atu(struct iommu *iommu, u64 mask)
+{
+        return iommu->atu && mask > DMA_BIT_MASK(32);
+}
+
 /* Interrupts must be disabled.  */
 static long iommu_batch_flush(struct iommu_batch *p, u64 mask)
 {
@@ -92,7 +97,7 @@ static long iommu_batch_flush(struct iommu_batch *p, u64 mask)
                 prot &= (HV_PCI_MAP_ATTR_READ | HV_PCI_MAP_ATTR_WRITE);
 
         while (npages != 0) {
-                if (mask <= DMA_BIT_MASK(32) || !pbm->iommu->atu) {
+                if (!iommu_use_atu(pbm->iommu, mask)) {
                         num = pci_sun4v_iommu_map(devhandle,
                                                   HV_PCI_TSBID(0, entry),
                                                   npages,
@@ -179,7 +184,6 @@ static void *dma_4v_alloc_coherent(struct device *dev, size_t size,
         unsigned long flags, order, first_page, npages, n;
         unsigned long prot = 0;
         struct iommu *iommu;
-        struct atu *atu;
         struct iommu_map_table *tbl;
         struct page *page;
         void *ret;
@@ -205,13 +209,11 @@ static void *dma_4v_alloc_coherent(struct device *dev, size_t size,
         memset((char *)first_page, 0, PAGE_SIZE << order);
 
         iommu = dev->archdata.iommu;
-        atu = iommu->atu;
-
         mask = dev->coherent_dma_mask;
-        if (mask <= DMA_BIT_MASK(32) || !atu)
+        if (!iommu_use_atu(iommu, mask))
                 tbl = &iommu->tbl;
         else
-                tbl = &atu->tbl;
+                tbl = &iommu->atu->tbl;
 
         entry = iommu_tbl_range_alloc(dev, tbl, npages, NULL,
                                       (unsigned long)(-1), 0);
@@ -333,7 +335,7 @@ static void dma_4v_free_coherent(struct device *dev, size_t size, void *cpu,
         atu = iommu->atu;
         devhandle = pbm->devhandle;
 
-        if (dvma <= DMA_BIT_MASK(32)) {
+        if (!iommu_use_atu(iommu, dvma)) {
                 tbl = &iommu->tbl;
                 iotsb_num = 0; /* we don't care for legacy iommu */
         } else {
@@ -374,7 +376,7 @@ static dma_addr_t dma_4v_map_page(struct device *dev, struct page *page,
         npages >>= IO_PAGE_SHIFT;
 
         mask = *dev->dma_mask;
-        if (mask <= DMA_BIT_MASK(32))
+        if (!iommu_use_atu(iommu, mask))
                 tbl = &iommu->tbl;
         else
                 tbl = &atu->tbl;
@@ -510,7 +512,7 @@ static int dma_4v_map_sg(struct device *dev, struct scatterlist *sglist,
                                   IO_PAGE_SIZE) >> IO_PAGE_SHIFT;
 
         mask = *dev->dma_mask;
-        if (mask <= DMA_BIT_MASK(32))
+        if (!iommu_use_atu(iommu, mask))
                 tbl = &iommu->tbl;
         else
                 tbl = &atu->tbl;
diff --git a/arch/sparc/kernel/syscalls/syscall.tbl b/arch/sparc/kernel/syscalls/syscall.tbl
index b9a5a04b2d2c..a1dd24307b00 100644
--- a/arch/sparc/kernel/syscalls/syscall.tbl
+++ b/arch/sparc/kernel/syscalls/syscall.tbl
@@ -469,3 +469,7 @@
 421     32      rt_sigtimedwait_time64          sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait_time64
 422     32      futex_time64                    sys_futex                       sys_futex
 423     32      sched_rr_get_interval_time64    sys_sched_rr_get_interval       sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/um/include/asm/syscall-generic.h b/arch/um/include/asm/syscall-generic.h
index 9fb9cf8cd39a..98e50c50c12e 100644
--- a/arch/um/include/asm/syscall-generic.h
+++ b/arch/um/include/asm/syscall-generic.h
@@ -53,84 +53,30 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         const struct uml_pt_regs *r = &regs->regs;
 
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG1(r);
-        case 1:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG2(r);
-        case 2:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG3(r);
-        case 3:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG4(r);
-        case 4:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG5(r);
-        case 5:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG6(r);
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-                break;
-        }
+        *args++ = UPT_SYSCALL_ARG1(r);
+        *args++ = UPT_SYSCALL_ARG2(r);
+        *args++ = UPT_SYSCALL_ARG3(r);
+        *args++ = UPT_SYSCALL_ARG4(r);
+        *args++ = UPT_SYSCALL_ARG5(r);
+        *args   = UPT_SYSCALL_ARG6(r);
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
         struct uml_pt_regs *r = &regs->regs;
 
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG1(r) = *args++;
-        case 1:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG2(r) = *args++;
-        case 2:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG3(r) = *args++;
-        case 3:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG4(r) = *args++;
-        case 4:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG5(r) = *args++;
-        case 5:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG6(r) = *args++;
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-                break;
-        }
+        UPT_SYSCALL_ARG1(r) = *args++;
+        UPT_SYSCALL_ARG2(r) = *args++;
+        UPT_SYSCALL_ARG3(r) = *args++;
+        UPT_SYSCALL_ARG4(r) = *args++;
+        UPT_SYSCALL_ARG5(r) = *args++;
+        UPT_SYSCALL_ARG6(r) = *args;
 }
 
 /* See arch/x86/um/asm/syscall.h for syscall_get_arch() definition. */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 5ad92419be19..62fc3fda1a05 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1499,7 +1499,7 @@ config X86_CPA_STATISTICS
         depends on DEBUG_FS
         ---help---
           Expose statistics about the Change Page Attribute mechanims, which
-          helps to determine the effectivness of preserving large and huge
+          helps to determine the effectiveness of preserving large and huge
           page mappings when mapping protections are changed.
 
 config ARCH_HAS_MEM_ENCRYPT
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index c0d6c560df69..5a237e8dbf8d 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -352,7 +352,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
         boot_params->hdr.loadflags &= ~KASLR_FLAG;
 
         /* Save RSDP address for later use. */
-        boot_params->acpi_rsdp_addr = get_rsdp_addr();
+        /* boot_params->acpi_rsdp_addr = get_rsdp_addr(); */
 
         sanitize_boot_params(boot_params);
 
diff --git a/arch/x86/crypto/poly1305-avx2-x86_64.S b/arch/x86/crypto/poly1305-avx2-x86_64.S
index 3b6e70d085da..8457cdd47f75 100644
--- a/arch/x86/crypto/poly1305-avx2-x86_64.S
+++ b/arch/x86/crypto/poly1305-avx2-x86_64.S
@@ -323,6 +323,12 @@ ENTRY(poly1305_4block_avx2)
         vpaddq          t2,t1,t1
         vmovq           t1x,d4
 
+        # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
+        # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
+        # amount.  Careful: we must not assume the carry bits 'd0 >> 26',
+        # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
+        # integers.  It's true in a single-block implementation, but not here.
+
         # d1 += d0 >> 26
         mov             d0,%rax
         shr             $26,%rax
@@ -361,16 +367,16 @@ ENTRY(poly1305_4block_avx2)
         # h0 += (d4 >> 26) * 5
         mov             d4,%rax
         shr             $26,%rax
-        lea             (%eax,%eax,4),%eax
-        add             %eax,%ebx
+        lea             (%rax,%rax,4),%rax
+        add             %rax,%rbx
         # h4 = d4 & 0x3ffffff
         mov             d4,%rax
         and             $0x3ffffff,%eax
         mov             %eax,h4
 
         # h1 += h0 >> 26
-        mov             %ebx,%eax
-        shr             $26,%eax
+        mov             %rbx,%rax
+        shr             $26,%rax
         add             %eax,h1
         # h0 = h0 & 0x3ffffff
         andl            $0x3ffffff,%ebx
diff --git a/arch/x86/crypto/poly1305-sse2-x86_64.S b/arch/x86/crypto/poly1305-sse2-x86_64.S
index e6add74d78a5..6f0be7a86964 100644
--- a/arch/x86/crypto/poly1305-sse2-x86_64.S
+++ b/arch/x86/crypto/poly1305-sse2-x86_64.S
@@ -253,16 +253,16 @@ ENTRY(poly1305_block_sse2)
         # h0 += (d4 >> 26) * 5
         mov             d4,%rax
         shr             $26,%rax
-        lea             (%eax,%eax,4),%eax
-        add             %eax,%ebx
+        lea             (%rax,%rax,4),%rax
+        add             %rax,%rbx
         # h4 = d4 & 0x3ffffff
         mov             d4,%rax
         and             $0x3ffffff,%eax
         mov             %eax,h4
 
         # h1 += h0 >> 26
-        mov             %ebx,%eax
-        shr             $26,%eax
+        mov             %rbx,%rax
+        shr             $26,%rax
         add             %eax,h1
         # h0 = h0 & 0x3ffffff
         andl            $0x3ffffff,%ebx
@@ -524,6 +524,12 @@ ENTRY(poly1305_2block_sse2)
         paddq           t2,t1
         movq            t1,d4
 
+        # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
+        # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
+        # amount.  Careful: we must not assume the carry bits 'd0 >> 26',
+        # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
+        # integers.  It's true in a single-block implementation, but not here.
+
         # d1 += d0 >> 26
         mov             d0,%rax
         shr             $26,%rax
@@ -562,16 +568,16 @@ ENTRY(poly1305_2block_sse2)
         # h0 += (d4 >> 26) * 5
         mov             d4,%rax
         shr             $26,%rax
-        lea             (%eax,%eax,4),%eax
-        add             %eax,%ebx
+        lea             (%rax,%rax,4),%rax
+        add             %rax,%rbx
         # h4 = d4 & 0x3ffffff
         mov             d4,%rax
         and             $0x3ffffff,%eax
         mov             %eax,h4
 
         # h1 += h0 >> 26
-        mov             %ebx,%eax
-        shr             $26,%eax
+        mov             %rbx,%rax
+        shr             $26,%rax
         add             %eax,h1
         # h0 = h0 & 0x3ffffff
         andl            $0x3ffffff,%ebx
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index 7d2d7c801dba..d45f3fbd232e 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -3,10 +3,14 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
 #include <asm/apicdef.h>
+#include <asm/nmi.h>
 
 #include "../perf_event.h"
 
+static DEFINE_PER_CPU(unsigned int, perf_nmi_counter);
+
 static __initconst const u64 amd_hw_cache_event_ids
                                 [PERF_COUNT_HW_CACHE_MAX]
                                 [PERF_COUNT_HW_CACHE_OP_MAX]
@@ -113,22 +117,39 @@ static __initconst const u64 amd_hw_cache_event_ids
 };
 
 /*
- * AMD Performance Monitor K7 and later.
+ * AMD Performance Monitor K7 and later, up to and including Family 16h:
  */
 static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
 {
-  [PERF_COUNT_HW_CPU_CYCLES]                    = 0x0076,
-  [PERF_COUNT_HW_INSTRUCTIONS]                  = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x077d,
-  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x077e,
-  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]           = 0x00c2,
-  [PERF_COUNT_HW_BRANCH_MISSES]                 = 0x00c3,
-  [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]       = 0x00d0, /* "Decoder empty" event */
-  [PERF_COUNT_HW_STALLED_CYCLES_BACKEND]        = 0x00d1, /* "Dispatch stalls" event */
+        [PERF_COUNT_HW_CPU_CYCLES]              = 0x0076,
+        [PERF_COUNT_HW_INSTRUCTIONS]            = 0x00c0,
+        [PERF_COUNT_HW_CACHE_REFERENCES]        = 0x077d,
+        [PERF_COUNT_HW_CACHE_MISSES]            = 0x077e,
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]     = 0x00c2,
+        [PERF_COUNT_HW_BRANCH_MISSES]           = 0x00c3,
+        [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */
+        [PERF_COUNT_HW_STALLED_CYCLES_BACKEND]  = 0x00d1, /* "Dispatch stalls" event */
+};
+
+/*
+ * AMD Performance Monitor Family 17h and later:
+ */
+static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] =
+{
+        [PERF_COUNT_HW_CPU_CYCLES]              = 0x0076,
+        [PERF_COUNT_HW_INSTRUCTIONS]            = 0x00c0,
+        [PERF_COUNT_HW_CACHE_REFERENCES]        = 0xff60,
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]     = 0x00c2,
+        [PERF_COUNT_HW_BRANCH_MISSES]           = 0x00c3,
+        [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x0287,
+        [PERF_COUNT_HW_STALLED_CYCLES_BACKEND]  = 0x0187,
 };
 
 static u64 amd_pmu_event_map(int hw_event)
 {
+        if (boot_cpu_data.x86 >= 0x17)
+                return amd_f17h_perfmon_event_map[hw_event];
+
         return amd_perfmon_event_map[hw_event];
 }
 
@@ -429,6 +450,132 @@ static void amd_pmu_cpu_dead(int cpu)
         }
 }
 
+/*
+ * When a PMC counter overflows, an NMI is used to process the event and
+ * reset the counter. NMI latency can result in the counter being updated
+ * before the NMI can run, which can result in what appear to be spurious
+ * NMIs. This function is intended to wait for the NMI to run and reset
+ * the counter to avoid possible unhandled NMI messages.
+ */
+#define OVERFLOW_WAIT_COUNT     50
+
+static void amd_pmu_wait_on_overflow(int idx)
+{
+        unsigned int i;
+        u64 counter;
+
+        /*
+         * Wait for the counter to be reset if it has overflowed. This loop
+         * should exit very, very quickly, but just in case, don't wait
+         * forever...
+         */
+        for (i = 0; i < OVERFLOW_WAIT_COUNT; i++) {
+                rdmsrl(x86_pmu_event_addr(idx), counter);
+                if (counter & (1ULL << (x86_pmu.cntval_bits - 1)))
+                        break;
+
+                /* Might be in IRQ context, so can't sleep */
+                udelay(1);
+        }
+}
+
+static void amd_pmu_disable_all(void)
+{
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+        int idx;
+
+        x86_pmu_disable_all();
+
+        /*
+         * This shouldn't be called from NMI context, but add a safeguard here
+         * to return, since if we're in NMI context we can't wait for an NMI
+         * to reset an overflowed counter value.
+         */
+        if (in_nmi())
+                return;
+
+        /*
+         * Check each counter for overflow and wait for it to be reset by the
+         * NMI if it has overflowed. This relies on the fact that all active
+         * counters are always enabled when this function is caled and
+         * ARCH_PERFMON_EVENTSEL_INT is always set.
+         */
+        for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+                if (!test_bit(idx, cpuc->active_mask))
+                        continue;
+
+                amd_pmu_wait_on_overflow(idx);
+        }
+}
+
+static void amd_pmu_disable_event(struct perf_event *event)
+{
+        x86_pmu_disable_event(event);
+
+        /*
+         * This can be called from NMI context (via x86_pmu_stop). The counter
+         * may have overflowed, but either way, we'll never see it get reset
+         * by the NMI if we're already in the NMI. And the NMI latency support
+         * below will take care of any pending NMI that might have been
+         * generated by the overflow.
+         */
+        if (in_nmi())
+                return;
+
+        amd_pmu_wait_on_overflow(event->hw.idx);
+}
+
+/*
+ * Because of NMI latency, if multiple PMC counters are active or other sources
+ * of NMIs are received, the perf NMI handler can handle one or more overflowed
+ * PMC counters outside of the NMI associated with the PMC overflow. If the NMI
+ * doesn't arrive at the LAPIC in time to become a pending NMI, then the kernel
+ * back-to-back NMI support won't be active. This PMC handler needs to take into
+ * account that this can occur, otherwise this could result in unknown NMI
+ * messages being issued. Examples of this is PMC overflow while in the NMI
+ * handler when multiple PMCs are active or PMC overflow while handling some
+ * other source of an NMI.
+ *
+ * Attempt to mitigate this by using the number of active PMCs to determine
+ * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset
+ * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the
+ * number of active PMCs or 2. The value of 2 is used in case an NMI does not
+ * arrive at the LAPIC in time to be collapsed into an already pending NMI.
+ */
+static int amd_pmu_handle_irq(struct pt_regs *regs)
+{
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+        int active, handled;
+
+        /*
+         * Obtain the active count before calling x86_pmu_handle_irq() since
+         * it is possible that x86_pmu_handle_irq() may make a counter
+         * inactive (through x86_pmu_stop).
+         */
+        active = __bitmap_weight(cpuc->active_mask, X86_PMC_IDX_MAX);
+
+        /* Process any counter overflows */
+        handled = x86_pmu_handle_irq(regs);
+
+        /*
+         * If a counter was handled, record the number of possible remaining
+         * NMIs that can occur.
+         */
+        if (handled) {
+                this_cpu_write(perf_nmi_counter,
+                               min_t(unsigned int, 2, active));
+
+                return handled;
+        }
+
+        if (!this_cpu_read(perf_nmi_counter))
+                return NMI_DONE;
+
+        this_cpu_dec(perf_nmi_counter);
+
+        return NMI_HANDLED;
+}
+
 static struct event_constraint *
 amd_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
                           struct perf_event *event)
@@ -621,11 +768,11 @@ static ssize_t amd_event_sysfs_show(char *page, u64 config)
 
 static __initconst const struct x86_pmu amd_pmu = {
         .name                   = "AMD",
-        .handle_irq             = x86_pmu_handle_irq,
-        .disable_all            = x86_pmu_disable_all,
+        .handle_irq             = amd_pmu_handle_irq,
+        .disable_all            = amd_pmu_disable_all,
         .enable_all             = x86_pmu_enable_all,
         .enable                 = x86_pmu_enable_event,
-        .disable                = x86_pmu_disable_event,
+        .disable                = amd_pmu_disable_event,
         .hw_config              = amd_pmu_hw_config,
         .schedule_events        = x86_schedule_events,
         .eventsel               = MSR_K7_EVNTSEL0,
@@ -732,7 +879,7 @@ void amd_pmu_enable_virt(void)
         cpuc->perf_ctr_virt_mask = 0;
 
         /* Reload all events */
-        x86_pmu_disable_all();
+        amd_pmu_disable_all();
         x86_pmu_enable_all(0);
 }
 EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
@@ -750,7 +897,7 @@ void amd_pmu_disable_virt(void)
         cpuc->perf_ctr_virt_mask = AMD64_EVENTSEL_HOSTONLY;
 
         /* Reload all events */
-        x86_pmu_disable_all();
+        amd_pmu_disable_all();
         x86_pmu_enable_all(0);
 }
 EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index e2b1447192a8..81911e11a15d 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1349,8 +1349,9 @@ void x86_pmu_stop(struct perf_event *event, int flags)
         struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
 
-        if (__test_and_clear_bit(hwc->idx, cpuc->active_mask)) {
+        if (test_bit(hwc->idx, cpuc->active_mask)) {
                 x86_pmu.disable(event);
+                __clear_bit(hwc->idx, cpuc->active_mask);
                 cpuc->events[hwc->idx] = NULL;
                 WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
                 hwc->state |= PERF_HES_STOPPED;
@@ -1447,16 +1448,8 @@ int x86_pmu_handle_irq(struct pt_regs *regs)
         apic_write(APIC_LVTPC, APIC_DM_NMI);
 
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
-                if (!test_bit(idx, cpuc->active_mask)) {
-                        /*
-                         * Though we deactivated the counter some cpus
-                         * might still deliver spurious interrupts still
-                         * in flight. Catch them:
-                         */
-                        if (__test_and_clear_bit(idx, cpuc->running))
-                                handled++;
+                if (!test_bit(idx, cpuc->active_mask))
                         continue;
-                }
 
                 event = cpuc->events[idx];
 
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 8baa441d8000..f9451566cd9b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3131,7 +3131,7 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
                 flags &= ~PERF_SAMPLE_TIME;
         if (!event->attr.exclude_kernel)
                 flags &= ~PERF_SAMPLE_REGS_USER;
-        if (event->attr.sample_regs_user & ~PEBS_REGS)
+        if (event->attr.sample_regs_user & ~PEBS_GP_REGS)
                 flags &= ~(PERF_SAMPLE_REGS_USER | PERF_SAMPLE_REGS_INTR);
         return flags;
 }
@@ -3185,7 +3185,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 return ret;
 
         if (event->attr.precise_ip) {
-                if (!event->attr.freq) {
+                if (!(event->attr.freq || event->attr.wakeup_events)) {
                         event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
                         if (!(event->attr.sample_type &
                               ~intel_pmu_large_pebs_flags(event)))
@@ -3575,6 +3575,12 @@ static void intel_pmu_cpu_starting(int cpu)
 
         cpuc->lbr_sel = NULL;
 
+        if (x86_pmu.flags & PMU_FL_TFA) {
+                WARN_ON_ONCE(cpuc->tfa_shadow);
+                cpuc->tfa_shadow = ~0ULL;
+                intel_set_tfa(cpuc, false);
+        }
+
         if (x86_pmu.version > 1)
                 flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
 
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 94a4b7fc75d0..d41de9af7a39 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -76,15 +76,15 @@
  *                             Scope: Package (physical package)
  *      MSR_PKG_C8_RESIDENCY:  Package C8 Residency Counter.
  *                             perf code: 0x04
- *                             Available model: HSW ULT,CNL
+ *                             Available model: HSW ULT,KBL,CNL
  *                             Scope: Package (physical package)
  *      MSR_PKG_C9_RESIDENCY:  Package C9 Residency Counter.
  *                             perf code: 0x05
- *                             Available model: HSW ULT,CNL
+ *                             Available model: HSW ULT,KBL,CNL
  *                             Scope: Package (physical package)
  *      MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter.
  *                             perf code: 0x06
- *                             Available model: HSW ULT,GLM,CNL
+ *                             Available model: HSW ULT,KBL,GLM,CNL
  *                             Scope: Package (physical package)
  *
  */
@@ -566,8 +566,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_DESKTOP, snb_cstates),
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_X, snb_cstates),
 
-        X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_MOBILE,  snb_cstates),
-        X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_DESKTOP, snb_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_MOBILE,  hswult_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_DESKTOP, hswult_cstates),
 
         X86_CSTATES_MODEL(INTEL_FAM6_CANNONLAKE_MOBILE, cnl_cstates),
 
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index a75955741c50..1e98a42b560a 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -96,25 +96,25 @@ struct amd_nb {
         PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_REGS_USER | \
         PERF_SAMPLE_PERIOD)
 
-#define PEBS_REGS \
-        (PERF_REG_X86_AX | \
-         PERF_REG_X86_BX | \
-         PERF_REG_X86_CX | \
-         PERF_REG_X86_DX | \
-         PERF_REG_X86_DI | \
-         PERF_REG_X86_SI | \
-         PERF_REG_X86_SP | \
-         PERF_REG_X86_BP | \
-         PERF_REG_X86_IP | \
-         PERF_REG_X86_FLAGS | \
-         PERF_REG_X86_R8 | \
-         PERF_REG_X86_R9 | \
-         PERF_REG_X86_R10 | \
-         PERF_REG_X86_R11 | \
-         PERF_REG_X86_R12 | \
-         PERF_REG_X86_R13 | \
-         PERF_REG_X86_R14 | \
-         PERF_REG_X86_R15)
+#define PEBS_GP_REGS                    \
+        ((1ULL << PERF_REG_X86_AX)    | \
+         (1ULL << PERF_REG_X86_BX)    | \
+         (1ULL << PERF_REG_X86_CX)    | \
+         (1ULL << PERF_REG_X86_DX)    | \
+         (1ULL << PERF_REG_X86_DI)    | \
+         (1ULL << PERF_REG_X86_SI)    | \
+         (1ULL << PERF_REG_X86_SP)    | \
+         (1ULL << PERF_REG_X86_BP)    | \
+         (1ULL << PERF_REG_X86_IP)    | \
+         (1ULL << PERF_REG_X86_FLAGS) | \
+         (1ULL << PERF_REG_X86_R8)    | \
+         (1ULL << PERF_REG_X86_R9)    | \
+         (1ULL << PERF_REG_X86_R10)   | \
+         (1ULL << PERF_REG_X86_R11)   | \
+         (1ULL << PERF_REG_X86_R12)   | \
+         (1ULL << PERF_REG_X86_R13)   | \
+         (1ULL << PERF_REG_X86_R14)   | \
+         (1ULL << PERF_REG_X86_R15))
 
 /*
  * Per register state.
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index d153d570bb04..8e790ec219a5 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -36,16 +36,17 @@
  * bit 0 is the LSB of addr; bit 32 is the LSB of (addr+1).
  */
 
-#define BITOP_ADDR(x) "+m" (*(volatile long *) (x))
+#define RLONG_ADDR(x)                    "m" (*(volatile long *) (x))
+#define WBYTE_ADDR(x)                   "+m" (*(volatile char *) (x))
 
-#define ADDR                            BITOP_ADDR(addr)
+#define ADDR                            RLONG_ADDR(addr)
 
 /*
  * We do the locked ops that don't return the old value as
  * a mask operation on a byte.
  */
 #define IS_IMMEDIATE(nr)                (__builtin_constant_p(nr))
-#define CONST_MASK_ADDR(nr, addr)       BITOP_ADDR((void *)(addr) + ((nr)>>3))
+#define CONST_MASK_ADDR(nr, addr)       WBYTE_ADDR((void *)(addr) + ((nr)>>3))
 #define CONST_MASK(nr)                  (1 << ((nr) & 7))
 
 /**
@@ -73,7 +74,7 @@ set_bit(long nr, volatile unsigned long *addr)
                         : "memory");
         } else {
                 asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0"
-                        : BITOP_ADDR(addr) : "Ir" (nr) : "memory");
+                        : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
         }
 }
 
@@ -88,7 +89,7 @@ set_bit(long nr, volatile unsigned long *addr)
  */
 static __always_inline void __set_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory");
+        asm volatile(__ASM_SIZE(bts) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
 }
 
 /**
@@ -110,8 +111,7 @@ clear_bit(long nr, volatile unsigned long *addr)
                         : "iq" ((u8)~CONST_MASK(nr)));
         } else {
                 asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0"
-                        : BITOP_ADDR(addr)
-                        : "Ir" (nr));
+                        : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
         }
 }
 
@@ -131,7 +131,7 @@ static __always_inline void clear_bit_unlock(long nr, volatile unsigned long *ad
 
 static __always_inline void __clear_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr));
+        asm volatile(__ASM_SIZE(btr) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
 }
 
 static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr)
@@ -139,7 +139,7 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile
         bool negative;
         asm volatile(LOCK_PREFIX "andb %2,%1"
                 CC_SET(s)
-                : CC_OUT(s) (negative), ADDR
+                : CC_OUT(s) (negative), WBYTE_ADDR(addr)
                 : "ir" ((char) ~(1 << nr)) : "memory");
         return negative;
 }
@@ -155,13 +155,9 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile
  * __clear_bit() is non-atomic and implies release semantics before the memory
  * operation. It can be used for an unlock if no other CPUs can concurrently
  * modify other bits in the word.
- *
- * No memory barrier is required here, because x86 cannot reorder stores past
- * older loads. Same principle as spin_unlock.
  */
 static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *addr)
 {
-        barrier();
         __clear_bit(nr, addr);
 }
 
@@ -176,7 +172,7 @@ static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *
  */
 static __always_inline void __change_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr));
+        asm volatile(__ASM_SIZE(btc) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
 }
 
 /**
@@ -196,8 +192,7 @@ static __always_inline void change_bit(long nr, volatile unsigned long *addr)
                         : "iq" ((u8)CONST_MASK(nr)));
         } else {
                 asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0"
-                        : BITOP_ADDR(addr)
-                        : "Ir" (nr));
+                        : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
         }
 }
 
@@ -242,8 +237,8 @@ static __always_inline bool __test_and_set_bit(long nr, volatile unsigned long *
 
         asm(__ASM_SIZE(bts) " %2,%1"
             CC_SET(c)
-            : CC_OUT(c) (oldbit), ADDR
-            : "Ir" (nr));
+            : CC_OUT(c) (oldbit)
+            : ADDR, "Ir" (nr) : "memory");
         return oldbit;
 }
 
@@ -282,8 +277,8 @@ static __always_inline bool __test_and_clear_bit(long nr, volatile unsigned long
 
         asm volatile(__ASM_SIZE(btr) " %2,%1"
                      CC_SET(c)
-                     : CC_OUT(c) (oldbit), ADDR
-                     : "Ir" (nr));
+                     : CC_OUT(c) (oldbit)
+                     : ADDR, "Ir" (nr) : "memory");
         return oldbit;
 }
 
@@ -294,8 +289,8 @@ static __always_inline bool __test_and_change_bit(long nr, volatile unsigned lon
 
         asm volatile(__ASM_SIZE(btc) " %2,%1"
                      CC_SET(c)
-                     : CC_OUT(c) (oldbit), ADDR
-                     : "Ir" (nr) : "memory");
+                     : CC_OUT(c) (oldbit)
+                     : ADDR, "Ir" (nr) : "memory");
 
         return oldbit;
 }
@@ -326,7 +321,7 @@ static __always_inline bool variable_test_bit(long nr, volatile const unsigned l
         asm volatile(__ASM_SIZE(bt) " %2,%1"
                      CC_SET(c)
                      : CC_OUT(c) (oldbit)
-                     : "m" (*(unsigned long *)addr), "Ir" (nr));
+                     : "m" (*(unsigned long *)addr), "Ir" (nr) : "memory");
 
         return oldbit;
 }
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index 93c4bf598fb0..feab24cac610 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -226,7 +226,9 @@ struct x86_emulate_ops {
 
         unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt);
         void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags);
-        int (*pre_leave_smm)(struct x86_emulate_ctxt *ctxt, u64 smbase);
+        int (*pre_leave_smm)(struct x86_emulate_ctxt *ctxt,
+                             const char *smstate);
+        void (*post_leave_smm)(struct x86_emulate_ctxt *ctxt);
 
 };
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 159b5988292f..a9d03af34030 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -126,7 +126,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
 }
 
 #define KVM_PERMILLE_MMU_PAGES 20
-#define KVM_MIN_ALLOC_MMU_PAGES 64
+#define KVM_MIN_ALLOC_MMU_PAGES 64UL
 #define KVM_MMU_HASH_SHIFT 12
 #define KVM_NUM_MMU_PAGES (1 << KVM_MMU_HASH_SHIFT)
 #define KVM_MIN_FREE_MMU_PAGES 5
@@ -844,9 +844,9 @@ enum kvm_irqchip_mode {
 };
 
 struct kvm_arch {
-        unsigned int n_used_mmu_pages;
-        unsigned int n_requested_mmu_pages;
-        unsigned int n_max_mmu_pages;
+        unsigned long n_used_mmu_pages;
+        unsigned long n_requested_mmu_pages;
+        unsigned long n_max_mmu_pages;
         unsigned int indirect_shadow_pages;
         struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
         /*
@@ -1182,7 +1182,7 @@ struct kvm_x86_ops {
 
         int (*smi_allowed)(struct kvm_vcpu *vcpu);
         int (*pre_enter_smm)(struct kvm_vcpu *vcpu, char *smstate);
-        int (*pre_leave_smm)(struct kvm_vcpu *vcpu, u64 smbase);
+        int (*pre_leave_smm)(struct kvm_vcpu *vcpu, const char *smstate);
         int (*enable_smi_window)(struct kvm_vcpu *vcpu);
 
         int (*mem_enc_op)(struct kvm *kvm, void __user *argp);
@@ -1256,8 +1256,8 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
                                    gfn_t gfn_offset, unsigned long mask);
 void kvm_mmu_zap_all(struct kvm *kvm);
 void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
-unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm);
-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
+unsigned long kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm);
+void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long kvm_nr_mmu_pages);
 
 int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3);
 bool pdptrs_changed(struct kvm_vcpu *vcpu);
@@ -1592,4 +1592,7 @@ static inline int kvm_cpu_get_apicid(int mps_cpu)
 #define put_smstate(type, buf, offset, val)                      \
         *(type *)((buf) + (offset) - 0x7e00) = val
 
+#define GET_SMSTATE(type, buf, offset)          \
+        (*(type *)((buf) + (offset) - 0x7e00))
+
 #endif /* _ASM_X86_KVM_HOST_H */
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 2779ace16d23..50b3e2d963c9 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -46,7 +46,7 @@ void ptdump_walk_user_pgd_level_checkwx(void);
  */
 extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
         __visible;
-#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page))
+#define ZERO_PAGE(vaddr) ((void)(vaddr),virt_to_page(empty_zero_page))
 
 extern spinlock_t pgd_lock;
 extern struct list_head pgd_list;
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index d653139857af..4c305471ec33 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h
@@ -91,11 +91,9 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(args, &regs->bx + i, n * sizeof(args[0]));
+        memcpy(args, &regs->bx, 6 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
@@ -116,124 +114,50 @@ static inline int syscall_get_arch(void)
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
 # ifdef CONFIG_IA32_EMULATION
-        if (task->thread_info.status & TS_COMPAT)
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        *args++ = regs->bx;
-                case 1:
-                        if (!n--) break;
-                        *args++ = regs->cx;
-                case 2:
-                        if (!n--) break;
-                        *args++ = regs->dx;
-                case 3:
-                        if (!n--) break;
-                        *args++ = regs->si;
-                case 4:
-                        if (!n--) break;
-                        *args++ = regs->di;
-                case 5:
-                        if (!n--) break;
-                        *args++ = regs->bp;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
-        else
+        if (task->thread_info.status & TS_COMPAT) {
+                *args++ = regs->bx;
+                *args++ = regs->cx;
+                *args++ = regs->dx;
+                *args++ = regs->si;
+                *args++ = regs->di;
+                *args   = regs->bp;
+        } else
 # endif
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        *args++ = regs->di;
-                case 1:
-                        if (!n--) break;
-                        *args++ = regs->si;
-                case 2:
-                        if (!n--) break;
-                        *args++ = regs->dx;
-                case 3:
-                        if (!n--) break;
-                        *args++ = regs->r10;
-                case 4:
-                        if (!n--) break;
-                        *args++ = regs->r8;
-                case 5:
-                        if (!n--) break;
-                        *args++ = regs->r9;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
+        {
+                *args++ = regs->di;
+                *args++ = regs->si;
+                *args++ = regs->dx;
+                *args++ = regs->r10;
+                *args++ = regs->r8;
+                *args   = regs->r9;
+        }
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
 # ifdef CONFIG_IA32_EMULATION
-        if (task->thread_info.status & TS_COMPAT)
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        regs->bx = *args++;
-                case 1:
-                        if (!n--) break;
-                        regs->cx = *args++;
-                case 2:
-                        if (!n--) break;
-                        regs->dx = *args++;
-                case 3:
-                        if (!n--) break;
-                        regs->si = *args++;
-                case 4:
-                        if (!n--) break;
-                        regs->di = *args++;
-                case 5:
-                        if (!n--) break;
-                        regs->bp = *args++;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
-        else
+        if (task->thread_info.status & TS_COMPAT) {
+                regs->bx = *args++;
+                regs->cx = *args++;
+                regs->dx = *args++;
+                regs->si = *args++;
+                regs->di = *args++;
+                regs->bp = *args;
+        } else
 # endif
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        regs->di = *args++;
-                case 1:
-                        if (!n--) break;
-                        regs->si = *args++;
-                case 2:
-                        if (!n--) break;
-                        regs->dx = *args++;
-                case 3:
-                        if (!n--) break;
-                        regs->r10 = *args++;
-                case 4:
-                        if (!n--) break;
-                        regs->r8 = *args++;
-                case 5:
-                        if (!n--) break;
-                        regs->r9 = *args++;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
+        {
+                regs->di = *args++;
+                regs->si = *args++;
+                regs->dx = *args++;
+                regs->r10 = *args++;
+                regs->r8 = *args++;
+                regs->r9 = *args;
+        }
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index de6f0d59a24f..2863c2026655 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -206,6 +206,9 @@ xen_single_call(unsigned int call,
         __HYPERCALL_DECLS;
         __HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
+        if (call >= PAGE_SIZE / sizeof(hypercall_page[0]))
+                return -EINVAL;
+
         asm volatile(CALL_NOSPEC
                      : __HYPERCALL_5PARAM
                      : [thunk_target] "a" (&hypercall_page[call])
diff --git a/arch/x86/include/uapi/asm/vmx.h b/arch/x86/include/uapi/asm/vmx.h
index f0b0c90dd398..d213ec5c3766 100644
--- a/arch/x86/include/uapi/asm/vmx.h
+++ b/arch/x86/include/uapi/asm/vmx.h
@@ -146,6 +146,7 @@
 
 #define VMX_ABORT_SAVE_GUEST_MSR_FAIL        1
 #define VMX_ABORT_LOAD_HOST_PDPTE_FAIL       2
+#define VMX_ABORT_VMCS_CORRUPTED             3
 #define VMX_ABORT_LOAD_HOST_MSR_FAIL         4
 
 #endif /* _UAPIVMX_H */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 2da82eff0eb4..b91b3bfa5cfb 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -275,7 +275,7 @@ static const struct {
         const char                      *option;
         enum spectre_v2_user_cmd        cmd;
         bool                            secure;
-} v2_user_options[] __initdata = {
+} v2_user_options[] __initconst = {
         { "auto",               SPECTRE_V2_USER_CMD_AUTO,               false },
         { "off",                SPECTRE_V2_USER_CMD_NONE,               false },
         { "on",                 SPECTRE_V2_USER_CMD_FORCE,              true  },
@@ -419,7 +419,7 @@ static const struct {
         const char *option;
         enum spectre_v2_mitigation_cmd cmd;
         bool secure;
-} mitigation_options[] __initdata = {
+} mitigation_options[] __initconst = {
         { "off",                SPECTRE_V2_CMD_NONE,              false },
         { "on",                 SPECTRE_V2_CMD_FORCE,             true  },
         { "retpoline",          SPECTRE_V2_CMD_RETPOLINE,         false },
@@ -658,7 +658,7 @@ static const char * const ssb_strings[] = {
 static const struct {
         const char *option;
         enum ssb_mitigation_cmd cmd;
-} ssb_mitigation_options[]  __initdata = {
+} ssb_mitigation_options[]  __initconst = {
         { "auto",       SPEC_STORE_BYPASS_CMD_AUTO },    /* Platform decides */
         { "on",         SPEC_STORE_BYPASS_CMD_ON },      /* Disable Speculative Store Bypass */
         { "off",        SPEC_STORE_BYPASS_CMD_NONE },    /* Don't touch Speculative Store Bypass */
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index fc3c07fe7df5..3142fd7a9b32 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -611,8 +611,8 @@ static void init_intel_energy_perf(struct cpuinfo_x86 *c)
         if ((epb & 0xF) != ENERGY_PERF_BIAS_PERFORMANCE)
                 return;
 
-        pr_warn_once("ENERGY_PERF_BIAS: Set to 'normal', was 'performance'\n");
-        pr_warn_once("ENERGY_PERF_BIAS: View and update with x86_energy_perf_policy(8)\n");
+        pr_info_once("ENERGY_PERF_BIAS: Set to 'normal', was 'performance'\n");
+        pr_info_once("ENERGY_PERF_BIAS: View and update with x86_energy_perf_policy(8)\n");
         epb = (epb & ~0xF) | ENERGY_PERF_BIAS_NORMAL;
         wrmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
 }
diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
index 399601eda8e4..85212a32b54d 100644
--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
@@ -2039,14 +2039,14 @@ out:
 enum rdt_param {
         Opt_cdp,
         Opt_cdpl2,
-        Opt_mba_mpbs,
+        Opt_mba_mbps,
         nr__rdt_params
 };
 
 static const struct fs_parameter_spec rdt_param_specs[] = {
         fsparam_flag("cdp",             Opt_cdp),
         fsparam_flag("cdpl2",           Opt_cdpl2),
-        fsparam_flag("mba_mpbs",        Opt_mba_mpbs),
+        fsparam_flag("mba_MBps",        Opt_mba_mbps),
         {}
 };
 
@@ -2072,7 +2072,7 @@ static int rdt_parse_param(struct fs_context *fc, struct fs_parameter *param)
         case Opt_cdpl2:
                 ctx->enable_cdpl2 = true;
                 return 0;
-        case Opt_mba_mpbs:
+        case Opt_mba_mbps:
                 if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
                         return -EINVAL;
                 ctx->enable_mba_mbps = true;
@@ -2610,9 +2610,10 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
                         rdt_last_cmd_puts("Failed to initialize allocations\n");
                         return ret;
                 }
-                rdtgrp->mode = RDT_MODE_SHAREABLE;
         }
 
+        rdtgrp->mode = RDT_MODE_SHAREABLE;
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index a034cb808e7e..fed46ddb1eef 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -569,6 +569,7 @@ void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
         unsigned long *sara = stack_addr(regs);
 
         ri->ret_addr = (kprobe_opcode_t *) *sara;
+        ri->fp = sara;
 
         /* Replace the return addr with trampoline addr */
         *sara = (unsigned long) &kretprobe_trampoline;
@@ -748,26 +749,48 @@ asm(
 NOKPROBE_SYMBOL(kretprobe_trampoline);
 STACK_FRAME_NON_STANDARD(kretprobe_trampoline);
 
+static struct kprobe kretprobe_kprobe = {
+        .addr = (void *)kretprobe_trampoline,
+};
+
 /*
  * Called from kretprobe_trampoline
  */
 static __used void *trampoline_handler(struct pt_regs *regs)
 {
+        struct kprobe_ctlblk *kcb;
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
         struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
         kprobe_opcode_t *correct_ret_addr = NULL;
+        void *frame_pointer;
+        bool skipped = false;
+
+        preempt_disable();
+
+        /*
+         * Set a dummy kprobe for avoiding kretprobe recursion.
+         * Since kretprobe never run in kprobe handler, kprobe must not
+         * be running at this point.
+         */
+        kcb = get_kprobe_ctlblk();
+        __this_cpu_write(current_kprobe, &kretprobe_kprobe);
+        kcb->kprobe_status = KPROBE_HIT_ACTIVE;
 
         INIT_HLIST_HEAD(&empty_rp);
         kretprobe_hash_lock(current, &head, &flags);
         /* fixup registers */
 #ifdef CONFIG_X86_64
         regs->cs = __KERNEL_CS;
+        /* On x86-64, we use pt_regs->sp for return address holder. */
+        frame_pointer = &regs->sp;
 #else
         regs->cs = __KERNEL_CS | get_kernel_rpl();
         regs->gs = 0;
+        /* On x86-32, we use pt_regs->flags for return address holder. */
+        frame_pointer = &regs->flags;
 #endif
         regs->ip = trampoline_address;
         regs->orig_ax = ~0UL;
@@ -789,8 +812,25 @@ static __used void *trampoline_handler(struct pt_regs *regs)
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
+                /*
+                 * Return probes must be pushed on this hash list correct
+                 * order (same as return order) so that it can be poped
+                 * correctly. However, if we find it is pushed it incorrect
+                 * order, this means we find a function which should not be
+                 * probed, because the wrong order entry is pushed on the
+                 * path of processing other kretprobe itself.
+                 */
+                if (ri->fp != frame_pointer) {
+                        if (!skipped)
+                                pr_warn("kretprobe is stacked incorrectly. Trying to fixup.\n");
+                        skipped = true;
+                        continue;
+                }
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
+                if (skipped)
+                        pr_warn("%ps must be blacklisted because of incorrect kretprobe order\n",
+                                ri->rp->kp.addr);
 
                 if (orig_ret_address != trampoline_address)
                         /*
@@ -808,14 +848,15 @@ static __used void *trampoline_handler(struct pt_regs *regs)
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
+                if (ri->fp != frame_pointer)
+                        continue;
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
                 if (ri->rp && ri->rp->handler) {
                         __this_cpu_write(current_kprobe, &ri->rp->kp);
-                        get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
                         ri->ret_addr = correct_ret_addr;
                         ri->rp->handler(ri, regs);
-                        __this_cpu_write(current_kprobe, NULL);
+                        __this_cpu_write(current_kprobe, &kretprobe_kprobe);
                 }
 
                 recycle_rp_inst(ri, &empty_rp);
@@ -831,6 +872,9 @@ static __used void *trampoline_handler(struct pt_regs *regs)
 
         kretprobe_hash_unlock(current, &flags);
 
+        __this_cpu_write(current_kprobe, NULL);
+        preempt_enable();
+
         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 58ac7be52c7a..957eae13b370 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -426,6 +426,8 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
         u64 msr = x86_spec_ctrl_base;
         bool updmsr = false;
 
+        lockdep_assert_irqs_disabled();
+
         /*
          * If TIF_SSBD is different, select the proper mitigation
          * method. Note that if SSBD mitigation is disabled or permanentely
@@ -477,10 +479,12 @@ static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
 
 void speculation_ctrl_update(unsigned long tif)
 {
+        unsigned long flags;
+
         /* Forced update. Make sure all relevant TIF flags are different */
-        preempt_disable();
+        local_irq_save(flags);
         __speculation_ctrl_update(~tif, tif);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /* Called from seccomp/prctl update */
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 725624b6c0c0..8fd3cedd9acc 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -81,6 +81,19 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
         return 0;
 }
 
+/*
+ * Some machines don't handle the default ACPI reboot method and
+ * require the EFI reboot method:
+ */
+static int __init set_efi_reboot(const struct dmi_system_id *d)
+{
+        if (reboot_type != BOOT_EFI && !efi_runtime_disabled()) {
+                reboot_type = BOOT_EFI;
+                pr_info("%s series board detected. Selecting EFI-method for reboot.\n", d->ident);
+        }
+        return 0;
+}
+
 void __noreturn machine_real_restart(unsigned int type)
 {
         local_irq_disable();
@@ -166,6 +179,14 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "AOA110"),
                 },
         },
+        {       /* Handle reboot issue on Acer TravelMate X514-51T */
+                .callback = set_efi_reboot,
+                .ident = "Acer TravelMate X514-51T",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate X514-51T"),
+                },
+        },
 
         /* Apple */
         {       /* Handle problems with rebooting on Apple MacBook5 */
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index bad8c51fee6e..a5127b2c195f 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -362,7 +362,7 @@ SECTIONS
         .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
                 __bss_start = .;
                 *(.bss..page_aligned)
-                *(.bss)
+                *(BSS_MAIN)
                 BSS_DECRYPTED
                 . = ALIGN(PAGE_SIZE);
                 __bss_stop = .;
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index c338984c850d..d0d5dd44b4f4 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2331,24 +2331,18 @@ static int em_lseg(struct x86_emulate_ctxt *ctxt)
 
 static int emulator_has_longmode(struct x86_emulate_ctxt *ctxt)
 {
+#ifdef CONFIG_X86_64
         u32 eax, ebx, ecx, edx;
 
         eax = 0x80000001;
         ecx = 0;
         ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx, false);
         return edx & bit(X86_FEATURE_LM);
+#else
+        return false;
+#endif
 }
 
-#define GET_SMSTATE(type, smbase, offset)                                 \
-        ({                                                                \
-         type __val;                                                      \
-         int r = ctxt->ops->read_phys(ctxt, smbase + offset, &__val,      \
-                                      sizeof(__val));                     \
-         if (r != X86EMUL_CONTINUE)                                       \
-                 return X86EMUL_UNHANDLEABLE;                             \
-         __val;                                                           \
-        })
-
 static void rsm_set_desc_flags(struct desc_struct *desc, u32 flags)
 {
         desc->g    = (flags >> 23) & 1;
@@ -2361,27 +2355,30 @@ static void rsm_set_desc_flags(struct desc_struct *desc, u32 flags)
         desc->type = (flags >>  8) & 15;
 }
 
-static int rsm_load_seg_32(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+static int rsm_load_seg_32(struct x86_emulate_ctxt *ctxt, const char *smstate,
+                           int n)
 {
         struct desc_struct desc;
         int offset;
         u16 selector;
 
-        selector = GET_SMSTATE(u32, smbase, 0x7fa8 + n * 4);
+        selector = GET_SMSTATE(u32, smstate, 0x7fa8 + n * 4);
 
         if (n < 3)
                 offset = 0x7f84 + n * 12;
         else
                 offset = 0x7f2c + (n - 3) * 12;
 
-        set_desc_base(&desc,      GET_SMSTATE(u32, smbase, offset + 8));
-        set_desc_limit(&desc,     GET_SMSTATE(u32, smbase, offset + 4));
-        rsm_set_desc_flags(&desc, GET_SMSTATE(u32, smbase, offset));
+        set_desc_base(&desc,      GET_SMSTATE(u32, smstate, offset + 8));
+        set_desc_limit(&desc,     GET_SMSTATE(u32, smstate, offset + 4));
+        rsm_set_desc_flags(&desc, GET_SMSTATE(u32, smstate, offset));
         ctxt->ops->set_segment(ctxt, selector, &desc, 0, n);
         return X86EMUL_CONTINUE;
 }
 
-static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+#ifdef CONFIG_X86_64
+static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, const char *smstate,
+                           int n)
 {
         struct desc_struct desc;
         int offset;
@@ -2390,15 +2387,16 @@ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
 
         offset = 0x7e00 + n * 16;
 
-        selector =                GET_SMSTATE(u16, smbase, offset);
-        rsm_set_desc_flags(&desc, GET_SMSTATE(u16, smbase, offset + 2) << 8);
-        set_desc_limit(&desc,     GET_SMSTATE(u32, smbase, offset + 4));
-        set_desc_base(&desc,      GET_SMSTATE(u32, smbase, offset + 8));
-        base3 =                   GET_SMSTATE(u32, smbase, offset + 12);
+        selector =                GET_SMSTATE(u16, smstate, offset);
+        rsm_set_desc_flags(&desc, GET_SMSTATE(u16, smstate, offset + 2) << 8);
+        set_desc_limit(&desc,     GET_SMSTATE(u32, smstate, offset + 4));
+        set_desc_base(&desc,      GET_SMSTATE(u32, smstate, offset + 8));
+        base3 =                   GET_SMSTATE(u32, smstate, offset + 12);
 
         ctxt->ops->set_segment(ctxt, selector, &desc, base3, n);
         return X86EMUL_CONTINUE;
 }
+#endif
 
 static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
                                     u64 cr0, u64 cr3, u64 cr4)
@@ -2445,7 +2443,8 @@ static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
         return X86EMUL_CONTINUE;
 }
 
-static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
+static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt,
+                             const char *smstate)
 {
         struct desc_struct desc;
         struct desc_ptr dt;
@@ -2453,53 +2452,55 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
         u32 val, cr0, cr3, cr4;
         int i;
 
-        cr0 =                      GET_SMSTATE(u32, smbase, 0x7ffc);
-        cr3 =                      GET_SMSTATE(u32, smbase, 0x7ff8);
-        ctxt->eflags =             GET_SMSTATE(u32, smbase, 0x7ff4) | X86_EFLAGS_FIXED;
-        ctxt->_eip =               GET_SMSTATE(u32, smbase, 0x7ff0);
+        cr0 =                      GET_SMSTATE(u32, smstate, 0x7ffc);
+        cr3 =                      GET_SMSTATE(u32, smstate, 0x7ff8);
+        ctxt->eflags =             GET_SMSTATE(u32, smstate, 0x7ff4) | X86_EFLAGS_FIXED;
+        ctxt->_eip =               GET_SMSTATE(u32, smstate, 0x7ff0);
 
         for (i = 0; i < 8; i++)
-                *reg_write(ctxt, i) = GET_SMSTATE(u32, smbase, 0x7fd0 + i * 4);
+                *reg_write(ctxt, i) = GET_SMSTATE(u32, smstate, 0x7fd0 + i * 4);
 
-        val = GET_SMSTATE(u32, smbase, 0x7fcc);
+        val = GET_SMSTATE(u32, smstate, 0x7fcc);
         ctxt->ops->set_dr(ctxt, 6, (val & DR6_VOLATILE) | DR6_FIXED_1);
-        val = GET_SMSTATE(u32, smbase, 0x7fc8);
+        val = GET_SMSTATE(u32, smstate, 0x7fc8);
         ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1);
 
-        selector =                 GET_SMSTATE(u32, smbase, 0x7fc4);
-        set_desc_base(&desc,       GET_SMSTATE(u32, smbase, 0x7f64));
-        set_desc_limit(&desc,      GET_SMSTATE(u32, smbase, 0x7f60));
-        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smbase, 0x7f5c));
+        selector =                 GET_SMSTATE(u32, smstate, 0x7fc4);
+        set_desc_base(&desc,       GET_SMSTATE(u32, smstate, 0x7f64));
+        set_desc_limit(&desc,      GET_SMSTATE(u32, smstate, 0x7f60));
+        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smstate, 0x7f5c));
         ctxt->ops->set_segment(ctxt, selector, &desc, 0, VCPU_SREG_TR);
 
-        selector =                 GET_SMSTATE(u32, smbase, 0x7fc0);
-        set_desc_base(&desc,       GET_SMSTATE(u32, smbase, 0x7f80));
-        set_desc_limit(&desc,      GET_SMSTATE(u32, smbase, 0x7f7c));
-        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smbase, 0x7f78));
+        selector =                 GET_SMSTATE(u32, smstate, 0x7fc0);
+        set_desc_base(&desc,       GET_SMSTATE(u32, smstate, 0x7f80));
+        set_desc_limit(&desc,      GET_SMSTATE(u32, smstate, 0x7f7c));
+        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smstate, 0x7f78));
         ctxt->ops->set_segment(ctxt, selector, &desc, 0, VCPU_SREG_LDTR);
 
-        dt.address =               GET_SMSTATE(u32, smbase, 0x7f74);
-        dt.size =                  GET_SMSTATE(u32, smbase, 0x7f70);
+        dt.address =               GET_SMSTATE(u32, smstate, 0x7f74);
+        dt.size =                  GET_SMSTATE(u32, smstate, 0x7f70);
         ctxt->ops->set_gdt(ctxt, &dt);
 
-        dt.address =               GET_SMSTATE(u32, smbase, 0x7f58);
-        dt.size =                  GET_SMSTATE(u32, smbase, 0x7f54);
+        dt.address =               GET_SMSTATE(u32, smstate, 0x7f58);
+        dt.size =                  GET_SMSTATE(u32, smstate, 0x7f54);
         ctxt->ops->set_idt(ctxt, &dt);
 
         for (i = 0; i < 6; i++) {
-                int r = rsm_load_seg_32(ctxt, smbase, i);
+                int r = rsm_load_seg_32(ctxt, smstate, i);
                 if (r != X86EMUL_CONTINUE)
                         return r;
         }
 
-        cr4 = GET_SMSTATE(u32, smbase, 0x7f14);
+        cr4 = GET_SMSTATE(u32, smstate, 0x7f14);
 
-        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7ef8));
+        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smstate, 0x7ef8));
 
         return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
 }
 
-static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
+#ifdef CONFIG_X86_64
+static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt,
+                             const char *smstate)
 {
         struct desc_struct desc;
         struct desc_ptr dt;
@@ -2509,43 +2510,43 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
         int i, r;
 
         for (i = 0; i < 16; i++)
-                *reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8);
+                *reg_write(ctxt, i) = GET_SMSTATE(u64, smstate, 0x7ff8 - i * 8);
 
-        ctxt->_eip   = GET_SMSTATE(u64, smbase, 0x7f78);
-        ctxt->eflags = GET_SMSTATE(u32, smbase, 0x7f70) | X86_EFLAGS_FIXED;
+        ctxt->_eip   = GET_SMSTATE(u64, smstate, 0x7f78);
+        ctxt->eflags = GET_SMSTATE(u32, smstate, 0x7f70) | X86_EFLAGS_FIXED;
 
-        val = GET_SMSTATE(u32, smbase, 0x7f68);
+        val = GET_SMSTATE(u32, smstate, 0x7f68);
         ctxt->ops->set_dr(ctxt, 6, (val & DR6_VOLATILE) | DR6_FIXED_1);
-        val = GET_SMSTATE(u32, smbase, 0x7f60);
+        val = GET_SMSTATE(u32, smstate, 0x7f60);
         ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1);
 
-        cr0 =                       GET_SMSTATE(u64, smbase, 0x7f58);
-        cr3 =                       GET_SMSTATE(u64, smbase, 0x7f50);
-        cr4 =                       GET_SMSTATE(u64, smbase, 0x7f48);
-        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7f00));
-        val =                       GET_SMSTATE(u64, smbase, 0x7ed0);
+        cr0 =                       GET_SMSTATE(u64, smstate, 0x7f58);
+        cr3 =                       GET_SMSTATE(u64, smstate, 0x7f50);
+        cr4 =                       GET_SMSTATE(u64, smstate, 0x7f48);
+        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smstate, 0x7f00));
+        val =                       GET_SMSTATE(u64, smstate, 0x7ed0);
         ctxt->ops->set_msr(ctxt, MSR_EFER, val & ~EFER_LMA);
 
-        selector =                  GET_SMSTATE(u32, smbase, 0x7e90);
-        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smbase, 0x7e92) << 8);
-        set_desc_limit(&desc,       GET_SMSTATE(u32, smbase, 0x7e94));
-        set_desc_base(&desc,        GET_SMSTATE(u32, smbase, 0x7e98));
-        base3 =                     GET_SMSTATE(u32, smbase, 0x7e9c);
+        selector =                  GET_SMSTATE(u32, smstate, 0x7e90);
+        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smstate, 0x7e92) << 8);
+        set_desc_limit(&desc,       GET_SMSTATE(u32, smstate, 0x7e94));
+        set_desc_base(&desc,        GET_SMSTATE(u32, smstate, 0x7e98));
+        base3 =                     GET_SMSTATE(u32, smstate, 0x7e9c);
         ctxt->ops->set_segment(ctxt, selector, &desc, base3, VCPU_SREG_TR);
 
-        dt.size =                   GET_SMSTATE(u32, smbase, 0x7e84);
-        dt.address =                GET_SMSTATE(u64, smbase, 0x7e88);
+        dt.size =                   GET_SMSTATE(u32, smstate, 0x7e84);
+        dt.address =                GET_SMSTATE(u64, smstate, 0x7e88);
         ctxt->ops->set_idt(ctxt, &dt);
 
-        selector =                  GET_SMSTATE(u32, smbase, 0x7e70);
-        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smbase, 0x7e72) << 8);
-        set_desc_limit(&desc,       GET_SMSTATE(u32, smbase, 0x7e74));
-        set_desc_base(&desc,        GET_SMSTATE(u32, smbase, 0x7e78));
-        base3 =                     GET_SMSTATE(u32, smbase, 0x7e7c);
+        selector =                  GET_SMSTATE(u32, smstate, 0x7e70);
+        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smstate, 0x7e72) << 8);
+        set_desc_limit(&desc,       GET_SMSTATE(u32, smstate, 0x7e74));
+        set_desc_base(&desc,        GET_SMSTATE(u32, smstate, 0x7e78));
+        base3 =                     GET_SMSTATE(u32, smstate, 0x7e7c);
         ctxt->ops->set_segment(ctxt, selector, &desc, base3, VCPU_SREG_LDTR);
 
-        dt.size =                   GET_SMSTATE(u32, smbase, 0x7e64);
-        dt.address =                GET_SMSTATE(u64, smbase, 0x7e68);
+        dt.size =                   GET_SMSTATE(u32, smstate, 0x7e64);
+        dt.address =                GET_SMSTATE(u64, smstate, 0x7e68);
         ctxt->ops->set_gdt(ctxt, &dt);
 
         r = rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
@@ -2553,37 +2554,49 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
                 return r;
 
         for (i = 0; i < 6; i++) {
-                r = rsm_load_seg_64(ctxt, smbase, i);
+                r = rsm_load_seg_64(ctxt, smstate, i);
                 if (r != X86EMUL_CONTINUE)
                         return r;
         }
 
         return X86EMUL_CONTINUE;
 }
+#endif
 
 static int em_rsm(struct x86_emulate_ctxt *ctxt)
 {
         unsigned long cr0, cr4, efer;
+        char buf[512];
         u64 smbase;
         int ret;
 
         if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0)
                 return emulate_ud(ctxt);
 
+        smbase = ctxt->ops->get_smbase(ctxt);
+
+        ret = ctxt->ops->read_phys(ctxt, smbase + 0xfe00, buf, sizeof(buf));
+        if (ret != X86EMUL_CONTINUE)
+                return X86EMUL_UNHANDLEABLE;
+
+        if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
+                ctxt->ops->set_nmi_mask(ctxt, false);
+
+        ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
+                ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
+
         /*
          * Get back to real mode, to prepare a safe state in which to load
          * CR0/CR3/CR4/EFER.  It's all a bit more complicated if the vCPU
          * supports long mode.
          */
-        cr4 = ctxt->ops->get_cr(ctxt, 4);
         if (emulator_has_longmode(ctxt)) {
                 struct desc_struct cs_desc;
 
                 /* Zero CR4.PCIDE before CR0.PG.  */
-                if (cr4 & X86_CR4_PCIDE) {
+                cr4 = ctxt->ops->get_cr(ctxt, 4);
+                if (cr4 & X86_CR4_PCIDE)
                         ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE);
-                        cr4 &= ~X86_CR4_PCIDE;
-                }
 
                 /* A 32-bit code segment is required to clear EFER.LMA.  */
                 memset(&cs_desc, 0, sizeof(cs_desc));
@@ -2597,39 +2610,39 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
         if (cr0 & X86_CR0_PE)
                 ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE));
 
-        /* Now clear CR4.PAE (which must be done before clearing EFER.LME).  */
-        if (cr4 & X86_CR4_PAE)
-                ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
-
-        /* And finally go back to 32-bit mode.  */
-        efer = 0;
-        ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
+        if (emulator_has_longmode(ctxt)) {
+                /* Clear CR4.PAE before clearing EFER.LME. */
+                cr4 = ctxt->ops->get_cr(ctxt, 4);
+                if (cr4 & X86_CR4_PAE)
+                        ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
 
-        smbase = ctxt->ops->get_smbase(ctxt);
+                /* And finally go back to 32-bit mode.  */
+                efer = 0;
+                ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
+        }
 
         /*
          * Give pre_leave_smm() a chance to make ISA-specific changes to the
          * vCPU state (e.g. enter guest mode) before loading state from the SMM
          * state-save area.
          */
-        if (ctxt->ops->pre_leave_smm(ctxt, smbase))
+        if (ctxt->ops->pre_leave_smm(ctxt, buf))
                 return X86EMUL_UNHANDLEABLE;
 
+#ifdef CONFIG_X86_64
         if (emulator_has_longmode(ctxt))
-                ret = rsm_load_state_64(ctxt, smbase + 0x8000);
+                ret = rsm_load_state_64(ctxt, buf);
         else
-                ret = rsm_load_state_32(ctxt, smbase + 0x8000);
+#endif
+                ret = rsm_load_state_32(ctxt, buf);
 
         if (ret != X86EMUL_CONTINUE) {
                 /* FIXME: should triple fault */
                 return X86EMUL_UNHANDLEABLE;
         }
 
-        if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
-                ctxt->ops->set_nmi_mask(ctxt, false);
+        ctxt->ops->post_leave_smm(ctxt);
 
-        ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
-                ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
         return X86EMUL_CONTINUE;
 }
 
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 991fdf7fc17f..9bf70cf84564 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -138,6 +138,7 @@ static inline bool kvm_apic_map_get_logical_dest(struct kvm_apic_map *map,
                 if (offset <= max_apic_id) {
                         u8 cluster_size = min(max_apic_id - offset + 1, 16U);
 
+                        offset = array_index_nospec(offset, map->max_apic_id + 1);
                         *cluster = &map->phys_map[offset];
                         *mask = dest_id & (0xffff >> (16 - cluster_size));
                 } else {
@@ -901,7 +902,8 @@ static inline bool kvm_apic_map_get_dest_lapic(struct kvm *kvm,
                 if (irq->dest_id > map->max_apic_id) {
                         *bitmap = 0;
                 } else {
-                        *dst = &map->phys_map[irq->dest_id];
+                        u32 dest_id = array_index_nospec(irq->dest_id, map->max_apic_id + 1);
+                        *dst = &map->phys_map[dest_id];
                         *bitmap = 1;
                 }
                 return true;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index eee455a8a612..e10962dfc203 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2007,7 +2007,7 @@ static int is_empty_shadow_page(u64 *spt)
  * aggregate version in order to make the slab shrinker
  * faster
  */
-static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, int nr)
+static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr)
 {
         kvm->arch.n_used_mmu_pages += nr;
         percpu_counter_add(&kvm_total_used_mmu_pages, nr);
@@ -2238,7 +2238,7 @@ static bool kvm_mmu_remote_flush_or_zap(struct kvm *kvm,
                                         struct list_head *invalid_list,
                                         bool remote_flush)
 {
-        if (!remote_flush && !list_empty(invalid_list))
+        if (!remote_flush && list_empty(invalid_list))
                 return false;
 
         if (!list_empty(invalid_list))
@@ -2763,7 +2763,7 @@ static bool prepare_zap_oldest_mmu_page(struct kvm *kvm,
  * Changing the number of mmu pages allocated to the vm
  * Note: if goal_nr_mmu_pages is too small, you will get dead lock
  */
-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
+void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long goal_nr_mmu_pages)
 {
         LIST_HEAD(invalid_list);
 
@@ -6031,10 +6031,10 @@ out:
 /*
  * Calculate mmu pages needed for kvm.
  */
-unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
+unsigned long kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
 {
-        unsigned int nr_mmu_pages;
-        unsigned int  nr_pages = 0;
+        unsigned long nr_mmu_pages;
+        unsigned long nr_pages = 0;
         struct kvm_memslots *slots;
         struct kvm_memory_slot *memslot;
         int i;
@@ -6047,8 +6047,7 @@ unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
         }
 
         nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
-        nr_mmu_pages = max(nr_mmu_pages,
-                           (unsigned int) KVM_MIN_ALLOC_MMU_PAGES);
+        nr_mmu_pages = max(nr_mmu_pages, KVM_MIN_ALLOC_MMU_PAGES);
 
         return nr_mmu_pages;
 }
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index bbdc60f2fae8..54c2a377795b 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -64,7 +64,7 @@ bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
 int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
                                 u64 fault_address, char *insn, int insn_len);
 
-static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
+static inline unsigned long kvm_mmu_available_pages(struct kvm *kvm)
 {
         if (kvm->arch.n_max_mmu_pages > kvm->arch.n_used_mmu_pages)
                 return kvm->arch.n_max_mmu_pages -
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 58ead7db71a3..e39741997893 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -281,9 +281,13 @@ static int kvm_pmu_rdpmc_vmware(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
 int kvm_pmu_rdpmc(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
 {
         bool fast_mode = idx & (1u << 31);
+        struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
         struct kvm_pmc *pmc;
         u64 ctr_val;
 
+        if (!pmu->version)
+                return 1;
+
         if (is_vmware_backdoor_pmc(idx))
                 return kvm_pmu_rdpmc_vmware(vcpu, idx, data);
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 426039285fd1..406b558abfef 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -262,6 +262,7 @@ struct amd_svm_iommu_ir {
 };
 
 #define AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK    (0xFF)
+#define AVIC_LOGICAL_ID_ENTRY_VALID_BIT                 31
 #define AVIC_LOGICAL_ID_ENTRY_VALID_MASK                (1 << 31)
 
 #define AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK    (0xFFULL)
@@ -2692,6 +2693,7 @@ static int npf_interception(struct vcpu_svm *svm)
 static int db_interception(struct vcpu_svm *svm)
 {
         struct kvm_run *kvm_run = svm->vcpu.run;
+        struct kvm_vcpu *vcpu = &svm->vcpu;
 
         if (!(svm->vcpu.guest_debug &
               (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
@@ -2702,6 +2704,8 @@ static int db_interception(struct vcpu_svm *svm)
 
         if (svm->nmi_singlestep) {
                 disable_nmi_singlestep(svm);
+                /* Make sure we check for pending NMIs upon entry */
+                kvm_make_request(KVM_REQ_EVENT, vcpu);
         }
 
         if (svm->vcpu.guest_debug &
@@ -4517,14 +4521,25 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
                 kvm_lapic_reg_write(apic, APIC_ICR, icrl);
                 break;
         case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
+                int i;
+                struct kvm_vcpu *vcpu;
+                struct kvm *kvm = svm->vcpu.kvm;
                 struct kvm_lapic *apic = svm->vcpu.arch.apic;
 
                 /*
-                 * Update ICR high and low, then emulate sending IPI,
-                 * which is handled when writing APIC_ICR.
+                 * At this point, we expect that the AVIC HW has already
+                 * set the appropriate IRR bits on the valid target
+                 * vcpus. So, we just need to kick the appropriate vcpu.
                  */
-                kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
-                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+                kvm_for_each_vcpu(i, vcpu, kvm) {
+                        bool m = kvm_apic_match_dest(vcpu, apic,
+                                                     icrl & KVM_APIC_SHORT_MASK,
+                                                     GET_APIC_DEST_FIELD(icrh),
+                                                     icrl & KVM_APIC_DEST_MASK);
+
+                        if (m && !avic_vcpu_is_running(vcpu))
+                                kvm_vcpu_wake_up(vcpu);
+                }
                 break;
         }
         case AVIC_IPI_FAILURE_INVALID_TARGET:
@@ -4596,7 +4611,7 @@ static void avic_invalidate_logical_id_entry(struct kvm_vcpu *vcpu)
         u32 *entry = avic_get_logical_id_entry(vcpu, svm->ldr_reg, flat);
 
         if (entry)
-                WRITE_ONCE(*entry, (u32) ~AVIC_LOGICAL_ID_ENTRY_VALID_MASK);
+                clear_bit(AVIC_LOGICAL_ID_ENTRY_VALID_BIT, (unsigned long *)entry);
 }
 
 static int avic_handle_ldr_update(struct kvm_vcpu *vcpu)
@@ -5621,6 +5636,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         svm->vmcb->save.cr2 = vcpu->arch.cr2;
 
         clgi();
+        kvm_load_guest_xcr0(vcpu);
 
         /*
          * If this vCPU has touched SPEC_CTRL, restore the guest's value if
@@ -5766,6 +5782,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
                 kvm_before_interrupt(&svm->vcpu);
 
+        kvm_put_guest_xcr0(vcpu);
         stgi();
 
         /* Any pending NMI will happen here */
@@ -6215,32 +6232,24 @@ static int svm_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
         return 0;
 }
 
-static int svm_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
+static int svm_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
         struct vmcb *nested_vmcb;
         struct page *page;
-        struct {
-                u64 guest;
-                u64 vmcb;
-        } svm_state_save;
-        int ret;
+        u64 guest;
+        u64 vmcb;
 
-        ret = kvm_vcpu_read_guest(vcpu, smbase + 0xfed8, &svm_state_save,
-                                  sizeof(svm_state_save));
-        if (ret)
-                return ret;
+        guest = GET_SMSTATE(u64, smstate, 0x7ed8);
+        vmcb = GET_SMSTATE(u64, smstate, 0x7ee0);
 
-        if (svm_state_save.guest) {
-                vcpu->arch.hflags &= ~HF_SMM_MASK;
-                nested_vmcb = nested_svm_map(svm, svm_state_save.vmcb, &page);
-                if (nested_vmcb)
-                        enter_svm_guest_mode(svm, svm_state_save.vmcb, nested_vmcb, page);
-                else
-                        ret = 1;
-                vcpu->arch.hflags |= HF_SMM_MASK;
+        if (guest) {
+                nested_vmcb = nested_svm_map(svm, vmcb, &page);
+                if (!nested_vmcb)
+                        return 1;
+                enter_svm_guest_mode(svm, vmcb, nested_vmcb, page);
         }
-        return ret;
+        return 0;
 }
 
 static int enable_smi_window(struct kvm_vcpu *vcpu)
@@ -6422,11 +6431,11 @@ e_free:
         return ret;
 }
 
-static int get_num_contig_pages(int idx, struct page **inpages,
-                                unsigned long npages)
+static unsigned long get_num_contig_pages(unsigned long idx,
+                                struct page **inpages, unsigned long npages)
 {
         unsigned long paddr, next_paddr;
-        int i = idx + 1, pages = 1;
+        unsigned long i = idx + 1, pages = 1;
 
         /* find the number of contiguous pages starting from idx */
         paddr = __sme_page_pa(inpages[idx]);
@@ -6445,12 +6454,12 @@ static int get_num_contig_pages(int idx, struct page **inpages,
 
 static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
 {
-        unsigned long vaddr, vaddr_end, next_vaddr, npages, size;
+        unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
         struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
         struct kvm_sev_launch_update_data params;
         struct sev_data_launch_update_data *data;
         struct page **inpages;
-        int i, ret, pages;
+        int ret;
 
         if (!sev_guest(kvm))
                 return -ENOTTY;
@@ -6799,7 +6808,8 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
         struct page **src_p, **dst_p;
         struct kvm_sev_dbg debug;
         unsigned long n;
-        int ret, size;
+        unsigned int size;
+        int ret;
 
         if (!sev_guest(kvm))
                 return -ENOTTY;
@@ -6807,6 +6817,11 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
         if (copy_from_user(&debug, (void __user *)(uintptr_t)argp->data, sizeof(debug)))
                 return -EFAULT;
 
+        if (!debug.len || debug.src_uaddr + debug.len < debug.src_uaddr)
+                return -EINVAL;
+        if (!debug.dst_uaddr)
+                return -EINVAL;
+
         vaddr = debug.src_uaddr;
         size = debug.len;
         vaddr_end = vaddr + size;
@@ -6857,8 +6872,8 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
                                                      dst_vaddr,
                                                      len, &argp->error);
 
-                sev_unpin_memory(kvm, src_p, 1);
-                sev_unpin_memory(kvm, dst_p, 1);
+                sev_unpin_memory(kvm, src_p, n);
+                sev_unpin_memory(kvm, dst_p, n);
 
                 if (ret)
                         goto err;
diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 6432d08c7de7..4d47a2631d1f 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -438,13 +438,13 @@ TRACE_EVENT(kvm_apic_ipi,
 );
 
 TRACE_EVENT(kvm_apic_accept_irq,
-            TP_PROTO(__u32 apicid, __u16 dm, __u8 tm, __u8 vec),
+            TP_PROTO(__u32 apicid, __u16 dm, __u16 tm, __u8 vec),
             TP_ARGS(apicid, dm, tm, vec),
 
         TP_STRUCT__entry(
                 __field(        __u32,          apicid          )
                 __field(        __u16,          dm              )
-                __field(        __u8,           tm              )
+                __field(        __u16,          tm              )
                 __field(        __u8,           vec             )
         ),
 
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 153e539c29c9..6401eb7ef19c 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -500,6 +500,17 @@ static void nested_vmx_disable_intercept_for_msr(unsigned long *msr_bitmap_l1,
         }
 }
 
+static inline void enable_x2apic_msr_intercepts(unsigned long *msr_bitmap) {
+        int msr;
+
+        for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+                unsigned word = msr / BITS_PER_LONG;
+
+                msr_bitmap[word] = ~0;
+                msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
+        }
+}
+
 /*
  * Merge L0's and L1's MSR bitmap, return false to indicate that
  * we do not use the hardware.
@@ -541,39 +552,44 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
                 return false;
 
         msr_bitmap_l1 = (unsigned long *)kmap(page);
-        if (nested_cpu_has_apic_reg_virt(vmcs12)) {
-                /*
-                 * L0 need not intercept reads for MSRs between 0x800 and 0x8ff, it
-                 * just lets the processor take the value from the virtual-APIC page;
-                 * take those 256 bits directly from the L1 bitmap.
-                 */
-                for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
-                        unsigned word = msr / BITS_PER_LONG;
-                        msr_bitmap_l0[word] = msr_bitmap_l1[word];
-                        msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0;
-                }
-        } else {
-                for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
-                        unsigned word = msr / BITS_PER_LONG;
-                        msr_bitmap_l0[word] = ~0;
-                        msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0;
-                }
-        }
 
-        nested_vmx_disable_intercept_for_msr(
-                msr_bitmap_l1, msr_bitmap_l0,
-                X2APIC_MSR(APIC_TASKPRI),
-                MSR_TYPE_W);
+        /*
+         * To keep the control flow simple, pay eight 8-byte writes (sixteen
+         * 4-byte writes on 32-bit systems) up front to enable intercepts for
+         * the x2APIC MSR range and selectively disable them below.
+         */
+        enable_x2apic_msr_intercepts(msr_bitmap_l0);
+
+        if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
+                if (nested_cpu_has_apic_reg_virt(vmcs12)) {
+                        /*
+                         * L0 need not intercept reads for MSRs between 0x800
+                         * and 0x8ff, it just lets the processor take the value
+                         * from the virtual-APIC page; take those 256 bits
+                         * directly from the L1 bitmap.
+                         */
+                        for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+                                unsigned word = msr / BITS_PER_LONG;
+
+                                msr_bitmap_l0[word] = msr_bitmap_l1[word];
+                        }
+                }
 
-        if (nested_cpu_has_vid(vmcs12)) {
-                nested_vmx_disable_intercept_for_msr(
-                        msr_bitmap_l1, msr_bitmap_l0,
-                        X2APIC_MSR(APIC_EOI),
-                        MSR_TYPE_W);
                 nested_vmx_disable_intercept_for_msr(
                         msr_bitmap_l1, msr_bitmap_l0,
-                        X2APIC_MSR(APIC_SELF_IPI),
-                        MSR_TYPE_W);
+                        X2APIC_MSR(APIC_TASKPRI),
+                        MSR_TYPE_R | MSR_TYPE_W);
+
+                if (nested_cpu_has_vid(vmcs12)) {
+                        nested_vmx_disable_intercept_for_msr(
+                                msr_bitmap_l1, msr_bitmap_l0,
+                                X2APIC_MSR(APIC_EOI),
+                                MSR_TYPE_W);
+                        nested_vmx_disable_intercept_for_msr(
+                                msr_bitmap_l1, msr_bitmap_l0,
+                                X2APIC_MSR(APIC_SELF_IPI),
+                                MSR_TYPE_W);
+                }
         }
 
         if (spec_ctrl)
@@ -2857,20 +2873,27 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
                 /*
                  * If translation failed, VM entry will fail because
                  * prepare_vmcs02 set VIRTUAL_APIC_PAGE_ADDR to -1ull.
-                 * Failing the vm entry is _not_ what the processor
-                 * does but it's basically the only possibility we
-                 * have.  We could still enter the guest if CR8 load
-                 * exits are enabled, CR8 store exits are enabled, and
-                 * virtualize APIC access is disabled; in this case
-                 * the processor would never use the TPR shadow and we
-                 * could simply clear the bit from the execution
-                 * control.  But such a configuration is useless, so
-                 * let's keep the code simple.
                  */
                 if (!is_error_page(page)) {
                         vmx->nested.virtual_apic_page = page;
                         hpa = page_to_phys(vmx->nested.virtual_apic_page);
                         vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, hpa);
+                } else if (nested_cpu_has(vmcs12, CPU_BASED_CR8_LOAD_EXITING) &&
+                           nested_cpu_has(vmcs12, CPU_BASED_CR8_STORE_EXITING) &&
+                           !nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                        /*
+                         * The processor will never use the TPR shadow, simply
+                         * clear the bit from the execution control.  Such a
+                         * configuration is useless, but it happens in tests.
+                         * For any other configuration, failing the vm entry is
+                         * _not_ what the processor does but it's basically the
+                         * only possibility we have.
+                         */
+                        vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+                                        CPU_BASED_TPR_SHADOW);
+                } else {
+                        printk("bad virtual-APIC page address\n");
+                        dump_vmcs();
                 }
         }
 
@@ -3773,8 +3796,18 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)
         vmx_set_cr4(vcpu, vmcs_readl(CR4_READ_SHADOW));
 
         nested_ept_uninit_mmu_context(vcpu);
-        vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
-        __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+
+        /*
+         * This is only valid if EPT is in use, otherwise the vmcs01 GUEST_CR3
+         * points to shadow pages!  Fortunately we only get here after a WARN_ON
+         * if EPT is disabled, so a VMabort is perfectly fine.
+         */
+        if (enable_ept) {
+                vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
+                __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+        } else {
+                nested_vmx_abort(vcpu, VMX_ABORT_VMCS_CORRUPTED);
+        }
 
         /*
          * Use ept_save_pdptrs(vcpu) to load the MMU's cached PDPTRs
@@ -5722,6 +5755,14 @@ __init int nested_vmx_hardware_setup(int (*exit_handlers[])(struct kvm_vcpu *))
 {
         int i;
 
+        /*
+         * Without EPT it is not possible to restore L1's CR3 and PDPTR on
+         * VMfail, because they are not available in vmcs01.  Just always
+         * use hardware checks.
+         */
+        if (!enable_ept)
+                nested_early_check = 1;
+
         if (!cpu_has_vmx_shadow_vmcs())
                 enable_shadow_vmcs = 0;
         if (enable_shadow_vmcs) {
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index ab432a930ae8..b4e7d645275a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -5603,7 +5603,7 @@ static void vmx_dump_dtsel(char *name, uint32_t limit)
                vmcs_readl(limit + GUEST_GDTR_BASE - GUEST_GDTR_LIMIT));
 }
 
-static void dump_vmcs(void)
+void dump_vmcs(void)
 {
         u32 vmentry_ctl = vmcs_read32(VM_ENTRY_CONTROLS);
         u32 vmexit_ctl = vmcs_read32(VM_EXIT_CONTROLS);
@@ -6410,6 +6410,8 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
         if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
                 vmx_set_interrupt_shadow(vcpu, 0);
 
+        kvm_load_guest_xcr0(vcpu);
+
         if (static_cpu_has(X86_FEATURE_PKU) &&
             kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
             vcpu->arch.pkru != vmx->host_pkru)
@@ -6506,6 +6508,8 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
                         __write_pkru(vmx->host_pkru);
         }
 
+        kvm_put_guest_xcr0(vcpu);
+
         vmx->nested.nested_run_pending = 0;
         vmx->idt_vectoring_info = 0;
 
@@ -6852,6 +6856,30 @@ static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
         }
 }
 
+static bool guest_cpuid_has_pmu(struct kvm_vcpu *vcpu)
+{
+        struct kvm_cpuid_entry2 *entry;
+        union cpuid10_eax eax;
+
+        entry = kvm_find_cpuid_entry(vcpu, 0xa, 0);
+        if (!entry)
+                return false;
+
+        eax.full = entry->eax;
+        return (eax.split.version_id > 0);
+}
+
+static void nested_vmx_procbased_ctls_update(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        bool pmu_enabled = guest_cpuid_has_pmu(vcpu);
+
+        if (pmu_enabled)
+                vmx->nested.msrs.procbased_ctls_high |= CPU_BASED_RDPMC_EXITING;
+        else
+                vmx->nested.msrs.procbased_ctls_high &= ~CPU_BASED_RDPMC_EXITING;
+}
+
 static void update_intel_pt_cfg(struct kvm_vcpu *vcpu)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -6940,6 +6968,7 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
         if (nested_vmx_allowed(vcpu)) {
                 nested_vmx_cr_fixed1_bits_update(vcpu);
                 nested_vmx_entry_exit_ctls_update(vcpu);
+                nested_vmx_procbased_ctls_update(vcpu);
         }
 
         if (boot_cpu_has(X86_FEATURE_INTEL_PT) &&
@@ -7369,7 +7398,7 @@ static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
         return 0;
 }
 
-static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
+static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         int ret;
@@ -7380,9 +7409,7 @@ static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
         }
 
         if (vmx->nested.smm.guest_mode) {
-                vcpu->arch.hflags &= ~HF_SMM_MASK;
                 ret = nested_vmx_enter_non_root_mode(vcpu, false);
-                vcpu->arch.hflags |= HF_SMM_MASK;
                 if (ret)
                         return ret;
 
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index a1e00d0a2482..f879529906b4 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -517,4 +517,6 @@ static inline void decache_tsc_multiplier(struct vcpu_vmx *vmx)
         vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
 }
 
+void dump_vmcs(void);
+
 #endif /* __KVM_X86_VMX_H */
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 099b851dabaf..a0d1fc80ac5a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -800,7 +800,7 @@ void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw)
 }
 EXPORT_SYMBOL_GPL(kvm_lmsw);
 
-static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
+void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
 {
         if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE) &&
                         !vcpu->guest_xcr0_loaded) {
@@ -810,8 +810,9 @@ static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
                 vcpu->guest_xcr0_loaded = 1;
         }
 }
+EXPORT_SYMBOL_GPL(kvm_load_guest_xcr0);
 
-static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
+void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
 {
         if (vcpu->guest_xcr0_loaded) {
                 if (vcpu->arch.xcr0 != host_xcr0)
@@ -819,6 +820,7 @@ static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
                 vcpu->guest_xcr0_loaded = 0;
         }
 }
+EXPORT_SYMBOL_GPL(kvm_put_guest_xcr0);
 
 static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
 {
@@ -3093,7 +3095,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
                 break;
         case KVM_CAP_NESTED_STATE:
                 r = kvm_x86_ops->get_nested_state ?
-                        kvm_x86_ops->get_nested_state(NULL, 0, 0) : 0;
+                        kvm_x86_ops->get_nested_state(NULL, NULL, 0) : 0;
                 break;
         default:
                 break;
@@ -3528,7 +3530,7 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
         memset(&events->reserved, 0, sizeof(events->reserved));
 }
 
-static void kvm_set_hflags(struct kvm_vcpu *vcpu, unsigned emul_flags);
+static void kvm_smm_changed(struct kvm_vcpu *vcpu);
 
 static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
                                               struct kvm_vcpu_events *events)
@@ -3588,12 +3590,13 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
                 vcpu->arch.apic->sipi_vector = events->sipi_vector;
 
         if (events->flags & KVM_VCPUEVENT_VALID_SMM) {
-                u32 hflags = vcpu->arch.hflags;
-                if (events->smi.smm)
-                        hflags |= HF_SMM_MASK;
-                else
-                        hflags &= ~HF_SMM_MASK;
-                kvm_set_hflags(vcpu, hflags);
+                if (!!(vcpu->arch.hflags & HF_SMM_MASK) != events->smi.smm) {
+                        if (events->smi.smm)
+                                vcpu->arch.hflags |= HF_SMM_MASK;
+                        else
+                                vcpu->arch.hflags &= ~HF_SMM_MASK;
+                        kvm_smm_changed(vcpu);
+                }
 
                 vcpu->arch.smi_pending = events->smi.pending;
 
@@ -4270,7 +4273,7 @@ static int kvm_vm_ioctl_set_identity_map_addr(struct kvm *kvm,
 }
 
 static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
-                                          u32 kvm_nr_mmu_pages)
+                                         unsigned long kvm_nr_mmu_pages)
 {
         if (kvm_nr_mmu_pages < KVM_MIN_ALLOC_MMU_PAGES)
                 return -EINVAL;
@@ -4284,7 +4287,7 @@ static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
         return 0;
 }
 
-static int kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
+static unsigned long kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
 {
         return kvm->arch.n_max_mmu_pages;
 }
@@ -5958,12 +5961,18 @@ static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt)
 
 static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags)
 {
-        kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags);
+        emul_to_vcpu(ctxt)->arch.hflags = emul_flags;
+}
+
+static int emulator_pre_leave_smm(struct x86_emulate_ctxt *ctxt,
+                                  const char *smstate)
+{
+        return kvm_x86_ops->pre_leave_smm(emul_to_vcpu(ctxt), smstate);
 }
 
-static int emulator_pre_leave_smm(struct x86_emulate_ctxt *ctxt, u64 smbase)
+static void emulator_post_leave_smm(struct x86_emulate_ctxt *ctxt)
 {
-        return kvm_x86_ops->pre_leave_smm(emul_to_vcpu(ctxt), smbase);
+        kvm_smm_changed(emul_to_vcpu(ctxt));
 }
 
 static const struct x86_emulate_ops emulate_ops = {
@@ -6006,6 +6015,7 @@ static const struct x86_emulate_ops emulate_ops = {
         .get_hflags          = emulator_get_hflags,
         .set_hflags          = emulator_set_hflags,
         .pre_leave_smm       = emulator_pre_leave_smm,
+        .post_leave_smm      = emulator_post_leave_smm,
 };
 
 static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
@@ -6247,16 +6257,6 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu)
         kvm_mmu_reset_context(vcpu);
 }
 
-static void kvm_set_hflags(struct kvm_vcpu *vcpu, unsigned emul_flags)
-{
-        unsigned changed = vcpu->arch.hflags ^ emul_flags;
-
-        vcpu->arch.hflags = emul_flags;
-
-        if (changed & HF_SMM_MASK)
-                kvm_smm_changed(vcpu);
-}
-
 static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
                                 unsigned long *db)
 {
@@ -7441,9 +7441,9 @@ static void enter_smm_save_state_32(struct kvm_vcpu *vcpu, char *buf)
         put_smstate(u32, buf, 0x7ef8, vcpu->arch.smbase);
 }
 
+#ifdef CONFIG_X86_64
 static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
 {
-#ifdef CONFIG_X86_64
         struct desc_ptr dt;
         struct kvm_segment seg;
         unsigned long val;
@@ -7493,10 +7493,8 @@ static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
 
         for (i = 0; i < 6; i++)
                 enter_smm_save_seg_64(vcpu, buf, i);
-#else
-        WARN_ON_ONCE(1);
-#endif
 }
+#endif
 
 static void enter_smm(struct kvm_vcpu *vcpu)
 {
@@ -7507,9 +7505,11 @@ static void enter_smm(struct kvm_vcpu *vcpu)
 
         trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
         memset(buf, 0, 512);
+#ifdef CONFIG_X86_64
         if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
                 enter_smm_save_state_64(vcpu, buf);
         else
+#endif
                 enter_smm_save_state_32(vcpu, buf);
 
         /*
@@ -7567,8 +7567,10 @@ static void enter_smm(struct kvm_vcpu *vcpu)
         kvm_set_segment(vcpu, &ds, VCPU_SREG_GS);
         kvm_set_segment(vcpu, &ds, VCPU_SREG_SS);
 
+#ifdef CONFIG_X86_64
         if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
                 kvm_x86_ops->set_efer(vcpu, 0);
+#endif
 
         kvm_update_cpuid(vcpu);
         kvm_mmu_reset_context(vcpu);
@@ -7865,8 +7867,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
                 goto cancel_injection;
         }
 
-        kvm_load_guest_xcr0(vcpu);
-
         if (req_immediate_exit) {
                 kvm_make_request(KVM_REQ_EVENT, vcpu);
                 kvm_x86_ops->request_immediate_exit(vcpu);
@@ -7919,8 +7919,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
         vcpu->mode = OUTSIDE_GUEST_MODE;
         smp_wmb();
 
-        kvm_put_guest_xcr0(vcpu);
-
         kvm_before_interrupt(vcpu);
         kvm_x86_ops->handle_external_intr(vcpu);
         kvm_after_interrupt(vcpu);
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 28406aa1136d..aedc5d0d4989 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -347,4 +347,6 @@ static inline void kvm_after_interrupt(struct kvm_vcpu *vcpu)
         __this_cpu_write(current_vcpu, NULL);
 }
 
+void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu);
+void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu);
 #endif
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index ee8f8ab46941..c0309ea9abee 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
 #endif
         /* Account the WX pages */
         st->wx_pages += npages;
-        WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
+        WARN_ONCE(__supported_pte_mask & _PAGE_NX,
+                  "x86/mm: Found insecure W+X mapping at address %pS\n",
                   (void *)st->start_address);
 }
 
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index f905a2371080..8dacdb96899e 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -5,6 +5,7 @@
 #include <linux/memblock.h>
 #include <linux/swapfile.h>
 #include <linux/swapops.h>
+#include <linux/kmemleak.h>
 
 #include <asm/set_memory.h>
 #include <asm/e820/api.h>
@@ -766,6 +767,11 @@ void free_init_pages(const char *what, unsigned long begin, unsigned long end)
         if (debug_pagealloc_enabled()) {
                 pr_info("debug: unmapping init [mem %#010lx-%#010lx]\n",
                         begin, end - 1);
+                /*
+                 * Inform kmemleak about the hole in the memory since the
+                 * corresponding pages will be unmapped.
+                 */
+                kmemleak_free_part((void *)begin, end - begin);
                 set_memory_np(begin, (end - begin) >> PAGE_SHIFT);
         } else {
                 /*
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 0029604af8a4..dd73d5d74393 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
         pte = early_ioremap_pte(addr);
 
         /* Sanitize 'prot' against any unsupported bits: */
-        pgprot_val(flags) &= __default_kernel_pte_mask;
+        pgprot_val(flags) &= __supported_pte_mask;
 
         if (pgprot_val(flags))
                 set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 3f452ffed7e9..d669c5e797e0 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -94,7 +94,7 @@ void __init kernel_randomize_memory(void)
         if (!kaslr_memory_enabled())
                 return;
 
-        kaslr_regions[0].size_tb = 1 << (__PHYSICAL_MASK_SHIFT - TB_SHIFT);
+        kaslr_regions[0].size_tb = 1 << (MAX_PHYSMEM_BITS - TB_SHIFT);
         kaslr_regions[1].size_tb = VMALLOC_SIZE_TB;
 
         /*
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index bc4bc7b2f075..487b8474c01c 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -728,7 +728,7 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
 {
         int cpu;
 
-        struct flush_tlb_info info __aligned(SMP_CACHE_BYTES) = {
+        struct flush_tlb_info info = {
                 .mm = mm,
                 .stride_shift = stride_shift,
                 .freed_tables = freed_tables,
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index f7dd895b2353..0c14018d1c26 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -187,15 +187,18 @@ struct thread_struct {
 
 /* Clearing a0 terminates the backtrace. */
 #define start_thread(regs, new_pc, new_sp) \
-        memset(regs, 0, sizeof(*regs)); \
-        regs->pc = new_pc; \
-        regs->ps = USER_PS_VALUE; \
-        regs->areg[1] = new_sp; \
-        regs->areg[0] = 0; \
-        regs->wmask = 1; \
-        regs->depc = 0; \
-        regs->windowbase = 0; \
-        regs->windowstart = 1;
+        do { \
+                memset((regs), 0, sizeof(*(regs))); \
+                (regs)->pc = (new_pc); \
+                (regs)->ps = USER_PS_VALUE; \
+                (regs)->areg[1] = (new_sp); \
+                (regs)->areg[0] = 0; \
+                (regs)->wmask = 1; \
+                (regs)->depc = 0; \
+                (regs)->windowbase = 0; \
+                (regs)->windowstart = 1; \
+                (regs)->syscall = NO_SYSCALL; \
+        } while (0)
 
 /* Forward declaration */
 struct task_struct;
diff --git a/arch/xtensa/include/asm/syscall.h b/arch/xtensa/include/asm/syscall.h
index a168bf81c7f4..91dc06d58060 100644
--- a/arch/xtensa/include/asm/syscall.h
+++ b/arch/xtensa/include/asm/syscall.h
@@ -59,45 +59,24 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         static const unsigned int reg[] = XTENSA_SYSCALL_ARGUMENT_REGS;
-        unsigned int j;
+        unsigned int i;
 
-        if (n == 0)
-                return;
-
-        WARN_ON_ONCE(i + n > SYSCALL_MAX_ARGS);
-
-        for (j = 0; j < n; ++j) {
-                if (i + j < SYSCALL_MAX_ARGS)
-                        args[j] = regs->areg[reg[i + j]];
-                else
-                        args[j] = 0;
-        }
+        for (i = 0; i < 6; ++i)
+                args[i] = regs->areg[reg[i]];
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
         static const unsigned int reg[] = XTENSA_SYSCALL_ARGUMENT_REGS;
-        unsigned int j;
-
-        if (n == 0)
-                return;
-
-        if (WARN_ON_ONCE(i + n > SYSCALL_MAX_ARGS)) {
-                if (i < SYSCALL_MAX_ARGS)
-                        n = SYSCALL_MAX_ARGS - i;
-                else
-                        return;
-        }
+        unsigned int i;
 
-        for (j = 0; j < n; ++j)
-                regs->areg[reg[i + j]] = args[j];
+        for (i = 0; i < 6; ++i)
+                regs->areg[reg[i]] = args[i];
 }
 
 asmlinkage long xtensa_rt_sigreturn(struct pt_regs*);
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index e50f5124dc6f..e54af8b7e0f8 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1860,6 +1860,8 @@ ENTRY(system_call)
         l32i    a7, a2, PT_SYSCALL
 
 1:
+        s32i    a7, a1, 4
+
         /* syscall = sys_call_table[syscall_nr] */
 
         movi    a4, sys_call_table
@@ -1893,8 +1895,12 @@ ENTRY(system_call)
         retw
 
 1:
+        l32i    a4, a1, 4
+        l32i    a3, a2, PT_SYSCALL
+        s32i    a4, a2, PT_SYSCALL
         mov     a6, a2
         call4   do_syscall_trace_leave
+        s32i    a3, a2, PT_SYSCALL
         retw
 
 ENDPROC(system_call)
diff --git a/arch/xtensa/kernel/stacktrace.c b/arch/xtensa/kernel/stacktrace.c
index 174c11f13bba..b9f82510c650 100644
--- a/arch/xtensa/kernel/stacktrace.c
+++ b/arch/xtensa/kernel/stacktrace.c
@@ -253,10 +253,14 @@ static int return_address_cb(struct stackframe *frame, void *data)
         return 1;
 }
 
+/*
+ * level == 0 is for the return address from the caller of this function,
+ * not from this function itself.
+ */
 unsigned long return_address(unsigned level)
 {
         struct return_addr_data r = {
-                .skip = level + 1,
+                .skip = level,
         };
         walk_stackframe(stack_pointer(NULL), return_address_cb, &r);
         return r.addr;
diff --git a/arch/xtensa/kernel/syscalls/syscall.tbl b/arch/xtensa/kernel/syscalls/syscall.tbl
index 6af49929de85..30084eaf8422 100644
--- a/arch/xtensa/kernel/syscalls/syscall.tbl
+++ b/arch/xtensa/kernel/syscalls/syscall.tbl
@@ -394,3 +394,7 @@
 421     common  rt_sigtimedwait_time64          sys_rt_sigtimedwait
 422     common  futex_time64                    sys_futex
 423     common  sched_rr_get_interval_time64    sys_sched_rr_get_interval
+424     common  pidfd_send_signal               sys_pidfd_send_signal
+425     common  io_uring_setup                  sys_io_uring_setup
+426     common  io_uring_enter                  sys_io_uring_enter
+427     common  io_uring_register               sys_io_uring_register
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index 2fb7d1172228..03678c4afc39 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -33,7 +33,7 @@ static void * __init init_pmd(unsigned long vaddr, unsigned long n_pages)
 
         pte = memblock_alloc_low(n_pages * sizeof(pte_t), PAGE_SIZE);
         if (!pte)
-                panic("%s: Failed to allocate %zu bytes align=%lx\n",
+                panic("%s: Failed to allocate %lu bytes align=%lx\n",
                       __func__, n_pages * sizeof(pte_t), PAGE_SIZE);
 
         for (i = 0; i < n_pages; ++i)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 4c592496a16a..5ba1e0d841b4 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -674,7 +674,7 @@ static bool bfq_symmetric_scenario(struct bfq_data *bfqd)
          * at least two nodes.
          */
         return !(varied_queue_weights || multiple_classes_busy
-#ifdef BFQ_GROUP_IOSCHED_ENABLED
+#ifdef CONFIG_BFQ_GROUP_IOSCHED
                || bfqd->num_groups_with_pending_reqs > 0
 #endif
                 );
@@ -2822,7 +2822,7 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq)
         bfq_remove_request(q, rq);
 }
 
-static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+static bool __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
 {
         /*
          * If this bfqq is shared between multiple processes, check
@@ -2855,9 +2855,11 @@ static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
         /*
          * All in-service entities must have been properly deactivated
          * or requeued before executing the next function, which
-         * resets all in-service entites as no more in service.
+         * resets all in-service entities as no more in service. This
+         * may cause bfqq to be freed. If this happens, the next
+         * function returns true.
          */
-        __bfq_bfqd_reset_in_service(bfqd);
+        return __bfq_bfqd_reset_in_service(bfqd);
 }
 
 /**
@@ -3262,7 +3264,6 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
         bool slow;
         unsigned long delta = 0;
         struct bfq_entity *entity = &bfqq->entity;
-        int ref;
 
         /*
          * Check whether the process is slow (see bfq_bfqq_is_slow).
@@ -3347,10 +3348,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
          * reason.
          */
         __bfq_bfqq_recalc_budget(bfqd, bfqq, reason);
-        ref = bfqq->ref;
-        __bfq_bfqq_expire(bfqd, bfqq);
-
-        if (ref == 1) /* bfqq is gone, no more actions on it */
+        if (__bfq_bfqq_expire(bfqd, bfqq))
+                /* bfqq is gone, no more actions on it */
                 return;
 
         bfqq->injected_service = 0;
@@ -5397,7 +5396,7 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
         return min_shallow;
 }
 
-static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
+static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx)
 {
         struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
         struct blk_mq_tags *tags = hctx->sched_tags;
@@ -5405,6 +5404,11 @@ static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
 
         min_shallow = bfq_update_depths(bfqd, &tags->bitmap_tags);
         sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, min_shallow);
+}
+
+static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
+{
+        bfq_depth_updated(hctx);
         return 0;
 }
 
@@ -5827,6 +5831,7 @@ static struct elevator_type iosched_bfq_mq = {
                 .requests_merged        = bfq_requests_merged,
                 .request_merged         = bfq_request_merged,
                 .has_work               = bfq_has_work,
+                .depth_updated          = bfq_depth_updated,
                 .init_hctx              = bfq_init_hctx,
                 .init_sched             = bfq_init_queue,
                 .exit_sched             = bfq_exit_queue,
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index 062e1c4787f4..86394e503ca9 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -995,7 +995,7 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity,
                              bool ins_into_idle_tree);
 bool next_queue_may_preempt(struct bfq_data *bfqd);
 struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd);
-void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd);
+bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd);
 void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                          bool ins_into_idle_tree, bool expiration);
 void bfq_activate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq);
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 63311d1ff1ed..ae4d000ac0af 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1012,7 +1012,7 @@ static void __bfq_activate_entity(struct bfq_entity *entity,
                 entity->on_st = true;
         }
 
-#ifdef BFQ_GROUP_IOSCHED_ENABLED
+#ifdef CONFIG_BFQ_GROUP_IOSCHED
         if (!bfq_entity_to_bfqq(entity)) { /* bfq_group */
                 struct bfq_group *bfqg =
                         container_of(entity, struct bfq_group, entity);
@@ -1605,7 +1605,8 @@ struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
         return bfqq;
 }
 
-void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
+/* returns true if the in-service queue gets freed */
+bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
 {
         struct bfq_queue *in_serv_bfqq = bfqd->in_service_queue;
         struct bfq_entity *in_serv_entity = &in_serv_bfqq->entity;
@@ -1629,8 +1630,20 @@ void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
          * service tree either, then release the service reference to
          * the queue it represents (taken with bfq_get_entity).
          */
-        if (!in_serv_entity->on_st)
+        if (!in_serv_entity->on_st) {
+                /*
+                 * If no process is referencing in_serv_bfqq any
+                 * longer, then the service reference may be the only
+                 * reference to the queue. If this is the case, then
+                 * bfqq gets freed here.
+                 */
+                int ref = in_serv_bfqq->ref;
                 bfq_put_queue(in_serv_bfqq);
+                if (ref == 1)
+                        return true;
+        }
+
+        return false;
 }
 
 void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
diff --git a/block/bio.c b/block/bio.c
index b64cedc7f87c..716510ecd7ff 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1298,8 +1298,11 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                         }
                 }
 
-                if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes)
+                if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) {
+                        if (!map_data)
+                                __free_page(page);
                         break;
+                }
 
                 len -= bytes;
                 offset = 0;
diff --git a/block/blk-core.c b/block/blk-core.c
index 4673ebe42255..a55389ba8779 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1245,8 +1245,6 @@ static int blk_cloned_rq_check_limits(struct request_queue *q,
  */
 blk_status_t blk_insert_cloned_request(struct request_queue *q, struct request *rq)
 {
-        blk_qc_t unused;
-
         if (blk_cloned_rq_check_limits(q, rq))
                 return BLK_STS_IOERR;
 
@@ -1262,7 +1260,7 @@ blk_status_t blk_insert_cloned_request(struct request_queue *q, struct request *
          * bypass a potential scheduler on the bottom device for
          * insert.
          */
-        return blk_mq_try_issue_directly(rq->mq_hctx, rq, &unused, true, true);
+        return blk_mq_request_issue_directly(rq, true);
 }
 EXPORT_SYMBOL_GPL(blk_insert_cloned_request);
 
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 40905539afed..aa6bc5c02643 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -423,10 +423,12 @@ void blk_mq_sched_insert_requests(struct blk_mq_hw_ctx *hctx,
                  * busy in case of 'none' scheduler, and this way may save
                  * us one extra enqueue & dequeue to sw queue.
                  */
-                if (!hctx->dispatch_busy && !e && !run_queue_async)
+                if (!hctx->dispatch_busy && !e && !run_queue_async) {
                         blk_mq_try_issue_list_directly(hctx, list);
-                else
-                        blk_mq_insert_requests(hctx, ctx, list);
+                        if (list_empty(list))
+                                return;
+                }
+                blk_mq_insert_requests(hctx, ctx, list);
         }
 
         blk_mq_run_hw_queue(hctx, run_queue_async);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3ff3d7b49969..fc60ed7e940e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -654,6 +654,13 @@ bool blk_mq_complete_request(struct request *rq)
 }
 EXPORT_SYMBOL(blk_mq_complete_request);
 
+void blk_mq_complete_request_sync(struct request *rq)
+{
+        WRITE_ONCE(rq->state, MQ_RQ_COMPLETE);
+        rq->q->mq_ops->complete(rq);
+}
+EXPORT_SYMBOL_GPL(blk_mq_complete_request_sync);
+
 int blk_mq_request_started(struct request *rq)
 {
         return blk_mq_rq_state(rq) != MQ_RQ_IDLE;
@@ -1711,11 +1718,12 @@ void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule)
         unsigned int depth;
 
         list_splice_init(&plug->mq_list, &list);
-        plug->rq_count = 0;
 
         if (plug->rq_count > 2 && plug->multiple_queues)
                 list_sort(NULL, &list, plug_rq_cmp);
 
+        plug->rq_count = 0;
+
         this_q = NULL;
         this_hctx = NULL;
         this_ctx = NULL;
@@ -1800,74 +1808,76 @@ static blk_status_t __blk_mq_issue_directly(struct blk_mq_hw_ctx *hctx,
         return ret;
 }
 
-blk_status_t blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+static blk_status_t __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                                                 struct request *rq,
                                                 blk_qc_t *cookie,
-                                                bool bypass, bool last)
+                                                bool bypass_insert, bool last)
 {
         struct request_queue *q = rq->q;
         bool run_queue = true;
-        blk_status_t ret = BLK_STS_RESOURCE;
-        int srcu_idx;
-        bool force = false;
 
-        hctx_lock(hctx, &srcu_idx);
         /*
-         * hctx_lock is needed before checking quiesced flag.
+         * RCU or SRCU read lock is needed before checking quiesced flag.
          *
-         * When queue is stopped or quiesced, ignore 'bypass', insert
-         * and return BLK_STS_OK to caller, and avoid driver to try to
-         * dispatch again.
+         * When queue is stopped or quiesced, ignore 'bypass_insert' from
+         * blk_mq_request_issue_directly(), and return BLK_STS_OK to caller,
+         * and avoid driver to try to dispatch again.
          */
-        if (unlikely(blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(q))) {
+        if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(q)) {
                 run_queue = false;
-                bypass = false;
-                goto out_unlock;
+                bypass_insert = false;
+                goto insert;
         }
 
-        if (unlikely(q->elevator && !bypass))
-                goto out_unlock;
+        if (q->elevator && !bypass_insert)
+                goto insert;
 
         if (!blk_mq_get_dispatch_budget(hctx))
-                goto out_unlock;
+                goto insert;
 
         if (!blk_mq_get_driver_tag(rq)) {
                 blk_mq_put_dispatch_budget(hctx);
-                goto out_unlock;
+                goto insert;
         }
 
-        /*
-         * Always add a request that has been through
-         *.queue_rq() to the hardware dispatch list.
-         */
-        force = true;
-        ret = __blk_mq_issue_directly(hctx, rq, cookie, last);
-out_unlock:
+        return __blk_mq_issue_directly(hctx, rq, cookie, last);
+insert:
+        if (bypass_insert)
+                return BLK_STS_RESOURCE;
+
+        blk_mq_request_bypass_insert(rq, run_queue);
+        return BLK_STS_OK;
+}
+
+static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+                struct request *rq, blk_qc_t *cookie)
+{
+        blk_status_t ret;
+        int srcu_idx;
+
+        might_sleep_if(hctx->flags & BLK_MQ_F_BLOCKING);
+
+        hctx_lock(hctx, &srcu_idx);
+
+        ret = __blk_mq_try_issue_directly(hctx, rq, cookie, false, true);
+        if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
+                blk_mq_request_bypass_insert(rq, true);
+        else if (ret != BLK_STS_OK)
+                blk_mq_end_request(rq, ret);
+
+        hctx_unlock(hctx, srcu_idx);
+}
+
+blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last)
+{
+        blk_status_t ret;
+        int srcu_idx;
+        blk_qc_t unused_cookie;
+        struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
+
+        hctx_lock(hctx, &srcu_idx);
+        ret = __blk_mq_try_issue_directly(hctx, rq, &unused_cookie, true, last);
         hctx_unlock(hctx, srcu_idx);
-        switch (ret) {
-        case BLK_STS_OK:
-                break;
-        case BLK_STS_DEV_RESOURCE:
-        case BLK_STS_RESOURCE:
-                if (force) {
-                        blk_mq_request_bypass_insert(rq, run_queue);
-                        /*
-                         * We have to return BLK_STS_OK for the DM
-                         * to avoid livelock. Otherwise, we return
-                         * the real result to indicate whether the
-                         * request is direct-issued successfully.
-                         */
-                        ret = bypass ? BLK_STS_OK : ret;
-                } else if (!bypass) {
-                        blk_mq_sched_insert_request(rq, false,
-                                                    run_queue, false);
-                }
-                break;
-        default:
-                if (!bypass)
-                        blk_mq_end_request(rq, ret);
-                break;
-        }
 
         return ret;
 }
@@ -1875,20 +1885,22 @@ out_unlock:
 void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
                 struct list_head *list)
 {
-        blk_qc_t unused;
-        blk_status_t ret = BLK_STS_OK;
-
         while (!list_empty(list)) {
+                blk_status_t ret;
                 struct request *rq = list_first_entry(list, struct request,
                                 queuelist);
 
                 list_del_init(&rq->queuelist);
-                if (ret == BLK_STS_OK)
-                        ret = blk_mq_try_issue_directly(hctx, rq, &unused,
-                                                        false,
+                ret = blk_mq_request_issue_directly(rq, list_empty(list));
+                if (ret != BLK_STS_OK) {
+                        if (ret == BLK_STS_RESOURCE ||
+                                        ret == BLK_STS_DEV_RESOURCE) {
+                                blk_mq_request_bypass_insert(rq,
                                                         list_empty(list));
-                else
-                        blk_mq_sched_insert_request(rq, false, true, false);
+                                break;
+                        }
+                        blk_mq_end_request(rq, ret);
+                }
         }
 
         /*
@@ -1896,7 +1908,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
          * the driver there was more coming, but that turned out to
          * be a lie.
          */
-        if (ret != BLK_STS_OK && hctx->queue->mq_ops->commit_rqs)
+        if (!list_empty(list) && hctx->queue->mq_ops->commit_rqs)
                 hctx->queue->mq_ops->commit_rqs(hctx);
 }
 
@@ -2003,19 +2015,21 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
                         plug->rq_count--;
                 }
                 blk_add_rq_to_plug(plug, rq);
+                trace_block_plug(q);
 
                 blk_mq_put_ctx(data.ctx);
 
                 if (same_queue_rq) {
                         data.hctx = same_queue_rq->mq_hctx;
+                        trace_block_unplug(q, 1, true);
                         blk_mq_try_issue_directly(data.hctx, same_queue_rq,
-                                        &cookie, false, true);
+                                        &cookie);
                 }
         } else if ((q->nr_hw_queues > 1 && is_sync) || (!q->elevator &&
                         !data.hctx->dispatch_busy)) {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
-                blk_mq_try_issue_directly(data.hctx, rq, &cookie, false, true);
+                blk_mq_try_issue_directly(data.hctx, rq, &cookie);
         } else {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
@@ -2332,7 +2346,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
         return 0;
 
  free_fq:
-        kfree(hctx->fq);
+        blk_free_flush_queue(hctx->fq);
  exit_hctx:
         if (set->ops->exit_hctx)
                 set->ops->exit_hctx(hctx, hctx_idx);
@@ -3121,6 +3135,8 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
                 }
                 if (ret)
                         break;
+                if (q->elevator && q->elevator->type->ops.depth_updated)
+                        q->elevator->type->ops.depth_updated(hctx);
         }
 
         if (!ret)
diff --git a/block/blk-mq.h b/block/blk-mq.h
index d704fc7766f4..423ea88ab6fb 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -70,10 +70,8 @@ void blk_mq_request_bypass_insert(struct request *rq, bool run_queue);
 void blk_mq_insert_requests(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
                                 struct list_head *list);
 
-blk_status_t blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
-                                                struct request *rq,
-                                                blk_qc_t *cookie,
-                                                bool bypass, bool last);
+/* Used by blk_insert_cloned_request() to issue request directly */
+blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last);
 void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
                                     struct list_head *list);
 
diff --git a/crypto/lrw.c b/crypto/lrw.c
index 0430ccd08728..08a0e458bc3e 100644
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -212,8 +212,12 @@ static void crypt_done(struct crypto_async_request *areq, int err)
 {
         struct skcipher_request *req = areq->data;
 
-        if (!err)
+        if (!err) {
+                struct rctx *rctx = skcipher_request_ctx(req);
+
+                rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
                 err = xor_tweak_post(req);
+        }
 
         skcipher_request_complete(req, err);
 }
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index f267633cf13a..d18a37629f05 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -5634,7 +5634,49 @@ static const struct hash_testvec poly1305_tv_template[] = {
                 .psize          = 80,
                 .digest         = "\x13\x00\x00\x00\x00\x00\x00\x00"
                                   "\x00\x00\x00\x00\x00\x00\x00\x00",
-        },
+        }, { /* Regression test for overflow in AVX2 implementation */
+                .plaintext      = "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff\xff\xff\xff\xff"
+                                  "\xff\xff\xff\xff",
+                .psize          = 300,
+                .digest         = "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8"
+                                  "\x78\xe5\x87\xcc\x2d\x5a\x22\xe1",
+        }
 };
 
 /* NHPoly1305 test vectors from https://github.com/google/adiantum */
diff --git a/crypto/xts.c b/crypto/xts.c
index 847f54f76789..2f948328cabb 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -137,8 +137,12 @@ static void crypt_done(struct crypto_async_request *areq, int err)
 {
         struct skcipher_request *req = areq->data;
 
-        if (!err)
+        if (!err) {
+                struct rctx *rctx = skcipher_request_ctx(req);
+
+                rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
                 err = xor_tweak_post(req);
+        }
 
         skcipher_request_complete(req, err);
 }
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index 62d3aa74277b..5e9d7348c16f 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -81,8 +81,12 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
 
         ACPI_FUNCTION_TRACE(ev_enable_gpe);
 
-        /* Enable the requested GPE */
+        /* Clear the GPE status */
+        status = acpi_hw_clear_gpe(gpe_event_info);
+        if (ACPI_FAILURE(status))
+                return_ACPI_STATUS(status);
 
+        /* Enable the requested GPE */
         status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/nsobject.c b/drivers/acpi/acpica/nsobject.c
index 8638f43cfc3d..79d86da1c892 100644
--- a/drivers/acpi/acpica/nsobject.c
+++ b/drivers/acpi/acpica/nsobject.c
@@ -186,6 +186,10 @@ void acpi_ns_detach_object(struct acpi_namespace_node *node)
                 }
         }
 
+        if (obj_desc->common.type == ACPI_TYPE_REGION) {
+                acpi_ut_remove_address_range(obj_desc->region.space_id, node);
+        }
+
         /* Clear the Node entry in all cases */
 
         node->object = NULL;
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 5a389a4f4f65..f1ed0befe303 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -567,6 +567,12 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                 goto out;
         }
 
+        dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
+                        cmd_name, out_obj->buffer.length);
+        print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
+                        out_obj->buffer.pointer,
+                        min_t(u32, 128, out_obj->buffer.length), true);
+
         if (call_pkg) {
                 call_pkg->nd_fw_size = out_obj->buffer.length;
                 memcpy(call_pkg->nd_payload + call_pkg->nd_size_in,
@@ -585,12 +591,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                 return 0;
         }
 
-        dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
-                        cmd_name, out_obj->buffer.length);
-        print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
-                        out_obj->buffer.pointer,
-                        min_t(u32, 128, out_obj->buffer.length), true);
-
         for (i = 0, offset = 0; i < desc->out_num; i++) {
                 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
                                 (u32 *) out_obj->buffer.pointer,
diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
index f70de71f79d6..cddd0fcf622c 100644
--- a/drivers/acpi/nfit/intel.c
+++ b/drivers/acpi/nfit/intel.c
@@ -122,9 +122,8 @@ static int intel_security_change_key(struct nvdimm *nvdimm,
         if (!test_bit(cmd, &nfit_mem->dsm_mask))
                 return -ENOTTY;
 
-        if (old_data)
-                memcpy(nd_cmd.cmd.old_pass, old_data->data,
-                                sizeof(nd_cmd.cmd.old_pass));
+        memcpy(nd_cmd.cmd.old_pass, old_data->data,
+                        sizeof(nd_cmd.cmd.old_pass));
         memcpy(nd_cmd.cmd.new_pass, new_data->data,
                         sizeof(nd_cmd.cmd.new_pass));
         rc = nvdimm_ctl(nvdimm, ND_CMD_CALL, &nd_cmd, sizeof(nd_cmd), NULL);
@@ -336,9 +335,8 @@ static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
 
         /* flush all cache before we erase DIMM */
         nvdimm_invalidate_cache();
-        if (nkey)
-                memcpy(nd_cmd.cmd.passphrase, nkey->data,
-                                sizeof(nd_cmd.cmd.passphrase));
+        memcpy(nd_cmd.cmd.passphrase, nkey->data,
+                        sizeof(nd_cmd.cmd.passphrase));
         rc = nvdimm_ctl(nvdimm, ND_CMD_CALL, &nd_cmd, sizeof(nd_cmd), NULL);
         if (rc < 0)
                 return rc;
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 11e1663bdc4d..b2c06da4f62e 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1646,7 +1646,7 @@ static irqreturn_t fs_irq (int irq, void *dev_id)
         }
 
         if (status & ISR_TBRQ_W) {
-                fs_dprintk (FS_DEBUG_IRQ, "Data tramsitted!\n");
+                fs_dprintk (FS_DEBUG_IRQ, "Data transmitted!\n");
                 process_txdone_queue (dev, &dev->tx_relq);
         }
 
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index cb8347500ce2..e49028a60429 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -506,7 +506,7 @@ static ssize_t probe_store(struct device *dev, struct device_attribute *attr,
 
         ret = lock_device_hotplug_sysfs();
         if (ret)
-                goto out;
+                return ret;
 
         nid = memory_add_physaddr_to_nid(phys_addr);
         ret = __add_memory(nid, phys_addr,
diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 417a9f15c116..d7ac09c092f2 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -1748,6 +1748,11 @@ static int __init null_init(void)
                 return -EINVAL;
         }
 
+        if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) {
+                pr_err("null_blk: invalid home_node value\n");
+                g_home_node = NUMA_NO_NODE;
+        }
+
         if (g_queue_mode == NULL_Q_RQ) {
                 pr_err("null_blk: legacy IO path no longer available\n");
                 return -EINVAL;
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index 377a694dc228..6d415b20fb70 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -314,6 +314,7 @@ static void pcd_init_units(void)
                 disk->queue = blk_mq_init_sq_queue(&cd->tag_set, &pcd_mq_ops,
                                                    1, BLK_MQ_F_SHOULD_MERGE);
                 if (IS_ERR(disk->queue)) {
+                        put_disk(disk);
                         disk->queue = NULL;
                         continue;
                 }
@@ -750,6 +751,8 @@ static int pcd_detect(void)
 
         printk("%s: No CD-ROM drive found\n", name);
         for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                if (!cd->disk)
+                        continue;
                 blk_cleanup_queue(cd->disk->queue);
                 cd->disk->queue = NULL;
                 blk_mq_free_tag_set(&cd->tag_set);
@@ -1010,8 +1013,14 @@ static int __init pcd_init(void)
         pcd_probe_capabilities();
 
         if (register_blkdev(major, name)) {
-                for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++)
+                for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                        if (!cd->disk)
+                                continue;
+
+                        blk_cleanup_queue(cd->disk->queue);
+                        blk_mq_free_tag_set(&cd->tag_set);
                         put_disk(cd->disk);
+                }
                 return -EBUSY;
         }
 
@@ -1032,6 +1041,9 @@ static void __exit pcd_exit(void)
         int unit;
 
         for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                if (!cd->disk)
+                        continue;
+
                 if (cd->present) {
                         del_gendisk(cd->disk);
                         pi_release(cd->pi);
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index 103b617cdc31..35e6e271b219 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -762,6 +762,8 @@ static int pf_detect(void)
 
         printk("%s: No ATAPI disk detected\n", name);
         for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                if (!pf->disk)
+                        continue;
                 blk_cleanup_queue(pf->disk->queue);
                 pf->disk->queue = NULL;
                 blk_mq_free_tag_set(&pf->tag_set);
@@ -1029,8 +1031,13 @@ static int __init pf_init(void)
         pf_busy = 0;
 
         if (register_blkdev(major, name)) {
-                for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++)
+                for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                        if (!pf->disk)
+                                continue;
+                        blk_cleanup_queue(pf->disk->queue);
+                        blk_mq_free_tag_set(&pf->tag_set);
                         put_disk(pf->disk);
+                }
                 return -EBUSY;
         }
 
@@ -1051,6 +1058,9 @@ static void __exit pf_exit(void)
         int unit;
         unregister_blkdev(major, name);
         for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                if (!pf->disk)
+                        continue;
+
                 if (pf->present)
                         del_gendisk(pf->disk);
 
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 4bc083b7c9b5..2a7ca4a1e6f7 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -513,6 +513,8 @@ static int init_vq(struct virtio_blk *vblk)
         if (err)
                 num_vqs = 1;
 
+        num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
+
         vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
         if (!vblk->vqs)
                 return -ENOMEM;
diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
index 87ccef4bd69e..32a21b8d1d85 100644
--- a/drivers/block/xsysace.c
+++ b/drivers/block/xsysace.c
@@ -1090,6 +1090,8 @@ static int ace_setup(struct ace_device *ace)
         return 0;
 
 err_read:
+        /* prevent double queue cleanup */
+        ace->gd->queue = NULL;
         put_disk(ace->gd);
 err_alloc_disk:
         blk_cleanup_queue(ace->queue);
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 399cad7daae7..d58a359a6622 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -774,18 +774,18 @@ struct zram_work {
         struct zram *zram;
         unsigned long entry;
         struct bio *bio;
+        struct bio_vec bvec;
 };
 
 #if PAGE_SIZE != 4096
 static void zram_sync_read(struct work_struct *work)
 {
-        struct bio_vec bvec;
         struct zram_work *zw = container_of(work, struct zram_work, work);
         struct zram *zram = zw->zram;
         unsigned long entry = zw->entry;
         struct bio *bio = zw->bio;
 
-        read_from_bdev_async(zram, &bvec, entry, bio);
+        read_from_bdev_async(zram, &zw->bvec, entry, bio);
 }
 
 /*
@@ -798,6 +798,7 @@ static int read_from_bdev_sync(struct zram *zram, struct bio_vec *bvec,
 {
         struct zram_work work;
 
+        work.bvec = *bvec;
         work.zram = zram;
         work.entry = entry;
         work.bio = bio;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ded198328f21..7db48ae65cd2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2942,6 +2942,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
                 return 0;
         }
 
+        irq_set_status_flags(irq, IRQ_NOAUTOEN);
         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
                                0, "OOB Wake-on-BT", data);
         if (ret) {
@@ -2956,7 +2957,6 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
         }
 
         data->oob_wake_irq = irq;
-        disable_irq(irq);
         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
         return 0;
 }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 72866a004f07..466ebd84ad17 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -348,7 +348,7 @@ config XILINX_HWICAP
 
 config R3964
         tristate "Siemens R3964 line discipline"
-        depends on TTY
+        depends on TTY && BROKEN
         ---help---
           This driver allows synchronous communication with devices using the
           Siemens R3964 packet protocol. Unless you are dealing with special
diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
index ff0b199be472..f2411468f33f 100644
--- a/drivers/char/ipmi/ipmi_dmi.c
+++ b/drivers/char/ipmi/ipmi_dmi.c
@@ -66,7 +66,6 @@ static void __init dmi_add_platform_ipmi(unsigned long base_addr,
                 return;
         }
 
-        memset(&p, 0, sizeof(p));
         p.addr = base_addr;
         p.space = space;
         p.regspacing = offset;
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index e8ba67834746..00bf4b17edbf 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -214,6 +214,9 @@ struct ipmi_user {
 
         /* Does this interface receive IPMI events? */
         bool gets_events;
+
+        /* Free must run in process context for RCU cleanup. */
+        struct work_struct remove_work;
 };
 
 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)
@@ -1157,6 +1160,15 @@ static int intf_err_seq(struct ipmi_smi *intf,
         return rv;
 }
 
+static void free_user_work(struct work_struct *work)
+{
+        struct ipmi_user *user = container_of(work, struct ipmi_user,
+                                              remove_work);
+
+        cleanup_srcu_struct(&user->release_barrier);
+        kfree(user);
+}
+
 int ipmi_create_user(unsigned int          if_num,
                      const struct ipmi_user_hndl *handler,
                      void                  *handler_data,
@@ -1200,6 +1212,8 @@ int ipmi_create_user(unsigned int          if_num,
         goto out_kfree;
 
  found:
+        INIT_WORK(&new_user->remove_work, free_user_work);
+
         rv = init_srcu_struct(&new_user->release_barrier);
         if (rv)
                 goto out_kfree;
@@ -1260,8 +1274,9 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
         struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
-        cleanup_srcu_struct(&user->release_barrier);
-        kfree(user);
+
+        /* SRCU cleanup must happen in task context. */
+        schedule_work(&user->remove_work);
 }
 
 static void _ipmi_destroy_user(struct ipmi_user *user)
diff --git a/drivers/char/ipmi/ipmi_si_hardcode.c b/drivers/char/ipmi/ipmi_si_hardcode.c
index 01946cad3d13..682221eebd66 100644
--- a/drivers/char/ipmi/ipmi_si_hardcode.c
+++ b/drivers/char/ipmi/ipmi_si_hardcode.c
@@ -118,6 +118,8 @@ void __init ipmi_hardcode_init(void)
         char *str;
         char *si_type[SI_MAX_PARMS];
 
+        memset(si_type, 0, sizeof(si_type));
+
         /* Parse out the si_type string into its components. */
         str = si_type_str;
         if (*str != '\0') {
diff --git a/drivers/char/tpm/eventlog/tpm2.c b/drivers/char/tpm/eventlog/tpm2.c
index d8b77133a83a..f824563fc28d 100644
--- a/drivers/char/tpm/eventlog/tpm2.c
+++ b/drivers/char/tpm/eventlog/tpm2.c
@@ -37,8 +37,8 @@
  *
  * Returns size of the event. If it is an invalid event, returns 0.
  */
-static int calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
-                                struct tcg_pcr_event *event_header)
+static size_t calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
+                                   struct tcg_pcr_event *event_header)
 {
         struct tcg_efi_specid_event_head *efispecid;
         struct tcg_event_field *event_field;
diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index 8856cce5a23b..817ae09a369e 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -233,12 +233,19 @@ __poll_t tpm_common_poll(struct file *file, poll_table *wait)
         __poll_t mask = 0;
 
         poll_wait(file, &priv->async_wait, wait);
+        mutex_lock(&priv->buffer_mutex);
 
-        if (!priv->response_read || priv->response_length)
+        /*
+         * The response_length indicates if there is still response
+         * (or part of it) to be consumed. Partial reads decrease it
+         * by the number of bytes read, and write resets it the zero.
+         */
+        if (priv->response_length)
                 mask = EPOLLIN | EPOLLRDNORM;
         else
                 mask = EPOLLOUT | EPOLLWRNORM;
 
+        mutex_unlock(&priv->buffer_mutex);
         return mask;
 }
 
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 83ece5639f86..ae1030c9b086 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -402,15 +402,13 @@ int tpm_pm_suspend(struct device *dev)
         if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED)
                 return 0;
 
-        if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-                mutex_lock(&chip->tpm_mutex);
-                if (!tpm_chip_start(chip)) {
+        if (!tpm_chip_start(chip)) {
+                if (chip->flags & TPM_CHIP_FLAG_TPM2)
                         tpm2_shutdown(chip, TPM2_SU_STATE);
-                        tpm_chip_stop(chip);
-                }
-                mutex_unlock(&chip->tpm_mutex);
-        } else {
-                rc = tpm1_pm_suspend(chip, tpm_suspend_pcr);
+                else
+                        rc = tpm1_pm_suspend(chip, tpm_suspend_pcr);
+
+                tpm_chip_stop(chip);
         }
 
         return rc;
diff --git a/drivers/clk/at91/clk-programmable.c b/drivers/clk/at91/clk-programmable.c
index 89d6f3736dbf..f8edbb65eda3 100644
--- a/drivers/clk/at91/clk-programmable.c
+++ b/drivers/clk/at91/clk-programmable.c
@@ -20,8 +20,7 @@
 #define PROG_ID_MAX             7
 
 #define PROG_STATUS_MASK(id)    (1 << ((id) + 8))
-#define PROG_PRES_MASK          0x7
-#define PROG_PRES(layout, pckr) ((pckr >> layout->pres_shift) & PROG_PRES_MASK)
+#define PROG_PRES(layout, pckr) ((pckr >> layout->pres_shift) & layout->pres_mask)
 #define PROG_MAX_RM9200_CSS     3
 
 struct clk_programmable {
@@ -37,20 +36,29 @@ static unsigned long clk_programmable_recalc_rate(struct clk_hw *hw,
                                                   unsigned long parent_rate)
 {
         struct clk_programmable *prog = to_clk_programmable(hw);
+        const struct clk_programmable_layout *layout = prog->layout;
         unsigned int pckr;
+        unsigned long rate;
 
         regmap_read(prog->regmap, AT91_PMC_PCKR(prog->id), &pckr);
 
-        return parent_rate >> PROG_PRES(prog->layout, pckr);
+        if (layout->is_pres_direct)
+                rate = parent_rate / (PROG_PRES(layout, pckr) + 1);
+        else
+                rate = parent_rate >> PROG_PRES(layout, pckr);
+
+        return rate;
 }
 
 static int clk_programmable_determine_rate(struct clk_hw *hw,
                                            struct clk_rate_request *req)
 {
+        struct clk_programmable *prog = to_clk_programmable(hw);
+        const struct clk_programmable_layout *layout = prog->layout;
         struct clk_hw *parent;
         long best_rate = -EINVAL;
         unsigned long parent_rate;
-        unsigned long tmp_rate;
+        unsigned long tmp_rate = 0;
         int shift;
         int i;
 
@@ -60,10 +68,18 @@ static int clk_programmable_determine_rate(struct clk_hw *hw,
                         continue;
 
                 parent_rate = clk_hw_get_rate(parent);
-                for (shift = 0; shift < PROG_PRES_MASK; shift++) {
-                        tmp_rate = parent_rate >> shift;
-                        if (tmp_rate <= req->rate)
-                                break;
+                if (layout->is_pres_direct) {
+                        for (shift = 0; shift <= layout->pres_mask; shift++) {
+                                tmp_rate = parent_rate / (shift + 1);
+                                if (tmp_rate <= req->rate)
+                                        break;
+                        }
+                } else {
+                        for (shift = 0; shift < layout->pres_mask; shift++) {
+                                tmp_rate = parent_rate >> shift;
+                                if (tmp_rate <= req->rate)
+                                        break;
+                        }
                 }
 
                 if (tmp_rate > req->rate)
@@ -137,16 +153,23 @@ static int clk_programmable_set_rate(struct clk_hw *hw, unsigned long rate,
         if (!div)
                 return -EINVAL;
 
-        shift = fls(div) - 1;
+        if (layout->is_pres_direct) {
+                shift = div - 1;
 
-        if (div != (1 << shift))
-                return -EINVAL;
+                if (shift > layout->pres_mask)
+                        return -EINVAL;
+        } else {
+                shift = fls(div) - 1;
 
-        if (shift >= PROG_PRES_MASK)
-                return -EINVAL;
+                if (div != (1 << shift))
+                        return -EINVAL;
+
+                if (shift >= layout->pres_mask)
+                        return -EINVAL;
+        }
 
         regmap_update_bits(prog->regmap, AT91_PMC_PCKR(prog->id),
-                           PROG_PRES_MASK << layout->pres_shift,
+                           layout->pres_mask << layout->pres_shift,
                            shift << layout->pres_shift);
 
         return 0;
@@ -202,19 +225,25 @@ at91_clk_register_programmable(struct regmap *regmap,
 }
 
 const struct clk_programmable_layout at91rm9200_programmable_layout = {
+        .pres_mask = 0x7,
         .pres_shift = 2,
         .css_mask = 0x3,
         .have_slck_mck = 0,
+        .is_pres_direct = 0,
 };
 
 const struct clk_programmable_layout at91sam9g45_programmable_layout = {
+        .pres_mask = 0x7,
         .pres_shift = 2,
         .css_mask = 0x3,
         .have_slck_mck = 1,
+        .is_pres_direct = 0,
 };
 
 const struct clk_programmable_layout at91sam9x5_programmable_layout = {
+        .pres_mask = 0x7,
         .pres_shift = 4,
         .css_mask = 0x7,
         .have_slck_mck = 0,
+        .is_pres_direct = 0,
 };
diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
index 672a79bda88c..a0e5ce9c9b9e 100644
--- a/drivers/clk/at91/pmc.h
+++ b/drivers/clk/at91/pmc.h
@@ -71,9 +71,11 @@ struct clk_pll_characteristics {
 };
 
 struct clk_programmable_layout {
+        u8 pres_mask;
         u8 pres_shift;
         u8 css_mask;
         u8 have_slck_mck;
+        u8 is_pres_direct;
 };
 
 extern const struct clk_programmable_layout at91rm9200_programmable_layout;
diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c
index 1f70cb164b06..81943fac4537 100644
--- a/drivers/clk/at91/sama5d2.c
+++ b/drivers/clk/at91/sama5d2.c
@@ -125,6 +125,14 @@ static const struct {
           .pll = true },
 };
 
+static const struct clk_programmable_layout sama5d2_programmable_layout = {
+        .pres_mask = 0xff,
+        .pres_shift = 4,
+        .css_mask = 0x7,
+        .have_slck_mck = 0,
+        .is_pres_direct = 1,
+};
+
 static void __init sama5d2_pmc_setup(struct device_node *np)
 {
         struct clk_range range = CLK_RANGE(0, 0);
@@ -249,7 +257,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np)
 
                 hw = at91_clk_register_programmable(regmap, name,
                                                     parent_names, 6, i,
-                                                    &at91sam9x5_programmable_layout);
+                                                    &sama5d2_programmable_layout);
                 if (IS_ERR(hw))
                         goto err_free;
         }
diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c
index 1acfa3e3cfb4..113d71042199 100644
--- a/drivers/clk/imx/clk-pll14xx.c
+++ b/drivers/clk/imx/clk-pll14xx.c
@@ -362,7 +362,7 @@ struct clk *imx_clk_pll14xx(const char *name, const char *parent_name,
 
         switch (pll_clk->type) {
         case PLL_1416X:
-                if (!pll->rate_table)
+                if (!pll_clk->rate_table)
                         init.ops = &clk_pll1416x_min_ops;
                 else
                         init.ops = &clk_pll1416x_ops;
diff --git a/drivers/clk/mediatek/clk-gate.c b/drivers/clk/mediatek/clk-gate.c
index 9628d4e7690b..85daf826619a 100644
--- a/drivers/clk/mediatek/clk-gate.c
+++ b/drivers/clk/mediatek/clk-gate.c
@@ -169,11 +169,10 @@ struct clk *mtk_clk_register_gate(
                 return ERR_PTR(-ENOMEM);
 
         init.name = name;
-        init.flags = CLK_SET_RATE_PARENT;
+        init.flags = flags | CLK_SET_RATE_PARENT;
         init.parent_names = parent_name ? &parent_name : NULL;
         init.num_parents = parent_name ? 1 : 0;
         init.ops = ops;
-        init.flags = flags;
 
         cg->regmap = regmap;
         cg->set_ofs = set_ofs;
diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
index 41e16dd7272a..7a14ac9b2fec 100644
--- a/drivers/clk/meson/clk-pll.c
+++ b/drivers/clk/meson/clk-pll.c
@@ -120,7 +120,7 @@ static bool meson_clk_pll_is_better(unsigned long rate,
                         return true;
         } else {
                 /* Round down */
-                if (now < rate && best < now)
+                if (now <= rate && best < now)
                         return true;
         }
 
diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
index 0e1ce8c03259..f7b11e1eeebe 100644
--- a/drivers/clk/meson/g12a.c
+++ b/drivers/clk/meson/g12a.c
@@ -960,14 +960,14 @@ static struct clk_regmap g12a_sd_emmc_c_clk0 = {
 /* VPU Clock */
 
 static const char * const g12a_vpu_parent_names[] = {
-        "fclk_div4", "fclk_div3", "fclk_div5", "fclk_div7",
+        "fclk_div3", "fclk_div4", "fclk_div5", "fclk_div7",
         "mpll1", "vid_pll", "hifi_pll", "gp0_pll",
 };
 
 static struct clk_regmap g12a_vpu_0_sel = {
         .data = &(struct clk_regmap_mux_data){
                 .offset = HHI_VPU_CLK_CNTL,
-                .mask = 0x3,
+                .mask = 0x7,
                 .shift = 9,
         },
         .hw.init = &(struct clk_init_data){
@@ -1011,7 +1011,7 @@ static struct clk_regmap g12a_vpu_0 = {
 static struct clk_regmap g12a_vpu_1_sel = {
         .data = &(struct clk_regmap_mux_data){
                 .offset = HHI_VPU_CLK_CNTL,
-                .mask = 0x3,
+                .mask = 0x7,
                 .shift = 25,
         },
         .hw.init = &(struct clk_init_data){
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 04df2e208ed6..29ffb4fde714 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -2216,6 +2216,7 @@ static struct clk_regmap gxbb_vdec_1_div = {
                 .offset = HHI_VDEC_CLK_CNTL,
                 .shift = 0,
                 .width = 7,
+                .flags = CLK_DIVIDER_ROUND_CLOSEST,
         },
         .hw.init = &(struct clk_init_data){
                 .name = "vdec_1_div",
@@ -2261,6 +2262,7 @@ static struct clk_regmap gxbb_vdec_hevc_div = {
                 .offset = HHI_VDEC2_CLK_CNTL,
                 .shift = 16,
                 .width = 7,
+                .flags = CLK_DIVIDER_ROUND_CLOSEST,
         },
         .hw.init = &(struct clk_init_data){
                 .name = "vdec_hevc_div",
diff --git a/drivers/clk/meson/vid-pll-div.c b/drivers/clk/meson/vid-pll-div.c
index 08bcc01c0923..daff235bc763 100644
--- a/drivers/clk/meson/vid-pll-div.c
+++ b/drivers/clk/meson/vid-pll-div.c
@@ -82,8 +82,8 @@ static unsigned long meson_vid_pll_div_recalc_rate(struct clk_hw *hw,
         div = _get_table_val(meson_parm_read(clk->map, &pll_div->val),
                              meson_parm_read(clk->map, &pll_div->sel));
         if (!div || !div->divider) {
-                pr_info("%s: Invalid config value for vid_pll_div\n", __func__);
-                return parent_rate;
+                pr_debug("%s: Invalid config value for vid_pll_div\n", __func__);
+                return 0;
         }
 
         return DIV_ROUND_UP_ULL(parent_rate * div->multiplier, div->divider);
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index d977193842df..19174835693b 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -165,7 +165,7 @@ static const struct clk_ops plt_clk_ops = {
 };
 
 static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
-                                        void __iomem *base,
+                                        const struct pmc_clk_data *pmc_data,
                                         const char **parent_names,
                                         int num_parents)
 {
@@ -184,9 +184,17 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
         init.num_parents = num_parents;
 
         pclk->hw.init = &init;
-        pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
+        pclk->reg = pmc_data->base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
         spin_lock_init(&pclk->lock);
 
+        /*
+         * On some systems, the pmc_plt_clocks already enabled by the
+         * firmware are being marked as critical to avoid them being
+         * gated by the clock framework.
+         */
+        if (pmc_data->critical && plt_clk_is_enabled(&pclk->hw))
+                init.flags |= CLK_IS_CRITICAL;
+
         ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
         if (ret) {
                 pclk = ERR_PTR(ret);
@@ -332,7 +340,7 @@ static int plt_clk_probe(struct platform_device *pdev)
                 return PTR_ERR(parent_names);
 
         for (i = 0; i < PMC_CLK_NUM; i++) {
-                data->clks[i] = plt_clk_register(pdev, i, pmc_data->base,
+                data->clks[i] = plt_clk_register(pdev, i, pmc_data,
                                                  parent_names, data->nparents);
                 if (IS_ERR(data->clks[i])) {
                         err = PTR_ERR(data->clks[i]);
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 171502a356aa..4b3d143f0f8a 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -145,6 +145,7 @@ config VT8500_TIMER
 config NPCM7XX_TIMER
         bool "NPCM7xx timer driver" if COMPILE_TEST
         depends on HAS_IOMEM
+        select TIMER_OF
         select CLKSRC_MMIO
         help
           Enable 24-bit TIMER0 and TIMER1 counters in the NPCM7xx architecture,
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index aa4ec53281ce..ea373cfbcecb 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -9,7 +9,7 @@
  * published by the Free Software Foundation.
  */
 
-#define pr_fmt(fmt)     "arm_arch_timer: " fmt
+#define pr_fmt(fmt)     "arch_timer: " fmt
 
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -33,9 +33,6 @@
 
 #include <clocksource/arm_arch_timer.h>
 
-#undef pr_fmt
-#define pr_fmt(fmt) "arch_timer: " fmt
-
 #define CNTTIDR         0x08
 #define CNTTIDR_VIRT(n) (BIT(1) << ((n) * 4))
 
diff --git a/drivers/clocksource/timer-oxnas-rps.c b/drivers/clocksource/timer-oxnas-rps.c
index eed6feff8b5f..30c6f4ce672b 100644
--- a/drivers/clocksource/timer-oxnas-rps.c
+++ b/drivers/clocksource/timer-oxnas-rps.c
@@ -296,4 +296,4 @@ err_alloc:
 TIMER_OF_DECLARE(ox810se_rps,
                        "oxsemi,ox810se-rps-timer", oxnas_rps_timer_init);
 TIMER_OF_DECLARE(ox820_rps,
-                       "oxsemi,ox820se-rps-timer", oxnas_rps_timer_init);
+                       "oxsemi,ox820-rps-timer", oxnas_rps_timer_init);
diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
index 3352da6ed61f..ee8ec5a8cb16 100644
--- a/drivers/clocksource/timer-ti-dm.c
+++ b/drivers/clocksource/timer-ti-dm.c
@@ -585,34 +585,6 @@ static int omap_dm_timer_set_load(struct omap_dm_timer *timer, int autoreload,
         return 0;
 }
 
-/* Optimized set_load which removes costly spin wait in timer_start */
-static int omap_dm_timer_set_load_start(struct omap_dm_timer *timer,
-                                        int autoreload, unsigned int load)
-{
-        u32 l;
-
-        if (unlikely(!timer))
-                return -EINVAL;
-
-        omap_dm_timer_enable(timer);
-
-        l = omap_dm_timer_read_reg(timer, OMAP_TIMER_CTRL_REG);
-        if (autoreload) {
-                l |= OMAP_TIMER_CTRL_AR;
-                omap_dm_timer_write_reg(timer, OMAP_TIMER_LOAD_REG, load);
-        } else {
-                l &= ~OMAP_TIMER_CTRL_AR;
-        }
-        l |= OMAP_TIMER_CTRL_ST;
-
-        __omap_dm_timer_load_start(timer, l, load, timer->posted);
-
-        /* Save the context */
-        timer->context.tclr = l;
-        timer->context.tldr = load;
-        timer->context.tcrr = load;
-        return 0;
-}
 static int omap_dm_timer_set_match(struct omap_dm_timer *timer, int enable,
                                    unsigned int match)
 {
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b599c7318aab..2986119dd31f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2596,6 +2596,9 @@ static int __init intel_pstate_init(void)
         const struct x86_cpu_id *id;
         int rc;
 
+        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+                return -ENODEV;
+
         if (no_load)
                 return -ENODEV;
 
@@ -2611,7 +2614,7 @@ static int __init intel_pstate_init(void)
         } else {
                 id = x86_match_cpu(intel_pstate_cpu_ids);
                 if (!id) {
-                        pr_info("CPU ID not supported\n");
+                        pr_info("CPU model not supported\n");
                         return -ENODEV;
                 }
 
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index b1eadc6652b5..7205d9f4029e 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -865,19 +865,18 @@ static int ahash_update_ctx(struct ahash_request *req)
                 if (ret)
                         goto unmap_ctx;
 
-                if (mapped_nents) {
+                if (mapped_nents)
                         sg_to_sec4_sg_last(req->src, mapped_nents,
                                            edesc->sec4_sg + sec4_sg_src_index,
                                            0);
-                        if (*next_buflen)
-                                scatterwalk_map_and_copy(next_buf, req->src,
-                                                         to_hash - *buflen,
-                                                         *next_buflen, 0);
-                } else {
+                else
                         sg_to_sec4_set_last(edesc->sec4_sg + sec4_sg_src_index -
                                             1);
-                }
 
+                if (*next_buflen)
+                        scatterwalk_map_and_copy(next_buf, req->src,
+                                                 to_hash - *buflen,
+                                                 *next_buflen, 0);
                 desc = edesc->hw_desc;
 
                 edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg,
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index ec8a291d62ba..54093ffd0aef 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -671,7 +671,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_slave_sg(
         d = bcm2835_dma_create_cb_chain(chan, direction, false,
                                         info, extra,
                                         frames, src, dst, 0, 0,
-                                        GFP_KERNEL);
+                                        GFP_NOWAIT);
         if (!d)
                 return NULL;
 
diff --git a/drivers/dma/mediatek/mtk-cqdma.c b/drivers/dma/mediatek/mtk-cqdma.c
index 131f3974740d..814853842e29 100644
--- a/drivers/dma/mediatek/mtk-cqdma.c
+++ b/drivers/dma/mediatek/mtk-cqdma.c
@@ -253,7 +253,7 @@ static void mtk_cqdma_start(struct mtk_cqdma_pchan *pc,
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
         mtk_dma_set(pc, MTK_CQDMA_DST2, cvd->dest >> MTK_CQDMA_ADDR2_SHFIT);
 #else
-        mtk_dma_set(pc, MTK_CQDMA_SRC2, 0);
+        mtk_dma_set(pc, MTK_CQDMA_DST2, 0);
 #endif
 
         /* setup the length */
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index 2b4f25698169..e2a5398f89b5 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1282,6 +1282,9 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
         enum dma_status status;
         unsigned int residue = 0;
         unsigned int dptr = 0;
+        unsigned int chcrb;
+        unsigned int tcrb;
+        unsigned int i;
 
         if (!desc)
                 return 0;
@@ -1330,14 +1333,31 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
         }
 
         /*
+         * We need to read two registers.
+         * Make sure the control register does not skip to next chunk
+         * while reading the counter.
+         * Trying it 3 times should be enough: Initial read, retry, retry
+         * for the paranoid.
+         */
+        for (i = 0; i < 3; i++) {
+                chcrb = rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
+                                            RCAR_DMACHCRB_DPTR_MASK;
+                tcrb = rcar_dmac_chan_read(chan, RCAR_DMATCRB);
+                /* Still the same? */
+                if (chcrb == (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
+                              RCAR_DMACHCRB_DPTR_MASK))
+                        break;
+        }
+        WARN_ONCE(i >= 3, "residue might be not continuous!");
+
+        /*
          * In descriptor mode the descriptor running pointer is not maintained
          * by the interrupt handler, find the running descriptor from the
          * descriptor pointer field in the CHCRB register. In non-descriptor
          * mode just use the running descriptor pointer.
          */
         if (desc->hwdescs.use) {
-                dptr = (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
-                        RCAR_DMACHCRB_DPTR_MASK) >> RCAR_DMACHCRB_DPTR_SHIFT;
+                dptr = chcrb >> RCAR_DMACHCRB_DPTR_SHIFT;
                 if (dptr == 0)
                         dptr = desc->nchunks;
                 dptr--;
@@ -1355,7 +1375,7 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
         }
 
         /* Add the residue for the current chunk. */
-        residue += rcar_dmac_chan_read(chan, RCAR_DMATCRB) << desc->xfer_shift;
+        residue += tcrb << desc->xfer_shift;
 
         return residue;
 }
@@ -1368,6 +1388,7 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
         enum dma_status status;
         unsigned long flags;
         unsigned int residue;
+        bool cyclic;
 
         status = dma_cookie_status(chan, cookie, txstate);
         if (status == DMA_COMPLETE || !txstate)
@@ -1375,10 +1396,11 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
 
         spin_lock_irqsave(&rchan->lock, flags);
         residue = rcar_dmac_chan_get_residue(rchan, cookie);
+        cyclic = rchan->desc.running ? rchan->desc.running->cyclic : false;
         spin_unlock_irqrestore(&rchan->lock, flags);
 
         /* if there's no residue, the cookie is complete */
-        if (!residue)
+        if (!residue && !cyclic)
                 return DMA_COMPLETE;
 
         dma_set_residue(txstate, residue);
diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig
index 8e17149655f0..540e8cd16ee6 100644
--- a/drivers/extcon/Kconfig
+++ b/drivers/extcon/Kconfig
@@ -116,7 +116,7 @@ config EXTCON_PALMAS
 
 config EXTCON_PTN5150
         tristate "NXP PTN5150 CC LOGIC USB EXTCON support"
-        depends on I2C && GPIOLIB || COMPILE_TEST
+        depends on I2C && (GPIOLIB || COMPILE_TEST)
         select REGMAP_I2C
         help
           Say Y here to enable support for USB peripheral and USB host
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index f0223cee9774..77092268ee95 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -414,6 +414,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
                 case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0);
                         sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 1);
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 0495bf1d480a..bca3e7740ef6 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1379,7 +1379,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
 
         status = gpiochip_add_irqchip(chip, lock_key, request_key);
         if (status)
-                goto err_remove_chip;
+                goto err_free_gpiochip_mask;
 
         status = of_gpiochip_add(chip);
         if (status)
@@ -1387,7 +1387,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
 
         status = gpiochip_init_valid_mask(chip);
         if (status)
-                goto err_remove_chip;
+                goto err_remove_of_chip;
 
         for (i = 0; i < chip->ngpio; i++) {
                 struct gpio_desc *desc = &gdev->descs[i];
@@ -1415,14 +1415,18 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         if (gpiolib_initialized) {
                 status = gpiochip_setup_dev(gdev);
                 if (status)
-                        goto err_remove_chip;
+                        goto err_remove_acpi_chip;
         }
         return 0;
 
-err_remove_chip:
+err_remove_acpi_chip:
         acpi_gpiochip_remove(chip);
+err_remove_of_chip:
         gpiochip_free_hogs(chip);
         of_gpiochip_remove(chip);
+err_remove_chip:
+        gpiochip_irqchip_remove(chip);
+err_free_gpiochip_mask:
         gpiochip_free_valid_mask(chip);
 err_remove_irqchip_mask:
         gpiochip_irqchip_free_valid_mask(chip);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 4f8fb4ecde34..79fb302fb954 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3165,6 +3165,7 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev)
 
                 /* No need to recover an evicted BO */
                 if (shadow->tbo.mem.mem_type != TTM_PL_TT ||
+                    shadow->tbo.mem.start == AMDGPU_BO_INVALID_OFFSET ||
                     shadow->parent->tbo.mem.mem_type != TTM_PL_VRAM)
                         continue;
 
@@ -3173,11 +3174,16 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev)
                         break;
 
                 if (fence) {
-                        r = dma_fence_wait_timeout(fence, false, tmo);
+                        tmo = dma_fence_wait_timeout(fence, false, tmo);
                         dma_fence_put(fence);
                         fence = next;
-                        if (r <= 0)
+                        if (tmo == 0) {
+                                r = -ETIMEDOUT;
                                 break;
+                        } else if (tmo < 0) {
+                                r = tmo;
+                                break;
+                        }
                 } else {
                         fence = next;
                 }
@@ -3188,8 +3194,8 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev)
                 tmo = dma_fence_wait_timeout(fence, false, tmo);
         dma_fence_put(fence);
 
-        if (r <= 0 || tmo <= 0) {
-                DRM_ERROR("recover vram bo from shadow failed\n");
+        if (r < 0 || tmo <= 0) {
+                DRM_ERROR("recover vram bo from shadow failed, r is %ld, tmo is %ld\n", r, tmo);
                 return -EIO;
         }
 
@@ -3625,6 +3631,7 @@ static void amdgpu_device_get_min_pci_speed_width(struct amdgpu_device *adev,
         struct pci_dev *pdev = adev->pdev;
         enum pci_bus_speed cur_speed;
         enum pcie_link_width cur_width;
+        u32 ret = 1;
 
         *speed = PCI_SPEED_UNKNOWN;
         *width = PCIE_LNK_WIDTH_UNKNOWN;
@@ -3632,6 +3639,10 @@ static void amdgpu_device_get_min_pci_speed_width(struct amdgpu_device *adev,
         while (pdev) {
                 cur_speed = pcie_get_speed_cap(pdev);
                 cur_width = pcie_get_width_cap(pdev);
+                ret = pcie_bandwidth_available(adev->pdev, NULL,
+                                                       NULL, &cur_width);
+                if (!ret)
+                        cur_width = PCIE_LNK_WIDTH_RESRV;
 
                 if (cur_speed != PCI_SPEED_UNKNOWN) {
                         if (*speed == PCI_SPEED_UNKNOWN)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index 0b8ef2d27d6b..fe393a46f881 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -35,6 +35,7 @@
 #include "amdgpu_trace.h"
 
 #define AMDGPU_IB_TEST_TIMEOUT  msecs_to_jiffies(1000)
+#define AMDGPU_IB_TEST_GFX_XGMI_TIMEOUT msecs_to_jiffies(2000)
 
 /*
  * IB
@@ -344,6 +345,8 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
                  * cost waiting for it coming back under RUNTIME only
                 */
                 tmo_gfx = 8 * AMDGPU_IB_TEST_TIMEOUT;
+        } else if (adev->gmc.xgmi.hive_id) {
+                tmo_gfx = AMDGPU_IB_TEST_GFX_XGMI_TIMEOUT;
         }
 
         for (i = 0; i < adev->num_rings; ++i) {
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index d0309e8c9d12..a11db2b1a63f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2405,8 +2405,6 @@ static int gfx_v9_0_rlc_resume(struct amdgpu_device *adev)
         /* disable CG */
         WREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL, 0);
 
-        adev->gfx.rlc.funcs->reset(adev);
-
         gfx_v9_0_init_pg(adev);
 
         if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {
diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
index d0d966d6080a..1696644ec022 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
@@ -182,6 +182,7 @@ static void mmhub_v1_0_init_cache_regs(struct amdgpu_device *adev)
                 tmp = REG_SET_FIELD(tmp, VM_L2_CNTL3,
                                     L2_CACHE_BIGK_FRAGMENT_SIZE, 6);
         }
+        WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL3, tmp);
 
         tmp = mmVM_L2_CNTL4_DEFAULT;
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL4, VMC_TAP_PDE_REQUEST_PHYSICAL, 0);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 8be9677c0c07..cf9a49f49d3a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -320,6 +320,7 @@ static const struct kfd_deviceid supported_devices[] = {
         { 0x9876, &carrizo_device_info },       /* Carrizo */
         { 0x9877, &carrizo_device_info },       /* Carrizo */
         { 0x15DD, &raven_device_info },         /* Raven */
+        { 0x15D8, &raven_device_info },         /* Raven */
 #endif
         { 0x67A0, &hawaii_device_info },        /* Hawaii */
         { 0x67A1, &hawaii_device_info },        /* Hawaii */
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 81127f7d6ed1..3082b55b1e77 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4533,6 +4533,7 @@ static void handle_cursor_update(struct drm_plane *plane,
         amdgpu_crtc->cursor_width = plane->state->crtc_w;
         amdgpu_crtc->cursor_height = plane->state->crtc_h;
 
+        memset(&attributes, 0, sizeof(attributes));
         attributes.address.high_part = upper_32_bits(address);
         attributes.address.low_part  = lower_32_bits(address);
         attributes.width             = plane->state->crtc_w;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index c68fbd55db3c..a6cda201c964 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1377,6 +1377,11 @@ static enum surface_update_type det_surface_update(const struct dc *dc,
                 return UPDATE_TYPE_FULL;
         }
 
+        if (u->surface->force_full_update) {
+                update_flags->bits.full_update = 1;
+                return UPDATE_TYPE_FULL;
+        }
+
         type = get_plane_info_update_type(u);
         elevate_update_type(&overall_type, type);
 
@@ -1802,6 +1807,14 @@ void dc_commit_updates_for_stream(struct dc *dc,
                 }
 
                 dc_resource_state_copy_construct(state, context);
+
+                for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                        struct pipe_ctx *new_pipe = &context->res_ctx.pipe_ctx[i];
+                        struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i];
+
+                        if (new_pipe->plane_state && new_pipe->plane_state != old_pipe->plane_state)
+                                new_pipe->plane_state->force_full_update = true;
+                }
         }
 
 
@@ -1838,6 +1851,12 @@ void dc_commit_updates_for_stream(struct dc *dc,
                 dc->current_state = context;
                 dc_release_state(old);
 
+                for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                        struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+
+                        if (pipe_ctx->plane_state && pipe_ctx->stream == stream)
+                                pipe_ctx->plane_state->force_full_update = false;
+                }
         }
         /*let's use current_state to update watermark etc*/
         if (update_type >= UPDATE_TYPE_FULL)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 4eba3c4800b6..ea18e9c2d8ce 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2660,12 +2660,18 @@ void core_link_enable_stream(
 void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
 {
         struct dc  *core_dc = pipe_ctx->stream->ctx->dc;
+        struct dc_stream_state *stream = pipe_ctx->stream;
 
         core_dc->hwss.blank_stream(pipe_ctx);
 
         if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
                 deallocate_mst_payload(pipe_ctx);
 
+        if (dc_is_hdmi_signal(pipe_ctx->stream->signal))
+                dal_ddc_service_write_scdc_data(
+                        stream->link->ddc, 0,
+                        stream->timing.flags.LTE_340MCSC_SCRAMBLE);
+
         core_dc->hwss.disable_stream(pipe_ctx, option);
 
         disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 1a7fd6aa77eb..0515095574e7 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -503,6 +503,9 @@ struct dc_plane_state {
         struct dc_plane_status status;
         struct dc_context *ctx;
 
+        /* HACK: Workaround for forcing full reprogramming under some conditions */
+        bool force_full_update;
+
         /* private to dc_surface.c */
         enum dc_irq_source irq_source;
         struct kref refcount;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c
index 4febf4ef7240..4fe3664fb495 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c
@@ -190,6 +190,12 @@ static void submit_channel_request(
                                 1,
                                 0);
         }
+
+        REG_UPDATE(AUX_INTERRUPT_CONTROL, AUX_SW_DONE_ACK, 1);
+
+        REG_WAIT(AUX_SW_STATUS, AUX_SW_DONE, 0,
+                                10, aux110->timeout_period/10);
+
         /* set the delay and the number of bytes to write */
 
         /* The length include
@@ -242,9 +248,6 @@ static void submit_channel_request(
                 }
         }
 
-        REG_UPDATE(AUX_INTERRUPT_CONTROL, AUX_SW_DONE_ACK, 1);
-        REG_WAIT(AUX_SW_STATUS, AUX_SW_DONE, 0,
-                                10, aux110->timeout_period/10);
         REG_UPDATE(AUX_SW_CONTROL, AUX_SW_GO, 1);
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h
index d27f22c05e4b..e28ed6a00ff4 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h
@@ -71,11 +71,11 @@ enum {	/* This is the timeout as defined in DP 1.2a,
          * at most within ~240usec. That means,
          * increasing this timeout will not affect normal operation,
          * and we'll timeout after
-         * SW_AUX_TIMEOUT_PERIOD_MULTIPLIER * AUX_TIMEOUT_PERIOD = 1600usec.
+         * SW_AUX_TIMEOUT_PERIOD_MULTIPLIER * AUX_TIMEOUT_PERIOD = 2400usec.
          * This timeout is especially important for
-         * resume from S3 and CTS.
+         * converters, resume from S3, and CTS.
          */
-        SW_AUX_TIMEOUT_PERIOD_MULTIPLIER = 4
+        SW_AUX_TIMEOUT_PERIOD_MULTIPLIER = 6
 };
 
 struct dce_aux {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
index 683829466a44..0ba68d41b9c3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
@@ -1150,28 +1150,9 @@ void hubp1_cursor_set_position(
         REG_UPDATE(CURSOR_CONTROL,
                         CURSOR_ENABLE, cur_en);
 
-        //account for cases where we see negative offset relative to overlay plane
-        if (src_x_offset < 0 && src_y_offset < 0) {
-                REG_SET_2(CURSOR_POSITION, 0,
-                        CURSOR_X_POSITION, 0,
-                        CURSOR_Y_POSITION, 0);
-                x_hotspot -= src_x_offset;
-                y_hotspot -= src_y_offset;
-        } else if (src_x_offset < 0) {
-                REG_SET_2(CURSOR_POSITION, 0,
-                        CURSOR_X_POSITION, 0,
-                        CURSOR_Y_POSITION, pos->y);
-                x_hotspot -= src_x_offset;
-        } else if (src_y_offset < 0) {
-                REG_SET_2(CURSOR_POSITION, 0,
+        REG_SET_2(CURSOR_POSITION, 0,
                         CURSOR_X_POSITION, pos->x,
-                        CURSOR_Y_POSITION, 0);
-                y_hotspot -= src_y_offset;
-        } else {
-                REG_SET_2(CURSOR_POSITION, 0,
-                                CURSOR_X_POSITION, pos->x,
-                                CURSOR_Y_POSITION, pos->y);
-        }
+                        CURSOR_Y_POSITION, pos->y);
 
         REG_SET_2(CURSOR_HOT_SPOT, 0,
                         CURSOR_HOT_SPOT_X, x_hotspot,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index 9aa7bec1b5fe..23b5b94a4939 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -91,6 +91,12 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
          *   MP0CLK DS
          */
         data->registry_data.disallowed_features = 0xE0041C00;
+        /* ECC feature should be disabled on old SMUs */
+        smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetSmuVersion);
+        hwmgr->smu_version = smum_get_argument(hwmgr);
+        if (hwmgr->smu_version < 0x282100)
+                data->registry_data.disallowed_features |= FEATURE_ECC_MASK;
+
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -357,6 +363,7 @@ static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr)
         data->smu_features[GNLD_DS_MP1CLK].smu_feature_id = FEATURE_DS_MP1CLK_BIT;
         data->smu_features[GNLD_DS_MP0CLK].smu_feature_id = FEATURE_DS_MP0CLK_BIT;
         data->smu_features[GNLD_XGMI].smu_feature_id = FEATURE_XGMI_BIT;
+        data->smu_features[GNLD_ECC].smu_feature_id = FEATURE_ECC_BIT;
 
         for (i = 0; i < GNLD_FEATURES_MAX; i++) {
                 data->smu_features[i].smu_feature_bitmap =
@@ -3020,7 +3027,8 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf)
                                 "FCLK_DS",
                                 "MP1CLK_DS",
                                 "MP0CLK_DS",
-                                "XGMI"};
+                                "XGMI",
+                                "ECC"};
         static const char *output_title[] = {
                                 "FEATURES",
                                 "BITMASK",
@@ -3462,6 +3470,7 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         struct vega20_single_dpm_table *dpm_table;
         bool vblank_too_short = false;
         bool disable_mclk_switching;
+        bool disable_fclk_switching;
         uint32_t i, latency;
 
         disable_mclk_switching = ((1 < hwmgr->display_config->num_display) &&
@@ -3537,13 +3546,20 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         if (hwmgr->display_config->nb_pstate_switch_disable)
                 dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
+        if ((disable_mclk_switching &&
+            (dpm_table->dpm_state.hard_min_level == dpm_table->dpm_levels[dpm_table->count - 1].value)) ||
+             hwmgr->display_config->min_mem_set_clock / 100 >= dpm_table->dpm_levels[dpm_table->count - 1].value)
+                disable_fclk_switching = true;
+        else
+                disable_fclk_switching = false;
+
         /* fclk */
         dpm_table = &(data->dpm_table.fclk_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
         dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
         dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
-        if (hwmgr->display_config->nb_pstate_switch_disable)
+        if (hwmgr->display_config->nb_pstate_switch_disable || disable_fclk_switching)
                 dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
         /* vclk */
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
index a5bc758ae097..ac2a3118a0ae 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
@@ -80,6 +80,7 @@ enum {
         GNLD_DS_MP1CLK,
         GNLD_DS_MP0CLK,
         GNLD_XGMI,
+        GNLD_ECC,
 
         GNLD_FEATURES_MAX
 };
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
index 63d5cf691549..195c4ae67058 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
@@ -99,7 +99,7 @@
 #define FEATURE_DS_MP1CLK_BIT           30
 #define FEATURE_DS_MP0CLK_BIT           31
 #define FEATURE_XGMI_BIT                32
-#define FEATURE_SPARE_33_BIT            33
+#define FEATURE_ECC_BIT                 33
 #define FEATURE_SPARE_34_BIT            34
 #define FEATURE_SPARE_35_BIT            35
 #define FEATURE_SPARE_36_BIT            36
@@ -165,7 +165,8 @@
 #define FEATURE_DS_FCLK_MASK            (1 << FEATURE_DS_FCLK_BIT            )
 #define FEATURE_DS_MP1CLK_MASK          (1 << FEATURE_DS_MP1CLK_BIT          )
 #define FEATURE_DS_MP0CLK_MASK          (1 << FEATURE_DS_MP0CLK_BIT          )
-#define FEATURE_XGMI_MASK               (1 << FEATURE_XGMI_BIT               )
+#define FEATURE_XGMI_MASK               (1ULL << FEATURE_XGMI_BIT               )
+#define FEATURE_ECC_MASK                (1ULL << FEATURE_ECC_BIT                )
 
 #define DPM_OVERRIDE_DISABLE_SOCCLK_PID             0x00000001
 #define DPM_OVERRIDE_DISABLE_UCLK_PID               0x00000002
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
index a63e5f0dae56..ab7968c8f6a2 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
@@ -1037,6 +1037,35 @@ void dw_hdmi_phy_i2c_write(struct dw_hdmi *hdmi, unsigned short data,
 }
 EXPORT_SYMBOL_GPL(dw_hdmi_phy_i2c_write);
 
+/* Filter out invalid setups to avoid configuring SCDC and scrambling */
+static bool dw_hdmi_support_scdc(struct dw_hdmi *hdmi)
+{
+        struct drm_display_info *display = &hdmi->connector.display_info;
+
+        /* Completely disable SCDC support for older controllers */
+        if (hdmi->version < 0x200a)
+                return false;
+
+        /* Disable if no DDC bus */
+        if (!hdmi->ddc)
+                return false;
+
+        /* Disable if SCDC is not supported, or if an HF-VSDB block is absent */
+        if (!display->hdmi.scdc.supported ||
+            !display->hdmi.scdc.scrambling.supported)
+                return false;
+
+        /*
+         * Disable if display only support low TMDS rates and scrambling
+         * for low rates is not supported either
+         */
+        if (!display->hdmi.scdc.scrambling.low_rates &&
+            display->max_tmds_clock <= 340000)
+                return false;
+
+        return true;
+}
+
 /*
  * HDMI2.0 Specifies the following procedure for High TMDS Bit Rates:
  * - The Source shall suspend transmission of the TMDS clock and data
@@ -1055,7 +1084,7 @@ void dw_hdmi_set_high_tmds_clock_ratio(struct dw_hdmi *hdmi)
         unsigned long mtmdsclock = hdmi->hdmi_data.video_mode.mtmdsclock;
 
         /* Control for TMDS Bit Period/TMDS Clock-Period Ratio */
-        if (hdmi->connector.display_info.hdmi.scdc.supported) {
+        if (dw_hdmi_support_scdc(hdmi)) {
                 if (mtmdsclock > HDMI14_MAX_TMDSCLK)
                         drm_scdc_set_high_tmds_clock_ratio(hdmi->ddc, 1);
                 else
@@ -1579,8 +1608,9 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
 
         /* Set up HDMI_FC_INVIDCONF */
         inv_val = (hdmi->hdmi_data.hdcp_enable ||
-                   vmode->mtmdsclock > HDMI14_MAX_TMDSCLK ||
-                   hdmi_info->scdc.scrambling.low_rates ?
+                   (dw_hdmi_support_scdc(hdmi) &&
+                    (vmode->mtmdsclock > HDMI14_MAX_TMDSCLK ||
+                     hdmi_info->scdc.scrambling.low_rates)) ?
                 HDMI_FC_INVIDCONF_HDCP_KEEPOUT_ACTIVE :
                 HDMI_FC_INVIDCONF_HDCP_KEEPOUT_INACTIVE);
 
@@ -1646,7 +1676,7 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
         }
 
         /* Scrambling Control */
-        if (hdmi_info->scdc.supported) {
+        if (dw_hdmi_support_scdc(hdmi)) {
                 if (vmode->mtmdsclock > HDMI14_MAX_TMDSCLK ||
                     hdmi_info->scdc.scrambling.low_rates) {
                         /*
@@ -1658,13 +1688,13 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
                          * Source Devices compliant shall set the
                          * Source Version = 1.
                          */
-                        drm_scdc_readb(&hdmi->i2c->adap, SCDC_SINK_VERSION,
+                        drm_scdc_readb(hdmi->ddc, SCDC_SINK_VERSION,
                                        &bytes);
-                        drm_scdc_writeb(&hdmi->i2c->adap, SCDC_SOURCE_VERSION,
+                        drm_scdc_writeb(hdmi->ddc, SCDC_SOURCE_VERSION,
                                 min_t(u8, bytes, SCDC_MIN_SOURCE_VERSION));
 
                         /* Enabled Scrambling in the Sink */
-                        drm_scdc_set_scrambling(&hdmi->i2c->adap, 1);
+                        drm_scdc_set_scrambling(hdmi->ddc, 1);
 
                         /*
                          * To activate the scrambler feature, you must ensure
@@ -1680,7 +1710,7 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
                         hdmi_writeb(hdmi, 0, HDMI_FC_SCRAMBLER_CTRL);
                         hdmi_writeb(hdmi, (u8)~HDMI_MC_SWRSTZ_TMDSSWRST_REQ,
                                     HDMI_MC_SWRSTZ);
-                        drm_scdc_set_scrambling(&hdmi->i2c->adap, 0);
+                        drm_scdc_set_scrambling(hdmi->ddc, 0);
                 }
         }
 
@@ -1774,6 +1804,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
          * iteration for others.
          * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing
          * the workaround with a single iteration.
+         * The Rockchip RK3288 SoC (v2.00a) and RK3328/RK3399 SoCs (v2.11a) have
+         * been identified as needing the workaround with a single iteration.
          */
 
         switch (hdmi->version) {
@@ -1782,7 +1814,9 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
                 break;
         case 0x131a:
         case 0x132a:
+        case 0x200a:
         case 0x201a:
+        case 0x211a:
         case 0x212a:
                 count = 1;
                 break;
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 40ac19848034..fbb76332cc9f 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1034,7 +1034,7 @@ disable_outputs(struct drm_device *dev, struct drm_atomic_state *old_state)
                         funcs->atomic_disable(crtc, old_crtc_state);
                 else if (funcs->disable)
                         funcs->disable(crtc);
-                else
+                else if (funcs->dpms)
                         funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
 
                 if (!(dev->irq_enabled && dev->num_crtcs))
@@ -1277,10 +1277,9 @@ void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev,
                 if (new_crtc_state->enable) {
                         DRM_DEBUG_ATOMIC("enabling [CRTC:%d:%s]\n",
                                          crtc->base.id, crtc->name);
-
                         if (funcs->atomic_enable)
                                 funcs->atomic_enable(crtc, old_crtc_state);
-                        else
+                        else if (funcs->commit)
                                 funcs->commit(crtc);
                 }
         }
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 035479e273be..e3f9caa7839f 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -448,7 +448,7 @@ void intel_gvt_emulate_vblank(struct intel_gvt *gvt)
 /**
  * intel_vgpu_emulate_hotplug - trigger hotplug event for vGPU
  * @vgpu: a vGPU
- * @conncted: link state
+ * @connected: link state
  *
  * This function is used to trigger hotplug interrupt for vGPU
  *
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 3e7e2b80c857..69a9a1b2ea4a 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -209,7 +209,7 @@ static int vgpu_get_plane_info(struct drm_device *dev,
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct intel_vgpu_primary_plane_format p;
         struct intel_vgpu_cursor_plane_format c;
-        int ret;
+        int ret, tile_height = 1;
 
         if (plane_id == DRM_PLANE_TYPE_PRIMARY) {
                 ret = intel_vgpu_decode_primary_plane(vgpu, &p);
@@ -228,19 +228,19 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                         break;
                 case PLANE_CTL_TILED_X:
                         info->drm_format_mod = I915_FORMAT_MOD_X_TILED;
+                        tile_height = 8;
                         break;
                 case PLANE_CTL_TILED_Y:
                         info->drm_format_mod = I915_FORMAT_MOD_Y_TILED;
+                        tile_height = 32;
                         break;
                 case PLANE_CTL_TILED_YF:
                         info->drm_format_mod = I915_FORMAT_MOD_Yf_TILED;
+                        tile_height = 32;
                         break;
                 default:
                         gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
                 }
-
-                info->size = (((p.stride * p.height * p.bpp) / 8) +
-                              (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else if (plane_id == DRM_PLANE_TYPE_CURSOR) {
                 ret = intel_vgpu_decode_cursor_plane(vgpu, &c);
                 if (ret)
@@ -262,14 +262,13 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                         info->x_hot = UINT_MAX;
                         info->y_hot = UINT_MAX;
                 }
-
-                info->size = (((info->stride * c.height * c.bpp) / 8)
-                                + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else {
                 gvt_vgpu_err("invalid plane id:%d\n", plane_id);
                 return -EINVAL;
         }
 
+        info->size = (info->stride * roundup(info->height, tile_height)
+                      + PAGE_SIZE - 1) >> PAGE_SHIFT;
         if (info->size == 0) {
                 gvt_vgpu_err("fb size is zero\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index d7052ab7908c..9814773882ec 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -750,14 +750,20 @@ static void ppgtt_free_spt(struct intel_vgpu_ppgtt_spt *spt)
 
 static void ppgtt_free_all_spt(struct intel_vgpu *vgpu)
 {
-        struct intel_vgpu_ppgtt_spt *spt;
+        struct intel_vgpu_ppgtt_spt *spt, *spn;
         struct radix_tree_iter iter;
-        void **slot;
+        LIST_HEAD(all_spt);
+        void __rcu **slot;
 
+        rcu_read_lock();
         radix_tree_for_each_slot(slot, &vgpu->gtt.spt_tree, &iter, 0) {
                 spt = radix_tree_deref_slot(slot);
-                ppgtt_free_spt(spt);
+                list_move(&spt->post_shadow_list, &all_spt);
         }
+        rcu_read_unlock();
+
+        list_for_each_entry_safe(spt, spn, &all_spt, post_shadow_list)
+                ppgtt_free_spt(spt);
 }
 
 static int ppgtt_handle_guest_write_page_table_bytes(
@@ -1946,7 +1952,7 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
  */
 void intel_vgpu_unpin_mm(struct intel_vgpu_mm *mm)
 {
-        atomic_dec(&mm->pincount);
+        atomic_dec_if_positive(&mm->pincount);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index d5fcc447d22f..a68addf95c23 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -905,7 +905,7 @@ static inline bool intel_vgpu_in_aperture(struct intel_vgpu *vgpu, u64 off)
 static int intel_vgpu_aperture_rw(struct intel_vgpu *vgpu, u64 off,
                 void *buf, unsigned long count, bool is_write)
 {
-        void *aperture_va;
+        void __iomem *aperture_va;
 
         if (!intel_vgpu_in_aperture(vgpu, off) ||
             !intel_vgpu_in_aperture(vgpu, off + count)) {
@@ -920,9 +920,9 @@ static int intel_vgpu_aperture_rw(struct intel_vgpu *vgpu, u64 off,
                 return -EIO;
 
         if (is_write)
-                memcpy(aperture_va + offset_in_page(off), buf, count);
+                memcpy_toio(aperture_va + offset_in_page(off), buf, count);
         else
-                memcpy(buf, aperture_va + offset_in_page(off), count);
+                memcpy_fromio(buf, aperture_va + offset_in_page(off), count);
 
         io_mapping_unmap(aperture_va);
 
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 159192c097cc..05b953793316 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -1486,8 +1486,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                 intel_runtime_pm_put_unchecked(dev_priv);
         }
 
-        if (ret && (vgpu_is_vm_unhealthy(ret))) {
-                enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
+        if (ret) {
+                if (vgpu_is_vm_unhealthy(ret))
+                        enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
                 intel_vgpu_destroy_workload(workload);
                 return ERR_PTR(ret);
         }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 0bd890c04fe4..f6f6e5b78e97 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4830,7 +4830,10 @@ static int i915_dsc_fec_support_show(struct seq_file *m, void *data)
                 ret = drm_modeset_lock(&dev->mode_config.connection_mutex,
                                        &ctx);
                 if (ret) {
-                        ret = -EINTR;
+                        if (ret == -EDEADLK && !drm_modeset_backoff(&ctx)) {
+                                try_again = true;
+                                continue;
+                        }
                         break;
                 }
                 crtc = connector->state->crtc;
diff --git a/drivers/gpu/drm/i915/icl_dsi.c b/drivers/gpu/drm/i915/icl_dsi.c
index 73a7bee24a66..641e0778fa9c 100644
--- a/drivers/gpu/drm/i915/icl_dsi.c
+++ b/drivers/gpu/drm/i915/icl_dsi.c
@@ -323,6 +323,21 @@ static void gen11_dsi_program_esc_clk_div(struct intel_encoder *encoder)
         }
 }
 
+static void get_dsi_io_power_domains(struct drm_i915_private *dev_priv,
+                                     struct intel_dsi *intel_dsi)
+{
+        enum port port;
+
+        for_each_dsi_port(port, intel_dsi->ports) {
+                WARN_ON(intel_dsi->io_wakeref[port]);
+                intel_dsi->io_wakeref[port] =
+                        intel_display_power_get(dev_priv,
+                                                port == PORT_A ?
+                                                POWER_DOMAIN_PORT_DDI_A_IO :
+                                                POWER_DOMAIN_PORT_DDI_B_IO);
+        }
+}
+
 static void gen11_dsi_enable_io_power(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
@@ -336,13 +351,7 @@ static void gen11_dsi_enable_io_power(struct intel_encoder *encoder)
                 I915_WRITE(ICL_DSI_IO_MODECTL(port), tmp);
         }
 
-        for_each_dsi_port(port, intel_dsi->ports) {
-                intel_dsi->io_wakeref[port] =
-                        intel_display_power_get(dev_priv,
-                                                port == PORT_A ?
-                                                POWER_DOMAIN_PORT_DDI_A_IO :
-                                                POWER_DOMAIN_PORT_DDI_B_IO);
-        }
+        get_dsi_io_power_domains(dev_priv, intel_dsi);
 }
 
 static void gen11_dsi_power_up_lanes(struct intel_encoder *encoder)
@@ -589,6 +598,12 @@ static void gen11_dsi_map_pll(struct intel_encoder *encoder,
                 val |= DPCLKA_CFGCR0_DDI_CLK_SEL(pll->info->id, port);
         }
         I915_WRITE(DPCLKA_CFGCR0_ICL, val);
+
+        for_each_dsi_port(port, intel_dsi->ports) {
+                val &= ~DPCLKA_CFGCR0_DDI_CLK_OFF(port);
+        }
+        I915_WRITE(DPCLKA_CFGCR0_ICL, val);
+
         POSTING_READ(DPCLKA_CFGCR0_ICL);
 
         mutex_unlock(&dev_priv->dpll_lock);
@@ -1117,7 +1132,7 @@ static void gen11_dsi_disable_port(struct intel_encoder *encoder)
                         DRM_ERROR("DDI port:%c buffer not idle\n",
                                   port_name(port));
         }
-        gen11_dsi_ungate_clocks(encoder);
+        gen11_dsi_gate_clocks(encoder);
 }
 
 static void gen11_dsi_disable_io_power(struct intel_encoder *encoder)
@@ -1218,20 +1233,11 @@ static int gen11_dsi_compute_config(struct intel_encoder *encoder,
         return 0;
 }
 
-static u64 gen11_dsi_get_power_domains(struct intel_encoder *encoder,
-                                       struct intel_crtc_state *crtc_state)
+static void gen11_dsi_get_power_domains(struct intel_encoder *encoder,
+                                        struct intel_crtc_state *crtc_state)
 {
-        struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
-        u64 domains = 0;
-        enum port port;
-
-        for_each_dsi_port(port, intel_dsi->ports)
-                if (port == PORT_A)
-                        domains |= BIT_ULL(POWER_DOMAIN_PORT_DDI_A_IO);
-                else
-                        domains |= BIT_ULL(POWER_DOMAIN_PORT_DDI_B_IO);
-
-        return domains;
+        get_dsi_io_power_domains(to_i915(encoder->base.dev),
+                                 enc_to_intel_dsi(&encoder->base));
 }
 
 static bool gen11_dsi_get_hw_state(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 14d580cdefd3..98cea1f4b3bf 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2075,12 +2075,11 @@ intel_ddi_main_link_aux_domain(struct intel_digital_port *dig_port)
                                               intel_aux_power_domain(dig_port);
 }
 
-static u64 intel_ddi_get_power_domains(struct intel_encoder *encoder,
-                                       struct intel_crtc_state *crtc_state)
+static void intel_ddi_get_power_domains(struct intel_encoder *encoder,
+                                        struct intel_crtc_state *crtc_state)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         struct intel_digital_port *dig_port;
-        u64 domains;
 
         /*
          * TODO: Add support for MST encoders. Atm, the following should never
@@ -2088,10 +2087,10 @@ static u64 intel_ddi_get_power_domains(struct intel_encoder *encoder,
          * hook.
          */
         if (WARN_ON(intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DP_MST)))
-                return 0;
+                return;
 
         dig_port = enc_to_dig_port(&encoder->base);
-        domains = BIT_ULL(dig_port->ddi_io_power_domain);
+        intel_display_power_get(dev_priv, dig_port->ddi_io_power_domain);
 
         /*
          * AUX power is only needed for (e)DP mode, and for HDMI mode on TC
@@ -2099,15 +2098,15 @@ static u64 intel_ddi_get_power_domains(struct intel_encoder *encoder,
          */
         if (intel_crtc_has_dp_encoder(crtc_state) ||
             intel_port_is_tc(dev_priv, encoder->port))
-                domains |= BIT_ULL(intel_ddi_main_link_aux_domain(dig_port));
+                intel_display_power_get(dev_priv,
+                                        intel_ddi_main_link_aux_domain(dig_port));
 
         /*
          * VDSC power is needed when DSC is enabled
          */
         if (crtc_state->dsc_params.compression_enable)
-                domains |= BIT_ULL(intel_dsc_power_domain(crtc_state));
-
-        return domains;
+                intel_display_power_get(dev_priv,
+                                        intel_dsc_power_domain(crtc_state));
 }
 
 void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state)
@@ -2825,10 +2824,10 @@ void icl_sanitize_encoder_pll_mapping(struct intel_encoder *encoder)
                                 return;
                 }
                 /*
-                 * DSI ports should have their DDI clock ungated when disabled
-                 * and gated when enabled.
+                 * For DSI we keep the ddi clocks gated
+                 * except during enable/disable sequence.
                  */
-                ddi_clk_needed = !encoder->base.crtc;
+                ddi_clk_needed = false;
         }
 
         val = I915_READ(DPCLKA_CFGCR0_ICL);
@@ -3863,14 +3862,16 @@ static int intel_ddi_compute_config(struct intel_encoder *encoder,
                 ret = intel_hdmi_compute_config(encoder, pipe_config, conn_state);
         else
                 ret = intel_dp_compute_config(encoder, pipe_config, conn_state);
+        if (ret)
+                return ret;
 
-        if (IS_GEN9_LP(dev_priv) && ret)
+        if (IS_GEN9_LP(dev_priv))
                 pipe_config->lane_lat_optim_mask =
                         bxt_ddi_phy_calc_lane_lat_optim_mask(pipe_config->lane_count);
 
         intel_ddi_compute_min_voltage_level(dev_priv, pipe_config);
 
-        return ret;
+        return 0;
 
 }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index ccb616351bba..421aac80a838 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15986,8 +15986,6 @@ get_encoder_power_domains(struct drm_i915_private *dev_priv)
         struct intel_encoder *encoder;
 
         for_each_intel_encoder(&dev_priv->drm, encoder) {
-                u64 get_domains;
-                enum intel_display_power_domain domain;
                 struct intel_crtc_state *crtc_state;
 
                 if (!encoder->get_power_domains)
@@ -16001,9 +15999,7 @@ get_encoder_power_domains(struct drm_i915_private *dev_priv)
                         continue;
 
                 crtc_state = to_intel_crtc_state(encoder->base.crtc->state);
-                get_domains = encoder->get_power_domains(encoder, crtc_state);
-                for_each_power_domain(domain, get_domains)
-                        intel_display_power_get(dev_priv, domain);
+                encoder->get_power_domains(encoder, crtc_state);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cf709835fb9a..48da4a969a0a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1859,42 +1859,6 @@ intel_dp_compute_link_config_wide(struct intel_dp *intel_dp,
         return -EINVAL;
 }
 
-/* Optimize link config in order: max bpp, min lanes, min clock */
-static int
-intel_dp_compute_link_config_fast(struct intel_dp *intel_dp,
-                                  struct intel_crtc_state *pipe_config,
-                                  const struct link_config_limits *limits)
-{
-        struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
-        int bpp, clock, lane_count;
-        int mode_rate, link_clock, link_avail;
-
-        for (bpp = limits->max_bpp; bpp >= limits->min_bpp; bpp -= 2 * 3) {
-                mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
-                                                   bpp);
-
-                for (lane_count = limits->min_lane_count;
-                     lane_count <= limits->max_lane_count;
-                     lane_count <<= 1) {
-                        for (clock = limits->min_clock; clock <= limits->max_clock; clock++) {
-                                link_clock = intel_dp->common_rates[clock];
-                                link_avail = intel_dp_max_data_rate(link_clock,
-                                                                    lane_count);
-
-                                if (mode_rate <= link_avail) {
-                                        pipe_config->lane_count = lane_count;
-                                        pipe_config->pipe_bpp = bpp;
-                                        pipe_config->port_clock = link_clock;
-
-                                        return 0;
-                                }
-                        }
-                }
-        }
-
-        return -EINVAL;
-}
-
 static int intel_dp_dsc_compute_bpp(struct intel_dp *intel_dp, u8 dsc_max_bpc)
 {
         int i, num_bpc;
@@ -1922,6 +1886,9 @@ static int intel_dp_dsc_compute_config(struct intel_dp *intel_dp,
         int pipe_bpp;
         int ret;
 
+        pipe_config->fec_enable = !intel_dp_is_edp(intel_dp) &&
+                intel_dp_supports_fec(intel_dp, pipe_config);
+
         if (!intel_dp_supports_dsc(intel_dp, pipe_config))
                 return -EINVAL;
 
@@ -2031,15 +1998,13 @@ intel_dp_compute_link_config(struct intel_encoder *encoder,
         limits.min_bpp = 6 * 3;
         limits.max_bpp = intel_dp_compute_bpp(intel_dp, pipe_config);
 
-        if (intel_dp_is_edp(intel_dp) && intel_dp->edp_dpcd[0] < DP_EDP_14) {
+        if (intel_dp_is_edp(intel_dp)) {
                 /*
                  * Use the maximum clock and number of lanes the eDP panel
-                 * advertizes being capable of. The eDP 1.3 and earlier panels
-                 * are generally designed to support only a single clock and
-                 * lane configuration, and typically these values correspond to
-                 * the native resolution of the panel. With eDP 1.4 rate select
-                 * and DSC, this is decreasingly the case, and we need to be
-                 * able to select less than maximum link config.
+                 * advertizes being capable of. The panels are generally
+                 * designed to support only a single clock and lane
+                 * configuration, and typically these values correspond to the
+                 * native resolution of the panel.
                  */
                 limits.min_lane_count = limits.max_lane_count;
                 limits.min_clock = limits.max_clock;
@@ -2053,22 +2018,11 @@ intel_dp_compute_link_config(struct intel_encoder *encoder,
                       intel_dp->common_rates[limits.max_clock],
                       limits.max_bpp, adjusted_mode->crtc_clock);
 
-        if (intel_dp_is_edp(intel_dp))
-                /*
-                 * Optimize for fast and narrow. eDP 1.3 section 3.3 and eDP 1.4
-                 * section A.1: "It is recommended that the minimum number of
-                 * lanes be used, using the minimum link rate allowed for that
-                 * lane configuration."
-                 *
-                 * Note that we use the max clock and lane count for eDP 1.3 and
-                 * earlier, and fast vs. wide is irrelevant.
-                 */
-                ret = intel_dp_compute_link_config_fast(intel_dp, pipe_config,
-                                                        &limits);
-        else
-                /* Optimize for slow and wide. */
-                ret = intel_dp_compute_link_config_wide(intel_dp, pipe_config,
-                                                        &limits);
+        /*
+         * Optimize for slow and wide. This is the place to add alternative
+         * optimization policy.
+         */
+        ret = intel_dp_compute_link_config_wide(intel_dp, pipe_config, &limits);
 
         /* enable compression if the mode doesn't fit available BW */
         DRM_DEBUG_KMS("Force DSC en = %d\n", intel_dp->force_dsc_en);
@@ -2165,9 +2119,6 @@ intel_dp_compute_config(struct intel_encoder *encoder,
         if (adjusted_mode->flags & DRM_MODE_FLAG_DBLCLK)
                 return -EINVAL;
 
-        pipe_config->fec_enable = !intel_dp_is_edp(intel_dp) &&
-                                  intel_dp_supports_fec(intel_dp, pipe_config);
-
         ret = intel_dp_compute_link_config(encoder, pipe_config, conn_state);
         if (ret < 0)
                 return ret;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 15db41394b9e..d5660ac1b0d6 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -270,10 +270,12 @@ struct intel_encoder {
          * be set correctly before calling this function. */
         void (*get_config)(struct intel_encoder *,
                            struct intel_crtc_state *pipe_config);
-        /* Returns a mask of power domains that need to be referenced as part
-         * of the hardware state readout code. */
-        u64 (*get_power_domains)(struct intel_encoder *encoder,
-                                 struct intel_crtc_state *crtc_state);
+        /*
+         * Acquires the power domains needed for an active encoder during
+         * hardware state readout.
+         */
+        void (*get_power_domains)(struct intel_encoder *encoder,
+                                  struct intel_crtc_state *crtc_state);
         /*
          * Called during system suspend after all pending requests for the
          * encoder are flushed (for example for DP AUX transactions) and
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index e8f694b57b8a..376ffe842e26 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -338,8 +338,8 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                                     bool *enabled, int width, int height)
 {
         struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
+        unsigned long conn_configured, conn_seq, mask;
         unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
-        unsigned long conn_configured, conn_seq;
         int i, j;
         bool *save_enabled;
         bool fallback = true, ret = true;
@@ -357,9 +357,10 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                 drm_modeset_backoff(&ctx);
 
         memcpy(save_enabled, enabled, count);
-        conn_seq = GENMASK(count - 1, 0);
+        mask = GENMASK(count - 1, 0);
         conn_configured = 0;
 retry:
+        conn_seq = conn_configured;
         for (i = 0; i < count; i++) {
                 struct drm_fb_helper_connector *fb_conn;
                 struct drm_connector *connector;
@@ -372,8 +373,7 @@ retry:
                 if (conn_configured & BIT(i))
                         continue;
 
-                /* First pass, only consider tiled connectors */
-                if (conn_seq == GENMASK(count - 1, 0) && !connector->has_tile)
+                if (conn_seq == 0 && !connector->has_tile)
                         continue;
 
                 if (connector->status == connector_status_connected)
@@ -477,10 +477,8 @@ retry:
                 conn_configured |= BIT(i);
         }
 
-        if (conn_configured != conn_seq) { /* repeat until no more are found */
-                conn_seq = conn_configured;
+        if ((conn_configured & mask) != mask && conn_configured != conn_seq)
                 goto retry;
-        }
 
         /*
          * If the BIOS didn't enable everything it could, fall back to have the
diff --git a/drivers/gpu/drm/i915/vlv_dsi.c b/drivers/gpu/drm/i915/vlv_dsi.c
index 6403728fe778..31c93c3ccd00 100644
--- a/drivers/gpu/drm/i915/vlv_dsi.c
+++ b/drivers/gpu/drm/i915/vlv_dsi.c
@@ -256,6 +256,28 @@ static void band_gap_reset(struct drm_i915_private *dev_priv)
         mutex_unlock(&dev_priv->sb_lock);
 }
 
+static int bdw_get_pipemisc_bpp(struct intel_crtc *crtc)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        u32 tmp;
+
+        tmp = I915_READ(PIPEMISC(crtc->pipe));
+
+        switch (tmp & PIPEMISC_DITHER_BPC_MASK) {
+        case PIPEMISC_DITHER_6_BPC:
+                return 18;
+        case PIPEMISC_DITHER_8_BPC:
+                return 24;
+        case PIPEMISC_DITHER_10_BPC:
+                return 30;
+        case PIPEMISC_DITHER_12_BPC:
+                return 36;
+        default:
+                MISSING_CASE(tmp);
+                return 0;
+        }
+}
+
 static int intel_dsi_compute_config(struct intel_encoder *encoder,
                                     struct intel_crtc_state *pipe_config,
                                     struct drm_connector_state *conn_state)
@@ -1071,6 +1093,8 @@ static void bxt_dsi_get_pipe_config(struct intel_encoder *encoder,
         bpp = mipi_dsi_pixel_format_to_bpp(
                         pixel_format_from_register_bits(fmt));
 
+        pipe_config->pipe_bpp = bdw_get_pipemisc_bpp(crtc);
+
         /* Enable Frame time stamo based scanline reporting */
         adjusted_mode->private_flags |=
                         I915_MODE_FLAG_GET_SCANLINE_FROM_TIMESTAMP;
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index ec3602ebbc1c..54011df8c2e8 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -71,7 +71,7 @@ static void ipu_crtc_disable_planes(struct ipu_crtc *ipu_crtc,
         if (disable_partial)
                 ipu_plane_disable(ipu_crtc->plane[1], true);
         if (disable_full)
-                ipu_plane_disable(ipu_crtc->plane[0], false);
+                ipu_plane_disable(ipu_crtc->plane[0], true);
 }
 
 static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c
index 22e68a100e7b..5d333138f913 100644
--- a/drivers/gpu/drm/mediatek/mtk_dpi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c
@@ -662,13 +662,11 @@ static unsigned int mt8173_calculate_factor(int clock)
 static unsigned int mt2701_calculate_factor(int clock)
 {
         if (clock <= 64000)
-                return 16;
-        else if (clock <= 128000)
-                return 8;
-        else if (clock <= 256000)
                 return 4;
-        else
+        else if (clock <= 128000)
                 return 2;
+        else
+                return 1;
 }
 
 static const struct mtk_dpi_conf mt8173_conf = {
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index cf59ea9bccfd..57ce4708ef1b 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -15,6 +15,7 @@
 #include <drm/drmP.h>
 #include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
+#include <drm/drm_fb_helper.h>
 #include <drm/drm_gem.h>
 #include <drm/drm_gem_cma_helper.h>
 #include <drm/drm_of.h>
@@ -341,6 +342,8 @@ static struct drm_driver mtk_drm_driver = {
         .gem_prime_get_sg_table = mtk_gem_prime_get_sg_table,
         .gem_prime_import_sg_table = mtk_gem_prime_import_sg_table,
         .gem_prime_mmap = mtk_drm_gem_mmap_buf,
+        .gem_prime_vmap = mtk_drm_gem_prime_vmap,
+        .gem_prime_vunmap = mtk_drm_gem_prime_vunmap,
         .fops = &mtk_drm_fops,
 
         .name = DRIVER_NAME,
@@ -376,6 +379,10 @@ static int mtk_drm_bind(struct device *dev)
         if (ret < 0)
                 goto err_deinit;
 
+        ret = drm_fbdev_generic_setup(drm, 32);
+        if (ret)
+                DRM_ERROR("Failed to initialize fbdev: %d\n", ret);
+
         return 0;
 
 err_deinit:
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index 259b7b0de1d2..38483e9ee071 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -241,3 +241,49 @@ err_gem_free:
         kfree(mtk_gem);
         return ERR_PTR(ret);
 }
+
+void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj)
+{
+        struct mtk_drm_gem_obj *mtk_gem = to_mtk_gem_obj(obj);
+        struct sg_table *sgt;
+        struct sg_page_iter iter;
+        unsigned int npages;
+        unsigned int i = 0;
+
+        if (mtk_gem->kvaddr)
+                return mtk_gem->kvaddr;
+
+        sgt = mtk_gem_prime_get_sg_table(obj);
+        if (IS_ERR(sgt))
+                return NULL;
+
+        npages = obj->size >> PAGE_SHIFT;
+        mtk_gem->pages = kcalloc(npages, sizeof(*mtk_gem->pages), GFP_KERNEL);
+        if (!mtk_gem->pages)
+                goto out;
+
+        for_each_sg_page(sgt->sgl, &iter, sgt->orig_nents, 0) {
+                mtk_gem->pages[i++] = sg_page_iter_page(&iter);
+                if (i > npages)
+                        break;
+        }
+        mtk_gem->kvaddr = vmap(mtk_gem->pages, npages, VM_MAP,
+                               pgprot_writecombine(PAGE_KERNEL));
+
+out:
+        kfree((void *)sgt);
+
+        return mtk_gem->kvaddr;
+}
+
+void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
+{
+        struct mtk_drm_gem_obj *mtk_gem = to_mtk_gem_obj(obj);
+
+        if (!mtk_gem->pages)
+                return;
+
+        vunmap(vaddr);
+        mtk_gem->kvaddr = 0;
+        kfree((void *)mtk_gem->pages);
+}
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.h b/drivers/gpu/drm/mediatek/mtk_drm_gem.h
index 534639b43a1c..c047a7ef294f 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.h
@@ -37,6 +37,7 @@ struct mtk_drm_gem_obj {
         dma_addr_t              dma_addr;
         unsigned long           dma_attrs;
         struct sg_table         *sg;
+        struct page             **pages;
 };
 
 #define to_mtk_gem_obj(x)       container_of(x, struct mtk_drm_gem_obj, base)
@@ -52,5 +53,7 @@ int mtk_drm_gem_mmap_buf(struct drm_gem_object *obj,
 struct sg_table *mtk_gem_prime_get_sg_table(struct drm_gem_object *obj);
 struct drm_gem_object *mtk_gem_prime_import_sg_table(struct drm_device *dev,
                         struct dma_buf_attachment *attach, struct sg_table *sg);
+void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj);
+void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 
 #endif
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 915cc84621ae..e04e6c293d39 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1480,7 +1480,6 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
         if (IS_ERR(regmap))
                 ret = PTR_ERR(regmap);
         if (ret) {
-                ret = PTR_ERR(regmap);
                 dev_err(dev,
                         "Failed to get system configuration registers: %d\n",
                         ret);
@@ -1516,6 +1515,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
         of_node_put(remote);
 
         hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
+        of_node_put(i2c_np);
         if (!hdmi->ddc_adpt) {
                 dev_err(dev, "Failed to get ddc i2c adapter by node\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
index 4ef9c57ffd44..5223498502c4 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
@@ -15,28 +15,6 @@ static const struct phy_ops mtk_hdmi_phy_dev_ops = {
         .owner = THIS_MODULE,
 };
 
-long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
-                             unsigned long *parent_rate)
-{
-        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
-
-        hdmi_phy->pll_rate = rate;
-        if (rate <= 74250000)
-                *parent_rate = rate;
-        else
-                *parent_rate = rate / 2;
-
-        return rate;
-}
-
-unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
-                                       unsigned long parent_rate)
-{
-        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
-
-        return hdmi_phy->pll_rate;
-}
-
 void mtk_hdmi_phy_clear_bits(struct mtk_hdmi_phy *hdmi_phy, u32 offset,
                              u32 bits)
 {
@@ -110,13 +88,11 @@ mtk_hdmi_phy_dev_get_ops(const struct mtk_hdmi_phy *hdmi_phy)
                 return NULL;
 }
 
-static void mtk_hdmi_phy_clk_get_ops(struct mtk_hdmi_phy *hdmi_phy,
-                                     const struct clk_ops **ops)
+static void mtk_hdmi_phy_clk_get_data(struct mtk_hdmi_phy *hdmi_phy,
+                                      struct clk_init_data *clk_init)
 {
-        if (hdmi_phy && hdmi_phy->conf && hdmi_phy->conf->hdmi_phy_clk_ops)
-                *ops = hdmi_phy->conf->hdmi_phy_clk_ops;
-        else
-                dev_err(hdmi_phy->dev, "Failed to get clk ops of phy\n");
+        clk_init->flags = hdmi_phy->conf->flags;
+        clk_init->ops = hdmi_phy->conf->hdmi_phy_clk_ops;
 }
 
 static int mtk_hdmi_phy_probe(struct platform_device *pdev)
@@ -129,7 +105,6 @@ static int mtk_hdmi_phy_probe(struct platform_device *pdev)
         struct clk_init_data clk_init = {
                 .num_parents = 1,
                 .parent_names = (const char * const *)&ref_clk_name,
-                .flags = CLK_SET_RATE_PARENT | CLK_SET_RATE_GATE,
         };
 
         struct phy *phy;
@@ -167,7 +142,7 @@ static int mtk_hdmi_phy_probe(struct platform_device *pdev)
         hdmi_phy->dev = dev;
         hdmi_phy->conf =
                 (struct mtk_hdmi_phy_conf *)of_device_get_match_data(dev);
-        mtk_hdmi_phy_clk_get_ops(hdmi_phy, &clk_init.ops);
+        mtk_hdmi_phy_clk_get_data(hdmi_phy, &clk_init);
         hdmi_phy->pll_hw.init = &clk_init;
         hdmi_phy->pll = devm_clk_register(dev, &hdmi_phy->pll_hw);
         if (IS_ERR(hdmi_phy->pll)) {
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h
index f39b1fc66612..2d8b3182470d 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h
@@ -21,6 +21,7 @@ struct mtk_hdmi_phy;
 
 struct mtk_hdmi_phy_conf {
         bool tz_disabled;
+        unsigned long flags;
         const struct clk_ops *hdmi_phy_clk_ops;
         void (*hdmi_phy_enable_tmds)(struct mtk_hdmi_phy *hdmi_phy);
         void (*hdmi_phy_disable_tmds)(struct mtk_hdmi_phy *hdmi_phy);
@@ -48,10 +49,6 @@ void mtk_hdmi_phy_set_bits(struct mtk_hdmi_phy *hdmi_phy, u32 offset,
 void mtk_hdmi_phy_mask(struct mtk_hdmi_phy *hdmi_phy, u32 offset,
                        u32 val, u32 mask);
 struct mtk_hdmi_phy *to_mtk_hdmi_phy(struct clk_hw *hw);
-long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
-                             unsigned long *parent_rate);
-unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
-                                       unsigned long parent_rate);
 
 extern struct platform_driver mtk_hdmi_phy_driver;
 extern struct mtk_hdmi_phy_conf mtk_hdmi_phy_8173_conf;
diff --git a/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c
index fcc42dc6ea7f..d3cc4022e988 100644
--- a/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c
@@ -79,7 +79,6 @@ static int mtk_hdmi_pll_prepare(struct clk_hw *hw)
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
         usleep_range(80, 100);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
-        mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
@@ -94,7 +93,6 @@ static void mtk_hdmi_pll_unprepare(struct clk_hw *hw)
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
-        mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
         usleep_range(80, 100);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
@@ -108,6 +106,12 @@ static void mtk_hdmi_pll_unprepare(struct clk_hw *hw)
         usleep_range(80, 100);
 }
 
+static long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+                                    unsigned long *parent_rate)
+{
+        return rate;
+}
+
 static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                                  unsigned long parent_rate)
 {
@@ -116,13 +120,14 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 
         if (rate <= 64000000)
                 pos_div = 3;
-        else if (rate <= 12800000)
-                pos_div = 1;
+        else if (rate <= 128000000)
+                pos_div = 2;
         else
                 pos_div = 1;
 
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON6, RG_HTPLL_PREDIV_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON6, RG_HTPLL_POSDIV_MASK);
+        mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON6, (0x1 << RG_HTPLL_IC),
                           RG_HTPLL_IC_MASK);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON6, (0x1 << RG_HTPLL_IR),
@@ -154,6 +159,39 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
         return 0;
 }
 
+static unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
+                                              unsigned long parent_rate)
+{
+        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
+        unsigned long out_rate, val;
+
+        val = (readl(hdmi_phy->regs + HDMI_CON6)
+               & RG_HTPLL_PREDIV_MASK) >> RG_HTPLL_PREDIV;
+        switch (val) {
+        case 0x00:
+                out_rate = parent_rate;
+                break;
+        case 0x01:
+                out_rate = parent_rate / 2;
+                break;
+        default:
+                out_rate = parent_rate / 4;
+                break;
+        }
+
+        val = (readl(hdmi_phy->regs + HDMI_CON6)
+               & RG_HTPLL_FBKDIV_MASK) >> RG_HTPLL_FBKDIV;
+        out_rate *= (val + 1) * 2;
+        val = (readl(hdmi_phy->regs + HDMI_CON2)
+               & RG_HDMITX_TX_POSDIV_MASK);
+        out_rate >>= (val >> RG_HDMITX_TX_POSDIV);
+
+        if (readl(hdmi_phy->regs + HDMI_CON2) & RG_HDMITX_EN_TX_POSDIV)
+                out_rate /= 5;
+
+        return out_rate;
+}
+
 static const struct clk_ops mtk_hdmi_phy_pll_ops = {
         .prepare = mtk_hdmi_pll_prepare,
         .unprepare = mtk_hdmi_pll_unprepare,
@@ -174,7 +212,6 @@ static void mtk_hdmi_phy_enable_tmds(struct mtk_hdmi_phy *hdmi_phy)
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
         usleep_range(80, 100);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
-        mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
@@ -186,7 +223,6 @@ static void mtk_hdmi_phy_disable_tmds(struct mtk_hdmi_phy *hdmi_phy)
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
-        mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
         usleep_range(80, 100);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
@@ -202,6 +238,7 @@ static void mtk_hdmi_phy_disable_tmds(struct mtk_hdmi_phy *hdmi_phy)
 
 struct mtk_hdmi_phy_conf mtk_hdmi_phy_2701_conf = {
         .tz_disabled = true,
+        .flags = CLK_SET_RATE_GATE,
         .hdmi_phy_clk_ops = &mtk_hdmi_phy_pll_ops,
         .hdmi_phy_enable_tmds = mtk_hdmi_phy_enable_tmds,
         .hdmi_phy_disable_tmds = mtk_hdmi_phy_disable_tmds,
diff --git a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
index ed5916b27658..47f8a2951682 100644
--- a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
@@ -199,6 +199,20 @@ static void mtk_hdmi_pll_unprepare(struct clk_hw *hw)
         usleep_range(100, 150);
 }
 
+static long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+                                    unsigned long *parent_rate)
+{
+        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
+
+        hdmi_phy->pll_rate = rate;
+        if (rate <= 74250000)
+                *parent_rate = rate;
+        else
+                *parent_rate = rate / 2;
+
+        return rate;
+}
+
 static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                                  unsigned long parent_rate)
 {
@@ -285,6 +299,14 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
         return 0;
 }
 
+static unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
+                                              unsigned long parent_rate)
+{
+        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
+
+        return hdmi_phy->pll_rate;
+}
+
 static const struct clk_ops mtk_hdmi_phy_pll_ops = {
         .prepare = mtk_hdmi_pll_prepare,
         .unprepare = mtk_hdmi_pll_unprepare,
@@ -309,6 +331,7 @@ static void mtk_hdmi_phy_disable_tmds(struct mtk_hdmi_phy *hdmi_phy)
 }
 
 struct mtk_hdmi_phy_conf mtk_hdmi_phy_8173_conf = {
+        .flags = CLK_SET_RATE_PARENT | CLK_SET_RATE_GATE,
         .hdmi_phy_clk_ops = &mtk_hdmi_phy_pll_ops,
         .hdmi_phy_enable_tmds = mtk_hdmi_phy_enable_tmds,
         .hdmi_phy_disable_tmds = mtk_hdmi_phy_disable_tmds,
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
index 340383150fb9..ebf9c96d43ee 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
@@ -175,6 +175,7 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
                 REG_FLD_MOD(core->base, HDMI_CORE_SYS_INTR_UNMASK4, 0, 3, 3);
                 hdmi_wp_clear_irqenable(core->wp, HDMI_IRQ_CORE);
                 hdmi_wp_set_irqstatus(core->wp, HDMI_IRQ_CORE);
+                REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
                 hdmi4_core_disable(core);
                 return 0;
         }
@@ -182,16 +183,24 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
         if (err)
                 return err;
 
+        /*
+         * Initialize CEC clock divider: CEC needs 2MHz clock hence
+         * set the divider to 24 to get 48/24=2MHz clock
+         */
+        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
+
         /* Clear TX FIFO */
         if (!hdmi_cec_clear_tx_fifo(adap)) {
                 pr_err("cec-%s: could not clear TX FIFO\n", adap->name);
-                return -EIO;
+                err = -EIO;
+                goto err_disable_clk;
         }
 
         /* Clear RX FIFO */
         if (!hdmi_cec_clear_rx_fifo(adap)) {
                 pr_err("cec-%s: could not clear RX FIFO\n", adap->name);
-                return -EIO;
+                err = -EIO;
+                goto err_disable_clk;
         }
 
         /* Clear CEC interrupts */
@@ -236,6 +245,12 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
                 hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_1, temp);
         }
         return 0;
+
+err_disable_clk:
+        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
+        hdmi4_core_disable(core);
+
+        return err;
 }
 
 static int hdmi_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr)
@@ -333,11 +348,8 @@ int hdmi4_cec_init(struct platform_device *pdev, struct hdmi_core_data *core,
                 return ret;
         core->wp = wp;
 
-        /*
-         * Initialize CEC clock divider: CEC needs 2MHz clock hence
-         * set the devider to 24 to get 48/24=2MHz clock
-         */
-        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
+        /* Disable clock initially, hdmi_cec_adap_enable() manages it */
+        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
 
         ret = cec_register_adapter(core->adap, &pdev->dev);
         if (ret < 0) {
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
index 813ba42f2753..e384b95ad857 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
@@ -708,7 +708,7 @@ int hdmi4_audio_config(struct hdmi_core_data *core, struct hdmi_wp_data *wp,
         else
                 acore.i2s_cfg.justification = HDMI_AUDIO_JUSTIFY_RIGHT;
         /*
-         * The I2S input word length is twice the lenght given in the IEC-60958
+         * The I2S input word length is twice the length given in the IEC-60958
          * status word. If the word size is greater than
          * 20 bits, increment by one.
          */
diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 19fc601c9eeb..a1bec2779e76 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -366,10 +366,9 @@ void drm_sched_increase_karma(struct drm_sched_job *bad)
 EXPORT_SYMBOL(drm_sched_increase_karma);
 
 /**
- * drm_sched_hw_job_reset - stop the scheduler if it contains the bad job
+ * drm_sched_stop - stop the scheduler
  *
  * @sched: scheduler instance
- * @bad: bad scheduler job
  *
  */
 void drm_sched_stop(struct drm_gpu_scheduler *sched)
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 3ebd9f5e2719..29258b404e54 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -16,6 +16,7 @@
 #include <linux/of_reserved_mem.h>
 
 #include <drm/drmP.h>
+#include <drm/drm_atomic_helper.h>
 #include <drm/drm_fb_cma_helper.h>
 #include <drm/drm_fb_helper.h>
 #include <drm/drm_gem_cma_helper.h>
@@ -85,6 +86,8 @@ static int sun4i_drv_bind(struct device *dev)
                 ret = -ENOMEM;
                 goto free_drm;
         }
+
+        dev_set_drvdata(dev, drm);
         drm->dev_private = drv;
         INIT_LIST_HEAD(&drv->frontend_list);
         INIT_LIST_HEAD(&drv->engine_list);
@@ -144,8 +147,12 @@ static void sun4i_drv_unbind(struct device *dev)
 
         drm_dev_unregister(drm);
         drm_kms_helper_poll_fini(drm);
+        drm_atomic_helper_shutdown(drm);
         drm_mode_config_cleanup(drm);
+
+        component_unbind_all(dev, NULL);
         of_reserved_mem_device_release(dev);
+
         drm_dev_put(drm);
 }
 
@@ -395,6 +402,8 @@ static int sun4i_drv_probe(struct platform_device *pdev)
 
 static int sun4i_drv_remove(struct platform_device *pdev)
 {
+        component_master_del(&pdev->dev, &sun4i_drv_master_ops);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
index dc47720c99ba..39d8509d96a0 100644
--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
@@ -48,8 +48,13 @@ static enum drm_mode_status
 sun8i_dw_hdmi_mode_valid_h6(struct drm_connector *connector,
                             const struct drm_display_mode *mode)
 {
-        /* This is max for HDMI 2.0b (4K@60Hz) */
-        if (mode->clock > 594000)
+        /*
+         * Controller support maximum of 594 MHz, which correlates to
+         * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than
+         * 340 MHz scrambling has to be enabled. Because scrambling is
+         * not yet implemented, just limit to 340 MHz for now.
+         */
+        if (mode->clock > 340000)
                 return MODE_CLOCK_HIGH;
 
         return MODE_OK;
diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
index fc36e0c10a37..b1e7c76e9c17 100644
--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
@@ -227,7 +227,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
 
 err_unregister_gates:
         for (i = 0; i < CLK_NUM; i++)
-                if (clk_data->hws[i])
+                if (!IS_ERR_OR_NULL(clk_data->hws[i]))
                         clk_hw_unregister_gate(clk_data->hws[i]);
         clk_disable_unprepare(tcon_top->bus);
 err_assert_reset:
@@ -245,7 +245,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master,
 
         of_clk_del_provider(dev->of_node);
         for (i = 0; i < CLK_NUM; i++)
-                clk_hw_unregister_gate(clk_data->hws[i]);
+                if (clk_data->hws[i])
+                        clk_hw_unregister_gate(clk_data->hws[i]);
 
         clk_disable_unprepare(tcon_top->bus);
         reset_control_assert(tcon_top->rst);
diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
index 47c55974756d..d23c4bfde790 100644
--- a/drivers/gpu/drm/tegra/hdmi.c
+++ b/drivers/gpu/drm/tegra/hdmi.c
@@ -1260,9 +1260,15 @@ static void tegra_hdmi_encoder_enable(struct drm_encoder *encoder)
 
         hdmi->dvi = !tegra_output_is_hdmi(output);
         if (!hdmi->dvi) {
-                err = tegra_hdmi_setup_audio(hdmi);
-                if (err < 0)
-                        hdmi->dvi = true;
+                /*
+                 * Make sure that the audio format has been configured before
+                 * enabling audio, otherwise we may try to divide by zero.
+                */
+                if (hdmi->format.sample_rate > 0) {
+                        err = tegra_hdmi_setup_audio(hdmi);
+                        if (err < 0)
+                                hdmi->dvi = true;
+                }
         }
 
         if (hdmi->config->has_hda)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 3f56647cdb35..1a01669b159a 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -49,9 +49,8 @@ static void ttm_bo_global_kobj_release(struct kobject *kobj);
  * ttm_global_mutex - protecting the global BO state
  */
 DEFINE_MUTEX(ttm_global_mutex);
-struct ttm_bo_global ttm_bo_glob = {
-        .use_count = 0
-};
+unsigned ttm_bo_glob_use_count;
+struct ttm_bo_global ttm_bo_glob;
 
 static struct attribute ttm_bo_count = {
         .name = "bo_count",
@@ -876,8 +875,10 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo,
                 reservation_object_add_shared_fence(bo->resv, fence);
 
                 ret = reservation_object_reserve_shared(bo->resv, 1);
-                if (unlikely(ret))
+                if (unlikely(ret)) {
+                        dma_fence_put(fence);
                         return ret;
+                }
 
                 dma_fence_put(bo->moving);
                 bo->moving = fence;
@@ -1529,12 +1530,13 @@ static void ttm_bo_global_release(void)
         struct ttm_bo_global *glob = &ttm_bo_glob;
 
         mutex_lock(&ttm_global_mutex);
-        if (--glob->use_count > 0)
+        if (--ttm_bo_glob_use_count > 0)
                 goto out;
 
         kobject_del(&glob->kobj);
         kobject_put(&glob->kobj);
         ttm_mem_global_release(&ttm_mem_glob);
+        memset(glob, 0, sizeof(*glob));
 out:
         mutex_unlock(&ttm_global_mutex);
 }
@@ -1546,7 +1548,7 @@ static int ttm_bo_global_init(void)
         unsigned i;
 
         mutex_lock(&ttm_global_mutex);
-        if (++glob->use_count > 1)
+        if (++ttm_bo_glob_use_count > 1)
                 goto out;
 
         ret = ttm_mem_global_init(&ttm_mem_glob);
diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
index f1567c353b54..9a0909decb36 100644
--- a/drivers/gpu/drm/ttm/ttm_memory.c
+++ b/drivers/gpu/drm/ttm/ttm_memory.c
@@ -461,8 +461,8 @@ out_no_zone:
 
 void ttm_mem_global_release(struct ttm_mem_global *glob)
 {
-        unsigned int i;
         struct ttm_mem_zone *zone;
+        unsigned int i;
 
         /* let the page allocator first stop the shrink work. */
         ttm_page_alloc_fini();
@@ -475,9 +475,10 @@ void ttm_mem_global_release(struct ttm_mem_global *glob)
                 zone = glob->zones[i];
                 kobject_del(&zone->kobj);
                 kobject_put(&zone->kobj);
-                        }
+        }
         kobject_del(&glob->kobj);
         kobject_put(&glob->kobj);
+        memset(glob, 0, sizeof(*glob));
 }
 
 static void ttm_check_swapping(struct ttm_mem_global *glob)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index f841accc2c00..627f8dc91d0e 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -730,9 +730,10 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
                         }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-                        if (!(flags & TTM_PAGE_FLAG_DMA32)) {
-                                for (j = 0; j < HPAGE_PMD_NR; ++j)
-                                        if (p++ != pages[i + j])
+                        if (!(flags & TTM_PAGE_FLAG_DMA32) &&
+                            (npages - i) >= HPAGE_PMD_NR) {
+                                for (j = 1; j < HPAGE_PMD_NR; ++j)
+                                        if (++p != pages[i + j])
                                             break;
 
                                 if (j == HPAGE_PMD_NR)
@@ -759,15 +760,15 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
                 unsigned max_size, n2free;
 
                 spin_lock_irqsave(&huge->lock, irq_flags);
-                while (i < npages) {
+                while ((npages - i) >= HPAGE_PMD_NR) {
                         struct page *p = pages[i];
                         unsigned j;
 
                         if (!p)
                                 break;
 
-                        for (j = 0; j < HPAGE_PMD_NR; ++j)
-                                if (p++ != pages[i + j])
+                        for (j = 1; j < HPAGE_PMD_NR; ++j)
+                                if (++p != pages[i + j])
                                     break;
 
                         if (j != HPAGE_PMD_NR)
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 22cd2d13e272..ff47f890e6ad 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -52,6 +52,7 @@ static struct drm_driver driver = {
         .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
         .load = udl_driver_load,
         .unload = udl_driver_unload,
+        .release = udl_driver_release,
 
         /* gem hooks */
         .gem_free_object_unlocked = udl_gem_free_object,
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index e9e9b1ff678e..4ae67d882eae 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -104,6 +104,7 @@ void udl_urb_completion(struct urb *urb);
 
 int udl_driver_load(struct drm_device *dev, unsigned long flags);
 void udl_driver_unload(struct drm_device *dev);
+void udl_driver_release(struct drm_device *dev);
 
 int udl_fbdev_init(struct drm_device *dev);
 void udl_fbdev_cleanup(struct drm_device *dev);
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 9086d0d1b880..1f8ef34ade24 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -379,6 +379,12 @@ void udl_driver_unload(struct drm_device *dev)
                 udl_free_urb_list(dev);
 
         udl_fbdev_cleanup(dev);
-        udl_modeset_cleanup(dev);
         kfree(udl);
 }
+
+void udl_driver_release(struct drm_device *dev)
+{
+        udl_modeset_cleanup(dev);
+        drm_dev_fini(dev);
+        kfree(dev);
+}
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 730008d3da76..1baa10e94484 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -1042,7 +1042,7 @@ static void
 vc4_crtc_reset(struct drm_crtc *crtc)
 {
         if (crtc->state)
-                __drm_atomic_helper_crtc_destroy_state(crtc->state);
+                vc4_crtc_destroy_state(crtc, crtc->state);
 
         crtc->state = kzalloc(sizeof(struct vc4_crtc_state), GFP_KERNEL);
         if (crtc->state)
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
index b996ac1d4fcc..af92964b6889 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
@@ -205,10 +205,14 @@ static struct drm_driver driver = {
 #if defined(CONFIG_DEBUG_FS)
         .debugfs_init = virtio_gpu_debugfs_init,
 #endif
+        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
+        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
         .gem_prime_export = drm_gem_prime_export,
         .gem_prime_import = drm_gem_prime_import,
         .gem_prime_pin = virtgpu_gem_prime_pin,
         .gem_prime_unpin = virtgpu_gem_prime_unpin,
+        .gem_prime_get_sg_table = virtgpu_gem_prime_get_sg_table,
+        .gem_prime_import_sg_table = virtgpu_gem_prime_import_sg_table,
         .gem_prime_vmap = virtgpu_gem_prime_vmap,
         .gem_prime_vunmap = virtgpu_gem_prime_vunmap,
         .gem_prime_mmap = virtgpu_gem_prime_mmap,
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 3238fdf58eb4..d577cb76f5ad 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -354,6 +354,10 @@ int virtio_gpu_object_wait(struct virtio_gpu_object *bo, bool no_wait);
 /* virtgpu_prime.c */
 int virtgpu_gem_prime_pin(struct drm_gem_object *obj);
 void virtgpu_gem_prime_unpin(struct drm_gem_object *obj);
+struct sg_table *virtgpu_gem_prime_get_sg_table(struct drm_gem_object *obj);
+struct drm_gem_object *virtgpu_gem_prime_import_sg_table(
+        struct drm_device *dev, struct dma_buf_attachment *attach,
+        struct sg_table *sgt);
 void *virtgpu_gem_prime_vmap(struct drm_gem_object *obj);
 void virtgpu_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int virtgpu_gem_prime_mmap(struct drm_gem_object *obj,
diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c
index c59ec34c80a5..eb51a78e1199 100644
--- a/drivers/gpu/drm/virtio/virtgpu_prime.c
+++ b/drivers/gpu/drm/virtio/virtgpu_prime.c
@@ -39,6 +39,18 @@ void virtgpu_gem_prime_unpin(struct drm_gem_object *obj)
         WARN_ONCE(1, "not implemented");
 }
 
+struct sg_table *virtgpu_gem_prime_get_sg_table(struct drm_gem_object *obj)
+{
+        return ERR_PTR(-ENODEV);
+}
+
+struct drm_gem_object *virtgpu_gem_prime_import_sg_table(
+        struct drm_device *dev, struct dma_buf_attachment *attach,
+        struct sg_table *table)
+{
+        return ERR_PTR(-ENODEV);
+}
+
 void *virtgpu_gem_prime_vmap(struct drm_gem_object *obj)
 {
         struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(obj);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6165fe2c4504..1bfa353d995c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -546,29 +546,13 @@ static void vmw_get_initial_size(struct vmw_private *dev_priv)
 }
 
 /**
- * vmw_assume_iommu - Figure out whether coherent dma-remapping might be
- * taking place.
- * @dev: Pointer to the struct drm_device.
- *
- * Return: true if iommu present, false otherwise.
- */
-static bool vmw_assume_iommu(struct drm_device *dev)
-{
-        const struct dma_map_ops *ops = get_dma_ops(dev->dev);
-
-        return !dma_is_direct(ops) && ops &&
-                ops->map_page != dma_direct_map_page;
-}
-
-/**
  * vmw_dma_select_mode - Determine how DMA mappings should be set up for this
  * system.
  *
  * @dev_priv: Pointer to a struct vmw_private
  *
- * This functions tries to determine the IOMMU setup and what actions
- * need to be taken by the driver to make system pages visible to the
- * device.
+ * This functions tries to determine what actions need to be taken by the
+ * driver to make system pages visible to the device.
  * If this function decides that DMA is not possible, it returns -EINVAL.
  * The driver may then try to disable features of the device that require
  * DMA.
@@ -578,23 +562,16 @@ static int vmw_dma_select_mode(struct vmw_private *dev_priv)
         static const char *names[vmw_dma_map_max] = {
                 [vmw_dma_phys] = "Using physical TTM page addresses.",
                 [vmw_dma_alloc_coherent] = "Using coherent TTM pages.",
-                [vmw_dma_map_populate] = "Keeping DMA mappings.",
+                [vmw_dma_map_populate] = "Caching DMA mappings.",
                 [vmw_dma_map_bind] = "Giving up DMA mappings early."};
 
         if (vmw_force_coherent)
                 dev_priv->map_mode = vmw_dma_alloc_coherent;
-        else if (vmw_assume_iommu(dev_priv->dev))
-                dev_priv->map_mode = vmw_dma_map_populate;
-        else if (!vmw_force_iommu)
-                dev_priv->map_mode = vmw_dma_phys;
-        else if (IS_ENABLED(CONFIG_SWIOTLB) && swiotlb_nr_tbl())
-                dev_priv->map_mode = vmw_dma_alloc_coherent;
+        else if (vmw_restrict_iommu)
+                dev_priv->map_mode = vmw_dma_map_bind;
         else
                 dev_priv->map_mode = vmw_dma_map_populate;
 
-        if (dev_priv->map_mode == vmw_dma_map_populate && vmw_restrict_iommu)
-                dev_priv->map_mode = vmw_dma_map_bind;
-
         /* No TTM coherent page pool? FIXME: Ask TTM instead! */
         if (!(IS_ENABLED(CONFIG_SWIOTLB) || IS_ENABLED(CONFIG_INTEL_IOMMU)) &&
             (dev_priv->map_mode == vmw_dma_alloc_coherent))
diff --git a/drivers/gpu/host1x/hw/channel_hw.c b/drivers/gpu/host1x/hw/channel_hw.c
index 27101c04a827..0c0eb43abf65 100644
--- a/drivers/gpu/host1x/hw/channel_hw.c
+++ b/drivers/gpu/host1x/hw/channel_hw.c
@@ -115,8 +115,12 @@ static inline void synchronize_syncpt_base(struct host1x_job *job)
 static void host1x_channel_set_streamid(struct host1x_channel *channel)
 {
 #if HOST1X_HW >= 6
+        u32 sid = 0x7f;
+#ifdef CONFIG_IOMMU_API
         struct iommu_fwspec *spec = dev_iommu_fwspec_get(channel->dev->parent);
-        u32 sid = spec ? spec->ids[0] & 0xffff : 0x7f;
+        if (spec)
+                sid = spec->ids[0] & 0xffff;
+#endif
 
         host1x_ch_writel(channel, sid, HOST1X_CHANNEL_SMMU_STREAMID);
 #endif
diff --git a/drivers/gpu/ipu-v3/ipu-dp.c b/drivers/gpu/ipu-v3/ipu-dp.c
index 9b2b3fa479c4..5e44ff1f2085 100644
--- a/drivers/gpu/ipu-v3/ipu-dp.c
+++ b/drivers/gpu/ipu-v3/ipu-dp.c
@@ -195,7 +195,8 @@ int ipu_dp_setup_channel(struct ipu_dp *dp,
                 ipu_dp_csc_init(flow, flow->foreground.in_cs, flow->out_cs,
                                 DP_COM_CONF_CSC_DEF_BOTH);
         } else {
-                if (flow->foreground.in_cs == flow->out_cs)
+                if (flow->foreground.in_cs == IPUV3_COLORSPACE_UNKNOWN ||
+                    flow->foreground.in_cs == flow->out_cs)
                         /*
                          * foreground identical to output, apply color
                          * conversion on background
@@ -261,6 +262,8 @@ void ipu_dp_disable_channel(struct ipu_dp *dp, bool sync)
         struct ipu_dp_priv *priv = flow->priv;
         u32 reg, csc;
 
+        dp->in_cs = IPUV3_COLORSPACE_UNKNOWN;
+
         if (!dp->foreground)
                 return;
 
@@ -268,8 +271,9 @@ void ipu_dp_disable_channel(struct ipu_dp *dp, bool sync)
 
         reg = readl(flow->base + DP_COM_CONF);
         csc = reg & DP_COM_CONF_CSC_DEF_MASK;
-        if (csc == DP_COM_CONF_CSC_DEF_FG)
-                reg &= ~DP_COM_CONF_CSC_DEF_MASK;
+        reg &= ~DP_COM_CONF_CSC_DEF_MASK;
+        if (csc == DP_COM_CONF_CSC_DEF_BOTH || csc == DP_COM_CONF_CSC_DEF_BG)
+                reg |= DP_COM_CONF_CSC_DEF_BG;
 
         reg &= ~DP_COM_CONF_FG_EN;
         writel(reg, flow->base + DP_COM_CONF);
@@ -347,6 +351,8 @@ int ipu_dp_init(struct ipu_soc *ipu, struct device *dev, unsigned long base)
         mutex_init(&priv->mutex);
 
         for (i = 0; i < IPUV3_NUM_FLOWS; i++) {
+                priv->flow[i].background.in_cs = IPUV3_COLORSPACE_UNKNOWN;
+                priv->flow[i].foreground.in_cs = IPUV3_COLORSPACE_UNKNOWN;
                 priv->flow[i].foreground.foreground = true;
                 priv->flow[i].base = priv->base + ipu_dp_flow_base[i];
                 priv->flow[i].priv = priv;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 6ca8d322b487..4ca0cdfa6b33 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -150,6 +150,7 @@ config HID_ASUS
         tristate "Asus"
         depends on LEDS_CLASS
         depends on ASUS_WMI || ASUS_WMI=n
+        select POWER_SUPPLY
         ---help---
         Support for Asus notebook built-in keyboard and touchpad via i2c, and
         the Asus Republic of Gamers laptop keyboard special keys.
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9993b692598f..860e21ec6a49 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1301,10 +1301,10 @@ static u32 __extract(u8 *report, unsigned offset, int n)
 u32 hid_field_extract(const struct hid_device *hid, u8 *report,
                         unsigned offset, unsigned n)
 {
-        if (n > 32) {
-                hid_warn(hid, "hid_field_extract() called with n (%d) > 32! (%s)\n",
+        if (n > 256) {
+                hid_warn(hid, "hid_field_extract() called with n (%d) > 256! (%s)\n",
                          n, current->comm);
-                n = 32;
+                n = 256;
         }
 
         return __extract(report, offset, n);
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index ac9fda1b5a72..1384e57182af 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p)
         seq_printf(f, "\n\n");
 
         /* dump parsed data and input mappings */
+        if (down_interruptible(&hdev->driver_input_lock))
+                return 0;
+
         hid_dump_device(hdev, f);
         seq_printf(f, "\n");
         hid_dump_input_mapping(hdev, f);
 
+        up(&hdev->driver_input_lock);
+
         return 0;
 }
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b6d93f4ad037..adce58f24f76 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1083,6 +1083,7 @@
 #define USB_DEVICE_ID_SYNAPTICS_HD      0x0ac3
 #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
 #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+#define I2C_DEVICE_ID_SYNAPTICS_7E7E    0x7e7e
 
 #define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047
 #define USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA     0x0855
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b10b1922c5bd..b607286a0bc8 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -680,6 +680,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                         break;
                 }
 
+                if ((usage->hid & 0xf0) == 0xb0) {      /* SC - Display */
+                        switch (usage->hid & 0xf) {
+                        case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break;
+                        default: goto ignore;
+                        }
+                        break;
+                }
+
                 /*
                  * Some lazy vendors declare 255 usages for System Control,
                  * leading to the creation of ABS_X|Y axis and too many others.
@@ -902,7 +910,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x06a: map_key_clear(KEY_GREEN);           break;
                 case 0x06b: map_key_clear(KEY_BLUE);            break;
                 case 0x06c: map_key_clear(KEY_YELLOW);          break;
-                case 0x06d: map_key_clear(KEY_ZOOM);            break;
+                case 0x06d: map_key_clear(KEY_ASPECT_RATIO);    break;
 
                 case 0x06f: map_key_clear(KEY_BRIGHTNESSUP);            break;
                 case 0x070: map_key_clear(KEY_BRIGHTNESSDOWN);          break;
@@ -911,6 +919,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x074: map_key_clear(KEY_BRIGHTNESS_MAX);          break;
                 case 0x075: map_key_clear(KEY_BRIGHTNESS_AUTO);         break;
 
+                case 0x079: map_key_clear(KEY_KBDILLUMUP);      break;
+                case 0x07a: map_key_clear(KEY_KBDILLUMDOWN);    break;
+                case 0x07c: map_key_clear(KEY_KBDILLUMTOGGLE);  break;
+
                 case 0x082: map_key_clear(KEY_VIDEO_NEXT);      break;
                 case 0x083: map_key_clear(KEY_LAST);            break;
                 case 0x084: map_key_clear(KEY_ENTER);           break;
@@ -998,6 +1010,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x1b8: map_key_clear(KEY_VIDEO);           break;
                 case 0x1bc: map_key_clear(KEY_MESSENGER);       break;
                 case 0x1bd: map_key_clear(KEY_INFO);            break;
+                case 0x1cb: map_key_clear(KEY_ASSISTANT);       break;
                 case 0x201: map_key_clear(KEY_NEW);             break;
                 case 0x202: map_key_clear(KEY_OPEN);            break;
                 case 0x203: map_key_clear(KEY_CLOSE);           break;
@@ -1021,6 +1034,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x22d: map_key_clear(KEY_ZOOMIN);          break;
                 case 0x22e: map_key_clear(KEY_ZOOMOUT);         break;
                 case 0x22f: map_key_clear(KEY_ZOOMRESET);       break;
+                case 0x232: map_key_clear(KEY_FULL_SCREEN);     break;
                 case 0x233: map_key_clear(KEY_SCROLLUP);        break;
                 case 0x234: map_key_clear(KEY_SCROLLDOWN);      break;
                 case 0x238: /* AC Pan */
@@ -1044,6 +1058,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT);   break;
                 case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL);   break;
 
+                case 0x29f: map_key_clear(KEY_SCALE);           break;
+
                 default: map_key_clear(KEY_UNKNOWN);
                 }
                 break;
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 15ed6177a7a3..199cc256e9d9 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -2111,6 +2111,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
                 kfree(data);
                 return -ENOMEM;
         }
+        data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
+        if (!data->wq) {
+                kfree(data->effect_ids);
+                kfree(data);
+                return -ENOMEM;
+        }
+
         data->hidpp = hidpp;
         data->feature_index = feature_index;
         data->version = version;
@@ -2155,7 +2162,6 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
         /* ignore boost value at response.fap.params[2] */
 
         /* init the hardware command queue */
-        data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
         atomic_set(&data->workqueue_size, 0);
 
         /* initialize with zero autocenter to get wheel in usable state */
@@ -2608,8 +2614,9 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
                 input_report_rel(mydata->input, REL_Y, v);
 
                 v = hid_snto32(data[6], 8);
-                hidpp_scroll_counter_handle_scroll(
-                                &hidpp->vertical_wheel_counter, v);
+                if (v != 0)
+                        hidpp_scroll_counter_handle_scroll(
+                                        &hidpp->vertical_wheel_counter, v);
 
                 input_sync(mydata->input);
         }
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 953908f2267c..77ffba48cc73 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -715,7 +715,6 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_DEALEXTREAME, USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EARTHMATE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EM_LT20) },
-        { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0400) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) },
@@ -855,7 +854,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { }
 };
 
-/**
+/*
  * hid_mouse_ignore_list - mouse devices which should not be handled by the hid layer
  *
  * There are composite devices for which we want to ignore only a certain
@@ -996,6 +995,10 @@ bool hid_ignore(struct hid_device *hdev)
                 if (hdev->product == 0x0401 &&
                     strncmp(hdev->name, "ELAN0800", 8) != 0)
                         return true;
+                /* Same with product id 0x0400 */
+                if (hdev->product == 0x0400 &&
+                    strncmp(hdev->name, "QTEC0001", 8) != 0)
+                        return true;
                 break;
         }
 
@@ -1042,7 +1045,7 @@ static struct hid_device_id *hid_exists_dquirk(const struct hid_device *hdev)
         }
 
         if (bl_entry != NULL)
-                dbg_hid("Found dynamic quirk 0x%lx for HID device 0x%hx:0x%hx\n",
+                dbg_hid("Found dynamic quirk 0x%lx for HID device 0x%04x:0x%04x\n",
                         bl_entry->driver_data, bl_entry->vendor,
                         bl_entry->product);
 
@@ -1209,7 +1212,7 @@ static unsigned long hid_gets_squirk(const struct hid_device *hdev)
                 quirks |= bl_entry->driver_data;
 
         if (quirks)
-                dbg_hid("Found squirk 0x%lx for HID device 0x%hx:0x%hx\n",
+                dbg_hid("Found squirk 0x%lx for HID device 0x%04x:0x%04x\n",
                         quirks, hdev->vendor, hdev->product);
         return quirks;
 }
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 8141cadfca0e..8dae0f9b819e 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -499,6 +499,7 @@ static void steam_battery_unregister(struct steam_device *steam)
 static int steam_register(struct steam_device *steam)
 {
         int ret;
+        bool client_opened;
 
         /*
          * This function can be called several times in a row with the
@@ -511,9 +512,11 @@ static int steam_register(struct steam_device *steam)
                  * Unlikely, but getting the serial could fail, and it is not so
                  * important, so make up a serial number and go on.
                  */
+                mutex_lock(&steam->mutex);
                 if (steam_get_serial(steam) < 0)
                         strlcpy(steam->serial_no, "XXXXXXXXXX",
                                         sizeof(steam->serial_no));
+                mutex_unlock(&steam->mutex);
 
                 hid_info(steam->hdev, "Steam Controller '%s' connected",
                                 steam->serial_no);
@@ -528,13 +531,15 @@ static int steam_register(struct steam_device *steam)
         }
 
         mutex_lock(&steam->mutex);
-        if (!steam->client_opened) {
+        client_opened = steam->client_opened;
+        if (!client_opened)
                 steam_set_lizard_mode(steam, lizard_mode);
+        mutex_unlock(&steam->mutex);
+
+        if (!client_opened)
                 ret = steam_input_register(steam);
-        } else {
+        else
                 ret = 0;
-        }
-        mutex_unlock(&steam->mutex);
 
         return ret;
 }
@@ -630,14 +635,21 @@ static void steam_client_ll_close(struct hid_device *hdev)
 {
         struct steam_device *steam = hdev->driver_data;
 
+        unsigned long flags;
+        bool connected;
+
+        spin_lock_irqsave(&steam->lock, flags);
+        connected = steam->connected;
+        spin_unlock_irqrestore(&steam->lock, flags);
+
         mutex_lock(&steam->mutex);
         steam->client_opened = false;
+        if (connected)
+                steam_set_lizard_mode(steam, lizard_mode);
         mutex_unlock(&steam->mutex);
 
-        if (steam->connected) {
-                steam_set_lizard_mode(steam, lizard_mode);
+        if (connected)
                 steam_input_register(steam);
-        }
 }
 
 static int steam_client_ll_raw_request(struct hid_device *hdev,
diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
index 7710d9f957da..0187c9f8fc22 100644
--- a/drivers/hid/hid-uclogic-params.c
+++ b/drivers/hid/hid-uclogic-params.c
@@ -735,10 +735,6 @@ static int uclogic_params_huion_init(struct uclogic_params *params,
                 goto cleanup;
         }
         rc = usb_string(udev, 201, ver_ptr, ver_len);
-        if (ver_ptr == NULL) {
-                rc = -ENOMEM;
-                goto cleanup;
-        }
         if (rc == -EPIPE) {
                 *ver_ptr = '\0';
         } else if (rc < 0) {
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 90164fed08d3..4d1f24ee249c 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -184,6 +184,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
         { USB_VENDOR_ID_ELAN, HID_ANY_ID,
                  I2C_HID_QUIRK_BOGUS_IRQ },
+        { USB_VENDOR_ID_SYNAPTICS, I2C_DEVICE_ID_SYNAPTICS_7E7E,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 6f929bfa9fcd..d0f1dfe2bcbb 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1759,6 +1759,7 @@ config SENSORS_VT8231
 config SENSORS_W83773G
         tristate "Nuvoton W83773G"
         depends on I2C
+        select REGMAP_I2C
         help
           If you say yes here you get support for the Nuvoton W83773G hardware
           monitoring chip.
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index e4f9f7ce92fa..f9abeeeead9e 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -640,7 +640,7 @@ static const struct hwmon_channel_info ntc_chip = {
 };
 
 static const u32 ntc_temp_config[] = {
-        HWMON_T_INPUT, HWMON_T_TYPE,
+        HWMON_T_INPUT | HWMON_T_TYPE,
         0
 };
 
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index b91a80abf724..4679acb4918e 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -890,6 +890,8 @@ static int occ_setup_sensor_attrs(struct occ *occ)
                                 s++;
                         }
                 }
+
+                s = (sensors->power.num_sensors * 4) + 1;
         } else {
                 for (i = 0; i < sensors->power.num_sensors; ++i) {
                         s = i + 1;
@@ -918,11 +920,11 @@ static int occ_setup_sensor_attrs(struct occ *occ)
                                                      show_power, NULL, 3, i);
                         attr++;
                 }
-        }
 
-        if (sensors->caps.num_sensors >= 1) {
                 s = sensors->power.num_sensors + 1;
+        }
 
+        if (sensors->caps.num_sensors >= 1) {
                 snprintf(attr->name, sizeof(attr->name), "power%d_label", s);
                 attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL,
                                              0, 0);
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 42fed40198a0..c0c3043b5d61 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1169,11 +1169,13 @@ static int i2c_imx_probe(struct platform_device *pdev)
         /* Init DMA config if supported */
         ret = i2c_imx_dma_request(i2c_imx, phy_addr);
         if (ret < 0)
-                goto clk_notifier_unregister;
+                goto del_adapter;
 
         dev_info(&i2c_imx->adapter.dev, "IMX I2C adapter registered\n");
         return 0;   /* Return OK */
 
+del_adapter:
+        i2c_del_adapter(&i2c_imx->adapter);
 clk_notifier_unregister:
         clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
 rpm_disable:
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 2dc628d4f1ae..1412abcff010 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1980,7 +1980,6 @@ of_i3c_master_add_i3c_boardinfo(struct i3c_master_controller *master,
 {
         struct i3c_dev_boardinfo *boardinfo;
         struct device *dev = &master->dev;
-        struct i3c_device_info info = { };
         enum i3c_addr_slot_status addrstatus;
         u32 init_dyn_addr = 0;
 
@@ -2012,8 +2011,8 @@ of_i3c_master_add_i3c_boardinfo(struct i3c_master_controller *master,
 
         boardinfo->pid = ((u64)reg[1] << 32) | reg[2];
 
-        if ((info.pid & GENMASK_ULL(63, 48)) ||
-            I3C_PID_RND_LOWER_32BITS(info.pid))
+        if ((boardinfo->pid & GENMASK_ULL(63, 48)) ||
+            I3C_PID_RND_LOWER_32BITS(boardinfo->pid))
                 return -EINVAL;
 
         boardinfo->init_dyn_addr = init_dyn_addr;
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index 59279224e07f..10c26ffaa8ef 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -300,7 +300,7 @@ to_dw_i3c_master(struct i3c_master_controller *master)
 
 static void dw_i3c_master_disable(struct dw_i3c_master *master)
 {
-        writel(readl(master->regs + DEVICE_CTRL) & DEV_CTRL_ENABLE,
+        writel(readl(master->regs + DEVICE_CTRL) & ~DEV_CTRL_ENABLE,
                master->regs + DEVICE_CTRL);
 }
 
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 7096e577b23f..50f3ff386bea 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1437,6 +1437,8 @@ static int kxcjk1013_resume(struct device *dev)
 
         mutex_lock(&data->mutex);
         ret = kxcjk1013_set_mode(data, OPERATION);
+        if (ret == 0)
+                ret = kxcjk1013_set_range(data, data->range);
         mutex_unlock(&data->mutex);
 
         return ret;
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index ff5f2da2e1b1..54d9978b2740 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -121,6 +121,7 @@ static int ad_sd_read_reg_raw(struct ad_sigma_delta *sigma_delta,
         if (sigma_delta->info->has_registers) {
                 data[0] = reg << sigma_delta->info->addr_shift;
                 data[0] |= sigma_delta->info->read_mask;
+                data[0] |= sigma_delta->comm;
                 spi_message_add_tail(&t[0], &m);
         }
         spi_message_add_tail(&t[1], &m);
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 75d2f73582a3..596841a3c4db 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -704,23 +704,29 @@ static int at91_adc_read_raw(struct iio_dev *idev,
                 ret = wait_event_interruptible_timeout(st->wq_data_avail,
                                                        st->done,
                                                        msecs_to_jiffies(1000));
-                if (ret == 0)
-                        ret = -ETIMEDOUT;
-                if (ret < 0) {
-                        mutex_unlock(&st->lock);
-                        return ret;
-                }
-
-                *val = st->last_value;
 
+                /* Disable interrupts, regardless if adc conversion was
+                 * successful or not
+                 */
                 at91_adc_writel(st, AT91_ADC_CHDR,
                                 AT91_ADC_CH(chan->channel));
                 at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel));
 
-                st->last_value = 0;
-                st->done = false;
+                if (ret > 0) {
+                        /* a valid conversion took place */
+                        *val = st->last_value;
+                        st->last_value = 0;
+                        st->done = false;
+                        ret = IIO_VAL_INT;
+                } else if (ret == 0) {
+                        /* conversion timeout */
+                        dev_err(&idev->dev, "ADC Channel %d timeout.\n",
+                                chan->channel);
+                        ret = -ETIMEDOUT;
+                }
+
                 mutex_unlock(&st->lock);
-                return IIO_VAL_INT;
+                return ret;
 
         case IIO_CHAN_INFO_SCALE:
                 *val = st->vref_mv;
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index b13c61539d46..6401ca7a9a20 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1292,6 +1292,7 @@ static int xadc_probe(struct platform_device *pdev)
 
 err_free_irq:
         free_irq(xadc->irq, indio_dev);
+        cancel_delayed_work_sync(&xadc->zynq_unmask_work);
 err_clk_disable_unprepare:
         clk_disable_unprepare(xadc->clk);
 err_free_samplerate_trigger:
@@ -1321,8 +1322,8 @@ static int xadc_remove(struct platform_device *pdev)
                 iio_triggered_buffer_cleanup(indio_dev);
         }
         free_irq(xadc->irq, indio_dev);
+        cancel_delayed_work_sync(&xadc->zynq_unmask_work);
         clk_disable_unprepare(xadc->clk);
-        cancel_delayed_work(&xadc->zynq_unmask_work);
         kfree(xadc->data);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/chemical/Kconfig b/drivers/iio/chemical/Kconfig
index d5d146e9e372..92c684d2b67e 100644
--- a/drivers/iio/chemical/Kconfig
+++ b/drivers/iio/chemical/Kconfig
@@ -64,6 +64,7 @@ config IAQCORE
 config PMS7003
         tristate "Plantower PMS7003 particulate matter sensor"
         depends on SERIAL_DEV_BUS
+        select IIO_TRIGGERED_BUFFER
         help
           Say Y here to build support for the Plantower PMS7003 particulate
           matter sensor.
@@ -71,6 +72,19 @@ config PMS7003
           To compile this driver as a module, choose M here: the module will
           be called pms7003.
 
+config SENSIRION_SGP30
+        tristate "Sensirion SGPxx gas sensors"
+        depends on I2C
+        select CRC8
+        help
+          Say Y here to build I2C interface support for the following
+          Sensirion SGP gas sensors:
+            * SGP30 gas sensor
+            * SGPC3 low power gas sensor
+
+          To compile this driver as module, choose M here: the
+          module will be called sgp30.
+
 config SPS30
         tristate "SPS30 particulate matter sensor"
         depends on I2C
diff --git a/drivers/iio/chemical/bme680.h b/drivers/iio/chemical/bme680.h
index 0ae89b87e2d6..4edc5d21cb9f 100644
--- a/drivers/iio/chemical/bme680.h
+++ b/drivers/iio/chemical/bme680.h
@@ -2,11 +2,9 @@
 #ifndef BME680_H_
 #define BME680_H_
 
-#define BME680_REG_CHIP_I2C_ID                  0xD0
-#define BME680_REG_CHIP_SPI_ID                  0x50
+#define BME680_REG_CHIP_ID                      0xD0
 #define   BME680_CHIP_ID_VAL                    0x61
-#define BME680_REG_SOFT_RESET_I2C               0xE0
-#define BME680_REG_SOFT_RESET_SPI               0x60
+#define BME680_REG_SOFT_RESET                   0xE0
 #define   BME680_CMD_SOFTRESET                  0xB6
 #define BME680_REG_STATUS                       0x73
 #define   BME680_SPI_MEM_PAGE_BIT               BIT(4)
diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c
index 70c1fe4366f4..ccde4c65ff93 100644
--- a/drivers/iio/chemical/bme680_core.c
+++ b/drivers/iio/chemical/bme680_core.c
@@ -63,9 +63,23 @@ struct bme680_data {
         s32 t_fine;
 };
 
+static const struct regmap_range bme680_volatile_ranges[] = {
+        regmap_reg_range(BME680_REG_MEAS_STAT_0, BME680_REG_GAS_R_LSB),
+        regmap_reg_range(BME680_REG_STATUS, BME680_REG_STATUS),
+        regmap_reg_range(BME680_T2_LSB_REG, BME680_GH3_REG),
+};
+
+static const struct regmap_access_table bme680_volatile_table = {
+        .yes_ranges     = bme680_volatile_ranges,
+        .n_yes_ranges   = ARRAY_SIZE(bme680_volatile_ranges),
+};
+
 const struct regmap_config bme680_regmap_config = {
         .reg_bits = 8,
         .val_bits = 8,
+        .max_register = 0xef,
+        .volatile_table = &bme680_volatile_table,
+        .cache_type = REGCACHE_RBTREE,
 };
 EXPORT_SYMBOL(bme680_regmap_config);
 
@@ -316,6 +330,10 @@ static s16 bme680_compensate_temp(struct bme680_data *data,
         s64 var1, var2, var3;
         s16 calc_temp;
 
+        /* If the calibration is invalid, attempt to reload it */
+        if (!calib->par_t2)
+                bme680_read_calib(data, calib);
+
         var1 = (adc_temp >> 3) - (calib->par_t1 << 1);
         var2 = (var1 * calib->par_t2) >> 11;
         var3 = ((var1 >> 1) * (var1 >> 1)) >> 12;
@@ -583,8 +601,7 @@ static int bme680_gas_config(struct bme680_data *data)
         return ret;
 }
 
-static int bme680_read_temp(struct bme680_data *data,
-                            int *val, int *val2)
+static int bme680_read_temp(struct bme680_data *data, int *val)
 {
         struct device *dev = regmap_get_device(data->regmap);
         int ret;
@@ -617,10 +634,9 @@ static int bme680_read_temp(struct bme680_data *data,
          * compensate_press/compensate_humid to get compensated
          * pressure/humidity readings.
          */
-        if (val && val2) {
-                *val = comp_temp;
-                *val2 = 100;
-                return IIO_VAL_FRACTIONAL;
+        if (val) {
+                *val = comp_temp * 10; /* Centidegrees to millidegrees */
+                return IIO_VAL_INT;
         }
 
         return ret;
@@ -635,7 +651,7 @@ static int bme680_read_press(struct bme680_data *data,
         s32 adc_press;
 
         /* Read and compensate temperature to get a reading of t_fine */
-        ret = bme680_read_temp(data, NULL, NULL);
+        ret = bme680_read_temp(data, NULL);
         if (ret < 0)
                 return ret;
 
@@ -668,7 +684,7 @@ static int bme680_read_humid(struct bme680_data *data,
         u32 comp_humidity;
 
         /* Read and compensate temperature to get a reading of t_fine */
-        ret = bme680_read_temp(data, NULL, NULL);
+        ret = bme680_read_temp(data, NULL);
         if (ret < 0)
                 return ret;
 
@@ -761,7 +777,7 @@ static int bme680_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_PROCESSED:
                 switch (chan->type) {
                 case IIO_TEMP:
-                        return bme680_read_temp(data, val, val2);
+                        return bme680_read_temp(data, val);
                 case IIO_PRESSURE:
                         return bme680_read_press(data, val, val2);
                 case IIO_HUMIDITYRELATIVE:
@@ -867,8 +883,28 @@ int bme680_core_probe(struct device *dev, struct regmap *regmap,
 {
         struct iio_dev *indio_dev;
         struct bme680_data *data;
+        unsigned int val;
         int ret;
 
+        ret = regmap_write(regmap, BME680_REG_SOFT_RESET,
+                           BME680_CMD_SOFTRESET);
+        if (ret < 0) {
+                dev_err(dev, "Failed to reset chip\n");
+                return ret;
+        }
+
+        ret = regmap_read(regmap, BME680_REG_CHIP_ID, &val);
+        if (ret < 0) {
+                dev_err(dev, "Error reading chip ID\n");
+                return ret;
+        }
+
+        if (val != BME680_CHIP_ID_VAL) {
+                dev_err(dev, "Wrong chip ID, got %x expected %x\n",
+                                val, BME680_CHIP_ID_VAL);
+                return -ENODEV;
+        }
+
         indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
         if (!indio_dev)
                 return -ENOMEM;
diff --git a/drivers/iio/chemical/bme680_i2c.c b/drivers/iio/chemical/bme680_i2c.c
index b2f805b6b36a..de9c9e3d23ea 100644
--- a/drivers/iio/chemical/bme680_i2c.c
+++ b/drivers/iio/chemical/bme680_i2c.c
@@ -23,8 +23,6 @@ static int bme680_i2c_probe(struct i2c_client *client,
 {
         struct regmap *regmap;
         const char *name = NULL;
-        unsigned int val;
-        int ret;
 
         regmap = devm_regmap_init_i2c(client, &bme680_regmap_config);
         if (IS_ERR(regmap)) {
@@ -33,25 +31,6 @@ static int bme680_i2c_probe(struct i2c_client *client,
                 return PTR_ERR(regmap);
         }
 
-        ret = regmap_write(regmap, BME680_REG_SOFT_RESET_I2C,
-                           BME680_CMD_SOFTRESET);
-        if (ret < 0) {
-                dev_err(&client->dev, "Failed to reset chip\n");
-                return ret;
-        }
-
-        ret = regmap_read(regmap, BME680_REG_CHIP_I2C_ID, &val);
-        if (ret < 0) {
-                dev_err(&client->dev, "Error reading I2C chip ID\n");
-                return ret;
-        }
-
-        if (val != BME680_CHIP_ID_VAL) {
-                dev_err(&client->dev, "Wrong chip ID, got %x expected %x\n",
-                                val, BME680_CHIP_ID_VAL);
-                return -ENODEV;
-        }
-
         if (id)
                 name = id->name;
 
diff --git a/drivers/iio/chemical/bme680_spi.c b/drivers/iio/chemical/bme680_spi.c
index d0b7bdd3f066..3b838068a7e4 100644
--- a/drivers/iio/chemical/bme680_spi.c
+++ b/drivers/iio/chemical/bme680_spi.c
@@ -12,28 +12,93 @@
 
 #include "bme680.h"
 
+struct bme680_spi_bus_context {
+        struct spi_device *spi;
+        u8 current_page;
+};
+
+/*
+ * In SPI mode there are only 7 address bits, a "page" register determines
+ * which part of the 8-bit range is active. This function looks at the address
+ * and writes the page selection bit if needed
+ */
+static int bme680_regmap_spi_select_page(
+        struct bme680_spi_bus_context *ctx, u8 reg)
+{
+        struct spi_device *spi = ctx->spi;
+        int ret;
+        u8 buf[2];
+        u8 page = (reg & 0x80) ? 0 : 1; /* Page "1" is low range */
+
+        if (page == ctx->current_page)
+                return 0;
+
+        /*
+         * Data sheet claims we're only allowed to change bit 4, so we must do
+         * a read-modify-write on each and every page select
+         */
+        buf[0] = BME680_REG_STATUS;
+        ret = spi_write_then_read(spi, buf, 1, buf + 1, 1);
+        if (ret < 0) {
+                dev_err(&spi->dev, "failed to set page %u\n", page);
+                return ret;
+        }
+
+        buf[0] = BME680_REG_STATUS;
+        if (page)
+                buf[1] |= BME680_SPI_MEM_PAGE_BIT;
+        else
+                buf[1] &= ~BME680_SPI_MEM_PAGE_BIT;
+
+        ret = spi_write(spi, buf, 2);
+        if (ret < 0) {
+                dev_err(&spi->dev, "failed to set page %u\n", page);
+                return ret;
+        }
+
+        ctx->current_page = page;
+
+        return 0;
+}
+
 static int bme680_regmap_spi_write(void *context, const void *data,
                                    size_t count)
 {
-        struct spi_device *spi = context;
+        struct bme680_spi_bus_context *ctx = context;
+        struct spi_device *spi = ctx->spi;
+        int ret;
         u8 buf[2];
 
         memcpy(buf, data, 2);
+
+        ret = bme680_regmap_spi_select_page(ctx, buf[0]);
+        if (ret)
+                return ret;
+
         /*
          * The SPI register address (= full register address without bit 7)
          * and the write command (bit7 = RW = '0')
          */
         buf[0] &= ~0x80;
 
-        return spi_write_then_read(spi, buf, 2, NULL, 0);
+        return spi_write(spi, buf, 2);
 }
 
 static int bme680_regmap_spi_read(void *context, const void *reg,
                                   size_t reg_size, void *val, size_t val_size)
 {
-        struct spi_device *spi = context;
+        struct bme680_spi_bus_context *ctx = context;
+        struct spi_device *spi = ctx->spi;
+        int ret;
+        u8 addr = *(const u8 *)reg;
+
+        ret = bme680_regmap_spi_select_page(ctx, addr);
+        if (ret)
+                return ret;
 
-        return spi_write_then_read(spi, reg, reg_size, val, val_size);
+        addr |= 0x80; /* bit7 = RW = '1' */
+
+        return spi_write_then_read(spi, &addr, 1, val, val_size);
 }
 
 static struct regmap_bus bme680_regmap_bus = {
@@ -46,8 +111,8 @@ static struct regmap_bus bme680_regmap_bus = {
 static int bme680_spi_probe(struct spi_device *spi)
 {
         const struct spi_device_id *id = spi_get_device_id(spi);
+        struct bme680_spi_bus_context *bus_context;
         struct regmap *regmap;
-        unsigned int val;
         int ret;
 
         spi->bits_per_word = 8;
@@ -57,45 +122,21 @@ static int bme680_spi_probe(struct spi_device *spi)
                 return ret;
         }
 
+        bus_context = devm_kzalloc(&spi->dev, sizeof(*bus_context), GFP_KERNEL);
+        if (!bus_context)
+                return -ENOMEM;
+
+        bus_context->spi = spi;
+        bus_context->current_page = 0xff; /* Undefined on warm boot */
+
         regmap = devm_regmap_init(&spi->dev, &bme680_regmap_bus,
-                                  &spi->dev, &bme680_regmap_config);
+                                  bus_context, &bme680_regmap_config);
         if (IS_ERR(regmap)) {
                 dev_err(&spi->dev, "Failed to register spi regmap %d\n",
                                 (int)PTR_ERR(regmap));
                 return PTR_ERR(regmap);
         }
 
-        ret = regmap_write(regmap, BME680_REG_SOFT_RESET_SPI,
-                           BME680_CMD_SOFTRESET);
-        if (ret < 0) {
-                dev_err(&spi->dev, "Failed to reset chip\n");
-                return ret;
-        }
-
-        /* after power-on reset, Page 0(0x80-0xFF) of spi_mem_page is active */
-        ret = regmap_read(regmap, BME680_REG_CHIP_SPI_ID, &val);
-        if (ret < 0) {
-                dev_err(&spi->dev, "Error reading SPI chip ID\n");
-                return ret;
-        }
-
-        if (val != BME680_CHIP_ID_VAL) {
-                dev_err(&spi->dev, "Wrong chip ID, got %x expected %x\n",
-                                val, BME680_CHIP_ID_VAL);
-                return -ENODEV;
-        }
-        /*
-         * select Page 1 of spi_mem_page to enable access to
-         * to registers from address 0x00 to 0x7F.
-         */
-        ret = regmap_write_bits(regmap, BME680_REG_STATUS,
-                                BME680_SPI_MEM_PAGE_BIT,
-                                BME680_SPI_MEM_PAGE_1_VAL);
-        if (ret < 0) {
-                dev_err(&spi->dev, "failed to set page 1 of spi_mem_page\n");
-                return ret;
-        }
-
         return bme680_core_probe(&spi->dev, regmap, id->name);
 }
 
diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
index 89cb0066a6e0..8d76afb87d87 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
@@ -103,9 +103,10 @@ static int cros_ec_sensors_read(struct iio_dev *indio_dev,
                          * Do not use IIO_DEGREE_TO_RAD to avoid precision
                          * loss. Round to the nearest integer.
                          */
-                        *val = div_s64(val64 * 314159 + 9000000ULL, 1000);
-                        *val2 = 18000 << (CROS_EC_SENSOR_BITS - 1);
-                        ret = IIO_VAL_FRACTIONAL;
+                        *val = 0;
+                        *val2 = div_s64(val64 * 3141592653ULL,
+                                        180 << (CROS_EC_SENSOR_BITS - 1));
+                        ret = IIO_VAL_INT_PLUS_NANO;
                         break;
                 case MOTIONSENSE_TYPE_MAG:
                         /*
diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c
index 6d71fd905e29..c701a45469f6 100644
--- a/drivers/iio/dac/mcp4725.c
+++ b/drivers/iio/dac/mcp4725.c
@@ -92,6 +92,7 @@ static ssize_t mcp4725_store_eeprom(struct device *dev,
 
         inoutbuf[0] = 0x60; /* write EEPROM */
         inoutbuf[0] |= data->ref_mode << 3;
+        inoutbuf[0] |= data->powerdown ? ((data->powerdown_mode + 1) << 1) : 0;
         inoutbuf[1] = data->dac_value >> 4;
         inoutbuf[2] = (data->dac_value & 0xf) << 4;
 
diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
index 63ca31628a93..92c07ab826eb 100644
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -582,11 +582,10 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
                 return bmg160_get_filter(data, val);
         case IIO_CHAN_INFO_SCALE:
-                *val = 0;
                 switch (chan->type) {
                 case IIO_TEMP:
-                        *val2 = 500000;
-                        return IIO_VAL_INT_PLUS_MICRO;
+                        *val = 500;
+                        return IIO_VAL_INT;
                 case IIO_ANGL_VEL:
                 {
                         int i;
@@ -594,6 +593,7 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
                         for (i = 0; i < ARRAY_SIZE(bmg160_scale_table); ++i) {
                                 if (bmg160_scale_table[i].dps_range ==
                                                         data->dps_range) {
+                                        *val = 0;
                                         *val2 = bmg160_scale_table[i].scale;
                                         return IIO_VAL_INT_PLUS_MICRO;
                                 }
diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index 77fac81a3adc..5ddebede31a6 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -29,7 +29,8 @@
 
 #include "mpu3050.h"
 
-#define MPU3050_CHIP_ID         0x69
+#define MPU3050_CHIP_ID         0x68
+#define MPU3050_CHIP_ID_MASK    0x7E
 
 /*
  * Register map: anything suffixed *_H is a big-endian high byte and always
@@ -1176,8 +1177,9 @@ int mpu3050_common_probe(struct device *dev,
                 goto err_power_down;
         }
 
-        if (val != MPU3050_CHIP_ID) {
-                dev_err(dev, "unsupported chip id %02x\n", (u8)val);
+        if ((val & MPU3050_CHIP_ID_MASK) != MPU3050_CHIP_ID) {
+                dev_err(dev, "unsupported chip id %02x\n",
+                                (u8)(val & MPU3050_CHIP_ID_MASK));
                 ret = -ENODEV;
                 goto err_power_down;
         }
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index cd5bfe39591b..dadd921a4a30 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -320,9 +320,8 @@ static int iio_scan_mask_set(struct iio_dev *indio_dev,
         const unsigned long *mask;
         unsigned long *trialmask;
 
-        trialmask = kmalloc_array(BITS_TO_LONGS(indio_dev->masklength),
-                                  sizeof(*trialmask),
-                                  GFP_KERNEL);
+        trialmask = kcalloc(BITS_TO_LONGS(indio_dev->masklength),
+                            sizeof(*trialmask), GFP_KERNEL);
         if (trialmask == NULL)
                 return -ENOMEM;
         if (!indio_dev->masklength) {
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 4700fd5d8c90..9c4d92115504 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -1743,10 +1743,10 @@ EXPORT_SYMBOL(__iio_device_register);
  **/
 void iio_device_unregister(struct iio_dev *indio_dev)
 {
-        mutex_lock(&indio_dev->info_exist_lock);
-
         cdev_device_del(&indio_dev->chrdev, &indio_dev->dev);
 
+        mutex_lock(&indio_dev->info_exist_lock);
+
         iio_device_unregister_debugfs(indio_dev);
 
         iio_disable_all_buffers(indio_dev);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index ea0bc6885517..32cc8fe7902f 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -160,6 +160,7 @@ struct ib_uverbs_file {
 
         struct mutex umap_lock;
         struct list_head umaps;
+        struct page *disassociate_page;
 
         struct idr              idr;
         /* spinlock protects write access to idr */
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 70b7d80431a9..c489f545baae 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -208,6 +208,9 @@ void ib_uverbs_release_file(struct kref *ref)
                 kref_put(&file->async_file->ref,
                          ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
+
+        if (file->disassociate_page)
+                __free_pages(file->disassociate_page, 0);
         kfree(file);
 }
 
@@ -877,9 +880,50 @@ static void rdma_umap_close(struct vm_area_struct *vma)
         kfree(priv);
 }
 
+/*
+ * Once the zap_vma_ptes has been called touches to the VMA will come here and
+ * we return a dummy writable zero page for all the pfns.
+ */
+static vm_fault_t rdma_umap_fault(struct vm_fault *vmf)
+{
+        struct ib_uverbs_file *ufile = vmf->vma->vm_file->private_data;
+        struct rdma_umap_priv *priv = vmf->vma->vm_private_data;
+        vm_fault_t ret = 0;
+
+        if (!priv)
+                return VM_FAULT_SIGBUS;
+
+        /* Read only pages can just use the system zero page. */
+        if (!(vmf->vma->vm_flags & (VM_WRITE | VM_MAYWRITE))) {
+                vmf->page = ZERO_PAGE(vmf->address);
+                get_page(vmf->page);
+                return 0;
+        }
+
+        mutex_lock(&ufile->umap_lock);
+        if (!ufile->disassociate_page)
+                ufile->disassociate_page =
+                        alloc_pages(vmf->gfp_mask | __GFP_ZERO, 0);
+
+        if (ufile->disassociate_page) {
+                /*
+                 * This VMA is forced to always be shared so this doesn't have
+                 * to worry about COW.
+                 */
+                vmf->page = ufile->disassociate_page;
+                get_page(vmf->page);
+        } else {
+                ret = VM_FAULT_SIGBUS;
+        }
+        mutex_unlock(&ufile->umap_lock);
+
+        return ret;
+}
+
 static const struct vm_operations_struct rdma_umap_ops = {
         .open = rdma_umap_open,
         .close = rdma_umap_close,
+        .fault = rdma_umap_fault,
 };
 
 static struct rdma_umap_priv *rdma_user_mmap_pre(struct ib_ucontext *ucontext,
@@ -889,6 +933,9 @@ static struct rdma_umap_priv *rdma_user_mmap_pre(struct ib_ucontext *ucontext,
         struct ib_uverbs_file *ufile = ucontext->ufile;
         struct rdma_umap_priv *priv;
 
+        if (!(vma->vm_flags & VM_SHARED))
+                return ERR_PTR(-EINVAL);
+
         if (vma->vm_end - vma->vm_start != size)
                 return ERR_PTR(-EINVAL);
 
@@ -992,7 +1039,9 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
                  * at a time to get the lock ordering right. Typically there
                  * will only be one mm, so no big deal.
                  */
-                down_write(&mm->mmap_sem);
+                down_read(&mm->mmap_sem);
+                if (!mmget_still_valid(mm))
+                        goto skip_mm;
                 mutex_lock(&ufile->umap_lock);
                 list_for_each_entry_safe (priv, next_priv, &ufile->umaps,
                                           list) {
@@ -1004,10 +1053,10 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                         zap_vma_ptes(vma, vma->vm_start,
                                      vma->vm_end - vma->vm_start);
-                        vma->vm_flags &= ~(VM_SHARED | VM_MAYSHARE);
                 }
                 mutex_unlock(&ufile->umap_lock);
-                up_write(&mm->mmap_sem);
+        skip_mm:
+                up_read(&mm->mmap_sem);
                 mmput(mm);
         }
 }
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 612f04190ed8..9784c6c0d2ec 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -13232,7 +13232,7 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
         int total_contexts;
         int ret;
         unsigned ngroups;
-        int qos_rmt_count;
+        int rmt_count;
         int user_rmt_reduced;
         u32 n_usr_ctxts;
         u32 send_contexts = chip_send_contexts(dd);
@@ -13294,10 +13294,20 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
                 n_usr_ctxts = rcv_contexts - total_contexts;
         }
 
-        /* each user context requires an entry in the RMT */
-        qos_rmt_count = qos_rmt_entries(dd, NULL, NULL);
-        if (qos_rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
-                user_rmt_reduced = NUM_MAP_ENTRIES - qos_rmt_count;
+        /*
+         * The RMT entries are currently allocated as shown below:
+         * 1. QOS (0 to 128 entries);
+         * 2. FECN for PSM (num_user_contexts + num_vnic_contexts);
+         * 3. VNIC (num_vnic_contexts).
+         * It should be noted that PSM FECN oversubscribe num_vnic_contexts
+         * entries of RMT because both VNIC and PSM could allocate any receive
+         * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts,
+         * and PSM FECN must reserve an RMT entry for each possible PSM receive
+         * context.
+         */
+        rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_vnic_contexts * 2);
+        if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
+                user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count;
                 dd_dev_err(dd,
                            "RMT size is reducing the number of user receive contexts from %u to %d\n",
                            n_usr_ctxts,
@@ -14285,9 +14295,11 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
         u64 reg;
         int i, idx, regoff, regidx;
         u8 offset;
+        u32 total_cnt;
 
         /* there needs to be enough room in the map table */
-        if (rmt->used + dd->num_user_contexts >= NUM_MAP_ENTRIES) {
+        total_cnt = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
+        if (rmt->used + total_cnt >= NUM_MAP_ENTRIES) {
                 dd_dev_err(dd, "User FECN handling disabled - too many user contexts allocated\n");
                 return;
         }
@@ -14341,7 +14353,7 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
         /* add rule 1 */
         add_rsm_rule(dd, RSM_INS_FECN, &rrd);
 
-        rmt->used += dd->num_user_contexts;
+        rmt->used += total_cnt;
 }
 
 /* Initialize RSM for VNIC */
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index 9b643c2409cf..eba300330a02 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -898,7 +898,9 @@ void notify_error_qp(struct rvt_qp *qp)
                 if (!list_empty(&priv->s_iowait.list) &&
                     !(qp->s_flags & RVT_S_BUSY) &&
                     !(priv->s_flags & RVT_S_BUSY)) {
-                        qp->s_flags &= ~RVT_S_ANY_WAIT_IO;
+                        qp->s_flags &= ~HFI1_S_ANY_WAIT_IO;
+                        iowait_clear_flag(&priv->s_iowait, IOWAIT_PENDING_IB);
+                        iowait_clear_flag(&priv->s_iowait, IOWAIT_PENDING_TID);
                         list_del_init(&priv->s_iowait.list);
                         priv->s_iowait.lock = NULL;
                         rvt_put_qp(qp);
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index e6726c1ab866..5991211d72bd 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -3088,7 +3088,7 @@ send_last:
                         update_ack_queue(qp, next);
                 }
                 e = &qp->s_ack_queue[qp->r_head_ack_queue];
-                if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
+                if (e->rdma_sge.mr) {
                         rvt_put_mr(e->rdma_sge.mr);
                         e->rdma_sge.mr = NULL;
                 }
@@ -3166,7 +3166,7 @@ send_last:
                         update_ack_queue(qp, next);
                 }
                 e = &qp->s_ack_queue[qp->r_head_ack_queue];
-                if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
+                if (e->rdma_sge.mr) {
                         rvt_put_mr(e->rdma_sge.mr);
                         e->rdma_sge.mr = NULL;
                 }
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c
index fdda33aca77f..43cbce7a19ea 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -5017,24 +5017,14 @@ int hfi1_make_tid_rdma_pkt(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
             make_tid_rdma_ack(qp, ohdr, ps))
                 return 1;
 
-        if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) {
-                if (!(ib_rvt_state_ops[qp->state] & RVT_FLUSH_SEND))
-                        goto bail;
-                /* We are in the error state, flush the work request. */
-                if (qp->s_last == READ_ONCE(qp->s_head))
-                        goto bail;
-                /* If DMAs are in progress, we can't flush immediately. */
-                if (iowait_sdma_pending(&priv->s_iowait)) {
-                        qp->s_flags |= RVT_S_WAIT_DMA;
-                        goto bail;
-                }
-                clear_ahg(qp);
-                wqe = rvt_get_swqe_ptr(qp, qp->s_last);
-                hfi1_trdma_send_complete(qp, wqe, qp->s_last != qp->s_acked ?
-                                         IB_WC_SUCCESS : IB_WC_WR_FLUSH_ERR);
-                /* will get called again */
-                goto done_free_tx;
-        }
+        /*
+         * Bail out if we can't send data.
+         * Be reminded that this check must been done after the call to
+         * make_tid_rdma_ack() because the responding QP could be in
+         * RTR state where it can send TID RDMA ACK, not TID RDMA WRITE DATA.
+         */
+        if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK))
+                goto bail;
 
         if (priv->s_flags & RVT_S_WAIT_ACK)
                 goto bail;
@@ -5144,11 +5134,6 @@ int hfi1_make_tid_rdma_pkt(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
         hfi1_make_ruc_header(qp, ohdr, (opcode << 24), bth1, bth2,
                              middle, ps);
         return 1;
-done_free_tx:
-        hfi1_put_txreq(ps->s_txreq);
-        ps->s_txreq = NULL;
-        return 1;
-
 bail:
         hfi1_put_txreq(ps->s_txreq);
 bail_no_tx:
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index f1fec56f3ff4..8e29dbb5b5fb 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -792,6 +792,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
                 idx_offset = (obj & (table->num_obj - 1)) % obj_per_chunk;
                 dma_offset = offset = idx_offset * table->obj_size;
         } else {
+                u32 seg_size = 64; /* 8 bytes per BA and 8 BA per segment */
+
                 hns_roce_calc_hem_mhop(hr_dev, table, &mhop_obj, &mhop);
                 /* mtt mhop */
                 i = mhop.l0_idx;
@@ -803,8 +805,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
                         hem_idx = i;
 
                 hem = table->hem[hem_idx];
-                dma_offset = offset = (obj & (table->num_obj - 1)) *
-                                       table->obj_size % mhop.bt_chunk_size;
+                dma_offset = offset = (obj & (table->num_obj - 1)) * seg_size %
+                                       mhop.bt_chunk_size;
                 if (mhop.hop_num == 2)
                         dma_offset = offset = 0;
         }
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index b09f1cde2ff5..08be0e4eabcd 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -746,7 +746,6 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
         struct hns_roce_hem_table *table;
         dma_addr_t dma_handle;
         __le64 *mtts;
-        u32 s = start_index * sizeof(u64);
         u32 bt_page_size;
         u32 i;
 
@@ -780,7 +779,8 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
                 return -EINVAL;
 
         mtts = hns_roce_table_find(hr_dev, table,
-                                mtt->first_seg + s / hr_dev->caps.mtt_entry_sz,
+                                mtt->first_seg +
+                                start_index / HNS_ROCE_MTT_ENTRY_PER_SEG,
                                 &dma_handle);
         if (!mtts)
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 57c76eafef2f..60cf9f03e941 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -274,9 +274,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
         wait_for_completion(&hr_qp->free);
 
         if ((hr_qp->ibqp.qp_type) != IB_QPT_GSI) {
-                if (hr_dev->caps.sccc_entry_sz)
-                        hns_roce_table_put(hr_dev, &qp_table->sccc_table,
-                                           hr_qp->qpn);
                 if (hr_dev->caps.trrl_entry_sz)
                         hns_roce_table_put(hr_dev, &qp_table->trrl_table,
                                            hr_qp->qpn);
@@ -536,7 +533,7 @@ static int hns_roce_set_kernel_sq_size(struct hns_roce_dev *hr_dev,
 
 static int hns_roce_qp_has_sq(struct ib_qp_init_attr *attr)
 {
-        if (attr->qp_type == IB_QPT_XRC_TGT)
+        if (attr->qp_type == IB_QPT_XRC_TGT || !attr->cap.max_send_wr)
                 return 0;
 
         return 1;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 531ff20b32ad..d3dd290ae1b1 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1119,6 +1119,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
                 if (MLX5_CAP_GEN(mdev, qp_packet_based))
                         resp.flags |=
                                 MLX5_IB_QUERY_DEV_RESP_PACKET_BASED_CREDIT_MODE;
+
+                resp.flags |= MLX5_IB_QUERY_DEV_RESP_FLAGS_SCAT2CQE_DCT;
         }
 
         if (field_avail(typeof(resp), sw_parsing_caps,
@@ -2066,6 +2068,7 @@ static int mlx5_ib_mmap_clock_info_page(struct mlx5_ib_dev *dev,
 
         if (vma->vm_flags & VM_WRITE)
                 return -EPERM;
+        vma->vm_flags &= ~VM_MAYWRITE;
 
         if (!dev->mdev->clock_info_page)
                 return -EOPNOTSUPP;
@@ -2231,19 +2234,18 @@ static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vm
 
                 if (vma->vm_flags & VM_WRITE)
                         return -EPERM;
+                vma->vm_flags &= ~VM_MAYWRITE;
 
                 /* Don't expose to user-space information it shouldn't have */
                 if (PAGE_SIZE > 4096)
                         return -EOPNOTSUPP;
 
-                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
                 pfn = (dev->mdev->iseg_base +
                        offsetof(struct mlx5_init_seg, internal_timer_h)) >>
                         PAGE_SHIFT;
-                if (io_remap_pfn_range(vma, vma->vm_start, pfn,
-                                       PAGE_SIZE, vma->vm_page_prot))
-                        return -EAGAIN;
-                break;
+                return rdma_user_mmap_io(&context->ibucontext, vma, pfn,
+                                         PAGE_SIZE,
+                                         pgprot_noncached(vma->vm_page_prot));
         case MLX5_IB_MMAP_CLOCK_INFO:
                 return mlx5_ib_mmap_clock_info_page(dev, vma, context);
 
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index c20bfc41ecf1..0aa10ebda5d9 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -585,7 +585,7 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
         struct ib_umem_odp *odp_mr = to_ib_umem_odp(mr->umem);
         bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE;
         bool prefetch = flags & MLX5_PF_FLAGS_PREFETCH;
-        u64 access_mask = ODP_READ_ALLOWED_BIT;
+        u64 access_mask;
         u64 start_idx, page_mask;
         struct ib_umem_odp *odp;
         size_t size;
@@ -607,6 +607,7 @@ next_mr:
         page_shift = mr->umem->page_shift;
         page_mask = ~(BIT(page_shift) - 1);
         start_idx = (io_virt - (mr->mmkey.iova & page_mask)) >> page_shift;
+        access_mask = ODP_READ_ALLOWED_BIT;
 
         if (prefetch && !downgrade && !mr->umem->writable) {
                 /* prefetch with write-access must
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 7cd006da1dae..8870c350fda0 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1818,13 +1818,16 @@ static void configure_responder_scat_cqe(struct ib_qp_init_attr *init_attr,
 
         rcqe_sz = mlx5_ib_get_cqe_size(init_attr->recv_cq);
 
-        if (rcqe_sz == 128) {
-                MLX5_SET(qpc, qpc, cs_res, MLX5_RES_SCAT_DATA64_CQE);
+        if (init_attr->qp_type == MLX5_IB_QPT_DCT) {
+                if (rcqe_sz == 128)
+                        MLX5_SET(dctc, qpc, cs_res, MLX5_RES_SCAT_DATA64_CQE);
+
                 return;
         }
 
-        if (init_attr->qp_type != MLX5_IB_QPT_DCT)
-                MLX5_SET(qpc, qpc, cs_res, MLX5_RES_SCAT_DATA32_CQE);
+        MLX5_SET(qpc, qpc, cs_res,
+                 rcqe_sz == 128 ? MLX5_RES_SCAT_DATA64_CQE :
+                                  MLX5_RES_SCAT_DATA32_CQE);
 }
 
 static void configure_requester_scat_cqe(struct mlx5_ib_dev *dev,
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 6d8b3e0de57a..ec41400fec0c 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -1131,6 +1131,8 @@ static void pvrdma_pci_remove(struct pci_dev *pdev)
         pvrdma_page_dir_cleanup(dev, &dev->cq_pdir);
         pvrdma_page_dir_cleanup(dev, &dev->async_pdir);
         pvrdma_free_slots(dev);
+        dma_free_coherent(&pdev->dev, sizeof(*dev->dsr), dev->dsr,
+                          dev->dsrbase);
 
         iounmap(dev->regs);
         kfree(dev->sgid_tbl);
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 728795043496..0bb6e39dd03a 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -608,11 +608,6 @@ static int rvt_set_page(struct ib_mr *ibmr, u64 addr)
         if (unlikely(mapped_segs == mr->mr.max_segs))
                 return -ENOMEM;
 
-        if (mr->mr.length == 0) {
-                mr->mr.user_base = addr;
-                mr->mr.iova = addr;
-        }
-
         m = mapped_segs / RVT_SEGSZ;
         n = mapped_segs % RVT_SEGSZ;
         mr->mr.map[m]->segs[n].vaddr = (void *)addr;
@@ -630,17 +625,24 @@ static int rvt_set_page(struct ib_mr *ibmr, u64 addr)
  * @sg_nents: number of entries in sg
  * @sg_offset: offset in bytes into sg
  *
+ * Overwrite rvt_mr length with mr length calculated by ib_sg_to_pages.
+ *
  * Return: number of sg elements mapped to the memory region
  */
 int rvt_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
                   int sg_nents, unsigned int *sg_offset)
 {
         struct rvt_mr *mr = to_imr(ibmr);
+        int ret;
 
         mr->mr.length = 0;
         mr->mr.page_shift = PAGE_SHIFT;
-        return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset,
-                              rvt_set_page);
+        ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rvt_set_page);
+        mr->mr.user_base = ibmr->iova;
+        mr->mr.iova = ibmr->iova;
+        mr->mr.offset = ibmr->iova - (u64)mr->mr.map[0]->segs[0].vaddr;
+        mr->mr.length = (size_t)ibmr->length;
+        return ret;
 }
 
 /**
@@ -671,6 +673,7 @@ int rvt_fast_reg_mr(struct rvt_qp *qp, struct ib_mr *ibmr, u32 key,
         ibmr->rkey = key;
         mr->mr.lkey = key;
         mr->mr.access_flags = access;
+        mr->mr.iova = ibmr->iova;
         atomic_set(&mr->mr.lkey_invalid, 0);
 
         return 0;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index a878351f1643..52d7f55fca32 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -420,7 +420,7 @@ config KEYBOARD_MPR121
 
 config KEYBOARD_SNVS_PWRKEY
         tristate "IMX SNVS Power Key Driver"
-        depends on SOC_IMX6SX || SOC_IMX7D
+        depends on ARCH_MXC || COMPILE_TEST
         depends on OF
         help
           This is the snvs powerkey driver for the Freescale i.MX application
diff --git a/drivers/input/keyboard/snvs_pwrkey.c b/drivers/input/keyboard/snvs_pwrkey.c
index effb63205d3d..4c67cf30a5d9 100644
--- a/drivers/input/keyboard/snvs_pwrkey.c
+++ b/drivers/input/keyboard/snvs_pwrkey.c
@@ -148,6 +148,9 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
                 return error;
         }
 
+        pdata->input = input;
+        platform_set_drvdata(pdev, pdata);
+
         error = devm_request_irq(&pdev->dev, pdata->irq,
                                imx_snvs_pwrkey_interrupt,
                                0, pdev->name, pdev);
@@ -163,9 +166,6 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
                 return error;
         }
 
-        pdata->input = input;
-        platform_set_drvdata(pdev, pdata);
-
         device_init_wakeup(&pdev->dev, pdata->wakeup);
 
         return 0;
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 628ef617bb2f..f9525d6f0bfe 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1339,21 +1339,46 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0600", 0 },
         { "ELAN0601", 0 },
         { "ELAN0602", 0 },
+        { "ELAN0603", 0 },
+        { "ELAN0604", 0 },
         { "ELAN0605", 0 },
+        { "ELAN0606", 0 },
+        { "ELAN0607", 0 },
         { "ELAN0608", 0 },
         { "ELAN0609", 0 },
         { "ELAN060B", 0 },
         { "ELAN060C", 0 },
+        { "ELAN060F", 0 },
+        { "ELAN0610", 0 },
         { "ELAN0611", 0 },
         { "ELAN0612", 0 },
+        { "ELAN0615", 0 },
+        { "ELAN0616", 0 },
         { "ELAN0617", 0 },
         { "ELAN0618", 0 },
+        { "ELAN0619", 0 },
+        { "ELAN061A", 0 },
+        { "ELAN061B", 0 },
         { "ELAN061C", 0 },
         { "ELAN061D", 0 },
         { "ELAN061E", 0 },
+        { "ELAN061F", 0 },
         { "ELAN0620", 0 },
         { "ELAN0621", 0 },
         { "ELAN0622", 0 },
+        { "ELAN0623", 0 },
+        { "ELAN0624", 0 },
+        { "ELAN0625", 0 },
+        { "ELAN0626", 0 },
+        { "ELAN0627", 0 },
+        { "ELAN0628", 0 },
+        { "ELAN0629", 0 },
+        { "ELAN062A", 0 },
+        { "ELAN062B", 0 },
+        { "ELAN062C", 0 },
+        { "ELAN062D", 0 },
+        { "ELAN0631", 0 },
+        { "ELAN0632", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index fc3ab93b7aea..7fb358f96195 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -860,7 +860,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
 
         error = rmi_register_function(fn);
         if (error)
-                goto err_put_fn;
+                return error;
 
         if (pdt->function_number == 0x01)
                 data->f01_container = fn;
@@ -870,10 +870,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
         list_add_tail(&fn->node, &data->function_list);
 
         return RMI_SCAN_CONTINUE;
-
-err_put_fn:
-        put_device(&fn->dev);
-        return error;
 }
 
 void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index df64d6aed4f7..93901ebd122a 100644
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -1230,7 +1230,7 @@ static int rmi_f11_initialize(struct rmi_function *fn)
         }
 
         rc = f11_write_control_regs(fn, &f11->sens_query,
-                           &f11->dev_controls, fn->fd.query_base_addr);
+                           &f11->dev_controls, fn->fd.control_base_addr);
         if (rc)
                 dev_warn(&fn->dev, "Failed to write control registers\n");
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 1b1378619fc9..ff40ba758cf3 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -359,7 +359,7 @@ static void iommu_write_l2(struct amd_iommu *iommu, u8 address, u32 val)
 static void iommu_set_exclusion_range(struct amd_iommu *iommu)
 {
         u64 start = iommu->exclusion_start & PAGE_MASK;
-        u64 limit = (start + iommu->exclusion_length) & PAGE_MASK;
+        u64 limit = (start + iommu->exclusion_length - 1) & PAGE_MASK;
         u64 entry;
 
         if (!iommu->exclusion_start)
diff --git a/drivers/irqchip/irq-ath79-misc.c b/drivers/irqchip/irq-ath79-misc.c
index aa7290784636..0390603170b4 100644
--- a/drivers/irqchip/irq-ath79-misc.c
+++ b/drivers/irqchip/irq-ath79-misc.c
@@ -22,6 +22,15 @@
 #define AR71XX_RESET_REG_MISC_INT_ENABLE        4
 
 #define ATH79_MISC_IRQ_COUNT                    32
+#define ATH79_MISC_PERF_IRQ                     5
+
+static int ath79_perfcount_irq;
+
+int get_c0_perfcount_int(void)
+{
+        return ath79_perfcount_irq;
+}
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 static void ath79_misc_irq_handler(struct irq_desc *desc)
 {
@@ -113,6 +122,8 @@ static void __init ath79_misc_intc_domain_init(
 {
         void __iomem *base = domain->host_data;
 
+        ath79_perfcount_irq = irq_create_mapping(domain, ATH79_MISC_PERF_IRQ);
+
         /* Disable and clear all interrupts */
         __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_ENABLE);
         __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_STATUS);
diff --git a/drivers/irqchip/irq-ls1x.c b/drivers/irqchip/irq-ls1x.c
index 86b72fbd3b45..353111a10413 100644
--- a/drivers/irqchip/irq-ls1x.c
+++ b/drivers/irqchip/irq-ls1x.c
@@ -130,6 +130,7 @@ static int __init ls1x_intc_of_init(struct device_node *node,
                                              NULL);
         if (!priv->domain) {
                 pr_err("ls1x-irq: cannot add IRQ domain\n");
+                err = -ENOMEM;
                 goto out_iounmap;
         }
 
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 4ab8b1b6608f..a14e35d40538 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -710,10 +710,10 @@ base_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         struct sock *sk = sock->sk;
         int err = 0;
 
-        if (!maddr || maddr->family != AF_ISDN)
+        if (addr_len < sizeof(struct sockaddr_mISDN))
                 return -EINVAL;
 
-        if (addr_len < sizeof(struct sockaddr_mISDN))
+        if (!maddr || maddr->family != AF_ISDN)
                 return -EINVAL;
 
         lock_sock(sk);
diff --git a/drivers/lightnvm/pblk-read.c b/drivers/lightnvm/pblk-read.c
index 3789185144da..0b7d5fb4548d 100644
--- a/drivers/lightnvm/pblk-read.c
+++ b/drivers/lightnvm/pblk-read.c
@@ -231,14 +231,14 @@ static void pblk_end_partial_read(struct nvm_rq *rqd)
         struct pblk_sec_meta *meta;
         struct bio *new_bio = rqd->bio;
         struct bio *bio = pr_ctx->orig_bio;
-        struct bio_vec src_bv, dst_bv;
         void *meta_list = rqd->meta_list;
-        int bio_init_idx = pr_ctx->bio_init_idx;
         unsigned long *read_bitmap = pr_ctx->bitmap;
+        struct bvec_iter orig_iter = BVEC_ITER_ALL_INIT;
+        struct bvec_iter new_iter = BVEC_ITER_ALL_INIT;
         int nr_secs = pr_ctx->orig_nr_secs;
         int nr_holes = nr_secs - bitmap_weight(read_bitmap, nr_secs);
         void *src_p, *dst_p;
-        int hole, i;
+        int bit, i;
 
         if (unlikely(nr_holes == 1)) {
                 struct ppa_addr ppa;
@@ -257,33 +257,39 @@ static void pblk_end_partial_read(struct nvm_rq *rqd)
 
         /* Fill the holes in the original bio */
         i = 0;
-        hole = find_first_zero_bit(read_bitmap, nr_secs);
-        do {
-                struct pblk_line *line;
+        for (bit = 0; bit < nr_secs; bit++) {
+                if (!test_bit(bit, read_bitmap)) {
+                        struct bio_vec dst_bv, src_bv;
+                        struct pblk_line *line;
 
-                line = pblk_ppa_to_line(pblk, rqd->ppa_list[i]);
-                kref_put(&line->ref, pblk_line_put);
+                        line = pblk_ppa_to_line(pblk, rqd->ppa_list[i]);
+                        kref_put(&line->ref, pblk_line_put);
 
-                meta = pblk_get_meta(pblk, meta_list, hole);
-                meta->lba = cpu_to_le64(pr_ctx->lba_list_media[i]);
+                        meta = pblk_get_meta(pblk, meta_list, bit);
+                        meta->lba = cpu_to_le64(pr_ctx->lba_list_media[i]);
 
-                src_bv = new_bio->bi_io_vec[i++];
-                dst_bv = bio->bi_io_vec[bio_init_idx + hole];
+                        dst_bv = bio_iter_iovec(bio, orig_iter);
+                        src_bv = bio_iter_iovec(new_bio, new_iter);
 
-                src_p = kmap_atomic(src_bv.bv_page);
-                dst_p = kmap_atomic(dst_bv.bv_page);
+                        src_p = kmap_atomic(src_bv.bv_page);
+                        dst_p = kmap_atomic(dst_bv.bv_page);
 
-                memcpy(dst_p + dst_bv.bv_offset,
-                        src_p + src_bv.bv_offset,
-                        PBLK_EXPOSED_PAGE_SIZE);
+                        memcpy(dst_p + dst_bv.bv_offset,
+                                src_p + src_bv.bv_offset,
+                                PBLK_EXPOSED_PAGE_SIZE);
 
-                kunmap_atomic(src_p);
-                kunmap_atomic(dst_p);
+                        kunmap_atomic(src_p);
+                        kunmap_atomic(dst_p);
 
-                mempool_free(src_bv.bv_page, &pblk->page_bio_pool);
+                        flush_dcache_page(dst_bv.bv_page);
+                        mempool_free(src_bv.bv_page, &pblk->page_bio_pool);
 
-                hole = find_next_zero_bit(read_bitmap, nr_secs, hole + 1);
-        } while (hole < nr_secs);
+                        bio_advance_iter(new_bio, &new_iter,
+                                        PBLK_EXPOSED_PAGE_SIZE);
+                        i++;
+                }
+                bio_advance_iter(bio, &orig_iter, PBLK_EXPOSED_PAGE_SIZE);
+        }
 
         bio_put(new_bio);
         kfree(pr_ctx);
diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 95c6d86ab5e8..c4ef1fceead6 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -115,6 +115,7 @@ struct mapped_device {
         struct srcu_struct io_barrier;
 };
 
+void disable_discard(struct mapped_device *md);
 void disable_write_same(struct mapped_device *md);
 void disable_write_zeroes(struct mapped_device *md);
 
diff --git a/drivers/md/dm-init.c b/drivers/md/dm-init.c
index b53f30f16b4d..4b76f84424c3 100644
--- a/drivers/md/dm-init.c
+++ b/drivers/md/dm-init.c
@@ -36,7 +36,7 @@ struct dm_device {
         struct list_head list;
 };
 
-const char *dm_allowed_targets[] __initconst = {
+const char * const dm_allowed_targets[] __initconst = {
         "crypt",
         "delay",
         "linear",
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index d57d997a52c8..7c678f50aaa3 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -913,7 +913,7 @@ static void copy_from_journal(struct dm_integrity_c *ic, unsigned section, unsig
 static bool ranges_overlap(struct dm_integrity_range *range1, struct dm_integrity_range *range2)
 {
         return range1->logical_sector < range2->logical_sector + range2->n_sectors &&
-               range2->logical_sector + range2->n_sectors > range2->logical_sector;
+               range1->logical_sector + range1->n_sectors > range2->logical_sector;
 }
 
 static bool add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range *new_range, bool check_waiting)
@@ -959,8 +959,6 @@ static void remove_range_unlocked(struct dm_integrity_c *ic, struct dm_integrity
                 struct dm_integrity_range *last_range =
                         list_first_entry(&ic->wait_list, struct dm_integrity_range, wait_entry);
                 struct task_struct *last_range_task;
-                if (!ranges_overlap(range, last_range))
-                        break;
                 last_range_task = last_range->task;
                 list_del(&last_range->wait_entry);
                 if (!add_new_range(ic, last_range, false)) {
@@ -3185,7 +3183,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                         journal_watermark = val;
                 else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
                         sync_msec = val;
-                else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {
+                else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
                         if (ic->meta_dev) {
                                 dm_put_device(ti, ic->meta_dev);
                                 ic->meta_dev = NULL;
@@ -3204,17 +3202,17 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                                 goto bad;
                         }
                         ic->sectors_per_block = val >> SECTOR_SHIFT;
-                } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
+                } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
                         r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
                                             "Invalid internal_hash argument");
                         if (r)
                                 goto bad;
-                } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
+                } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
                         r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
                                             "Invalid journal_crypt argument");
                         if (r)
                                 goto bad;
-                } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
+                } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
                         r = get_alg_and_key(opt_string, &ic->journal_mac_alg,  &ti->error,
                                             "Invalid journal_mac argument");
                         if (r)
@@ -3616,7 +3614,7 @@ static struct target_type integrity_target = {
         .io_hints               = dm_integrity_io_hints,
 };
 
-int __init dm_integrity_init(void)
+static int __init dm_integrity_init(void)
 {
         int r;
 
@@ -3635,7 +3633,7 @@ int __init dm_integrity_init(void)
         return r;
 }
 
-void dm_integrity_exit(void)
+static void __exit dm_integrity_exit(void)
 {
         dm_unregister_target(&integrity_target);
         kmem_cache_destroy(journal_io_cache);
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 09773636602d..b66745bd08bb 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -222,11 +222,14 @@ static void dm_done(struct request *clone, blk_status_t error, bool mapped)
         }
 
         if (unlikely(error == BLK_STS_TARGET)) {
-                if (req_op(clone) == REQ_OP_WRITE_SAME &&
-                    !clone->q->limits.max_write_same_sectors)
+                if (req_op(clone) == REQ_OP_DISCARD &&
+                    !clone->q->limits.max_discard_sectors)
+                        disable_discard(tio->md);
+                else if (req_op(clone) == REQ_OP_WRITE_SAME &&
+                         !clone->q->limits.max_write_same_sectors)
                         disable_write_same(tio->md);
-                if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
-                    !clone->q->limits.max_write_zeroes_sectors)
+                else if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
+                         !clone->q->limits.max_write_zeroes_sectors)
                         disable_write_zeroes(tio->md);
         }
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index ba9481f1bf3c..cde3b49b2a91 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1844,6 +1844,36 @@ static bool dm_table_supports_secure_erase(struct dm_table *t)
         return true;
 }
 
+static int device_requires_stable_pages(struct dm_target *ti,
+                                        struct dm_dev *dev, sector_t start,
+                                        sector_t len, void *data)
+{
+        struct request_queue *q = bdev_get_queue(dev->bdev);
+
+        return q && bdi_cap_stable_pages_required(q->backing_dev_info);
+}
+
+/*
+ * If any underlying device requires stable pages, a table must require
+ * them as well.  Only targets that support iterate_devices are considered:
+ * don't want error, zero, etc to require stable pages.
+ */
+static bool dm_table_requires_stable_pages(struct dm_table *t)
+{
+        struct dm_target *ti;
+        unsigned i;
+
+        for (i = 0; i < dm_table_get_num_targets(t); i++) {
+                ti = dm_table_get_target(t, i);
+
+                if (ti->type->iterate_devices &&
+                    ti->type->iterate_devices(ti, device_requires_stable_pages, NULL))
+                        return true;
+        }
+
+        return false;
+}
+
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
                                struct queue_limits *limits)
 {
@@ -1897,6 +1927,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         dm_table_verify_integrity(t);
 
         /*
+         * Some devices don't use blk_integrity but still want stable pages
+         * because they do their own checksumming.
+         */
+        if (dm_table_requires_stable_pages(t))
+                q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
+        else
+                q->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES;
+
+        /*
          * Determine whether or not this queue's I/O timings contribute
          * to the entropy pool, Only request-based targets use this.
          * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 68d24056d0b1..043f0761e4a0 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -945,6 +945,15 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
         }
 }
 
+void disable_discard(struct mapped_device *md)
+{
+        struct queue_limits *limits = dm_get_queue_limits(md);
+
+        /* device doesn't really support DISCARD, disable it */
+        limits->max_discard_sectors = 0;
+        blk_queue_flag_clear(QUEUE_FLAG_DISCARD, md->queue);
+}
+
 void disable_write_same(struct mapped_device *md)
 {
         struct queue_limits *limits = dm_get_queue_limits(md);
@@ -970,11 +979,14 @@ static void clone_endio(struct bio *bio)
         dm_endio_fn endio = tio->ti->type->end_io;
 
         if (unlikely(error == BLK_STS_TARGET) && md->type != DM_TYPE_NVME_BIO_BASED) {
-                if (bio_op(bio) == REQ_OP_WRITE_SAME &&
-                    !bio->bi_disk->queue->limits.max_write_same_sectors)
+                if (bio_op(bio) == REQ_OP_DISCARD &&
+                    !bio->bi_disk->queue->limits.max_discard_sectors)
+                        disable_discard(md);
+                else if (bio_op(bio) == REQ_OP_WRITE_SAME &&
+                         !bio->bi_disk->queue->limits.max_write_same_sectors)
                         disable_write_same(md);
-                if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
-                    !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
+                else if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
+                         !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
                         disable_write_zeroes(md);
         }
 
@@ -1042,15 +1054,7 @@ int dm_set_target_max_io_len(struct dm_target *ti, sector_t len)
                 return -EINVAL;
         }
 
-        /*
-         * BIO based queue uses its own splitting. When multipage bvecs
-         * is switched on, size of the incoming bio may be too big to
-         * be handled in some targets, such as crypt.
-         *
-         * When these targets are ready for the big bio, we can remove
-         * the limit.
-         */
-        ti->max_io_len = min_t(uint32_t, len, BIO_MAX_PAGES * PAGE_SIZE);
+        ti->max_io_len = (uint32_t) len;
 
         return 0;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 0ce2d8dfc5f1..26ad6468d13a 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1246,7 +1246,7 @@ config MFD_STA2X11
 
 config MFD_SUN6I_PRCM
         bool "Allwinner A31 PRCM controller"
-        depends on ARCH_SUNXI
+        depends on ARCH_SUNXI || COMPILE_TEST
         select MFD_CORE
         help
           Support for the PRCM (Power/Reset/Clock Management) unit available
diff --git a/drivers/mfd/sprd-sc27xx-spi.c b/drivers/mfd/sprd-sc27xx-spi.c
index 69df27769c21..43ac71691fe4 100644
--- a/drivers/mfd/sprd-sc27xx-spi.c
+++ b/drivers/mfd/sprd-sc27xx-spi.c
@@ -53,67 +53,67 @@ static const struct sprd_pmic_data sc2731_data = {
 static const struct mfd_cell sprd_pmic_devs[] = {
         {
                 .name = "sc27xx-wdt",
-                .of_compatible = "sprd,sc27xx-wdt",
+                .of_compatible = "sprd,sc2731-wdt",
         }, {
                 .name = "sc27xx-rtc",
-                .of_compatible = "sprd,sc27xx-rtc",
+                .of_compatible = "sprd,sc2731-rtc",
         }, {
                 .name = "sc27xx-charger",
-                .of_compatible = "sprd,sc27xx-charger",
+                .of_compatible = "sprd,sc2731-charger",
         }, {
                 .name = "sc27xx-chg-timer",
-                .of_compatible = "sprd,sc27xx-chg-timer",
+                .of_compatible = "sprd,sc2731-chg-timer",
         }, {
                 .name = "sc27xx-fast-chg",
-                .of_compatible = "sprd,sc27xx-fast-chg",
+                .of_compatible = "sprd,sc2731-fast-chg",
         }, {
                 .name = "sc27xx-chg-wdt",
-                .of_compatible = "sprd,sc27xx-chg-wdt",
+                .of_compatible = "sprd,sc2731-chg-wdt",
         }, {
                 .name = "sc27xx-typec",
-                .of_compatible = "sprd,sc27xx-typec",
+                .of_compatible = "sprd,sc2731-typec",
         }, {
                 .name = "sc27xx-flash",
-                .of_compatible = "sprd,sc27xx-flash",
+                .of_compatible = "sprd,sc2731-flash",
         }, {
                 .name = "sc27xx-eic",
-                .of_compatible = "sprd,sc27xx-eic",
+                .of_compatible = "sprd,sc2731-eic",
         }, {
                 .name = "sc27xx-efuse",
-                .of_compatible = "sprd,sc27xx-efuse",
+                .of_compatible = "sprd,sc2731-efuse",
         }, {
                 .name = "sc27xx-thermal",
-                .of_compatible = "sprd,sc27xx-thermal",
+                .of_compatible = "sprd,sc2731-thermal",
         }, {
                 .name = "sc27xx-adc",
-                .of_compatible = "sprd,sc27xx-adc",
+                .of_compatible = "sprd,sc2731-adc",
         }, {
                 .name = "sc27xx-audio-codec",
-                .of_compatible = "sprd,sc27xx-audio-codec",
+                .of_compatible = "sprd,sc2731-audio-codec",
         }, {
                 .name = "sc27xx-regulator",
-                .of_compatible = "sprd,sc27xx-regulator",
+                .of_compatible = "sprd,sc2731-regulator",
         }, {
                 .name = "sc27xx-vibrator",
-                .of_compatible = "sprd,sc27xx-vibrator",
+                .of_compatible = "sprd,sc2731-vibrator",
         }, {
                 .name = "sc27xx-keypad-led",
-                .of_compatible = "sprd,sc27xx-keypad-led",
+                .of_compatible = "sprd,sc2731-keypad-led",
         }, {
                 .name = "sc27xx-bltc",
-                .of_compatible = "sprd,sc27xx-bltc",
+                .of_compatible = "sprd,sc2731-bltc",
         }, {
                 .name = "sc27xx-fgu",
-                .of_compatible = "sprd,sc27xx-fgu",
+                .of_compatible = "sprd,sc2731-fgu",
         }, {
                 .name = "sc27xx-7sreset",
-                .of_compatible = "sprd,sc27xx-7sreset",
+                .of_compatible = "sprd,sc2731-7sreset",
         }, {
                 .name = "sc27xx-poweroff",
-                .of_compatible = "sprd,sc27xx-poweroff",
+                .of_compatible = "sprd,sc2731-poweroff",
         }, {
                 .name = "sc27xx-syscon",
-                .of_compatible = "sprd,sc27xx-syscon",
+                .of_compatible = "sprd,sc2731-syscon",
         },
 };
 
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index 299016bc46d9..104477b512a2 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -1245,6 +1245,28 @@ free:
         return status;
 }
 
+static int __maybe_unused twl_suspend(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        if (client->irq)
+                disable_irq(client->irq);
+
+        return 0;
+}
+
+static int __maybe_unused twl_resume(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        if (client->irq)
+                enable_irq(client->irq);
+
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(twl_dev_pm_ops, twl_suspend, twl_resume);
+
 static const struct i2c_device_id twl_ids[] = {
         { "twl4030", TWL4030_VAUX2 },   /* "Triton 2" */
         { "twl5030", 0 },               /* T2 updated */
@@ -1262,6 +1284,7 @@ static const struct i2c_device_id twl_ids[] = {
 /* One Client Driver , 4 Clients */
 static struct i2c_driver twl_driver = {
         .driver.name    = DRIVER_NAME,
+        .driver.pm      = &twl_dev_pm_ops,
         .id_table       = twl_ids,
         .probe          = twl_probe,
         .remove         = twl_remove,
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 39f832d27288..36d0d5c9cfba 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1184,6 +1184,7 @@ static int fastrpc_cb_probe(struct platform_device *pdev)
         struct fastrpc_session_ctx *sess;
         struct device *dev = &pdev->dev;
         int i, sessions = 0;
+        int rc;
 
         cctx = dev_get_drvdata(dev->parent);
         if (!cctx)
@@ -1213,7 +1214,11 @@ static int fastrpc_cb_probe(struct platform_device *pdev)
         }
         cctx->sesscount++;
         spin_unlock(&cctx->lock);
-        dma_set_mask(dev, DMA_BIT_MASK(32));
+        rc = dma_set_mask(dev, DMA_BIT_MASK(32));
+        if (rc) {
+                dev_err(dev, "32-bit DMA enable failed\n");
+                return rc;
+        }
 
         return 0;
 }
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index ea979ebd62fb..3c509e19d69d 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -1688,12 +1688,11 @@ static void goya_init_golden_registers(struct hl_device *hdev)
 
         /*
          * Workaround for H2 #HW-23 bug
-         * Set DMA max outstanding read requests to 240 on DMA CH 1. Set it
-         * to 16 on KMD DMA
-         * We need to limit only these DMAs because the user can only read
+         * Set DMA max outstanding read requests to 240 on DMA CH 1.
+         * This limitation is still large enough to not affect Gen4 bandwidth.
+         * We need to only limit that DMA channel because the user can only read
          * from Host using DMA CH 1
          */
-        WREG32(mmDMA_CH_0_CFG0, 0x0fff0010);
         WREG32(mmDMA_CH_1_CFG0, 0x0fff00F0);
 
         goya->hw_cap_initialized |= HW_CAP_GOLDEN;
@@ -3693,7 +3692,7 @@ static int goya_validate_dma_pkt_mmu(struct hl_device *hdev,
          * WA for HW-23.
          * We can't allow user to read from Host using QMANs other than 1.
          */
-        if (parser->hw_queue_id > GOYA_QUEUE_ID_DMA_1 &&
+        if (parser->hw_queue_id != GOYA_QUEUE_ID_DMA_1 &&
                 hl_mem_area_inside_range(le64_to_cpu(user_dma_pkt->src_addr),
                                 le32_to_cpu(user_dma_pkt->tsize),
                                 hdev->asic_prop.va_space_host_start_address,
diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c
index 82a97866e0cf..7c8f203f9a24 100644
--- a/drivers/mmc/host/alcor.c
+++ b/drivers/mmc/host/alcor.c
@@ -48,7 +48,6 @@ struct alcor_sdmmc_host {
         struct mmc_command *cmd;
         struct mmc_data *data;
         unsigned int dma_on:1;
-        unsigned int early_data:1;
 
         struct mutex cmd_mutex;
 
@@ -144,8 +143,7 @@ static void alcor_data_set_dma(struct alcor_sdmmc_host *host)
         host->sg_count--;
 }
 
-static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host,
-                                        bool early)
+static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host)
 {
         struct alcor_pci_priv *priv = host->alcor_pci;
         struct mmc_data *data = host->data;
@@ -155,13 +153,6 @@ static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host,
                 ctrl |= AU6601_DATA_WRITE;
 
         if (data->host_cookie == COOKIE_MAPPED) {
-                if (host->early_data) {
-                        host->early_data = false;
-                        return;
-                }
-
-                host->early_data = early;
-
                 alcor_data_set_dma(host);
                 ctrl |= AU6601_DATA_DMA_MODE;
                 host->dma_on = 1;
@@ -231,6 +222,7 @@ static void alcor_prepare_sg_miter(struct alcor_sdmmc_host *host)
 static void alcor_prepare_data(struct alcor_sdmmc_host *host,
                                struct mmc_command *cmd)
 {
+        struct alcor_pci_priv *priv = host->alcor_pci;
         struct mmc_data *data = cmd->data;
 
         if (!data)
@@ -248,7 +240,7 @@ static void alcor_prepare_data(struct alcor_sdmmc_host *host,
         if (data->host_cookie != COOKIE_MAPPED)
                 alcor_prepare_sg_miter(host);
 
-        alcor_trigger_data_transfer(host, true);
+        alcor_write8(priv, 0, AU6601_DATA_XFER_CTRL);
 }
 
 static void alcor_send_cmd(struct alcor_sdmmc_host *host,
@@ -435,7 +427,7 @@ static int alcor_cmd_irq_done(struct alcor_sdmmc_host *host, u32 intmask)
         if (!host->data)
                 return false;
 
-        alcor_trigger_data_transfer(host, false);
+        alcor_trigger_data_transfer(host);
         host->cmd = NULL;
         return true;
 }
@@ -456,7 +448,7 @@ static void alcor_cmd_irq_thread(struct alcor_sdmmc_host *host, u32 intmask)
         if (!host->data)
                 alcor_request_complete(host, 1);
         else
-                alcor_trigger_data_transfer(host, false);
+                alcor_trigger_data_transfer(host);
         host->cmd = NULL;
 }
 
@@ -487,15 +479,9 @@ static int alcor_data_irq_done(struct alcor_sdmmc_host *host, u32 intmask)
                 break;
         case AU6601_INT_READ_BUF_RDY:
                 alcor_trf_block_pio(host, true);
-                if (!host->blocks)
-                        break;
-                alcor_trigger_data_transfer(host, false);
                 return 1;
         case AU6601_INT_WRITE_BUF_RDY:
                 alcor_trf_block_pio(host, false);
-                if (!host->blocks)
-                        break;
-                alcor_trigger_data_transfer(host, false);
                 return 1;
         case AU6601_INT_DMA_END:
                 if (!host->sg_count)
@@ -508,8 +494,14 @@ static int alcor_data_irq_done(struct alcor_sdmmc_host *host, u32 intmask)
                 break;
         }
 
-        if (intmask & AU6601_INT_DATA_END)
-                return 0;
+        if (intmask & AU6601_INT_DATA_END) {
+                if (!host->dma_on && host->blocks) {
+                        alcor_trigger_data_transfer(host);
+                        return 1;
+                } else {
+                        return 0;
+                }
+        }
 
         return 1;
 }
diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index 5bbed477c9b1..9f20fff9781b 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -797,6 +797,43 @@ void sdhci_omap_reset(struct sdhci_host *host, u8 mask)
         sdhci_reset(host, mask);
 }
 
+#define CMD_ERR_MASK (SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX |\
+                      SDHCI_INT_TIMEOUT)
+#define CMD_MASK (CMD_ERR_MASK | SDHCI_INT_RESPONSE)
+
+static u32 sdhci_omap_irq(struct sdhci_host *host, u32 intmask)
+{
+        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
+
+        if (omap_host->is_tuning && host->cmd && !host->data_early &&
+            (intmask & CMD_ERR_MASK)) {
+
+                /*
+                 * Since we are not resetting data lines during tuning
+                 * operation, data error or data complete interrupts
+                 * might still arrive. Mark this request as a failure
+                 * but still wait for the data interrupt
+                 */
+                if (intmask & SDHCI_INT_TIMEOUT)
+                        host->cmd->error = -ETIMEDOUT;
+                else
+                        host->cmd->error = -EILSEQ;
+
+                host->cmd = NULL;
+
+                /*
+                 * Sometimes command error interrupts and command complete
+                 * interrupt will arrive together. Clear all command related
+                 * interrupts here.
+                 */
+                sdhci_writel(host, intmask & CMD_MASK, SDHCI_INT_STATUS);
+                intmask &= ~CMD_MASK;
+        }
+
+        return intmask;
+}
+
 static struct sdhci_ops sdhci_omap_ops = {
         .set_clock = sdhci_omap_set_clock,
         .set_power = sdhci_omap_set_power,
@@ -807,6 +844,7 @@ static struct sdhci_ops sdhci_omap_ops = {
         .platform_send_init_74_clocks = sdhci_omap_init_74_clocks,
         .reset = sdhci_omap_reset,
         .set_uhs_signaling = sdhci_omap_set_uhs_signaling,
+        .irq = sdhci_omap_irq,
 };
 
 static int sdhci_omap_set_capabilities(struct sdhci_omap_host *omap_host)
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 72428b6bfc47..7b7286b4d81e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1876,7 +1876,11 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                         continue;
                 }
 
-                if (time_after(jiffies, timeo) && !chip_ready(map, adr))
+                /*
+                 * We check "time_after" and "!chip_good" before checking "chip_good" to avoid
+                 * the failure due to scheduling.
+                 */
+                if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
                         break;
 
                 if (chip_good(map, adr, datum)) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b59708c35faf..ee610721098e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3213,8 +3213,12 @@ static int bond_netdev_event(struct notifier_block *this,
                 return NOTIFY_DONE;
 
         if (event_dev->flags & IFF_MASTER) {
+                int ret;
+
                 netdev_dbg(event_dev, "IFF_MASTER\n");
-                return bond_master_netdev_event(event, event_dev);
+                ret = bond_master_netdev_event(event, event_dev);
+                if (ret != NOTIFY_DONE)
+                        return ret;
         }
 
         if (event_dev->flags & IFF_SLAVE) {
diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index 2f120b2ffef0..4985268e2273 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -55,7 +55,9 @@ static SLAVE_ATTR_RO(link_failure_count);
 
 static ssize_t perm_hwaddr_show(struct slave *slave, char *buf)
 {
-        return sprintf(buf, "%pM\n", slave->perm_hwaddr);
+        return sprintf(buf, "%*phC\n",
+                       slave->dev->addr_len,
+                       slave->perm_hwaddr);
 }
 static SLAVE_ATTR_RO(perm_hwaddr);
 
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index dce84a2a65c7..c44b2822e4dd 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -427,18 +427,22 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 return 0;
 
         lane = mv88e6390x_serdes_get_lane(chip, port);
-        if (lane < 0)
+        if (lane < 0 && lane != -ENODEV)
                 return lane;
 
-        if (chip->ports[port].serdes_irq) {
-                err = mv88e6390_serdes_irq_disable(chip, port, lane);
+        if (lane >= 0) {
+                if (chip->ports[port].serdes_irq) {
+                        err = mv88e6390_serdes_irq_disable(chip, port, lane);
+                        if (err)
+                                return err;
+                }
+
+                err = mv88e6390x_serdes_power(chip, port, false);
                 if (err)
                         return err;
         }
 
-        err = mv88e6390x_serdes_power(chip, port, false);
-        if (err)
-                return err;
+        chip->ports[port].cmode = 0;
 
         if (cmode) {
                 err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, &reg);
@@ -452,6 +456,12 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 if (err)
                         return err;
 
+                chip->ports[port].cmode = cmode;
+
+                lane = mv88e6390x_serdes_get_lane(chip, port);
+                if (lane < 0)
+                        return lane;
+
                 err = mv88e6390x_serdes_power(chip, port, true);
                 if (err)
                         return err;
@@ -463,8 +473,6 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 }
         }
 
-        chip->ports[port].cmode = cmode;
-
         return 0;
 }
 
diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
index 9e07b469066a..156fbc5601ca 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.c
+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
@@ -1721,7 +1721,7 @@ static void atl1_inc_smb(struct atl1_adapter *adapter)
         adapter->soft_stats.scc += smb->tx_1_col;
         adapter->soft_stats.mcc += smb->tx_2_col;
         adapter->soft_stats.latecol += smb->tx_late_col;
-        adapter->soft_stats.tx_underun += smb->tx_underrun;
+        adapter->soft_stats.tx_underrun += smb->tx_underrun;
         adapter->soft_stats.tx_trunc += smb->tx_trunc;
         adapter->soft_stats.tx_pause += smb->tx_pause;
 
@@ -3179,7 +3179,7 @@ static struct atl1_stats atl1_gstrings_stats[] = {
         {"tx_deferred_ok", ATL1_STAT(soft_stats.deffer)},
         {"tx_single_coll_ok", ATL1_STAT(soft_stats.scc)},
         {"tx_multi_coll_ok", ATL1_STAT(soft_stats.mcc)},
-        {"tx_underun", ATL1_STAT(soft_stats.tx_underun)},
+        {"tx_underrun", ATL1_STAT(soft_stats.tx_underrun)},
         {"tx_trunc", ATL1_STAT(soft_stats.tx_trunc)},
         {"tx_pause", ATL1_STAT(soft_stats.tx_pause)},
         {"rx_pause", ATL1_STAT(soft_stats.rx_pause)},
diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h
index 34a58cd846a0..eacff19ea05b 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.h
+++ b/drivers/net/ethernet/atheros/atlx/atl1.h
@@ -681,7 +681,7 @@ struct atl1_sft_stats {
         u64 scc;                /* packets TX after a single collision */
         u64 mcc;                /* packets TX after multiple collisions */
         u64 latecol;            /* TX packets w/ late collisions */
-        u64 tx_underun;         /* TX packets aborted due to TX FIFO underrun
+        u64 tx_underrun;        /* TX packets aborted due to TX FIFO underrun
                                  * or TRD FIFO underrun */
         u64 tx_trunc;           /* TX packets truncated due to size > MTU */
         u64 rx_pause;           /* num Pause packets received. */
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index d99317b3d891..98da0fa27192 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -553,7 +553,7 @@ static void atl2_intr_tx(struct atl2_adapter *adapter)
                         netdev->stats.tx_aborted_errors++;
                 if (txs->late_col)
                         netdev->stats.tx_window_errors++;
-                if (txs->underun)
+                if (txs->underrun)
                         netdev->stats.tx_fifo_errors++;
         } while (1);
 
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.h b/drivers/net/ethernet/atheros/atlx/atl2.h
index c64a6bdfa7ae..25ec84cb4853 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.h
+++ b/drivers/net/ethernet/atheros/atlx/atl2.h
@@ -260,7 +260,7 @@ struct tx_pkt_status {
         unsigned multi_col:1;
         unsigned late_col:1;
         unsigned abort_col:1;
-        unsigned underun:1;     /* current packet is aborted
+        unsigned underrun:1;    /* current packet is aborted
                                  * due to txram underrun */
         unsigned:3;             /* reserved */
         unsigned update:1;      /* always 1'b1 in tx_status_buf */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index a9bdc21873d3..10ff37d6dc78 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -957,7 +957,7 @@ int bnx2x_vfpf_update_vlan(struct bnx2x *bp, u16 vid, u8 vf_qid, bool add)
         bnx2x_sample_bulletin(bp);
 
         if (bp->shadow_bulletin.content.valid_bitmap & 1 << VLAN_VALID) {
-                BNX2X_ERR("Hypervisor will dicline the request, avoiding\n");
+                BNX2X_ERR("Hypervisor will decline the request, avoiding\n");
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 0bb9d7b3a2b6..4c586ba4364b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1133,6 +1133,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
         tpa_info = &rxr->rx_tpa[agg_id];
 
         if (unlikely(cons != rxr->rx_next_cons)) {
+                netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n",
+                            cons, rxr->rx_next_cons);
                 bnxt_sched_reset(bp, rxr);
                 return;
         }
@@ -1585,15 +1587,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
         }
 
         cons = rxcmp->rx_cmp_opaque;
-        rx_buf = &rxr->rx_buf_ring[cons];
-        data = rx_buf->data;
-        data_ptr = rx_buf->data_ptr;
         if (unlikely(cons != rxr->rx_next_cons)) {
                 int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp);
 
+                netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+                            cons, rxr->rx_next_cons);
                 bnxt_sched_reset(bp, rxr);
                 return rc1;
         }
+        rx_buf = &rxr->rx_buf_ring[cons];
+        data = rx_buf->data;
+        data_ptr = rx_buf->data_ptr;
         prefetch(data_ptr);
 
         misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1);
@@ -1610,11 +1614,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
 
         rx_buf->data = NULL;
         if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L2_ERRORS) {
+                u32 rx_err = le32_to_cpu(rxcmp1->rx_cmp_cfa_code_errors_v2);
+
                 bnxt_reuse_rx_data(rxr, cons, data);
                 if (agg_bufs)
                         bnxt_reuse_rx_agg_bufs(cpr, cp_cons, agg_bufs);
 
                 rc = -EIO;
+                if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) {
+                        netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
+                        bnxt_sched_reset(bp, rxr);
+                }
                 goto next_rx;
         }
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 328373e0578f..060a6f386104 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -4283,7 +4283,7 @@ static void tg3_power_down(struct tg3 *tp)
         pci_set_power_state(tp->pdev, PCI_D3hot);
 }
 
-static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u16 *speed, u8 *duplex)
+static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u32 *speed, u8 *duplex)
 {
         switch (val & MII_TG3_AUX_STAT_SPDMASK) {
         case MII_TG3_AUX_STAT_10HALF:
@@ -4787,7 +4787,7 @@ static int tg3_setup_copper_phy(struct tg3 *tp, bool force_reset)
         bool current_link_up;
         u32 bmsr, val;
         u32 lcl_adv, rmt_adv;
-        u16 current_speed;
+        u32 current_speed;
         u8 current_duplex;
         int i, err;
 
@@ -5719,7 +5719,7 @@ out:
 static int tg3_setup_fiber_phy(struct tg3 *tp, bool force_reset)
 {
         u32 orig_pause_cfg;
-        u16 orig_active_speed;
+        u32 orig_active_speed;
         u8 orig_active_duplex;
         u32 mac_status;
         bool current_link_up;
@@ -5823,7 +5823,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
 {
         int err = 0;
         u32 bmsr, bmcr;
-        u16 current_speed = SPEED_UNKNOWN;
+        u32 current_speed = SPEED_UNKNOWN;
         u8 current_duplex = DUPLEX_UNKNOWN;
         bool current_link_up = false;
         u32 local_adv, remote_adv, sgsr;
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index a772a33b685c..6953d0546acb 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2873,7 +2873,7 @@ struct tg3_tx_ring_info {
 struct tg3_link_config {
         /* Describes what we're trying to get. */
         u32                             advertising;
-        u16                             speed;
+        u32                             speed;
         u8                              duplex;
         u8                              autoneg;
         u8                              flowctrl;
@@ -2882,7 +2882,7 @@ struct tg3_link_config {
         u8                              active_flowctrl;
 
         u8                              active_duplex;
-        u16                             active_speed;
+        u32                             active_speed;
         u32                             rmt_adv;
 };
 
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 1522aee81884..3da2795e2486 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -898,7 +898,9 @@ static void macb_tx_interrupt(struct macb_queue *queue)
 
                         /* First, update TX stats if needed */
                         if (skb) {
-                                if (gem_ptp_do_txstamp(queue, skb, desc) == 0) {
+                                if (unlikely(skb_shinfo(skb)->tx_flags &
+                                             SKBTX_HW_TSTAMP) &&
+                                    gem_ptp_do_txstamp(queue, skb, desc) == 0) {
                                         /* skb now belongs to timestamp buffer
                                          * and will be removed later
                                          */
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index aa2be4807191..c032bef1b776 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -32,6 +32,13 @@
 #define DRV_NAME        "nicvf"
 #define DRV_VERSION     "1.0"
 
+/* NOTE: Packets bigger than 1530 are split across multiple pages and XDP needs
+ * the buffer to be contiguous. Allow XDP to be set up only if we don't exceed
+ * this value, keeping headroom for the 14 byte Ethernet header and two
+ * VLAN tags (for QinQ)
+ */
+#define MAX_XDP_MTU     (1530 - ETH_HLEN - VLAN_HLEN * 2)
+
 /* Supported devices */
 static const struct pci_device_id nicvf_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM,
@@ -1328,10 +1335,11 @@ int nicvf_stop(struct net_device *netdev)
         struct nicvf_cq_poll *cq_poll = NULL;
         union nic_mbx mbx = {};
 
-        cancel_delayed_work_sync(&nic->link_change_work);
-
         /* wait till all queued set_rx_mode tasks completes */
-        drain_workqueue(nic->nicvf_rx_mode_wq);
+        if (nic->nicvf_rx_mode_wq) {
+                cancel_delayed_work_sync(&nic->link_change_work);
+                drain_workqueue(nic->nicvf_rx_mode_wq);
+        }
 
         mbx.msg.msg = NIC_MBOX_MSG_SHUTDOWN;
         nicvf_send_msg_to_pf(nic, &mbx);
@@ -1452,7 +1460,8 @@ int nicvf_open(struct net_device *netdev)
         struct nicvf_cq_poll *cq_poll = NULL;
 
         /* wait till all queued set_rx_mode tasks completes if any */
-        drain_workqueue(nic->nicvf_rx_mode_wq);
+        if (nic->nicvf_rx_mode_wq)
+                drain_workqueue(nic->nicvf_rx_mode_wq);
 
         netif_carrier_off(netdev);
 
@@ -1550,10 +1559,12 @@ int nicvf_open(struct net_device *netdev)
         /* Send VF config done msg to PF */
         nicvf_send_cfg_done(nic);
 
-        INIT_DELAYED_WORK(&nic->link_change_work,
-                          nicvf_link_status_check_task);
-        queue_delayed_work(nic->nicvf_rx_mode_wq,
-                           &nic->link_change_work, 0);
+        if (nic->nicvf_rx_mode_wq) {
+                INIT_DELAYED_WORK(&nic->link_change_work,
+                                  nicvf_link_status_check_task);
+                queue_delayed_work(nic->nicvf_rx_mode_wq,
+                                   &nic->link_change_work, 0);
+        }
 
         return 0;
 cleanup:
@@ -1578,6 +1589,15 @@ static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)
         struct nicvf *nic = netdev_priv(netdev);
         int orig_mtu = netdev->mtu;
 
+        /* For now just support only the usual MTU sized frames,
+         * plus some headroom for VLAN, QinQ.
+         */
+        if (nic->xdp_prog && new_mtu > MAX_XDP_MTU) {
+                netdev_warn(netdev, "Jumbo frames not yet supported with XDP, current MTU %d.\n",
+                            netdev->mtu);
+                return -EINVAL;
+        }
+
         netdev->mtu = new_mtu;
 
         if (!netif_running(netdev))
@@ -1826,8 +1846,10 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         bool bpf_attached = false;
         int ret = 0;
 
-        /* For now just support only the usual MTU sized frames */
-        if (prog && (dev->mtu > 1500)) {
+        /* For now just support only the usual MTU sized frames,
+         * plus some headroom for VLAN, QinQ.
+         */
+        if (prog && dev->mtu > MAX_XDP_MTU) {
                 netdev_warn(dev, "Jumbo frames not yet supported with XDP, current MTU %d.\n",
                             dev->mtu);
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 5b4d3badcb73..e246f9733bb8 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -105,20 +105,19 @@ static inline struct pgcache *nicvf_alloc_page(struct nicvf *nic,
         /* Check if page can be recycled */
         if (page) {
                 ref_count = page_ref_count(page);
-                /* Check if this page has been used once i.e 'put_page'
-                 * called after packet transmission i.e internal ref_count
-                 * and page's ref_count are equal i.e page can be recycled.
+                /* This page can be recycled if internal ref_count and page's
+                 * ref_count are equal, indicating that the page has been used
+                 * once for packet transmission. For non-XDP mode, internal
+                 * ref_count is always '1'.
                  */
-                if (rbdr->is_xdp && (ref_count == pgcache->ref_count))
-                        pgcache->ref_count--;
-                else
-                        page = NULL;
-
-                /* In non-XDP mode, page's ref_count needs to be '1' for it
-                 * to be recycled.
-                 */
-                if (!rbdr->is_xdp && (ref_count != 1))
+                if (rbdr->is_xdp) {
+                        if (ref_count == pgcache->ref_count)
+                                pgcache->ref_count--;
+                        else
+                                page = NULL;
+                } else if (ref_count != 1) {
                         page = NULL;
+                }
         }
 
         if (!page) {
@@ -365,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
         while (head < rbdr->pgcnt) {
                 pgcache = &rbdr->pgcache[head];
                 if (pgcache->page && page_ref_count(pgcache->page) != 0) {
-                        if (!rbdr->is_xdp) {
-                                put_page(pgcache->page);
-                                continue;
+                        if (rbdr->is_xdp) {
+                                page_ref_sub(pgcache->page,
+                                             pgcache->ref_count - 1);
                         }
-                        page_ref_sub(pgcache->page, pgcache->ref_count - 1);
                         put_page(pgcache->page);
                 }
                 head++;
diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
index 74849be5f004..e2919005ead3 100644
--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
+++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
@@ -354,7 +354,10 @@ static struct cxgbi_ppm_pool *ppm_alloc_cpu_pool(unsigned int *total,
                 ppmax = max;
 
         /* pool size must be multiple of unsigned long */
-        bmap = BITS_TO_LONGS(ppmax);
+        bmap = ppmax / BITS_PER_TYPE(unsigned long);
+        if (!bmap)
+                return NULL;
+
         ppmax = (bmap * sizeof(unsigned long)) << 3;
 
         alloc_sz = sizeof(*pools) + sizeof(unsigned long) * bmap;
@@ -402,6 +405,10 @@ int cxgbi_ppm_init(void **ppm_pp, struct net_device *ndev,
         if (reserve_factor) {
                 ppmax_pool = ppmax / reserve_factor;
                 pool = ppm_alloc_cpu_pool(&ppmax_pool, &pool_index_max);
+                if (!pool) {
+                        ppmax_pool = 0;
+                        reserve_factor = 0;
+                }
 
                 pr_debug("%s: ppmax %u, cpu total %u, per cpu %u.\n",
                          ndev->name, ppmax, ppmax_pool, pool_index_max);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 697c2427f2b7..a96ad20ee484 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1840,13 +1840,9 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
         int ret;
 
         if (enable) {
-                ret = clk_prepare_enable(fep->clk_ahb);
-                if (ret)
-                        return ret;
-
                 ret = clk_prepare_enable(fep->clk_enet_out);
                 if (ret)
-                        goto failed_clk_enet_out;
+                        return ret;
 
                 if (fep->clk_ptp) {
                         mutex_lock(&fep->ptp_clk_mutex);
@@ -1866,7 +1862,6 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
 
                 phy_reset_after_clk_enable(ndev->phydev);
         } else {
-                clk_disable_unprepare(fep->clk_ahb);
                 clk_disable_unprepare(fep->clk_enet_out);
                 if (fep->clk_ptp) {
                         mutex_lock(&fep->ptp_clk_mutex);
@@ -1885,8 +1880,6 @@ failed_clk_ref:
 failed_clk_ptp:
         if (fep->clk_enet_out)
                 clk_disable_unprepare(fep->clk_enet_out);
-failed_clk_enet_out:
-                clk_disable_unprepare(fep->clk_ahb);
 
         return ret;
 }
@@ -3470,6 +3463,9 @@ fec_probe(struct platform_device *pdev)
         ret = clk_prepare_enable(fep->clk_ipg);
         if (ret)
                 goto failed_clk_ipg;
+        ret = clk_prepare_enable(fep->clk_ahb);
+        if (ret)
+                goto failed_clk_ahb;
 
         fep->reg_phy = devm_regulator_get_optional(&pdev->dev, "phy");
         if (!IS_ERR(fep->reg_phy)) {
@@ -3563,6 +3559,9 @@ failed_reset:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 failed_regulator:
+        clk_disable_unprepare(fep->clk_ahb);
+failed_clk_ahb:
+        clk_disable_unprepare(fep->clk_ipg);
 failed_clk_ipg:
         fec_enet_clk_enable(ndev, false);
 failed_clk:
@@ -3686,6 +3685,7 @@ static int __maybe_unused fec_runtime_suspend(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct fec_enet_private *fep = netdev_priv(ndev);
 
+        clk_disable_unprepare(fep->clk_ahb);
         clk_disable_unprepare(fep->clk_ipg);
 
         return 0;
@@ -3695,8 +3695,20 @@ static int __maybe_unused fec_runtime_resume(struct device *dev)
 {
         struct net_device *ndev = dev_get_drvdata(dev);
         struct fec_enet_private *fep = netdev_priv(ndev);
+        int ret;
 
-        return clk_prepare_enable(fep->clk_ipg);
+        ret = clk_prepare_enable(fep->clk_ahb);
+        if (ret)
+                return ret;
+        ret = clk_prepare_enable(fep->clk_ipg);
+        if (ret)
+                goto failed_clk_ipg;
+
+        return 0;
+
+failed_clk_ipg:
+        clk_disable_unprepare(fep->clk_ahb);
+        return ret;
 }
 
 static const struct dev_pm_ops fec_pm_ops = {
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index 79d03f8ee7b1..c7fa97a7e1f4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -150,7 +150,6 @@ out_buffer_fail:
 /* free desc along with its attached buffer */
 static void hnae_free_desc(struct hnae_ring *ring)
 {
-        hnae_free_buffers(ring);
         dma_unmap_single(ring_to_dev(ring), ring->desc_dma_addr,
                          ring->desc_num * sizeof(ring->desc[0]),
                          ring_to_dma_dir(ring));
@@ -183,6 +182,9 @@ static int hnae_alloc_desc(struct hnae_ring *ring)
 /* fini ring, also free the buffer for the ring */
 static void hnae_fini_ring(struct hnae_ring *ring)
 {
+        if (is_rx_ring(ring))
+                hnae_free_buffers(ring);
+
         hnae_free_desc(ring);
         kfree(ring->desc_cb);
         ring->desc_cb = NULL;
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index 08a750fb60c4..d6fb83437230 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -357,7 +357,7 @@ struct hnae_buf_ops {
 };
 
 struct hnae_queue {
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         phys_addr_t phy_base;
         struct hnae_ae_dev *dev;        /* the device who use this queue */
         struct hnae_ring rx_ring ____cacheline_internodealigned_in_smp;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index a97228c93831..6c0507921623 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -370,7 +370,7 @@ int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn)
 static void hns_mac_param_get(struct mac_params *param,
                               struct hns_mac_cb *mac_cb)
 {
-        param->vaddr = (void *)mac_cb->vaddr;
+        param->vaddr = mac_cb->vaddr;
         param->mac_mode = hns_get_enet_interface(mac_cb);
         ether_addr_copy(param->addr, mac_cb->addr_entry_idx[0].addr);
         param->mac_id = mac_cb->mac_id;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
index fbc75341bef7..22589799f1a5 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
@@ -187,7 +187,7 @@ struct mac_statistics {
 /*mac para struct ,mac get param from nic or dsaf when initialize*/
 struct mac_params {
         char addr[ETH_ALEN];
-        void *vaddr; /*virtual address*/
+        u8 __iomem *vaddr; /*virtual address*/
         struct device *dev;
         u8 mac_id;
         /**< Ethernet operation mode (MAC-PHY interface and speed) */
@@ -402,7 +402,7 @@ struct mac_driver {
         enum mac_mode mac_mode;
         u8 mac_id;
         struct hns_mac_cb *mac_cb;
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         unsigned int mac_en_flg;/*you'd better don't enable mac twice*/
         unsigned int virt_dev_num;
         struct device *dev;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index ac55db065f16..61eea6ac846f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1602,8 +1602,6 @@ static void hns_dsaf_set_mac_key(
                        DSAF_TBL_TCAM_KEY_VLAN_S, vlan_id);
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_PORT_M,
                        DSAF_TBL_TCAM_KEY_PORT_S, port);
-
-        mac_key->low.bits.port_vlan = le16_to_cpu(mac_key->low.bits.port_vlan);
 }
 
 /**
@@ -1663,8 +1661,8 @@ int hns_dsaf_set_mac_uc_entry(
         /* default config dvc to 0 */
         mac_data.tbl_ucast_dvc = 0;
         mac_data.tbl_ucast_out_port = mac_entry->port_num;
-        tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-        tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+        tcam_data.tbl_tcam_data_high = mac_key.high.val;
+        tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
         hns_dsaf_tcam_uc_cfg(dsaf_dev, entry_index, &tcam_data, &mac_data);
 
@@ -1786,9 +1784,6 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
                                      0xff,
                                      mc_mask);
 
-                mask_key.high.val = le32_to_cpu(mask_key.high.val);
-                mask_key.low.val = le32_to_cpu(mask_key.low.val);
-
                 pmask_key = (struct dsaf_tbl_tcam_data *)(&mask_key);
         }
 
@@ -1840,8 +1835,8 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
                 dsaf_dev->ae_dev.name, mac_key.high.val,
                 mac_key.low.val, entry_index);
 
-        tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-        tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+        tcam_data.tbl_tcam_data_high = mac_key.high.val;
+        tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
         /* config mc entry with mask */
         hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index, &tcam_data,
@@ -1956,9 +1951,6 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
                 /* config key mask */
                 hns_dsaf_set_mac_key(dsaf_dev, &mask_key, 0x00, 0xff, mc_mask);
 
-                mask_key.high.val = le32_to_cpu(mask_key.high.val);
-                mask_key.low.val = le32_to_cpu(mask_key.low.val);
-
                 pmask_key = (struct dsaf_tbl_tcam_data *)(&mask_key);
         }
 
@@ -2012,8 +2004,8 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
                 soft_mac_entry += entry_index;
                 soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
         } else { /* not zero, just del port, update */
-                tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-                tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+                tcam_data.tbl_tcam_data_high = mac_key.high.val;
+                tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
                 hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index,
                                      &tcam_data,
@@ -2750,6 +2742,17 @@ int hns_dsaf_get_regs_count(void)
         return DSAF_DUMP_REGS_NUM;
 }
 
+static int hns_dsaf_get_port_id(u8 port)
+{
+        if (port < DSAF_SERVICE_NW_NUM)
+                return port;
+
+        if (port >= DSAF_BASE_INNER_PORT_NUM)
+                return port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+
+        return -EINVAL;
+}
+
 static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
 {
         struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
@@ -2815,23 +2818,33 @@ static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
         memset(&temp_key, 0x0, sizeof(temp_key));
         mask_entry.addr[0] = 0x01;
         hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
-                             port, mask_entry.addr);
+                             0xf, mask_entry.addr);
         tbl_tcam_mcast.tbl_mcast_item_vld = 1;
         tbl_tcam_mcast.tbl_mcast_old_en = 0;
 
-        if (port < DSAF_SERVICE_NW_NUM) {
-                mskid = port;
-        } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
-                mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
-        } else {
+        /* set MAC port to handle multicast */
+        mskid = hns_dsaf_get_port_id(port);
+        if (mskid == -EINVAL) {
                 dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
                         dsaf_dev->ae_dev.name, port,
                         mask_key.high.val, mask_key.low.val);
                 return;
         }
+        dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
+                     mskid % 32, 1);
 
+        /* set pool bit map to handle multicast */
+        mskid = hns_dsaf_get_port_id(port_num);
+        if (mskid == -EINVAL) {
+                dev_err(dsaf_dev->dev,
+                        "%s, pool bit map pnum(%d)error,key(%#x:%#x)\n",
+                        dsaf_dev->ae_dev.name, port_num,
+                        mask_key.high.val, mask_key.low.val);
+                return;
+        }
         dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
                      mskid % 32, 1);
+
         memcpy(&temp_key, &mask_key, sizeof(mask_key));
         hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
                                    (struct dsaf_tbl_tcam_data *)(&mask_key),
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
index 0e1cd99831a6..76cc8887e1a8 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
@@ -467,4 +467,6 @@ int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev,
                              u8 mac_id, u8 port_num);
 int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port);
 
+int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset);
+
 #endif /* __HNS_DSAF_MAIN_H__ */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
index 16294cd3c954..19b94879691f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
@@ -670,7 +670,7 @@ static int hns_mac_config_sds_loopback(struct hns_mac_cb *mac_cb, bool en)
                 dsaf_set_field(origin, 1ull << 10, 10, en);
                 dsaf_write_syscon(mac_cb->serdes_ctrl, reg_offset, origin);
         } else {
-                u8 *base_addr = (u8 *)mac_cb->serdes_vaddr +
+                u8 __iomem *base_addr = mac_cb->serdes_vaddr +
                                 (mac_cb->mac_id <= 3 ? 0x00280000 : 0x00200000);
                 dsaf_set_reg_field(base_addr, reg_offset, 1ull << 10, 10, en);
         }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index 3d07c8a7639d..17c019106e6e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -61,7 +61,7 @@ void hns_ppe_set_indir_table(struct hns_ppe_cb *ppe_cb,
         }
 }
 
-static void __iomem *
+static u8 __iomem *
 hns_ppe_common_get_ioaddr(struct ppe_common_cb *ppe_common)
 {
         return ppe_common->dsaf_dev->ppe_base + PPE_COMMON_REG_OFFSET;
@@ -111,8 +111,8 @@ hns_ppe_common_free_cfg(struct dsaf_device *dsaf_dev, u32 comm_index)
         dsaf_dev->ppe_common[comm_index] = NULL;
 }
 
-static void __iomem *hns_ppe_get_iobase(struct ppe_common_cb *ppe_common,
-                                        int ppe_idx)
+static u8 __iomem *hns_ppe_get_iobase(struct ppe_common_cb *ppe_common,
+                                      int ppe_idx)
 {
         return ppe_common->dsaf_dev->ppe_base + ppe_idx * PPE_REG_OFFSET;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
index f670e63a5a01..110c6e8222c7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
@@ -80,7 +80,7 @@ struct hns_ppe_cb {
         struct hns_ppe_hw_stats hw_stats;
 
         u8 index;       /* index in a ppe common device */
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         int virq;
         u32 rss_indir_table[HNS_PPEV2_RSS_IND_TBL_SIZE]; /*shadow indir tab */
         u32 rss_key[HNS_PPEV2_RSS_KEY_NUM]; /* rss hash key */
@@ -89,7 +89,7 @@ struct hns_ppe_cb {
 struct ppe_common_cb {
         struct device *dev;
         struct dsaf_device *dsaf_dev;
-        void __iomem *io_base;
+        u8 __iomem *io_base;
 
         enum ppe_common_mode ppe_mode;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 6bf346c11b25..ac3518ca4d7b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -458,7 +458,7 @@ static void hns_rcb_ring_get_cfg(struct hnae_queue *q, int ring_type)
                 mdnum_ppkt = HNS_RCB_RING_MAX_BD_PER_PKT;
         } else {
                 ring = &q->tx_ring;
-                ring->io_base = (u8 __iomem *)ring_pair_cb->q.io_base +
+                ring->io_base = ring_pair_cb->q.io_base +
                         HNS_RCB_TX_REG_OFFSET;
                 irq_idx = HNS_RCB_IRQ_IDX_TX;
                 mdnum_ppkt = is_ver1 ? HNS_RCB_RING_MAX_TXBD_PER_PKT :
@@ -764,7 +764,7 @@ static int hns_rcb_get_ring_num(struct dsaf_device *dsaf_dev)
         }
 }
 
-static void __iomem *hns_rcb_common_get_vaddr(struct rcb_common_cb *rcb_common)
+static u8 __iomem *hns_rcb_common_get_vaddr(struct rcb_common_cb *rcb_common)
 {
         struct dsaf_device *dsaf_dev = rcb_common->dsaf_dev;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index b9733b0b8482..b9e7f11f0896 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -1018,7 +1018,7 @@
 #define XGMAC_PAUSE_CTL_RSP_MODE_B      2
 #define XGMAC_PAUSE_CTL_TX_XOFF_B       3
 
-static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+static inline void dsaf_write_reg(u8 __iomem *base, u32 reg, u32 value)
 {
         writel(value, base + reg);
 }
@@ -1053,7 +1053,7 @@ static inline int dsaf_read_syscon(struct regmap *base, u32 reg, u32 *val)
 #define dsaf_set_bit(origin, shift, val) \
         dsaf_set_field((origin), (1ull << (shift)), (shift), (val))
 
-static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
+static inline void dsaf_set_reg_field(u8 __iomem *base, u32 reg, u32 mask,
                                       u32 shift, u32 val)
 {
         u32 origin = dsaf_read_reg(base, reg);
@@ -1073,7 +1073,7 @@ static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
 #define dsaf_get_bit(origin, shift) \
         dsaf_get_field((origin), (1ull << (shift)), (shift))
 
-static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
+static inline u32 dsaf_get_reg_field(u8 __iomem *base, u32 reg, u32 mask,
                                      u32 shift)
 {
         u32 origin;
@@ -1089,11 +1089,11 @@ static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
         dsaf_get_reg_field((dev)->io_base, (reg), (1ull << (bit)), (bit))
 
 #define dsaf_write_b(addr, data)\
-        writeb((data), (__iomem unsigned char *)(addr))
+        writeb((data), (__iomem u8 *)(addr))
 #define dsaf_read_b(addr)\
-        readb((__iomem unsigned char *)(addr))
+        readb((__iomem u8 *)(addr))
 
 #define hns_mac_reg_read64(drv, offset) \
-        readq((__iomem void *)(((u8 *)(drv)->io_base + 0xc00 + (offset))))
+        readq((__iomem void *)(((drv)->io_base + 0xc00 + (offset))))
 
 #endif  /* _DSAF_REG_H */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
index ba4316910dea..a60f207768fc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
@@ -129,7 +129,7 @@ static void hns_xgmac_lf_rf_control_init(struct mac_driver *mac_drv)
         dsaf_set_bit(val, XGMAC_UNIDIR_EN_B, 0);
         dsaf_set_bit(val, XGMAC_RF_TX_EN_B, 1);
         dsaf_set_field(val, XGMAC_LF_RF_INSERT_M, XGMAC_LF_RF_INSERT_S, 0);
-        dsaf_write_reg(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
+        dsaf_write_dev(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
 }
 
 /**
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 60e7d7ae3787..4cd86ba1f050 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -29,9 +29,6 @@
 
 #define SERVICE_TIMER_HZ (1 * HZ)
 
-#define NIC_TX_CLEAN_MAX_NUM 256
-#define NIC_RX_CLEAN_MAX_NUM 64
-
 #define RCB_IRQ_NOT_INITED 0
 #define RCB_IRQ_INITED 1
 #define HNS_BUFFER_SIZE_2048 2048
@@ -376,8 +373,6 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
         wmb(); /* commit all data before submit */
         assert(skb->queue_mapping < priv->ae_handle->q_num);
         hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
-        ring->stats.tx_pkts++;
-        ring->stats.tx_bytes += skb->len;
 
         return NETDEV_TX_OK;
 
@@ -999,6 +994,9 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
                 /* issue prefetch for next Tx descriptor */
                 prefetch(&ring->desc_cb[ring->next_to_clean]);
         }
+        /* update tx ring statistics. */
+        ring->stats.tx_pkts += pkts;
+        ring->stats.tx_bytes += bytes;
 
         NETIF_TX_UNLOCK(ring);
 
@@ -2152,7 +2150,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                         hns_nic_tx_fini_pro_v2;
 
                 netif_napi_add(priv->netdev, &rd->napi,
-                               hns_nic_common_poll, NIC_TX_CLEAN_MAX_NUM);
+                               hns_nic_common_poll, NAPI_POLL_WEIGHT);
                 rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
         }
         for (i = h->q_num; i < h->q_num * 2; i++) {
@@ -2165,7 +2163,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                         hns_nic_rx_fini_pro_v2;
 
                 netif_napi_add(priv->netdev, &rd->napi,
-                               hns_nic_common_poll, NIC_RX_CLEAN_MAX_NUM);
+                               hns_nic_common_poll, NAPI_POLL_WEIGHT);
                 rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
index fffe8c1c45d3..0fb61d440d3b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the HISILICON network device drivers.
 #
 
-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
+ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
 
 obj-$(CONFIG_HNS3_HCLGE) += hclge.o
 hclge-objs = hclge_main.o hclge_cmd.o hclge_mdio.o hclge_tm.o hclge_mbx.o hclge_err.o  hclge_debugfs.o
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
index fb93bbd35845..6193f8fa7cf3 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the HISILICON network device drivers.
 #
 
-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
+ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
 
 obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o
 hclgevf-objs = hclgevf_main.o hclgevf_cmd.o hclgevf_mbx.o
\ No newline at end of file
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index baf5cc251f32..8b8a7d00e8e0 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -39,7 +39,7 @@ struct hns_mdio_sc_reg {
 };
 
 struct hns_mdio_device {
-        void *vbase;            /* mdio reg base address */
+        u8 __iomem *vbase;              /* mdio reg base address */
         struct regmap *subctrl_vbase;
         struct hns_mdio_sc_reg sc_reg;
 };
@@ -96,21 +96,17 @@ enum mdio_c45_op_seq {
 #define MDIO_SC_CLK_ST          0x531C
 #define MDIO_SC_RESET_ST        0x5A1C
 
-static void mdio_write_reg(void *base, u32 reg, u32 value)
+static void mdio_write_reg(u8 __iomem *base, u32 reg, u32 value)
 {
-        u8 __iomem *reg_addr = (u8 __iomem *)base;
-
-        writel_relaxed(value, reg_addr + reg);
+        writel_relaxed(value, base + reg);
 }
 
 #define MDIO_WRITE_REG(a, reg, value) \
         mdio_write_reg((a)->vbase, (reg), (value))
 
-static u32 mdio_read_reg(void *base, u32 reg)
+static u32 mdio_read_reg(u8 __iomem *base, u32 reg)
 {
-        u8 __iomem *reg_addr = (u8 __iomem *)base;
-
-        return readl_relaxed(reg_addr + reg);
+        return readl_relaxed(base + reg);
 }
 
 #define mdio_set_field(origin, mask, shift, val) \
@@ -121,7 +117,7 @@ static u32 mdio_read_reg(void *base, u32 reg)
 
 #define mdio_get_field(origin, mask, shift) (((origin) >> (shift)) & (mask))
 
-static void mdio_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
+static void mdio_set_reg_field(u8 __iomem *base, u32 reg, u32 mask, u32 shift,
                                u32 val)
 {
         u32 origin = mdio_read_reg(base, reg);
@@ -133,7 +129,7 @@ static void mdio_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
 #define MDIO_SET_REG_FIELD(dev, reg, mask, shift, val) \
         mdio_set_reg_field((dev)->vbase, (reg), (mask), (shift), (val))
 
-static u32 mdio_get_reg_field(void *base, u32 reg, u32 mask, u32 shift)
+static u32 mdio_get_reg_field(u8 __iomem *base, u32 reg, u32 mask, u32 shift)
 {
         u32 origin;
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5ecbb1adcf3b..3dfb2d131eb7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1885,6 +1885,7 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
          */
         adapter->state = VNIC_PROBED;
 
+        reinit_completion(&adapter->init_done);
         rc = init_crq_queue(adapter);
         if (rc) {
                 netdev_err(adapter->netdev,
@@ -3761,6 +3762,7 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
 {
         struct device *dev = &adapter->vdev->dev;
         struct ibmvnic_query_ip_offload_buffer *buf = &adapter->ip_offload_buf;
+        netdev_features_t old_hw_features = 0;
         union ibmvnic_crq crq;
         int i;
 
@@ -3836,24 +3838,41 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
         adapter->ip_offload_ctrl.large_rx_ipv4 = 0;
         adapter->ip_offload_ctrl.large_rx_ipv6 = 0;
 
-        adapter->netdev->features = NETIF_F_SG | NETIF_F_GSO;
+        if (adapter->state != VNIC_PROBING) {
+                old_hw_features = adapter->netdev->hw_features;
+                adapter->netdev->hw_features = 0;
+        }
+
+        adapter->netdev->hw_features = NETIF_F_SG | NETIF_F_GSO | NETIF_F_GRO;
 
         if (buf->tcp_ipv4_chksum || buf->udp_ipv4_chksum)
-                adapter->netdev->features |= NETIF_F_IP_CSUM;
+                adapter->netdev->hw_features |= NETIF_F_IP_CSUM;
 
         if (buf->tcp_ipv6_chksum || buf->udp_ipv6_chksum)
-                adapter->netdev->features |= NETIF_F_IPV6_CSUM;
+                adapter->netdev->hw_features |= NETIF_F_IPV6_CSUM;
 
         if ((adapter->netdev->features &
             (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)))
-                adapter->netdev->features |= NETIF_F_RXCSUM;
+                adapter->netdev->hw_features |= NETIF_F_RXCSUM;
 
         if (buf->large_tx_ipv4)
-                adapter->netdev->features |= NETIF_F_TSO;
+                adapter->netdev->hw_features |= NETIF_F_TSO;
         if (buf->large_tx_ipv6)
-                adapter->netdev->features |= NETIF_F_TSO6;
+                adapter->netdev->hw_features |= NETIF_F_TSO6;
+
+        if (adapter->state == VNIC_PROBING) {
+                adapter->netdev->features |= adapter->netdev->hw_features;
+        } else if (old_hw_features != adapter->netdev->hw_features) {
+                netdev_features_t tmp = 0;
 
-        adapter->netdev->hw_features |= adapter->netdev->features;
+                /* disable features no longer supported */
+                adapter->netdev->features &= adapter->netdev->hw_features;
+                /* turn on features now supported if previously enabled */
+                tmp = (old_hw_features ^ adapter->netdev->hw_features) &
+                        adapter->netdev->hw_features;
+                adapter->netdev->features |=
+                                tmp & adapter->netdev->wanted_features;
+        }
 
         memset(&crq, 0, sizeof(crq));
         crq.control_ip_offload.first = IBMVNIC_CRQ_CMD;
@@ -4625,7 +4644,7 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter)
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
 
-        init_completion(&adapter->init_done);
+        reinit_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
         if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
@@ -4680,7 +4699,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
 
         adapter->from_passive_init = false;
 
-        init_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
         if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
@@ -4759,6 +4777,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
         spin_lock_init(&adapter->rwi_lock);
+        init_completion(&adapter->init_done);
         adapter->resetting = false;
 
         adapter->mac_change_pending = false;
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
index 5a0419421511..ecef949f3baa 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -41,6 +41,8 @@ static int __init fm10k_init_module(void)
         /* create driver workqueue */
         fm10k_workqueue = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
                                           fm10k_driver_name);
+        if (!fm10k_workqueue)
+                return -ENOMEM;
 
         fm10k_dbg_init();
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index d684998ba2b0..d3cc3427caad 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -790,6 +790,8 @@ struct i40e_vsi {
 
         /* VSI specific handlers */
         irqreturn_t (*irq_handler)(int irq, void *data);
+
+        unsigned long *af_xdp_zc_qps; /* tracks AF_XDP ZC enabled qps */
 } ____cacheline_internodealigned_in_smp;
 
 struct i40e_netdev_priv {
@@ -1096,20 +1098,6 @@ static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi)
         return !!vsi->xdp_prog;
 }
 
-static inline struct xdp_umem *i40e_xsk_umem(struct i40e_ring *ring)
-{
-        bool xdp_on = i40e_enabled_xdp_vsi(ring->vsi);
-        int qid = ring->queue_index;
-
-        if (ring_is_xdp(ring))
-                qid -= ring->vsi->alloc_queue_pairs;
-
-        if (!xdp_on)
-                return NULL;
-
-        return xdp_get_umem_from_qid(ring->vsi->netdev, qid);
-}
-
 int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch);
 int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate);
 int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 4c885801fa26..7874d0ec7fb0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2573,8 +2573,7 @@ static int i40e_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
                 return -EOPNOTSUPP;
 
         /* only magic packet is supported */
-        if (wol->wolopts && (wol->wolopts != WAKE_MAGIC)
-                          | (wol->wolopts != WAKE_FILTER))
+        if (wol->wolopts & ~WAKE_MAGIC)
                 return -EOPNOTSUPP;
 
         /* is this a new value? */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index da62218eb70a..b1c265012c8a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -3064,6 +3064,26 @@ static void i40e_config_xps_tx_ring(struct i40e_ring *ring)
 }
 
 /**
+ * i40e_xsk_umem - Retrieve the AF_XDP ZC if XDP and ZC is enabled
+ * @ring: The Tx or Rx ring
+ *
+ * Returns the UMEM or NULL.
+ **/
+static struct xdp_umem *i40e_xsk_umem(struct i40e_ring *ring)
+{
+        bool xdp_on = i40e_enabled_xdp_vsi(ring->vsi);
+        int qid = ring->queue_index;
+
+        if (ring_is_xdp(ring))
+                qid -= ring->vsi->alloc_queue_pairs;
+
+        if (!xdp_on || !test_bit(qid, ring->vsi->af_xdp_zc_qps))
+                return NULL;
+
+        return xdp_get_umem_from_qid(ring->vsi->netdev, qid);
+}
+
+/**
  * i40e_configure_tx_ring - Configure a transmit ring context and rest
  * @ring: The Tx ring to configure
  *
@@ -10064,6 +10084,12 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         hash_init(vsi->mac_filter_hash);
         vsi->irqs_ready = false;
 
+        if (type == I40E_VSI_MAIN) {
+                vsi->af_xdp_zc_qps = bitmap_zalloc(pf->num_lan_qps, GFP_KERNEL);
+                if (!vsi->af_xdp_zc_qps)
+                        goto err_rings;
+        }
+
         ret = i40e_set_num_rings_in_vsi(vsi);
         if (ret)
                 goto err_rings;
@@ -10082,6 +10108,7 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         goto unlock_pf;
 
 err_rings:
+        bitmap_free(vsi->af_xdp_zc_qps);
         pf->next_vsi = i - 1;
         kfree(vsi);
 unlock_pf:
@@ -10162,6 +10189,7 @@ static int i40e_vsi_clear(struct i40e_vsi *vsi)
         i40e_put_lump(pf->qp_pile, vsi->base_queue, vsi->idx);
         i40e_put_lump(pf->irq_pile, vsi->base_vector, vsi->idx);
 
+        bitmap_free(vsi->af_xdp_zc_qps);
         i40e_vsi_free_arrays(vsi, true);
         i40e_clear_rss_config_user(vsi);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index 5fb4353c742b..31575c0bb884 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -146,12 +146,13 @@ static int i40e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
 static int i40e_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
 {
         struct i40e_pf *pf = container_of(ptp, struct i40e_pf, ptp_caps);
-        struct timespec64 now;
+        struct timespec64 now, then;
 
+        then = ns_to_timespec64(delta);
         mutex_lock(&pf->tmreg_lock);
 
         i40e_ptp_read(pf, &now, NULL);
-        timespec64_add_ns(&now, delta);
+        now = timespec64_add(now, then);
         i40e_ptp_write(pf, (const struct timespec64 *)&now);
 
         mutex_unlock(&pf->tmreg_lock);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index b5c182e688e3..1b17486543ac 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -102,6 +102,8 @@ static int i40e_xsk_umem_enable(struct i40e_vsi *vsi, struct xdp_umem *umem,
         if (err)
                 return err;
 
+        set_bit(qid, vsi->af_xdp_zc_qps);
+
         if_running = netif_running(vsi->netdev) && i40e_enabled_xdp_vsi(vsi);
 
         if (if_running) {
@@ -148,6 +150,7 @@ static int i40e_xsk_umem_disable(struct i40e_vsi *vsi, u16 qid)
                         return err;
         }
 
+        clear_bit(qid, vsi->af_xdp_zc_qps);
         i40e_xsk_umem_dma_unmap(vsi, umem);
 
         if (if_running) {
diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
index 01fcfc6f3415..d2e2c50ce257 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -194,6 +194,8 @@
 /* enable link status from external LINK_0 and LINK_1 pins */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
+#define E1000_CTRL_ADVD3WUC 0x00100000  /* D3 WUC */
+#define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 /* PHY PM enable */
 #define E1000_CTRL_SDP0_DIR 0x00400000  /* SDP0 Data direction */
 #define E1000_CTRL_SDP1_DIR 0x00800000  /* SDP1 Data direction */
 #define E1000_CTRL_RST      0x04000000  /* Global reset */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 69b230c53fed..3269d8e94744 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8740,9 +8740,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
         struct e1000_hw *hw = &adapter->hw;
         u32 ctrl, rctl, status;
         u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
-#ifdef CONFIG_PM
-        int retval = 0;
-#endif
+        bool wake;
 
         rtnl_lock();
         netif_device_detach(netdev);
@@ -8755,14 +8753,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
         igb_clear_interrupt_scheme(adapter);
         rtnl_unlock();
 
-#ifdef CONFIG_PM
-        if (!runtime) {
-                retval = pci_save_state(pdev);
-                if (retval)
-                        return retval;
-        }
-#endif
-
         status = rd32(E1000_STATUS);
         if (status & E1000_STATUS_LU)
                 wufc &= ~E1000_WUFC_LNKC;
@@ -8779,10 +8769,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
                 }
 
                 ctrl = rd32(E1000_CTRL);
-                /* advertise wake from D3Cold */
-                #define E1000_CTRL_ADVD3WUC 0x00100000
-                /* phy power management enable */
-                #define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000
                 ctrl |= E1000_CTRL_ADVD3WUC;
                 wr32(E1000_CTRL, ctrl);
 
@@ -8796,12 +8782,15 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
                 wr32(E1000_WUFC, 0);
         }
 
-        *enable_wake = wufc || adapter->en_mng_pt;
-        if (!*enable_wake)
+        wake = wufc || adapter->en_mng_pt;
+        if (!wake)
                 igb_power_down_link(adapter);
         else
                 igb_power_up_link(adapter);
 
+        if (enable_wake)
+                *enable_wake = wake;
+
         /* Release control of h/w to f/w.  If f/w is AMT enabled, this
          * would have already happened in close and is redundant.
          */
@@ -8844,22 +8833,7 @@ static void igb_deliver_wake_packet(struct net_device *netdev)
 
 static int __maybe_unused igb_suspend(struct device *dev)
 {
-        int retval;
-        bool wake;
-        struct pci_dev *pdev = to_pci_dev(dev);
-
-        retval = __igb_shutdown(pdev, &wake, 0);
-        if (retval)
-                return retval;
-
-        if (wake) {
-                pci_prepare_to_sleep(pdev);
-        } else {
-                pci_wake_from_d3(pdev, false);
-                pci_set_power_state(pdev, PCI_D3hot);
-        }
-
-        return 0;
+        return __igb_shutdown(to_pci_dev(dev), NULL, 0);
 }
 
 static int __maybe_unused igb_resume(struct device *dev)
@@ -8930,22 +8904,7 @@ static int __maybe_unused igb_runtime_idle(struct device *dev)
 
 static int __maybe_unused igb_runtime_suspend(struct device *dev)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        int retval;
-        bool wake;
-
-        retval = __igb_shutdown(pdev, &wake, 1);
-        if (retval)
-                return retval;
-
-        if (wake) {
-                pci_prepare_to_sleep(pdev);
-        } else {
-                pci_wake_from_d3(pdev, false);
-                pci_set_power_state(pdev, PCI_D3hot);
-        }
-
-        return 0;
+        return __igb_shutdown(to_pci_dev(dev), NULL, 1);
 }
 
 static int __maybe_unused igb_runtime_resume(struct device *dev)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index cc4907f9ff02..2fb97967961c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -905,13 +905,12 @@ s32 ixgbe_mii_bus_init(struct ixgbe_hw *hw)
         struct pci_dev *pdev = adapter->pdev;
         struct device *dev = &adapter->netdev->dev;
         struct mii_bus *bus;
+        int err = -ENODEV;
 
-        adapter->mii_bus = devm_mdiobus_alloc(dev);
-        if (!adapter->mii_bus)
+        bus = devm_mdiobus_alloc(dev);
+        if (!bus)
                 return -ENOMEM;
 
-        bus = adapter->mii_bus;
-
         switch (hw->device_id) {
         /* C3000 SoCs */
         case IXGBE_DEV_ID_X550EM_A_KR:
@@ -949,12 +948,15 @@ s32 ixgbe_mii_bus_init(struct ixgbe_hw *hw)
          */
         hw->phy.mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_SUPPORTS_C22;
 
-        return mdiobus_register(bus);
+        err = mdiobus_register(bus);
+        if (!err) {
+                adapter->mii_bus = bus;
+                return 0;
+        }
 
 ixgbe_no_mii_bus:
         devm_mdiobus_free(dev, bus);
-        adapter->mii_bus = NULL;
-        return -ENODEV;
+        return err;
 }
 
 /**
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 71c65cc17904..d3eaf2ceaa39 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -858,6 +858,7 @@ void mlx5e_close_channels(struct mlx5e_channels *chs);
  * switching channels
  */
 typedef int (*mlx5e_fp_hw_modify)(struct mlx5e_priv *priv);
+int mlx5e_safe_reopen_channels(struct mlx5e_priv *priv);
 int mlx5e_safe_switch_channels(struct mlx5e_priv *priv,
                                struct mlx5e_channels *new_chs,
                                mlx5e_fp_hw_modify hw_modify);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 122927f3a600..d5e5afbdca6d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -96,9 +96,6 @@ int mlx5_port_query_eth_proto(struct mlx5_core_dev *dev, u8 port, bool ext,
         if (!eproto)
                 return -EINVAL;
 
-        if (ext !=  MLX5_CAP_PCAM_FEATURE(dev, ptys_extended_ethernet))
-                return -EOPNOTSUPP;
-
         err = mlx5_query_port_ptys(dev, out, sizeof(out), MLX5_PTYS_EN, port);
         if (err)
                 return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index eac245a93f91..4ab0d030b544 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -122,7 +122,9 @@ out:
         return err;
 }
 
-/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B]) */
+/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B])
+ * minimum speed value is 40Gbps
+ */
 static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
 {
         u32 speed;
@@ -130,10 +132,9 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err) {
-                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
-                return 0;
-        }
+        if (err)
+                speed = SPEED_40000;
+        speed = max_t(u32, speed, SPEED_40000);
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
@@ -142,7 +143,7 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
 }
 
 static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
-                                 u32 xoff, unsigned int mtu)
+                                 u32 xoff, unsigned int max_mtu)
 {
         int i;
 
@@ -154,11 +155,12 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
                 }
 
                 if (port_buffer->buffer[i].size <
-                    (xoff + mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
+                    (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
                         return -ENOMEM;
 
                 port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff;
-                port_buffer->buffer[i].xon  = port_buffer->buffer[i].xoff - mtu;
+                port_buffer->buffer[i].xon  =
+                        port_buffer->buffer[i].xoff - max_mtu;
         }
 
         return 0;
@@ -166,7 +168,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
 
 /**
  * update_buffer_lossy()
- *   mtu: device's MTU
+ *   max_mtu: netdev's max_mtu
  *   pfc_en: <input> current pfc configuration
  *   buffer: <input> current prio to buffer mapping
  *   xoff:   <input> xoff value
@@ -183,7 +185,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
  *     Return 0 if no error.
  *     Set change to true if buffer configuration is modified.
  */
-static int update_buffer_lossy(unsigned int mtu,
+static int update_buffer_lossy(unsigned int max_mtu,
                                u8 pfc_en, u8 *buffer, u32 xoff,
                                struct mlx5e_port_buffer *port_buffer,
                                bool *change)
@@ -220,7 +222,7 @@ static int update_buffer_lossy(unsigned int mtu,
         }
 
         if (changed) {
-                err = update_xoff_threshold(port_buffer, xoff, mtu);
+                err = update_xoff_threshold(port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
 
@@ -230,6 +232,7 @@ static int update_buffer_lossy(unsigned int mtu,
         return 0;
 }
 
+#define MINIMUM_MAX_MTU 9216
 int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                                     u32 change, unsigned int mtu,
                                     struct ieee_pfc *pfc,
@@ -241,12 +244,14 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
         bool update_prio2buffer = false;
         u8 buffer[MLX5E_MAX_PRIORITY];
         bool update_buffer = false;
+        unsigned int max_mtu;
         u32 total_used = 0;
         u8 curr_pfc_en;
         int err;
         int i;
 
         mlx5e_dbg(HW, priv, "%s: change=%x\n", __func__, change);
+        max_mtu = max_t(unsigned int, priv->netdev->max_mtu, MINIMUM_MAX_MTU);
 
         err = mlx5e_port_query_buffer(priv, &port_buffer);
         if (err)
@@ -254,7 +259,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
 
         if (change & MLX5E_PORT_BUFFER_CABLE_LEN) {
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
@@ -264,7 +269,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                 if (err)
                         return err;
 
-                err = update_buffer_lossy(mtu, pfc->pfc_en, buffer, xoff,
+                err = update_buffer_lossy(max_mtu, pfc->pfc_en, buffer, xoff,
                                           &port_buffer, &update_buffer);
                 if (err)
                         return err;
@@ -276,8 +281,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                 if (err)
                         return err;
 
-                err = update_buffer_lossy(mtu, curr_pfc_en, prio2buffer, xoff,
-                                          &port_buffer, &update_buffer);
+                err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer,
+                                          xoff, &port_buffer, &update_buffer);
                 if (err)
                         return err;
         }
@@ -301,7 +306,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                         return -EINVAL;
 
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
@@ -309,7 +314,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
         /* Need to update buffer configuration if xoff value is changed */
         if (!update_buffer && xoff != priv->dcbx.xoff) {
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
index 9d38e62cdf24..476dd97f7f2f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
@@ -186,12 +186,17 @@ static int mlx5e_tx_reporter_recover_from_ctx(struct mlx5e_tx_err_ctx *err_ctx)
 
 static int mlx5e_tx_reporter_recover_all(struct mlx5e_priv *priv)
 {
-        int err;
+        int err = 0;
 
         rtnl_lock();
         mutex_lock(&priv->state_lock);
-        mlx5e_close_locked(priv->netdev);
-        err = mlx5e_open_locked(priv->netdev);
+
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
+                goto out;
+
+        err = mlx5e_safe_reopen_channels(priv);
+
+out:
         mutex_unlock(&priv->state_lock);
         rtnl_unlock();
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index fa2a3c444cdc..eec07b34b4ad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -39,6 +39,10 @@ static int get_route_and_out_devs(struct mlx5e_priv *priv,
                         return -EOPNOTSUPP;
         }
 
+        if (!(mlx5e_eswitch_rep(*out_dev) &&
+              mlx5e_is_uplink_rep(netdev_priv(*out_dev))))
+                return -EOPNOTSUPP;
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 03b2a9f9c589..cad34d6f5f45 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -33,6 +33,26 @@
 #include <linux/bpf_trace.h>
 #include "en/xdp.h"
 
+int mlx5e_xdp_max_mtu(struct mlx5e_params *params)
+{
+        int hr = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
+
+        /* Let S := SKB_DATA_ALIGN(sizeof(struct skb_shared_info)).
+         * The condition checked in mlx5e_rx_is_linear_skb is:
+         *   SKB_DATA_ALIGN(sw_mtu + hard_mtu + hr) + S <= PAGE_SIZE         (1)
+         *   (Note that hw_mtu == sw_mtu + hard_mtu.)
+         * What is returned from this function is:
+         *   max_mtu = PAGE_SIZE - S - hr - hard_mtu                         (2)
+         * After assigning sw_mtu := max_mtu, the left side of (1) turns to
+         * SKB_DATA_ALIGN(PAGE_SIZE - S) + S, which is equal to PAGE_SIZE,
+         * because both PAGE_SIZE and S are already aligned. Any number greater
+         * than max_mtu would make the left side of (1) greater than PAGE_SIZE,
+         * so max_mtu is the maximum MTU allowed.
+         */
+
+        return MLX5E_HW2SW_MTU(params, SKB_MAX_HEAD(hr));
+}
+
 static inline bool
 mlx5e_xmit_xdp_buff(struct mlx5e_xdpsq *sq, struct mlx5e_dma_info *di,
                     struct xdp_buff *xdp)
@@ -304,9 +324,9 @@ bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq *cq, struct mlx5e_rq *rq)
                                         mlx5e_xdpi_fifo_pop(xdpi_fifo);
 
                                 if (is_redirect) {
-                                        xdp_return_frame(xdpi.xdpf);
                                         dma_unmap_single(sq->pdev, xdpi.dma_addr,
                                                          xdpi.xdpf->len, DMA_TO_DEVICE);
+                                        xdp_return_frame(xdpi.xdpf);
                                 } else {
                                         /* Recycle RX page */
                                         mlx5e_page_release(rq, &xdpi.di, true);
@@ -345,9 +365,9 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq *sq, struct mlx5e_rq *rq)
                                 mlx5e_xdpi_fifo_pop(xdpi_fifo);
 
                         if (is_redirect) {
-                                xdp_return_frame(xdpi.xdpf);
                                 dma_unmap_single(sq->pdev, xdpi.dma_addr,
                                                  xdpi.xdpf->len, DMA_TO_DEVICE);
+                                xdp_return_frame(xdpi.xdpf);
                         } else {
                                 /* Recycle RX page */
                                 mlx5e_page_release(rq, &xdpi.di, false);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
index ee27a7c8cd87..553956cadc8a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
@@ -34,13 +34,12 @@
 
 #include "en.h"
 
-#define MLX5E_XDP_MAX_MTU ((int)(PAGE_SIZE - \
-                                 MLX5_SKB_FRAG_SZ(XDP_PACKET_HEADROOM)))
 #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)
 #define MLX5E_XDP_TX_EMPTY_DS_COUNT \
         (sizeof(struct mlx5e_tx_wqe) / MLX5_SEND_WQE_DS)
 #define MLX5E_XDP_TX_DS_COUNT (MLX5E_XDP_TX_EMPTY_DS_COUNT + 1 /* SG DS */)
 
+int mlx5e_xdp_max_mtu(struct mlx5e_params *params);
 bool mlx5e_xdp_handle(struct mlx5e_rq *rq, struct mlx5e_dma_info *di,
                       void *va, u16 *rx_headroom, u32 *len);
 bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq *cq, struct mlx5e_rq *rq);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 3078491cc0d0..1539cf3de5dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -45,7 +45,9 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
         if (err)
                 return err;
 
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         list_add(&tir->list, &mdev->mlx5e_res.td.tirs_list);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 
         return 0;
 }
@@ -53,8 +55,10 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
 void mlx5e_destroy_tir(struct mlx5_core_dev *mdev,
                        struct mlx5e_tir *tir)
 {
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         mlx5_core_destroy_tir(mdev, tir->tirn);
         list_del(&tir->list);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 }
 
 static int mlx5e_create_mkey(struct mlx5_core_dev *mdev, u32 pdn,
@@ -114,6 +118,7 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev)
         }
 
         INIT_LIST_HEAD(&mdev->mlx5e_res.td.tirs_list);
+        mutex_init(&mdev->mlx5e_res.td.list_lock);
 
         return 0;
 
@@ -141,15 +146,17 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
         struct mlx5e_tir *tir;
-        int err  = -ENOMEM;
+        int err  = 0;
         u32 tirn = 0;
         int inlen;
         void *in;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = kvzalloc(inlen, GFP_KERNEL);
-        if (!in)
+        if (!in) {
+                err = -ENOMEM;
                 goto out;
+        }
 
         if (enable_uc_lb)
                 MLX5_SET(modify_tir_in, in, ctx.self_lb_block,
@@ -157,6 +164,7 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
 
         MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1);
 
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                 tirn = tir->tirn;
                 err = mlx5_core_modify_tir(mdev, tirn, in, inlen);
@@ -168,6 +176,7 @@ out:
         kvfree(in);
         if (err)
                 netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index a0987cc5fe4a..78dc8fe2a83c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -603,16 +603,18 @@ static void ptys2ethtool_supported_link(struct mlx5_core_dev *mdev,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
 }
 
-static void ptys2ethtool_adver_link(struct mlx5_core_dev *mdev,
-                                    unsigned long *advertising_modes,
-                                    u32 eth_proto_cap)
+static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
+                                    u32 eth_proto_cap, bool ext)
 {
         unsigned long proto_cap = eth_proto_cap;
         struct ptys2ethtool_config *table;
         u32 max_size;
         int proto;
 
-        mlx5e_ethtool_get_speed_arr(mdev, &table, &max_size);
+        table = ext ? ptys2ext_ethtool_table : ptys2legacy_ethtool_table;
+        max_size = ext ? ARRAY_SIZE(ptys2ext_ethtool_table) :
+                         ARRAY_SIZE(ptys2legacy_ethtool_table);
+
         for_each_set_bit(proto, &proto_cap, max_size)
                 bitmap_or(advertising_modes, advertising_modes,
                           table[proto].advertised,
@@ -794,12 +796,12 @@ static void get_supported(struct mlx5_core_dev *mdev, u32 eth_proto_cap,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
 }
 
-static void get_advertising(struct mlx5_core_dev *mdev, u32 eth_proto_cap,
-                            u8 tx_pause, u8 rx_pause,
-                            struct ethtool_link_ksettings *link_ksettings)
+static void get_advertising(u32 eth_proto_cap, u8 tx_pause, u8 rx_pause,
+                            struct ethtool_link_ksettings *link_ksettings,
+                            bool ext)
 {
         unsigned long *advertising = link_ksettings->link_modes.advertising;
-        ptys2ethtool_adver_link(mdev, advertising, eth_proto_cap);
+        ptys2ethtool_adver_link(advertising, eth_proto_cap, ext);
 
         if (rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
@@ -854,8 +856,9 @@ static void get_lp_advertising(struct mlx5_core_dev *mdev, u32 eth_proto_lp,
                                struct ethtool_link_ksettings *link_ksettings)
 {
         unsigned long *lp_advertising = link_ksettings->link_modes.lp_advertising;
+        bool ext = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
 
-        ptys2ethtool_adver_link(mdev, lp_advertising, eth_proto_lp);
+        ptys2ethtool_adver_link(lp_advertising, eth_proto_lp, ext);
 }
 
 int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
@@ -872,6 +875,7 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         u8 an_disable_admin;
         u8 an_status;
         u8 connector_type;
+        bool admin_ext;
         bool ext;
         int err;
 
@@ -886,6 +890,19 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
                                               eth_proto_capability);
         eth_proto_admin  = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
                                               eth_proto_admin);
+        /* Fields: eth_proto_admin and ext_eth_proto_admin  are
+         * mutually exclusive. Hence try reading legacy advertising
+         * when extended advertising is zero.
+         * admin_ext indicates how eth_proto_admin should be
+         * interpreted
+         */
+        admin_ext = ext;
+        if (ext && !eth_proto_admin) {
+                eth_proto_admin  = MLX5_GET_ETH_PROTO(ptys_reg, out, false,
+                                                      eth_proto_admin);
+                admin_ext = false;
+        }
+
         eth_proto_oper   = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
                                               eth_proto_oper);
         eth_proto_lp        = MLX5_GET(ptys_reg, out, eth_proto_lp_advertise);
@@ -899,7 +916,8 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
 
         get_supported(mdev, eth_proto_cap, link_ksettings);
-        get_advertising(mdev, eth_proto_admin, tx_pause, rx_pause, link_ksettings);
+        get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings,
+                        admin_ext);
         get_speed_duplex(priv->netdev, eth_proto_oper, link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
@@ -997,19 +1015,17 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
 
 #define MLX5E_PTYS_EXT ((1ULL << ETHTOOL_LINK_MODE_50000baseKR_Full_BIT) - 1)
 
-        ext_requested = (link_ksettings->link_modes.advertising[0] >
-                        MLX5E_PTYS_EXT);
+        ext_requested = !!(link_ksettings->link_modes.advertising[0] >
+                        MLX5E_PTYS_EXT ||
+                        link_ksettings->link_modes.advertising[1]);
         ext_supported = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
-
-        /*when ptys_extended_ethernet is set legacy link modes are deprecated */
-        if (ext_requested != ext_supported)
-                return -EPROTONOSUPPORT;
+        ext_requested &= ext_supported;
 
         speed = link_ksettings->base.speed;
         ethtool2ptys_adver_func = ext_requested ?
                                   mlx5e_ethtool2ptys_ext_adver_link :
                                   mlx5e_ethtool2ptys_adver_link;
-        err = mlx5_port_query_eth_proto(mdev, 1, ext_supported, &eproto);
+        err = mlx5_port_query_eth_proto(mdev, 1, ext_requested, &eproto);
         if (err) {
                 netdev_err(priv->netdev, "%s: query port eth proto failed: %d\n",
                            __func__, err);
@@ -1037,7 +1053,7 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
         if (!an_changes && link_modes == eproto.admin)
                 goto out;
 
-        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_supported);
+        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_requested);
         mlx5_toggle_port_link(mdev);
 
 out:
@@ -1570,7 +1586,7 @@ static int mlx5e_get_module_info(struct net_device *netdev,
                 break;
         case MLX5_MODULE_ID_SFP:
                 modinfo->type       = ETH_MODULE_SFF_8472;
-                modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+                modinfo->eeprom_len = MLX5_EEPROM_PAGE_LENGTH;
                 break;
         default:
                 netdev_err(priv->netdev, "%s: cable type not recognized:0x%x\n",
@@ -1752,7 +1768,8 @@ static int set_pflag_rx_no_csum_complete(struct net_device *netdev, bool enable)
         struct mlx5e_channel *c;
         int i;
 
-        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state) ||
+            priv->channels.params.xdp_prog)
                 return 0;
 
         for (i = 0; i < channels->num; i++) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index b5fdbd3190d9..46157e2a1e5a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -951,7 +951,11 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (params->rx_dim_enabled)
                 __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE))
+        /* We disable csum_complete when XDP is enabled since
+         * XDP programs might manipulate packets which will render
+         * skb->checksum incorrect.
+         */
+        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE) || c->xdp)
                 __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
 
         return 0;
@@ -2937,6 +2941,14 @@ int mlx5e_safe_switch_channels(struct mlx5e_priv *priv,
         return 0;
 }
 
+int mlx5e_safe_reopen_channels(struct mlx5e_priv *priv)
+{
+        struct mlx5e_channels new_channels = {};
+
+        new_channels.params = priv->channels.params;
+        return mlx5e_safe_switch_channels(priv, &new_channels, NULL);
+}
+
 void mlx5e_timestamp_init(struct mlx5e_priv *priv)
 {
         priv->tstamp.tx_type   = HWTSTAMP_TX_OFF;
@@ -3765,7 +3777,7 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
         if (params->xdp_prog &&
             !mlx5e_rx_is_linear_skb(priv->mdev, &new_channels.params)) {
                 netdev_err(netdev, "MTU(%d) > %d is not allowed while XDP enabled\n",
-                           new_mtu, MLX5E_XDP_MAX_MTU);
+                           new_mtu, mlx5e_xdp_max_mtu(params));
                 err = -EINVAL;
                 goto out;
         }
@@ -4161,11 +4173,10 @@ static void mlx5e_tx_timeout_work(struct work_struct *work)
         if (!report_failed)
                 goto unlock;
 
-        mlx5e_close_locked(priv->netdev);
-        err = mlx5e_open_locked(priv->netdev);
+        err = mlx5e_safe_reopen_channels(priv);
         if (err)
                 netdev_err(priv->netdev,
-                           "mlx5e_open_locked failed recovering from a tx_timeout, err(%d).\n",
+                           "mlx5e_safe_reopen_channels failed recovering from a tx_timeout, err(%d).\n",
                            err);
 
 unlock:
@@ -4201,7 +4212,8 @@ static int mlx5e_xdp_allowed(struct mlx5e_priv *priv, struct bpf_prog *prog)
 
         if (!mlx5e_rx_is_linear_skb(priv->mdev, &new_channels.params)) {
                 netdev_warn(netdev, "XDP is not allowed with MTU(%d) > %d\n",
-                            new_channels.params.sw_mtu, MLX5E_XDP_MAX_MTU);
+                            new_channels.params.sw_mtu,
+                            mlx5e_xdp_max_mtu(&new_channels.params));
                 return -EINVAL;
         }
 
@@ -4553,7 +4565,7 @@ void mlx5e_build_rss_params(struct mlx5e_rss_params *rss_params,
 {
         enum mlx5e_traffic_types tt;
 
-        rss_params->hfunc = ETH_RSS_HASH_XOR;
+        rss_params->hfunc = ETH_RSS_HASH_TOP;
         netdev_rss_key_fill(rss_params->toeplitz_hash_key,
                             sizeof(rss_params->toeplitz_hash_key));
         mlx5e_build_default_indir_rqt(rss_params->indirection_rqt,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 3dde5c7e0739..c3b3002ff62f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -692,7 +692,14 @@ static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth,
 {
         *proto = ((struct ethhdr *)skb->data)->h_proto;
         *proto = __vlan_get_protocol(skb, *proto, network_depth);
-        return (*proto == htons(ETH_P_IP) || *proto == htons(ETH_P_IPV6));
+
+        if (*proto == htons(ETH_P_IP))
+                return pskb_may_pull(skb, *network_depth + sizeof(struct iphdr));
+
+        if (*proto == htons(ETH_P_IPV6))
+                return pskb_may_pull(skb, *network_depth + sizeof(struct ipv6hdr));
+
+        return false;
 }
 
 static inline void mlx5e_enable_ecn(struct mlx5e_rq *rq, struct sk_buff *skb)
@@ -712,17 +719,6 @@ static inline void mlx5e_enable_ecn(struct mlx5e_rq *rq, struct sk_buff *skb)
         rq->stats->ecn_mark += !!rc;
 }
 
-static u32 mlx5e_get_fcs(const struct sk_buff *skb)
-{
-        const void *fcs_bytes;
-        u32 _fcs_bytes;
-
-        fcs_bytes = skb_header_pointer(skb, skb->len - ETH_FCS_LEN,
-                                       ETH_FCS_LEN, &_fcs_bytes);
-
-        return __get_unaligned_cpu32(fcs_bytes);
-}
-
 static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
 {
         void *ip_p = skb->data + network_depth;
@@ -733,6 +729,68 @@ static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
 
 #define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
 
+#define MAX_PADDING 8
+
+static void
+tail_padding_csum_slow(struct sk_buff *skb, int offset, int len,
+                       struct mlx5e_rq_stats *stats)
+{
+        stats->csum_complete_tail_slow++;
+        skb->csum = csum_block_add(skb->csum,
+                                   skb_checksum(skb, offset, len, 0),
+                                   offset);
+}
+
+static void
+tail_padding_csum(struct sk_buff *skb, int offset,
+                  struct mlx5e_rq_stats *stats)
+{
+        u8 tail_padding[MAX_PADDING];
+        int len = skb->len - offset;
+        void *tail;
+
+        if (unlikely(len > MAX_PADDING)) {
+                tail_padding_csum_slow(skb, offset, len, stats);
+                return;
+        }
+
+        tail = skb_header_pointer(skb, offset, len, tail_padding);
+        if (unlikely(!tail)) {
+                tail_padding_csum_slow(skb, offset, len, stats);
+                return;
+        }
+
+        stats->csum_complete_tail++;
+        skb->csum = csum_block_add(skb->csum, csum_partial(tail, len, 0), offset);
+}
+
+static void
+mlx5e_skb_padding_csum(struct sk_buff *skb, int network_depth, __be16 proto,
+                       struct mlx5e_rq_stats *stats)
+{
+        struct ipv6hdr *ip6;
+        struct iphdr   *ip4;
+        int pkt_len;
+
+        switch (proto) {
+        case htons(ETH_P_IP):
+                ip4 = (struct iphdr *)(skb->data + network_depth);
+                pkt_len = network_depth + ntohs(ip4->tot_len);
+                break;
+        case htons(ETH_P_IPV6):
+                ip6 = (struct ipv6hdr *)(skb->data + network_depth);
+                pkt_len = network_depth + sizeof(*ip6) + ntohs(ip6->payload_len);
+                break;
+        default:
+                return;
+        }
+
+        if (likely(pkt_len >= skb->len))
+                return;
+
+        tail_padding_csum(skb, pkt_len, stats);
+}
+
 static inline void mlx5e_handle_csum(struct net_device *netdev,
                                      struct mlx5_cqe64 *cqe,
                                      struct mlx5e_rq *rq,
@@ -752,7 +810,8 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                 return;
         }
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state)))
+        /* True when explicitly set via priv flag, or XDP prog is loaded */
+        if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state))
                 goto csum_unnecessary;
 
         /* CQE csum doesn't cover padding octets in short ethernet
@@ -780,18 +839,15 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                         skb->csum = csum_partial(skb->data + ETH_HLEN,
                                                  network_depth - ETH_HLEN,
                                                  skb->csum);
-                if (unlikely(netdev->features & NETIF_F_RXFCS))
-                        skb->csum = csum_block_add(skb->csum,
-                                                   (__force __wsum)mlx5e_get_fcs(skb),
-                                                   skb->len - ETH_FCS_LEN);
+
+                mlx5e_skb_padding_csum(skb, network_depth, proto, stats);
                 stats->csum_complete++;
                 return;
         }
 
 csum_unnecessary:
         if (likely((cqe->hds_ip_ext & CQE_L3_OK) &&
-                   ((cqe->hds_ip_ext & CQE_L4_OK) ||
-                    (get_cqe_l4_hdr_type(cqe) == CQE_L4_HDR_TYPE_NONE)))) {
+                   (cqe->hds_ip_ext & CQE_L4_OK))) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                 if (cqe_is_tunneled(cqe)) {
                         skb->csum_level = 1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 1a78e05cbba8..b75aa8b8bf04 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -59,6 +59,8 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_none) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail_slow) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_redirect) },
@@ -151,6 +153,8 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                 s->rx_removed_vlan_packets += rq_stats->removed_vlan_packets;
                 s->rx_csum_none += rq_stats->csum_none;
                 s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_complete_tail += rq_stats->csum_complete_tail;
+                s->rx_csum_complete_tail_slow += rq_stats->csum_complete_tail_slow;
                 s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
                 s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_xdp_drop     += rq_stats->xdp_drop;
@@ -1190,6 +1194,8 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail_slow) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 4640d4f986f8..16c3b785f282 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -71,6 +71,8 @@ struct mlx5e_sw_stats {
         u64 rx_csum_unnecessary;
         u64 rx_csum_none;
         u64 rx_csum_complete;
+        u64 rx_csum_complete_tail;
+        u64 rx_csum_complete_tail_slow;
         u64 rx_csum_unnecessary_inner;
         u64 rx_xdp_drop;
         u64 rx_xdp_redirect;
@@ -181,6 +183,8 @@ struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
         u64 csum_complete;
+        u64 csum_complete_tail;
+        u64 csum_complete_tail_slow;
         u64 csum_unnecessary;
         u64 csum_unnecessary_inner;
         u64 csum_none;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index b4967a0ff8c7..d75dc44eb2ff 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2158,6 +2158,52 @@ static bool csum_offload_supported(struct mlx5e_priv *priv,
         return true;
 }
 
+struct ip_ttl_word {
+        __u8    ttl;
+        __u8    protocol;
+        __sum16 check;
+};
+
+struct ipv6_hoplimit_word {
+        __be16  payload_len;
+        __u8    nexthdr;
+        __u8    hop_limit;
+};
+
+static bool is_action_keys_supported(const struct flow_action_entry *act)
+{
+        u32 mask, offset;
+        u8 htype;
+
+        htype = act->mangle.htype;
+        offset = act->mangle.offset;
+        mask = ~act->mangle.mask;
+        /* For IPv4 & IPv6 header check 4 byte word,
+         * to determine that modified fields
+         * are NOT ttl & hop_limit only.
+         */
+        if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP4) {
+                struct ip_ttl_word *ttl_word =
+                        (struct ip_ttl_word *)&mask;
+
+                if (offset != offsetof(struct iphdr, ttl) ||
+                    ttl_word->protocol ||
+                    ttl_word->check) {
+                        return true;
+                }
+        } else if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP6) {
+                struct ipv6_hoplimit_word *hoplimit_word =
+                        (struct ipv6_hoplimit_word *)&mask;
+
+                if (offset != offsetof(struct ipv6hdr, payload_len) ||
+                    hoplimit_word->payload_len ||
+                    hoplimit_word->nexthdr) {
+                        return true;
+                }
+        }
+        return false;
+}
+
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                                           struct flow_action *flow_action,
                                           u32 actions,
@@ -2165,9 +2211,9 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
 {
         const struct flow_action_entry *act;
         bool modify_ip_header;
-        u8 htype, ip_proto;
         void *headers_v;
         u16 ethertype;
+        u8 ip_proto;
         int i;
 
         if (actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
@@ -2187,9 +2233,7 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                     act->id != FLOW_ACTION_ADD)
                         continue;
 
-                htype = act->mangle.htype;
-                if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP4 ||
-                    htype == FLOW_ACT_MANGLE_HDR_TYPE_IP6) {
+                if (is_action_keys_supported(act)) {
                         modify_ip_header = true;
                         break;
                 }
@@ -2340,15 +2384,22 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv,
         return 0;
 }
 
-static inline int cmp_encap_info(struct ip_tunnel_key *a,
-                                 struct ip_tunnel_key *b)
+struct encap_key {
+        struct ip_tunnel_key *ip_tun_key;
+        int tunnel_type;
+};
+
+static inline int cmp_encap_info(struct encap_key *a,
+                                 struct encap_key *b)
 {
-        return memcmp(a, b, sizeof(*a));
+        return memcmp(a->ip_tun_key, b->ip_tun_key, sizeof(*a->ip_tun_key)) ||
+               a->tunnel_type != b->tunnel_type;
 }
 
-static inline int hash_encap_info(struct ip_tunnel_key *key)
+static inline int hash_encap_info(struct encap_key *key)
 {
-        return jhash(key, sizeof(*key), 0);
+        return jhash(key->ip_tun_key, sizeof(*key->ip_tun_key),
+                     key->tunnel_type);
 }
 
 
@@ -2379,7 +2430,7 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         struct mlx5_esw_flow_attr *attr = flow->esw_attr;
         struct mlx5e_tc_flow_parse_attr *parse_attr;
         struct ip_tunnel_info *tun_info;
-        struct ip_tunnel_key *key;
+        struct encap_key key, e_key;
         struct mlx5e_encap_entry *e;
         unsigned short family;
         uintptr_t hash_key;
@@ -2389,13 +2440,16 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         parse_attr = attr->parse_attr;
         tun_info = &parse_attr->tun_info[out_index];
         family = ip_tunnel_info_af(tun_info);
-        key = &tun_info->key;
+        key.ip_tun_key = &tun_info->key;
+        key.tunnel_type = mlx5e_tc_tun_get_type(mirred_dev);
 
-        hash_key = hash_encap_info(key);
+        hash_key = hash_encap_info(&key);
 
         hash_for_each_possible_rcu(esw->offloads.encap_tbl, e,
                                    encap_hlist, hash_key) {
-                if (!cmp_encap_info(&e->tun_info.key, key)) {
+                e_key.ip_tun_key = &e->tun_info.key;
+                e_key.tunnel_type = e->tunnel_type;
+                if (!cmp_encap_info(&e_key, &key)) {
                         found = true;
                         break;
                 }
@@ -2657,7 +2711,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
 
         if (hdrs[TCA_PEDIT_KEY_EX_CMD_SET].pedits ||
             hdrs[TCA_PEDIT_KEY_EX_CMD_ADD].pedits) {
-                err = alloc_tc_pedit_action(priv, MLX5_FLOW_NAMESPACE_KERNEL,
+                err = alloc_tc_pedit_action(priv, MLX5_FLOW_NAMESPACE_FDB,
                                             parse_attr, hdrs, extack);
                 if (err)
                         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index ecd2c747f726..8a67fd197b79 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -105,8 +105,7 @@ static int arm_vport_context_events_cmd(struct mlx5_core_dev *dev, u16 vport,
                  opcode, MLX5_CMD_OP_MODIFY_NIC_VPORT_CONTEXT);
         MLX5_SET(modify_nic_vport_context_in, in, field_select.change_event, 1);
         MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport);
-        if (vport)
-                MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
+        MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
         nic_vport_ctx = MLX5_ADDR_OF(modify_nic_vport_context_in,
                                      in, nic_vport_context);
 
@@ -134,8 +133,7 @@ static int modify_esw_vport_context_cmd(struct mlx5_core_dev *dev, u16 vport,
         MLX5_SET(modify_esw_vport_context_in, in, opcode,
                  MLX5_CMD_OP_MODIFY_ESW_VPORT_CONTEXT);
         MLX5_SET(modify_esw_vport_context_in, in, vport_number, vport);
-        if (vport)
-                MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
+        MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
         return mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
 }
 
@@ -431,6 +429,8 @@ static int esw_create_legacy_table(struct mlx5_eswitch *esw)
 {
         int err;
 
+        memset(&esw->fdb_table.legacy, 0, sizeof(struct legacy_fdb));
+
         err = esw_create_legacy_vepa_table(esw);
         if (err)
                 return err;
@@ -2157,6 +2157,7 @@ static int _mlx5_eswitch_set_vepa_locked(struct mlx5_eswitch *esw,
 
         /* Star rule to forward all traffic to uplink vport */
         memset(spec, 0, sizeof(*spec));
+        memset(&dest, 0, sizeof(dest));
         dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
         dest.vport.num = MLX5_VPORT_UPLINK;
         flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index f2260391be5b..9b2d78ee22b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1611,6 +1611,7 @@ static int esw_offloads_steering_init(struct mlx5_eswitch *esw, int nvports)
 {
         int err;
 
+        memset(&esw->fdb_table.offloads, 0, sizeof(struct offloads_fdb));
         mutex_init(&esw->fdb_table.offloads.fdb_prio_lock);
 
         err = esw_create_offloads_fdb_tables(esw, nvports);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
index 5cf5f2a9d51f..22a2ef111514 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
@@ -148,14 +148,16 @@ static int mlx5_fpga_tls_alloc_swid(struct idr *idr, spinlock_t *idr_spinlock,
         return ret;
 }
 
-static void mlx5_fpga_tls_release_swid(struct idr *idr,
-                                       spinlock_t *idr_spinlock, u32 swid)
+static void *mlx5_fpga_tls_release_swid(struct idr *idr,
+                                        spinlock_t *idr_spinlock, u32 swid)
 {
         unsigned long flags;
+        void *ptr;
 
         spin_lock_irqsave(idr_spinlock, flags);
-        idr_remove(idr, swid);
+        ptr = idr_remove(idr, swid);
         spin_unlock_irqrestore(idr_spinlock, flags);
+        return ptr;
 }
 
 static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
@@ -165,20 +167,12 @@ static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
         kfree(buf);
 }
 
-struct mlx5_teardown_stream_context {
-        struct mlx5_fpga_tls_command_context cmd;
-        u32 swid;
-};
-
 static void
 mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
                                   struct mlx5_fpga_device *fdev,
                                   struct mlx5_fpga_tls_command_context *cmd,
                                   struct mlx5_fpga_dma_buf *resp)
 {
-        struct mlx5_teardown_stream_context *ctx =
-                    container_of(cmd, struct mlx5_teardown_stream_context, cmd);
-
         if (resp) {
                 u32 syndrome = MLX5_GET(tls_resp, resp->sg[0].data, syndrome);
 
@@ -186,14 +180,6 @@ mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
                         mlx5_fpga_err(fdev,
                                       "Teardown stream failed with syndrome = %d",
                                       syndrome);
-                else if (MLX5_GET(tls_cmd, cmd->buf.sg[0].data, direction_sx))
-                        mlx5_fpga_tls_release_swid(&fdev->tls->tx_idr,
-                                                   &fdev->tls->tx_idr_spinlock,
-                                                   ctx->swid);
-                else
-                        mlx5_fpga_tls_release_swid(&fdev->tls->rx_idr,
-                                                   &fdev->tls->rx_idr_spinlock,
-                                                   ctx->swid);
         }
         mlx5_fpga_tls_put_command_ctx(cmd);
 }
@@ -225,8 +211,14 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
 
         rcu_read_lock();
         flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
-        rcu_read_unlock();
+        if (unlikely(!flow)) {
+                rcu_read_unlock();
+                WARN_ONCE(1, "Received NULL pointer for handle\n");
+                kfree(buf);
+                return -EINVAL;
+        }
         mlx5_fpga_tls_flow_to_cmd(flow, cmd);
+        rcu_read_unlock();
 
         MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
         MLX5_SET64(tls_cmd, cmd, tls_rcd_sn, be64_to_cpu(rcd_sn));
@@ -238,6 +230,8 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
         buf->complete = mlx_tls_kfree_complete;
 
         ret = mlx5_fpga_sbu_conn_sendmsg(mdev->fpga->tls->conn, buf);
+        if (ret < 0)
+                kfree(buf);
 
         return ret;
 }
@@ -245,7 +239,7 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
 static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
                                             void *flow, u32 swid, gfp_t flags)
 {
-        struct mlx5_teardown_stream_context *ctx;
+        struct mlx5_fpga_tls_command_context *ctx;
         struct mlx5_fpga_dma_buf *buf;
         void *cmd;
 
@@ -253,7 +247,7 @@ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
         if (!ctx)
                 return;
 
-        buf = &ctx->cmd.buf;
+        buf = &ctx->buf;
         cmd = (ctx + 1);
         MLX5_SET(tls_cmd, cmd, command_type, CMD_TEARDOWN_STREAM);
         MLX5_SET(tls_cmd, cmd, swid, swid);
@@ -264,8 +258,7 @@ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
         buf->sg[0].data = cmd;
         buf->sg[0].size = MLX5_TLS_COMMAND_SIZE;
 
-        ctx->swid = swid;
-        mlx5_fpga_tls_cmd_send(mdev->fpga, &ctx->cmd,
+        mlx5_fpga_tls_cmd_send(mdev->fpga, ctx,
                                mlx5_fpga_tls_teardown_completion);
 }
 
@@ -275,13 +268,14 @@ void mlx5_fpga_tls_del_flow(struct mlx5_core_dev *mdev, u32 swid,
         struct mlx5_fpga_tls *tls = mdev->fpga->tls;
         void *flow;
 
-        rcu_read_lock();
         if (direction_sx)
-                flow = idr_find(&tls->tx_idr, swid);
+                flow = mlx5_fpga_tls_release_swid(&tls->tx_idr,
+                                                  &tls->tx_idr_spinlock,
+                                                  swid);
         else
-                flow = idr_find(&tls->rx_idr, swid);
-
-        rcu_read_unlock();
+                flow = mlx5_fpga_tls_release_swid(&tls->rx_idr,
+                                                  &tls->rx_idr_spinlock,
+                                                  swid);
 
         if (!flow) {
                 mlx5_fpga_err(mdev->fpga, "No flow information for swid %u\n",
@@ -289,6 +283,7 @@ void mlx5_fpga_tls_del_flow(struct mlx5_core_dev *mdev, u32 swid,
                 return;
         }
 
+        synchronize_rcu(); /* before kfree(flow) */
         mlx5_fpga_tls_send_teardown_cmd(mdev, flow, swid, flags);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 70cc906a102b..76716419370d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -164,26 +164,6 @@ static struct mlx5_profile profile[] = {
                         .size   = 8,
                         .limit  = 4
                 },
-                .mr_cache[16]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[17]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[18]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[19]   = {
-                        .size   = 4,
-                        .limit  = 2
-                },
-                .mr_cache[20]   = {
-                        .size   = 4,
-                        .limit  = 2
-                },
         },
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index 21b7f05b16a5..361468e0435d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -317,10 +317,6 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
                 size -= offset + size - MLX5_EEPROM_PAGE_LENGTH;
 
         i2c_addr = MLX5_I2C_ADDR_LOW;
-        if (offset >= MLX5_EEPROM_PAGE_LENGTH) {
-                i2c_addr = MLX5_I2C_ADDR_HIGH;
-                offset -= MLX5_EEPROM_PAGE_LENGTH;
-        }
 
         MLX5_SET(mcia_reg, in, l, 0);
         MLX5_SET(mcia_reg, in, module, module_num);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index d23d53c0e284..f26a4ca29363 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -568,7 +568,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
         if (!(mlxsw_core->bus->features & MLXSW_BUS_F_TXRX))
                 return 0;
 
-        emad_wq = alloc_workqueue("mlxsw_core_emad", WQ_MEM_RECLAIM, 0);
+        emad_wq = alloc_workqueue("mlxsw_core_emad", 0, 0);
         if (!emad_wq)
                 return -ENOMEM;
         mlxsw_core->emad_wq = emad_wq;
@@ -1958,10 +1958,10 @@ static int __init mlxsw_core_module_init(void)
 {
         int err;
 
-        mlxsw_wq = alloc_workqueue(mlxsw_core_driver_name, WQ_MEM_RECLAIM, 0);
+        mlxsw_wq = alloc_workqueue(mlxsw_core_driver_name, 0, 0);
         if (!mlxsw_wq)
                 return -ENOMEM;
-        mlxsw_owq = alloc_ordered_workqueue("%s_ordered", WQ_MEM_RECLAIM,
+        mlxsw_owq = alloc_ordered_workqueue("%s_ordered", 0,
                                             mlxsw_core_driver_name);
         if (!mlxsw_owq) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
index ffee38e36ce8..8648ca171254 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
@@ -27,7 +27,7 @@
 
 #define MLXSW_PCI_SW_RESET                      0xF0010
 #define MLXSW_PCI_SW_RESET_RST_BIT              BIT(0)
-#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS        13000
+#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS        20000
 #define MLXSW_PCI_SW_RESET_WAIT_MSECS           100
 #define MLXSW_PCI_FW_READY                      0xA1844
 #define MLXSW_PCI_FW_READY_MASK                 0xFFFF
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 9eb63300c1d3..6b8aa3761899 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -3126,11 +3126,11 @@ mlxsw_sp_port_set_link_ksettings(struct net_device *dev,
         if (err)
                 return err;
 
+        mlxsw_sp_port->link.autoneg = autoneg;
+
         if (!netif_running(dev))
                 return 0;
 
-        mlxsw_sp_port->link.autoneg = autoneg;
-
         mlxsw_sp_port_admin_status_set(mlxsw_sp_port, false);
         mlxsw_sp_port_admin_status_set(mlxsw_sp_port, true);
 
@@ -3316,7 +3316,7 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
                 err = mlxsw_sp_port_ets_set(mlxsw_sp_port,
                                             MLXSW_REG_QEEC_HIERARCY_TC,
                                             i + 8, i,
-                                            false, 0);
+                                            true, 100);
                 if (err)
                         return err;
         }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 9a79b5e11597..d633bef5f105 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -70,6 +70,7 @@ static const struct mlxsw_sp_sb_pool_des mlxsw_sp2_sb_pool_dess[] = {
         {MLXSW_REG_SBXX_DIR_EGRESS, 1},
         {MLXSW_REG_SBXX_DIR_EGRESS, 2},
         {MLXSW_REG_SBXX_DIR_EGRESS, 3},
+        {MLXSW_REG_SBXX_DIR_EGRESS, 15},
 };
 
 #define MLXSW_SP_SB_ING_TC_COUNT 8
@@ -428,6 +429,7 @@ static const struct mlxsw_sp_sb_pr mlxsw_sp2_sb_prs[] = {
         MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, 0),
         MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, 0),
         MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, 0),
+        MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, MLXSW_SP_SB_INFI),
 };
 
 static int mlxsw_sp_sb_prs_init(struct mlxsw_sp *mlxsw_sp,
@@ -517,14 +519,14 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp2_sb_cms_egress[] = {
         MLXSW_SP_SB_CM(0, 7, 4),
         MLXSW_SP_SB_CM(0, 7, 4),
         MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
         MLXSW_SP_SB_CM(1, 0xff, 4),
 };
 
@@ -671,6 +673,7 @@ static const struct mlxsw_sp_sb_pm mlxsw_sp2_sb_pms[] = {
         MLXSW_SP_SB_PM(0, 0),
         MLXSW_SP_SB_PM(0, 0),
         MLXSW_SP_SB_PM(0, 0),
+        MLXSW_SP_SB_PM(10000, 90000),
 };
 
 static int mlxsw_sp_port_sb_pms_init(struct mlxsw_sp_port *mlxsw_sp_port)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 52fed8c7bf1e..902e766a8ed3 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -6781,7 +6781,7 @@ static int mlxsw_sp_router_port_check_rif_addr(struct mlxsw_sp *mlxsw_sp,
         /* A RIF is not created for macvlan netdevs. Their MAC is used to
          * populate the FDB
          */
-        if (netif_is_macvlan(dev))
+        if (netif_is_macvlan(dev) || netif_is_l3_master(dev))
                 return 0;
 
         for (i = 0; i < MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS); i++) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index f6ce386c3036..50111f228d77 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1630,7 +1630,7 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
         u16 fid_index;
         int err = 0;
 
-        if (switchdev_trans_ph_prepare(trans))
+        if (switchdev_trans_ph_commit(trans))
                 return 0;
 
         bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index a1d0d6e42533..d715ef4fc92f 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -613,7 +613,7 @@ static int ocelot_mact_mc_add(struct ocelot_port *port,
                               struct netdev_hw_addr *hw_addr)
 {
         struct ocelot *ocelot = port->ocelot;
-        struct netdev_hw_addr *ha = kzalloc(sizeof(*ha), GFP_KERNEL);
+        struct netdev_hw_addr *ha = kzalloc(sizeof(*ha), GFP_ATOMIC);
 
         if (!ha)
                 return -ENOMEM;
@@ -959,10 +959,8 @@ static void ocelot_get_strings(struct net_device *netdev, u32 sset, u8 *data)
                        ETH_GSTRING_LEN);
 }
 
-static void ocelot_check_stats(struct work_struct *work)
+static void ocelot_update_stats(struct ocelot *ocelot)
 {
-        struct delayed_work *del_work = to_delayed_work(work);
-        struct ocelot *ocelot = container_of(del_work, struct ocelot, stats_work);
         int i, j;
 
         mutex_lock(&ocelot->stats_lock);
@@ -986,11 +984,19 @@ static void ocelot_check_stats(struct work_struct *work)
                 }
         }
 
-        cancel_delayed_work(&ocelot->stats_work);
+        mutex_unlock(&ocelot->stats_lock);
+}
+
+static void ocelot_check_stats_work(struct work_struct *work)
+{
+        struct delayed_work *del_work = to_delayed_work(work);
+        struct ocelot *ocelot = container_of(del_work, struct ocelot,
+                                             stats_work);
+
+        ocelot_update_stats(ocelot);
+
         queue_delayed_work(ocelot->stats_queue, &ocelot->stats_work,
                            OCELOT_STATS_CHECK_DELAY);
-
-        mutex_unlock(&ocelot->stats_lock);
 }
 
 static void ocelot_get_ethtool_stats(struct net_device *dev,
@@ -1001,7 +1007,7 @@ static void ocelot_get_ethtool_stats(struct net_device *dev,
         int i;
 
         /* check and update now */
-        ocelot_check_stats(&ocelot->stats_work.work);
+        ocelot_update_stats(ocelot);
 
         /* Copy all counters */
         for (i = 0; i < ocelot->num_stats; i++)
@@ -1809,7 +1815,7 @@ int ocelot_init(struct ocelot *ocelot)
                                  ANA_CPUQ_8021_CFG_CPUQ_BPDU_VAL(6),
                                  ANA_CPUQ_8021_CFG, i);
 
-        INIT_DELAYED_WORK(&ocelot->stats_work, ocelot_check_stats);
+        INIT_DELAYED_WORK(&ocelot->stats_work, ocelot_check_stats_work);
         queue_delayed_work(ocelot->stats_queue, &ocelot->stats_work,
                            OCELOT_STATS_CHECK_DELAY);
         return 0;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
index 7cde387e5ec6..51cd57ab3d95 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
@@ -2366,6 +2366,7 @@ static void *__vxge_hw_blockpool_malloc(struct __vxge_hw_device *devh, u32 size,
                                 dma_object->addr))) {
                         vxge_os_dma_free(devh->pdev, memblock,
                                 &dma_object->acc_handle);
+                        memblock = NULL;
                         goto exit;
                 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/abm/cls.c b/drivers/net/ethernet/netronome/nfp/abm/cls.c
index 9852080cf454..ff3913085665 100644
--- a/drivers/net/ethernet/netronome/nfp/abm/cls.c
+++ b/drivers/net/ethernet/netronome/nfp/abm/cls.c
@@ -39,7 +39,7 @@ nfp_abm_u32_check_knode(struct nfp_abm *abm, struct tc_cls_u32_knode *knode,
         }
         if (knode->sel->off || knode->sel->offshift || knode->sel->offmask ||
             knode->sel->offoff || knode->fshift) {
-                NL_SET_ERR_MSG_MOD(extack, "variable offseting not supported");
+                NL_SET_ERR_MSG_MOD(extack, "variable offsetting not supported");
                 return false;
         }
         if (knode->sel->hoff || knode->sel->hmask) {
@@ -78,7 +78,7 @@ nfp_abm_u32_check_knode(struct nfp_abm *abm, struct tc_cls_u32_knode *knode,
 
         k = &knode->sel->keys[0];
         if (k->offmask) {
-                NL_SET_ERR_MSG_MOD(extack, "offset mask - variable offseting not supported");
+                NL_SET_ERR_MSG_MOD(extack, "offset mask - variable offsetting not supported");
                 return false;
         }
         if (k->off) {
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index eeda4ed98333..e336f6ee94f5 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -48,8 +48,7 @@ nfp_fl_push_vlan(struct nfp_fl_push_vlan *push_vlan,
 
         tmp_push_vlan_tci =
                 FIELD_PREP(NFP_FL_PUSH_VLAN_PRIO, act->vlan.prio) |
-                FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid) |
-                NFP_FL_PUSH_VLAN_CFI;
+                FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid);
         push_vlan->vlan_tci = cpu_to_be16(tmp_push_vlan_tci);
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index 4fcaf11ed56e..0ed51e79db00 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -26,7 +26,7 @@
 #define NFP_FLOWER_LAYER2_GENEVE_OP     BIT(6)
 
 #define NFP_FLOWER_MASK_VLAN_PRIO       GENMASK(15, 13)
-#define NFP_FLOWER_MASK_VLAN_CFI        BIT(12)
+#define NFP_FLOWER_MASK_VLAN_PRESENT    BIT(12)
 #define NFP_FLOWER_MASK_VLAN_VID        GENMASK(11, 0)
 
 #define NFP_FLOWER_MASK_MPLS_LB         GENMASK(31, 12)
@@ -82,7 +82,6 @@
 #define NFP_FL_OUT_FLAGS_TYPE_IDX       GENMASK(2, 0)
 
 #define NFP_FL_PUSH_VLAN_PRIO           GENMASK(15, 13)
-#define NFP_FL_PUSH_VLAN_CFI            BIT(12)
 #define NFP_FL_PUSH_VLAN_VID            GENMASK(11, 0)
 
 #define IPV6_FLOW_LABEL_MASK            cpu_to_be32(0x000fffff)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index e03c8ef2c28c..9b8b843d0340 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -30,20 +30,19 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *ext,
 
                 flow_rule_match_vlan(rule, &match);
                 /* Populate the tci field. */
-                if (match.key->vlan_id || match.key->vlan_priority) {
-                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                             match.key->vlan_priority) |
-                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                             match.key->vlan_id) |
-                                  NFP_FLOWER_MASK_VLAN_CFI;
-                        ext->tci = cpu_to_be16(tmp_tci);
-                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                             match.mask->vlan_priority) |
-                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                             match.mask->vlan_id) |
-                                  NFP_FLOWER_MASK_VLAN_CFI;
-                        msk->tci = cpu_to_be16(tmp_tci);
-                }
+                tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
+                tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                      match.key->vlan_priority) |
+                           FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                      match.key->vlan_id);
+                ext->tci = cpu_to_be16(tmp_tci);
+
+                tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
+                tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                      match.mask->vlan_priority) |
+                           FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                      match.mask->vlan_id);
+                msk->tci = cpu_to_be16(tmp_tci);
         }
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
index d2c803bb4e56..94d228c04496 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
@@ -195,7 +195,7 @@ static netdev_tx_t nfp_repr_xmit(struct sk_buff *skb, struct net_device *netdev)
         ret = dev_queue_xmit(skb);
         nfp_repr_inc_tx_stats(netdev, len, ret);
 
-        return ret;
+        return NETDEV_TX_OK;
 }
 
 static int nfp_repr_stop(struct net_device *netdev)
@@ -383,7 +383,7 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
         netdev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
         netdev->gso_max_segs = NFP_NET_LSO_MAX_SEGS;
 
-        netdev->priv_flags |= IFF_NO_QUEUE;
+        netdev->priv_flags |= IFF_NO_QUEUE | IFF_DISABLE_NETPOLL;
         netdev->features |= NETIF_F_LLTX;
 
         if (nfp_app_has_tc(app)) {
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 43a57ec296fd..127c89b22ef0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -431,12 +431,16 @@ struct qed_qm_info {
         u8 num_pf_rls;
 };
 
+#define QED_OVERFLOW_BIT        1
+
 struct qed_db_recovery_info {
         struct list_head list;
 
         /* Lock to protect the doorbell recovery mechanism list */
         spinlock_t lock;
+        bool dorq_attn;
         u32 db_recovery_counter;
+        unsigned long overflow;
 };
 
 struct storm_stats {
@@ -920,8 +924,7 @@ u16 qed_get_cm_pq_idx_llt_mtc(struct qed_hwfn *p_hwfn, u8 tc);
 
 /* doorbell recovery mechanism */
 void qed_db_recovery_dp(struct qed_hwfn *p_hwfn);
-void qed_db_recovery_execute(struct qed_hwfn *p_hwfn,
-                             enum qed_db_rec_exec db_exec);
+void qed_db_recovery_execute(struct qed_hwfn *p_hwfn);
 bool qed_edpm_enabled(struct qed_hwfn *p_hwfn);
 
 /* Other Linux specific common definitions */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 9df8c4b3b54e..866cdc86a3f2 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -102,11 +102,15 @@ static void qed_db_recovery_dp_entry(struct qed_hwfn *p_hwfn,
 
 /* Doorbell address sanity (address within doorbell bar range) */
 static bool qed_db_rec_sanity(struct qed_dev *cdev,
-                              void __iomem *db_addr, void *db_data)
+                              void __iomem *db_addr,
+                              enum qed_db_rec_width db_width,
+                              void *db_data)
 {
+        u32 width = (db_width == DB_REC_WIDTH_32B) ? 32 : 64;
+
         /* Make sure doorbell address is within the doorbell bar */
         if (db_addr < cdev->doorbells ||
-            (u8 __iomem *)db_addr >
+            (u8 __iomem *)db_addr + width >
             (u8 __iomem *)cdev->doorbells + cdev->db_size) {
                 WARN(true,
                      "Illegal doorbell address: %p. Legal range for doorbell addresses is [%p..%p]\n",
@@ -159,7 +163,7 @@ int qed_db_recovery_add(struct qed_dev *cdev,
         }
 
         /* Sanitize doorbell address */
-        if (!qed_db_rec_sanity(cdev, db_addr, db_data))
+        if (!qed_db_rec_sanity(cdev, db_addr, db_width, db_data))
                 return -EINVAL;
 
         /* Obtain hwfn from doorbell address */
@@ -205,10 +209,6 @@ int qed_db_recovery_del(struct qed_dev *cdev,
                 return 0;
         }
 
-        /* Sanitize doorbell address */
-        if (!qed_db_rec_sanity(cdev, db_addr, db_data))
-                return -EINVAL;
-
         /* Obtain hwfn from doorbell address */
         p_hwfn = qed_db_rec_find_hwfn(cdev, db_addr);
 
@@ -300,31 +300,24 @@ void qed_db_recovery_dp(struct qed_hwfn *p_hwfn)
 
 /* Ring the doorbell of a single doorbell recovery entry */
 static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
-                                 struct qed_db_recovery_entry *db_entry,
-                                 enum qed_db_rec_exec db_exec)
-{
-        if (db_exec != DB_REC_ONCE) {
-                /* Print according to width */
-                if (db_entry->db_width == DB_REC_WIDTH_32B) {
-                        DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
-                                   "%s doorbell address %p data %x\n",
-                                   db_exec == DB_REC_DRY_RUN ?
-                                   "would have rung" : "ringing",
-                                   db_entry->db_addr,
-                                   *(u32 *)db_entry->db_data);
-                } else {
-                        DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
-                                   "%s doorbell address %p data %llx\n",
-                                   db_exec == DB_REC_DRY_RUN ?
-                                   "would have rung" : "ringing",
-                                   db_entry->db_addr,
-                                   *(u64 *)(db_entry->db_data));
-                }
+                                 struct qed_db_recovery_entry *db_entry)
+{
+        /* Print according to width */
+        if (db_entry->db_width == DB_REC_WIDTH_32B) {
+                DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+                           "ringing doorbell address %p data %x\n",
+                           db_entry->db_addr,
+                           *(u32 *)db_entry->db_data);
+        } else {
+                DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+                           "ringing doorbell address %p data %llx\n",
+                           db_entry->db_addr,
+                           *(u64 *)(db_entry->db_data));
         }
 
         /* Sanity */
         if (!qed_db_rec_sanity(p_hwfn->cdev, db_entry->db_addr,
-                               db_entry->db_data))
+                               db_entry->db_width, db_entry->db_data))
                 return;
 
         /* Flush the write combined buffer. Since there are multiple doorbelling
@@ -334,14 +327,12 @@ static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
         wmb();
 
         /* Ring the doorbell */
-        if (db_exec == DB_REC_REAL_DEAL || db_exec == DB_REC_ONCE) {
-                if (db_entry->db_width == DB_REC_WIDTH_32B)
-                        DIRECT_REG_WR(db_entry->db_addr,
-                                      *(u32 *)(db_entry->db_data));
-                else
-                        DIRECT_REG_WR64(db_entry->db_addr,
-                                        *(u64 *)(db_entry->db_data));
-        }
+        if (db_entry->db_width == DB_REC_WIDTH_32B)
+                DIRECT_REG_WR(db_entry->db_addr,
+                              *(u32 *)(db_entry->db_data));
+        else
+                DIRECT_REG_WR64(db_entry->db_addr,
+                                *(u64 *)(db_entry->db_data));
 
         /* Flush the write combined buffer. Next doorbell may come from a
          * different entity to the same address...
@@ -350,29 +341,21 @@ static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
 }
 
 /* Traverse the doorbell recovery entry list and ring all the doorbells */
-void qed_db_recovery_execute(struct qed_hwfn *p_hwfn,
-                             enum qed_db_rec_exec db_exec)
+void qed_db_recovery_execute(struct qed_hwfn *p_hwfn)
 {
         struct qed_db_recovery_entry *db_entry = NULL;
 
-        if (db_exec != DB_REC_ONCE) {
-                DP_NOTICE(p_hwfn,
-                          "Executing doorbell recovery. Counter was %d\n",
-                          p_hwfn->db_recovery_info.db_recovery_counter);
+        DP_NOTICE(p_hwfn, "Executing doorbell recovery. Counter was %d\n",
+                  p_hwfn->db_recovery_info.db_recovery_counter);
 
-                /* Track amount of times recovery was executed */
-                p_hwfn->db_recovery_info.db_recovery_counter++;
-        }
+        /* Track amount of times recovery was executed */
+        p_hwfn->db_recovery_info.db_recovery_counter++;
 
         /* Protect the list */
         spin_lock_bh(&p_hwfn->db_recovery_info.lock);
         list_for_each_entry(db_entry,
-                            &p_hwfn->db_recovery_info.list, list_entry) {
-                qed_db_recovery_ring(p_hwfn, db_entry, db_exec);
-                if (db_exec == DB_REC_ONCE)
-                        break;
-        }
-
+                            &p_hwfn->db_recovery_info.list, list_entry)
+                qed_db_recovery_ring(p_hwfn, db_entry);
         spin_unlock_bh(&p_hwfn->db_recovery_info.lock);
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index e23980e301b6..8848d5bed6e5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -378,6 +378,9 @@ static int qed_db_rec_flush_queue(struct qed_hwfn *p_hwfn,
         u32 count = QED_DB_REC_COUNT;
         u32 usage = 1;
 
+        /* Flush any pending (e)dpms as they may never arrive */
+        qed_wr(p_hwfn, p_ptt, DORQ_REG_DPM_FORCE_ABORT, 0x1);
+
         /* wait for usage to zero or count to run out. This is necessary since
          * EDPM doorbell transactions can take multiple 64b cycles, and as such
          * can "split" over the pci. Possibly, the doorbell drop can happen with
@@ -406,51 +409,74 @@ static int qed_db_rec_flush_queue(struct qed_hwfn *p_hwfn,
 
 int qed_db_rec_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 overflow;
+        u32 attn_ovfl, cur_ovfl;
         int rc;
 
-        overflow = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
-        DP_NOTICE(p_hwfn, "PF Overflow sticky 0x%x\n", overflow);
-        if (!overflow) {
-                qed_db_recovery_execute(p_hwfn, DB_REC_ONCE);
+        attn_ovfl = test_and_clear_bit(QED_OVERFLOW_BIT,
+                                       &p_hwfn->db_recovery_info.overflow);
+        cur_ovfl = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
+        if (!cur_ovfl && !attn_ovfl)
                 return 0;
-        }
 
-        if (qed_edpm_enabled(p_hwfn)) {
+        DP_NOTICE(p_hwfn, "PF Overflow sticky: attn %u current %u\n",
+                  attn_ovfl, cur_ovfl);
+
+        if (cur_ovfl && !p_hwfn->db_bar_no_edpm) {
                 rc = qed_db_rec_flush_queue(p_hwfn, p_ptt);
                 if (rc)
                         return rc;
         }
 
-        /* Flush any pending (e)dpm as they may never arrive */
-        qed_wr(p_hwfn, p_ptt, DORQ_REG_DPM_FORCE_ABORT, 0x1);
-
         /* Release overflow sticky indication (stop silently dropping everything) */
         qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY, 0x0);
 
         /* Repeat all last doorbells (doorbell drop recovery) */
-        qed_db_recovery_execute(p_hwfn, DB_REC_REAL_DEAL);
+        qed_db_recovery_execute(p_hwfn);
 
         return 0;
 }
 
-static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
+static void qed_dorq_attn_overflow(struct qed_hwfn *p_hwfn)
 {
-        u32 int_sts, first_drop_reason, details, address, all_drops_reason;
         struct qed_ptt *p_ptt = p_hwfn->p_dpc_ptt;
+        u32 overflow;
         int rc;
 
-        int_sts = qed_rd(p_hwfn, p_ptt, DORQ_REG_INT_STS);
-        DP_NOTICE(p_hwfn->cdev, "DORQ attention. int_sts was %x\n", int_sts);
+        overflow = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
+        if (!overflow)
+                goto out;
+
+        /* Run PF doorbell recovery in next periodic handler */
+        set_bit(QED_OVERFLOW_BIT, &p_hwfn->db_recovery_info.overflow);
+
+        if (!p_hwfn->db_bar_no_edpm) {
+                rc = qed_db_rec_flush_queue(p_hwfn, p_ptt);
+                if (rc)
+                        goto out;
+        }
+
+        qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY, 0x0);
+out:
+        /* Schedule the handler even if overflow was not detected */
+        qed_periodic_db_rec_start(p_hwfn);
+}
+
+static int qed_dorq_attn_int_sts(struct qed_hwfn *p_hwfn)
+{
+        u32 int_sts, first_drop_reason, details, address, all_drops_reason;
+        struct qed_ptt *p_ptt = p_hwfn->p_dpc_ptt;
 
         /* int_sts may be zero since all PFs were interrupted for doorbell
          * overflow but another one already handled it. Can abort here. If
          * This PF also requires overflow recovery we will be interrupted again.
          * The masked almost full indication may also be set. Ignoring.
          */
+        int_sts = qed_rd(p_hwfn, p_ptt, DORQ_REG_INT_STS);
         if (!(int_sts & ~DORQ_REG_INT_STS_DORQ_FIFO_AFULL))
                 return 0;
 
+        DP_NOTICE(p_hwfn->cdev, "DORQ attention. int_sts was %x\n", int_sts);
+
         /* check if db_drop or overflow happened */
         if (int_sts & (DORQ_REG_INT_STS_DB_DROP |
                        DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR)) {
@@ -477,11 +503,6 @@ static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
                           GET_FIELD(details, QED_DORQ_ATTENTION_SIZE) * 4,
                           first_drop_reason, all_drops_reason);
 
-                rc = qed_db_rec_handler(p_hwfn, p_ptt);
-                qed_periodic_db_rec_start(p_hwfn);
-                if (rc)
-                        return rc;
-
                 /* Clear the doorbell drop details and prepare for next drop */
                 qed_wr(p_hwfn, p_ptt, DORQ_REG_DB_DROP_DETAILS_REL, 0);
 
@@ -507,6 +528,25 @@ static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
         return -EINVAL;
 }
 
+static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
+{
+        p_hwfn->db_recovery_info.dorq_attn = true;
+        qed_dorq_attn_overflow(p_hwfn);
+
+        return qed_dorq_attn_int_sts(p_hwfn);
+}
+
+static void qed_dorq_attn_handler(struct qed_hwfn *p_hwfn)
+{
+        if (p_hwfn->db_recovery_info.dorq_attn)
+                goto out;
+
+        /* Call DORQ callback if the attention was missed */
+        qed_dorq_attn_cb(p_hwfn);
+out:
+        p_hwfn->db_recovery_info.dorq_attn = false;
+}
+
 /* Instead of major changes to the data-structure, we have a some 'special'
  * identifiers for sources that changed meaning between adapters.
  */
@@ -1080,6 +1120,9 @@ static int qed_int_deassertion(struct qed_hwfn  *p_hwfn,
                 }
         }
 
+        /* Handle missed DORQ attention */
+        qed_dorq_attn_handler(p_hwfn);
+
         /* Clear IGU indication for the deasserted bits */
         DIRECT_REG_WR((u8 __iomem *)p_hwfn->regview +
                                     GTT_BAR0_MAP_REG_IGU_CMD +
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h
index 1f356ed4f761..d473b522afc5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
@@ -192,8 +192,8 @@ void qed_int_disable_post_isr_release(struct qed_dev *cdev);
 
 /**
  * @brief - Doorbell Recovery handler.
- *          Run DB_REAL_DEAL doorbell recovery in case of PF overflow
- *          (and flush DORQ if needed), otherwise run DB_REC_ONCE.
+ *          Run doorbell recovery in case of PF overflow (and flush DORQ if
+ *          needed).
  *
  * @param p_hwfn
  * @param p_ptt
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index f164d4acebcb..6de23b56b294 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -970,7 +970,7 @@ static void qed_update_pf_params(struct qed_dev *cdev,
         }
 }
 
-#define QED_PERIODIC_DB_REC_COUNT               100
+#define QED_PERIODIC_DB_REC_COUNT               10
 #define QED_PERIODIC_DB_REC_INTERVAL_MS         100
 #define QED_PERIODIC_DB_REC_INTERVAL \
         msecs_to_jiffies(QED_PERIODIC_DB_REC_INTERVAL_MS)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index 9faaa6df78ed..2f318aaf2b05 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -1591,7 +1591,7 @@ static void qed_iov_vf_mbx_acquire(struct qed_hwfn *p_hwfn,
                         p_vfdev->eth_fp_hsi_minor = ETH_HSI_VER_NO_PKT_LEN_TUNN;
                 } else {
                         DP_INFO(p_hwfn,
-                                "VF[%d] needs fastpath HSI %02x.%02x, which is incompatible with loaded FW's faspath HSI %02x.%02x\n",
+                                "VF[%d] needs fastpath HSI %02x.%02x, which is incompatible with loaded FW's fastpath HSI %02x.%02x\n",
                                 vf->abs_vf_id,
                                 req->vfdev_info.eth_fp_hsi_major,
                                 req->vfdev_info.eth_fp_hsi_minor,
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
index 5f3f42a25361..bddb2b5982dc 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
@@ -490,18 +490,17 @@ int qede_ptp_enable(struct qede_dev *edev, bool init_tc)
 
         ptp->clock = ptp_clock_register(&ptp->clock_info, &edev->pdev->dev);
         if (IS_ERR(ptp->clock)) {
-                rc = -EINVAL;
                 DP_ERR(edev, "PTP clock registration failed\n");
+                qede_ptp_disable(edev);
+                rc = -EINVAL;
                 goto err2;
         }
 
         return 0;
 
-err2:
-        qede_ptp_disable(edev);
-        ptp->clock = NULL;
 err1:
         kfree(ptp);
+err2:
         edev->ptp = NULL;
 
         return rc;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 0c443ea98479..374a4d4371f9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -497,7 +497,7 @@ struct qlcnic_hardware_context {
         u16 board_type;
         u16 supported_type;
 
-        u16 link_speed;
+        u32 link_speed;
         u16 link_duplex;
         u16 link_autoneg;
         u16 module_type;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7562ccbbb39a..ed651dde6ef9 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -28,6 +28,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/firmware.h>
 #include <linux/prefetch.h>
+#include <linux/pci-aspm.h>
 #include <linux/ipv6.h>
 #include <net/ip6_checksum.h>
 
@@ -5460,7 +5461,7 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp)
         tp->cp_cmd |= PktCntrDisable | INTT_1;
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 
-        RTL_W16(tp, IntrMitigate, 0x5151);
+        RTL_W16(tp, IntrMitigate, 0x5100);
 
         /* Work around for RxFIFO overflow. */
         if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
@@ -7352,6 +7353,11 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 return rc;
 
+        /* Disable ASPM completely as that cause random device stop working
+         * problems as well as full system hangs for some PCIe devices users.
+         */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
+
         /* enable device (incl. PCI PM wakeup and hotplug setup) */
         rc = pcim_enable_device(pdev);
         if (rc < 0) {
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index a18149720aa2..cba5881b2746 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -673,7 +673,8 @@ static void netsec_process_tx(struct netsec_priv *priv)
 }
 
 static void *netsec_alloc_rx_data(struct netsec_priv *priv,
-                                  dma_addr_t *dma_handle, u16 *desc_len)
+                                  dma_addr_t *dma_handle, u16 *desc_len,
+                                  bool napi)
 {
         size_t total_len = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
         size_t payload_len = NETSEC_RX_BUF_SZ;
@@ -682,7 +683,7 @@ static void *netsec_alloc_rx_data(struct netsec_priv *priv,
 
         total_len += SKB_DATA_ALIGN(payload_len + NETSEC_SKB_PAD);
 
-        buf = napi_alloc_frag(total_len);
+        buf = napi ? napi_alloc_frag(total_len) : netdev_alloc_frag(total_len);
         if (!buf)
                 return NULL;
 
@@ -765,7 +766,8 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
                 /* allocate a fresh buffer and map it to the hardware.
                  * This will eventually replace the old buffer in the hardware
                  */
-                buf_addr = netsec_alloc_rx_data(priv, &dma_handle, &desc_len);
+                buf_addr = netsec_alloc_rx_data(priv, &dma_handle, &desc_len,
+                                                true);
                 if (unlikely(!buf_addr))
                         break;
 
@@ -1069,7 +1071,8 @@ static int netsec_setup_rx_dring(struct netsec_priv *priv)
                 void *buf;
                 u16 len;
 
-                buf = netsec_alloc_rx_data(priv, &dma_handle, &len);
+                buf = netsec_alloc_rx_data(priv, &dma_handle, &len,
+                                           false);
                 if (!buf) {
                         netsec_uninit_pkt_dring(priv, NETSEC_RING_RX);
                         goto err_out;
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
index 40d6356a7e73..3dfb07a78952 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
@@ -29,11 +29,13 @@
 /* Specific functions used for Ring mode */
 
 /* Enhanced descriptors */
-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end,
+                                           int bfsize)
 {
-        p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
-                        << ERDES1_BUFFER2_SIZE_SHIFT)
-                   & ERDES1_BUFFER2_SIZE_MASK);
+        if (bfsize == BUF_SIZE_16KiB)
+                p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+                                << ERDES1_BUFFER2_SIZE_SHIFT)
+                           & ERDES1_BUFFER2_SIZE_MASK);
 
         if (end)
                 p->des1 |= cpu_to_le32(ERDES1_END_RING);
@@ -59,11 +61,15 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len)
 }
 
 /* Normal descriptors */
-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
 {
-        p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1)
-                                << RDES1_BUFFER2_SIZE_SHIFT)
-                    & RDES1_BUFFER2_SIZE_MASK);
+        if (bfsize >= BUF_SIZE_2KiB) {
+                int bfsize2;
+
+                bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
+                p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT)
+                            & RDES1_BUFFER2_SIZE_MASK);
+        }
 
         if (end)
                 p->des1 |= cpu_to_le32(RDES1_END_RING);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 7fbb6a4dbf51..e061e9f5fad7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -296,7 +296,7 @@ exit:
 }
 
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                   int mode, int end)
+                                   int mode, int end, int bfsize)
 {
         dwmac4_set_rx_owner(p, disable_rx_ic);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
index 1d858fdec997..98fa471da7c0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -123,7 +123,7 @@ static int dwxgmac2_get_rx_timestamp_status(void *desc, void *next_desc,
 }
 
 static void dwxgmac2_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                  int mode, int end)
+                                  int mode, int end, int bfsize)
 {
         dwxgmac2_set_rx_owner(p, disable_rx_ic);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 5ef91a790f9d..5202d6ad7919 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -201,6 +201,11 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
         if (unlikely(rdes0 & RDES0_OWN))
                 return dma_own;
 
+        if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
+                stats->rx_length_errors++;
+                return discard_frame;
+        }
+
         if (unlikely(rdes0 & RDES0_ERROR_SUMMARY)) {
                 if (unlikely(rdes0 & RDES0_DESCRIPTOR_ERROR)) {
                         x->rx_desc++;
@@ -231,9 +236,10 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
          * It doesn't match with the information reported into the databook.
          * At any rate, we need to understand if the CSUM hw computation is ok
          * and report this info to the upper layers. */
-        ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
-                                 !!(rdes0 & RDES0_FRAME_TYPE),
-                                 !!(rdes0 & ERDES0_RX_MAC_ADDR));
+        if (likely(ret == good_frame))
+                ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
+                                         !!(rdes0 & RDES0_FRAME_TYPE),
+                                         !!(rdes0 & ERDES0_RX_MAC_ADDR));
 
         if (unlikely(rdes0 & RDES0_DRIBBLING))
                 x->dribbling_bit++;
@@ -259,15 +265,19 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                  int mode, int end)
+                                  int mode, int end, int bfsize)
 {
+        int bfsize1;
+
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
+
+        bfsize1 = min(bfsize, BUF_SIZE_8KiB);
+        p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ehn_desc_rx_set_on_chain(p);
         else
-                ehn_desc_rx_set_on_ring(p, end);
+                ehn_desc_rx_set_on_ring(p, end, bfsize);
 
         if (disable_rx_ic)
                 p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC);
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index 92b8944f26e3..5bb00234d961 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -33,7 +33,7 @@ struct dma_extended_desc;
 struct stmmac_desc_ops {
         /* DMA RX descriptor ring initialization */
         void (*init_rx_desc)(struct dma_desc *p, int disable_rx_ic, int mode,
-                        int end);
+                        int end, int bfsize);
         /* DMA TX descriptor ring initialization */
         void (*init_tx_desc)(struct dma_desc *p, int mode, int end);
         /* Invoked by the xmit function to prepare the tx descriptor */
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index de65bb29feba..6d690678c20e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -91,8 +91,6 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
                 return dma_own;
 
         if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
-                pr_warn("%s: Oversized frame spanned multiple buffers\n",
-                        __func__);
                 stats->rx_length_errors++;
                 return discard_frame;
         }
@@ -135,15 +133,19 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
-                               int end)
+                               int end, int bfsize)
 {
+        int bfsize1;
+
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK);
+
+        bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1);
+        p->des1 |= cpu_to_le32(bfsize1 & RDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ndesc_rx_set_on_chain(p, end);
         else
-                ndesc_rx_set_on_ring(p, end);
+                ndesc_rx_set_on_ring(p, end, bfsize);
 
         if (disable_rx_ic)
                 p->des1 |= cpu_to_le32(RDES1_DISABLE_IC);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6a2e1031a62a..48712437d0da 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1136,11 +1136,13 @@ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue)
                 if (priv->extend_desc)
                         stmmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
                                         priv->use_riwt, priv->mode,
-                                        (i == DMA_RX_SIZE - 1));
+                                        (i == DMA_RX_SIZE - 1),
+                                        priv->dma_buf_sz);
                 else
                         stmmac_init_rx_desc(priv, &rx_q->dma_rx[i],
                                         priv->use_riwt, priv->mode,
-                                        (i == DMA_RX_SIZE - 1));
+                                        (i == DMA_RX_SIZE - 1),
+                                        priv->dma_buf_sz);
 }
 
 /**
@@ -2614,8 +2616,6 @@ static int stmmac_open(struct net_device *dev)
         u32 chan;
         int ret;
 
-        stmmac_check_ether_addr(priv);
-
         if (priv->hw->pcs != STMMAC_PCS_RGMII &&
             priv->hw->pcs != STMMAC_PCS_TBI &&
             priv->hw->pcs != STMMAC_PCS_RTBI) {
@@ -3352,9 +3352,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 {
         struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
         struct stmmac_channel *ch = &priv->channel[queue];
-        unsigned int entry = rx_q->cur_rx;
+        unsigned int next_entry = rx_q->cur_rx;
         int coe = priv->hw->rx_csum;
-        unsigned int next_entry;
         unsigned int count = 0;
         bool xmac;
 
@@ -3372,10 +3371,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                 stmmac_display_ring(priv, rx_head, DMA_RX_SIZE, true);
         }
         while (count < limit) {
-                int status;
+                int entry, status;
                 struct dma_desc *p;
                 struct dma_desc *np;
 
+                entry = next_entry;
+
                 if (priv->extend_desc)
                         p = (struct dma_desc *)(rx_q->dma_erx + entry);
                 else
@@ -3431,11 +3432,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                          *  ignored
                          */
                         if (frame_len > priv->dma_buf_sz) {
-                                netdev_err(priv->dev,
-                                           "len %d larger than size (%d)\n",
-                                           frame_len, priv->dma_buf_sz);
+                                if (net_ratelimit())
+                                        netdev_err(priv->dev,
+                                                   "len %d larger than size (%d)\n",
+                                                   frame_len, priv->dma_buf_sz);
                                 priv->dev->stats.rx_length_errors++;
-                                break;
+                                continue;
                         }
 
                         /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
@@ -3470,7 +3472,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                                                 dev_warn(priv->device,
                                                          "packet dropped\n");
                                         priv->dev->stats.rx_dropped++;
-                                        break;
+                                        continue;
                                 }
 
                                 dma_sync_single_for_cpu(priv->device,
@@ -3490,11 +3492,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         } else {
                                 skb = rx_q->rx_skbuff[entry];
                                 if (unlikely(!skb)) {
-                                        netdev_err(priv->dev,
-                                                   "%s: Inconsistent Rx chain\n",
-                                                   priv->dev->name);
+                                        if (net_ratelimit())
+                                                netdev_err(priv->dev,
+                                                           "%s: Inconsistent Rx chain\n",
+                                                           priv->dev->name);
                                         priv->dev->stats.rx_dropped++;
-                                        break;
+                                        continue;
                                 }
                                 prefetch(skb->data - NET_IP_ALIGN);
                                 rx_q->rx_skbuff[entry] = NULL;
@@ -3529,7 +3532,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         priv->dev->stats.rx_packets++;
                         priv->dev->stats.rx_bytes += frame_len;
                 }
-                entry = next_entry;
         }
 
         stmmac_rx_refill(priv, queue);
@@ -4299,6 +4301,8 @@ int stmmac_dvr_probe(struct device *device,
         if (ret)
                 goto error_hw_init;
 
+        stmmac_check_ether_addr(priv);
+
         /* Configure real RX and TX queues */
         netif_set_real_num_rx_queues(ndev, priv->plat->rx_queues_to_use);
         netif_set_real_num_tx_queues(ndev, priv->plat->tx_queues_to_use);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index d819e8eaba12..cc1e887e47b5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -159,6 +159,12 @@ static const struct dmi_system_id quark_pci_dmi[] = {
                 },
                 .driver_data = (void *)&galileo_stmmac_dmi_data,
         },
+        /*
+         * There are 2 types of SIMATIC IOT2000: IOT20202 and IOT2040.
+         * The asset tag "6ES7647-0AA00-0YA2" is only for IOT2020 which
+         * has only one pci network device while other asset tags are
+         * for IOT2040 which has two.
+         */
         {
                 .matches = {
                         DMI_EXACT_MATCH(DMI_BOARD_NAME, "SIMATIC IOT2000"),
@@ -170,8 +176,6 @@ static const struct dmi_system_id quark_pci_dmi[] = {
         {
                 .matches = {
                         DMI_EXACT_MATCH(DMI_BOARD_NAME, "SIMATIC IOT2000"),
-                        DMI_EXACT_MATCH(DMI_BOARD_ASSET_TAG,
-                                        "6ES7647-0AA00-1YA2"),
                 },
                 .driver_data = (void *)&iot2040_stmmac_dmi_data,
         },
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index e859ae2e42d5..49f41b64077b 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -987,6 +987,7 @@ struct netvsc_device {
 
         wait_queue_head_t wait_drain;
         bool destroy;
+        bool tx_disable; /* if true, do not wake up queue again */
 
         /* Receive buffer allocated by us but manages by NetVSP */
         void *recv_buf;
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 813d195bbd57..e0dce373cdd9 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -110,6 +110,7 @@ static struct netvsc_device *alloc_net_device(void)
 
         init_waitqueue_head(&net_device->wait_drain);
         net_device->destroy = false;
+        net_device->tx_disable = false;
 
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
@@ -719,7 +720,7 @@ static void netvsc_send_tx_complete(struct net_device *ndev,
         } else {
                 struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx);
 
-                if (netif_tx_queue_stopped(txq) &&
+                if (netif_tx_queue_stopped(txq) && !net_device->tx_disable &&
                     (hv_get_avail_to_write_percent(&channel->outbound) >
                      RING_AVAIL_PERCENT_HIWATER || queue_sends < 1)) {
                         netif_tx_wake_queue(txq);
@@ -874,7 +875,8 @@ static inline int netvsc_send_pkt(
         } else if (ret == -EAGAIN) {
                 netif_tx_stop_queue(txq);
                 ndev_ctx->eth_stats.stop_queue++;
-                if (atomic_read(&nvchan->queue_sends) < 1) {
+                if (atomic_read(&nvchan->queue_sends) < 1 &&
+                    !net_device->tx_disable) {
                         netif_tx_wake_queue(txq);
                         ndev_ctx->eth_stats.wake_queue++;
                         ret = -ENOSPC;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index cf4897043e83..b20fb0fb595b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -109,6 +109,15 @@ static void netvsc_set_rx_mode(struct net_device *net)
         rcu_read_unlock();
 }
 
+static void netvsc_tx_enable(struct netvsc_device *nvscdev,
+                             struct net_device *ndev)
+{
+        nvscdev->tx_disable = false;
+        virt_wmb(); /* ensure queue wake up mechanism is on */
+
+        netif_tx_wake_all_queues(ndev);
+}
+
 static int netvsc_open(struct net_device *net)
 {
         struct net_device_context *ndev_ctx = netdev_priv(net);
@@ -129,7 +138,7 @@ static int netvsc_open(struct net_device *net)
         rdev = nvdev->extension;
         if (!rdev->link_state) {
                 netif_carrier_on(net);
-                netif_tx_wake_all_queues(net);
+                netvsc_tx_enable(nvdev, net);
         }
 
         if (vf_netdev) {
@@ -184,6 +193,17 @@ static int netvsc_wait_until_empty(struct netvsc_device *nvdev)
         }
 }
 
+static void netvsc_tx_disable(struct netvsc_device *nvscdev,
+                              struct net_device *ndev)
+{
+        if (nvscdev) {
+                nvscdev->tx_disable = true;
+                virt_wmb(); /* ensure txq will not wake up after stop */
+        }
+
+        netif_tx_disable(ndev);
+}
+
 static int netvsc_close(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
@@ -192,7 +212,7 @@ static int netvsc_close(struct net_device *net)
         struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
         int ret;
 
-        netif_tx_disable(net);
+        netvsc_tx_disable(nvdev, net);
 
         /* No need to close rndis filter if it is removed already */
         if (!nvdev)
@@ -920,7 +940,7 @@ static int netvsc_detach(struct net_device *ndev,
 
         /* If device was up (receiving) then shutdown */
         if (netif_running(ndev)) {
-                netif_tx_disable(ndev);
+                netvsc_tx_disable(nvdev, ndev);
 
                 ret = rndis_filter_close(nvdev);
                 if (ret) {
@@ -1908,7 +1928,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (rdev->link_state) {
                         rdev->link_state = false;
                         netif_carrier_on(net);
-                        netif_tx_wake_all_queues(net);
+                        netvsc_tx_enable(net_device, net);
                 } else {
                         notify = true;
                 }
@@ -1918,7 +1938,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (!rdev->link_state) {
                         rdev->link_state = true;
                         netif_carrier_off(net);
-                        netif_tx_stop_all_queues(net);
+                        netvsc_tx_disable(net_device, net);
                 }
                 kfree(event);
                 break;
@@ -1927,7 +1947,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (!rdev->link_state) {
                         rdev->link_state = true;
                         netif_carrier_off(net);
-                        netif_tx_stop_all_queues(net);
+                        netvsc_tx_disable(net_device, net);
                         event->event = RNDIS_STATUS_MEDIA_CONNECT;
                         spin_lock_irqsave(&ndev_ctx->lock, flags);
                         list_add(&event->list, &ndev_ctx->reconfig_events);
diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c
index 92b64e254b44..7475cef17cf7 100644
--- a/drivers/net/phy/spi_ks8995.c
+++ b/drivers/net/phy/spi_ks8995.c
@@ -159,6 +159,14 @@ static const struct spi_device_id ks8995_id[] = {
 };
 MODULE_DEVICE_TABLE(spi, ks8995_id);
 
+static const struct of_device_id ks8895_spi_of_match[] = {
+        { .compatible = "micrel,ks8995" },
+        { .compatible = "micrel,ksz8864" },
+        { .compatible = "micrel,ksz8795" },
+        { },
+ };
+MODULE_DEVICE_TABLE(of, ks8895_spi_of_match);
+
 static inline u8 get_chip_id(u8 val)
 {
         return (val >> ID1_CHIPID_S) & ID1_CHIPID_M;
@@ -526,6 +534,7 @@ static int ks8995_remove(struct spi_device *spi)
 static struct spi_driver ks8995_driver = {
         .driver = {
                 .name       = "spi-ks8995",
+                .of_match_table = of_match_ptr(ks8895_spi_of_match),
         },
         .probe    = ks8995_probe,
         .remove   = ks8995_remove,
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index f4e93f5fc204..ea90db3c7705 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -153,7 +153,7 @@ out_fail:
 void
 slhc_free(struct slcompress *comp)
 {
-        if ( comp == NULLSLCOMPR )
+        if ( IS_ERR_OR_NULL(comp) )
                 return;
 
         if ( comp->tstate != NULLSLSTATE )
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 6ed96fdfd96d..16963f7a88f7 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1156,6 +1156,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                 return -EINVAL;
         }
 
+        if (netdev_has_upper_dev(dev, port_dev)) {
+                NL_SET_ERR_MSG(extack, "Device is already an upper device of the team interface");
+                netdev_err(dev, "Device %s is already an upper device of the team interface\n",
+                           portname);
+                return -EBUSY;
+        }
+
         if (port_dev->features & NETIF_F_VLAN_CHALLENGED &&
             vlan_uses_dev(dev)) {
                 NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up");
@@ -1246,6 +1253,23 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                 goto err_option_port_add;
         }
 
+        /* set promiscuity level to new slave */
+        if (dev->flags & IFF_PROMISC) {
+                err = dev_set_promiscuity(port_dev, 1);
+                if (err)
+                        goto err_set_slave_promisc;
+        }
+
+        /* set allmulti level to new slave */
+        if (dev->flags & IFF_ALLMULTI) {
+                err = dev_set_allmulti(port_dev, 1);
+                if (err) {
+                        if (dev->flags & IFF_PROMISC)
+                                dev_set_promiscuity(port_dev, -1);
+                        goto err_set_slave_promisc;
+                }
+        }
+
         netif_addr_lock_bh(dev);
         dev_uc_sync_multiple(port_dev, dev);
         dev_mc_sync_multiple(port_dev, dev);
@@ -1262,6 +1286,9 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
 
         return 0;
 
+err_set_slave_promisc:
+        __team_option_inst_del_port(team, port);
+
 err_option_port_add:
         team_upper_dev_unlink(team, port);
 
@@ -1307,6 +1334,12 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
 
         team_port_disable(team, port);
         list_del_rcu(&port->list);
+
+        if (dev->flags & IFF_PROMISC)
+                dev_set_promiscuity(port_dev, -1);
+        if (dev->flags & IFF_ALLMULTI)
+                dev_set_allmulti(port_dev, -1);
+
         team_upper_dev_unlink(team, port);
         netdev_rx_handler_unregister(port_dev);
         team_port_disable_netpoll(port);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 74bebbdb4b15..9195f3476b1d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1203,6 +1203,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
         {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
+        {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
         {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 7c1430ed0244..9ee4d7402ca2 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -875,6 +875,7 @@ static const struct net_device_ops vrf_netdev_ops = {
         .ndo_init               = vrf_dev_init,
         .ndo_uninit             = vrf_dev_uninit,
         .ndo_start_xmit         = vrf_xmit,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_get_stats64        = vrf_get_stats64,
         .ndo_add_slave          = vrf_add_slave,
         .ndo_del_slave          = vrf_del_slave,
@@ -1273,9 +1274,15 @@ static void vrf_setup(struct net_device *dev)
 
         /* default to no qdisc; user can add if desired */
         dev->priv_flags |= IFF_NO_QUEUE;
+        dev->priv_flags |= IFF_NO_RX_HANDLER;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 
-        dev->min_mtu = 0;
-        dev->max_mtu = 0;
+        /* VRF devices do not care about MTU, but if the MTU is set
+         * too low then the ipv4 and ipv6 protocols are disabled
+         * which breaks networking.
+         */
+        dev->min_mtu = IPV6_MIN_MTU;
+        dev->max_mtu = ETH_MAX_MTU;
 }
 
 static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index a20ea270d519..1acc622d2183 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2728,7 +2728,7 @@ static void ath10k_htt_rx_tx_fetch_ind(struct ath10k *ar, struct sk_buff *skb)
                         num_msdus++;
                         num_bytes += ret;
                 }
-                ieee80211_return_txq(hw, txq);
+                ieee80211_return_txq(hw, txq, false);
                 ieee80211_txq_schedule_end(hw, txq->ac);
 
                 record->num_msdus = cpu_to_le16(num_msdus);
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index b73c23d4ce86..41e89db244d2 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4089,7 +4089,7 @@ static int ath10k_mac_schedule_txq(struct ieee80211_hw *hw, u32 ac)
                         if (ret < 0)
                                 break;
                 }
-                ieee80211_return_txq(hw, txq);
+                ieee80211_return_txq(hw, txq, false);
                 ath10k_htt_tx_txq_update(hw, txq);
                 if (ret == -EBUSY)
                         break;
@@ -4374,7 +4374,7 @@ static void ath10k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
                 if (ret < 0)
                         break;
         }
-        ieee80211_return_txq(hw, txq);
+        ieee80211_return_txq(hw, txq, false);
         ath10k_htt_tx_txq_update(hw, txq);
 out:
         ieee80211_txq_schedule_end(hw, ac);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 773d428ff1b0..b17e1ca40995 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1938,12 +1938,15 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                 goto out;
 
         while ((queue = ieee80211_next_txq(hw, txq->mac80211_qnum))) {
+                bool force;
+
                 tid = (struct ath_atx_tid *)queue->drv_priv;
 
                 ret = ath_tx_sched_aggr(sc, txq, tid);
                 ath_dbg(common, QUEUE, "ath_tx_sched_aggr returned %d\n", ret);
 
-                ieee80211_return_txq(hw, queue);
+                force = !skb_queue_empty(&tid->retry_q);
+                ieee80211_return_txq(hw, queue, force);
         }
 
 out:
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index fdc56f821b5a..eb6defb6d0cd 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -82,6 +82,7 @@
 #define IWL_22000_HR_A0_FW_PRE          "iwlwifi-QuQnj-a0-hr-a0-"
 #define IWL_22000_SU_Z0_FW_PRE          "iwlwifi-su-z0-"
 #define IWL_QU_B_JF_B_FW_PRE            "iwlwifi-Qu-b0-jf-b0-"
+#define IWL_QUZ_A_HR_B_FW_PRE           "iwlwifi-QuZ-a0-hr-b0-"
 #define IWL_QNJ_B_JF_B_FW_PRE           "iwlwifi-QuQnj-b0-jf-b0-"
 #define IWL_CC_A_FW_PRE                 "iwlwifi-cc-a0-"
 #define IWL_22000_SO_A_JF_B_FW_PRE      "iwlwifi-so-a0-jf-b0-"
@@ -105,8 +106,8 @@
         IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
         IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
-#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
-        IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_QUZ_A_HR_B_MODULE_FIRMWARE(api) \
+        IWL_QUZ_A_HR_B_FW_PRE __stringify(api) ".ucode"
 #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
         IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
 #define IWL_QNJ_B_JF_B_MODULE_FIRMWARE(api)             \
@@ -235,8 +236,20 @@ const struct iwl_cfg iwl_ax101_cfg_qu_hr = {
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
 };
 
-const struct iwl_cfg iwl22260_2ax_cfg = {
-        .name = "Intel(R) Wireless-AX 22260",
+const struct iwl_cfg iwl_ax101_cfg_quz_hr = {
+        .name = "Intel(R) Wi-Fi 6 AX101",
+        .fw_name_pre = IWL_QUZ_A_HR_B_FW_PRE,
+        IWL_DEVICE_22500,
+        /*
+         * This device doesn't support receiving BlockAck with a large bitmap
+         * so we need to restrict the size of transmitted aggregation to the
+         * HT size; mac80211 would otherwise pick the HE max (256) by default.
+         */
+        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl_ax200_cfg_cc = {
+        .name = "Intel(R) Wi-Fi 6 AX200 160MHz",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -249,7 +262,7 @@ const struct iwl_cfg iwl22260_2ax_cfg = {
 };
 
 const struct iwl_cfg killer1650x_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (200NGW)",
+        .name = "Killer(R) Wi-Fi 6 AX1650x 160MHz Wireless Network Adapter (200NGW)",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -262,7 +275,7 @@ const struct iwl_cfg killer1650x_2ax_cfg = {
 };
 
 const struct iwl_cfg killer1650w_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (200D2W)",
+        .name = "Killer(R) Wi-Fi 6 AX1650w 160MHz Wireless Network Adapter (200D2W)",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -328,7 +341,7 @@ const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0 = {
 };
 
 const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0 = {
-        .name = "Killer(R) Wireless-AX 1650i Wireless Network Adapter (22560NGW)",
+        .name = "Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW)",
         .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -340,7 +353,7 @@ const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0 = {
 };
 
 const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0 = {
-        .name = "Killer(R) Wireless-AX 1650s Wireless Network Adapter (22560D2W)",
+        .name = "Killer(R) Wi-Fi 6 AX1650s 160MHz Wireless Network Adapter (201D2W)",
         .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -444,6 +457,7 @@ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_QUZ_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_QNJ_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_SO_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index f119c49cd39c..d7380016f1c0 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -1614,6 +1614,7 @@ iwl_dump_ini_mem(struct iwl_fw_runtime *fwrt,
         if (!range) {
                 IWL_ERR(fwrt, "Failed to fill region header: id=%d, type=%d\n",
                         le32_to_cpu(reg->region_id), type);
+                memset(*data, 0, le32_to_cpu((*data)->len));
                 return;
         }
 
@@ -1623,6 +1624,7 @@ iwl_dump_ini_mem(struct iwl_fw_runtime *fwrt,
                 if (range_size < 0) {
                         IWL_ERR(fwrt, "Failed to dump region: id=%d, type=%d\n",
                                 le32_to_cpu(reg->region_id), type);
+                        memset(*data, 0, le32_to_cpu((*data)->len));
                         return;
                 }
                 range = range + range_size;
@@ -1807,12 +1809,12 @@ _iwl_fw_error_ini_dump(struct iwl_fw_runtime *fwrt,
 
         trigger = fwrt->dump.active_trigs[id].trig;
 
-        size = sizeof(*dump_file);
-        size += iwl_fw_ini_get_trigger_len(fwrt, trigger);
-
+        size = iwl_fw_ini_get_trigger_len(fwrt, trigger);
         if (!size)
                 return NULL;
 
+        size += sizeof(*dump_file);
+
         dump_file = vzalloc(size);
         if (!dump_file)
                 return NULL;
@@ -1942,14 +1944,10 @@ int iwl_fw_dbg_error_collect(struct iwl_fw_runtime *fwrt,
         iwl_dump_error_desc->len = 0;
 
         ret = iwl_fw_dbg_collect_desc(fwrt, iwl_dump_error_desc, false, 0);
-        if (ret) {
+        if (ret)
                 kfree(iwl_dump_error_desc);
-        } else {
-                set_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
-
-                /* trigger nmi to halt the fw */
-                iwl_force_nmi(fwrt->trans);
-        }
+        else
+                iwl_trans_sync_nmi(fwrt->trans);
 
         return ret;
 }
@@ -2489,22 +2487,6 @@ IWL_EXPORT_SYMBOL(iwl_fw_dbg_apply_point);
 
 void iwl_fwrt_stop_device(struct iwl_fw_runtime *fwrt)
 {
-        /* if the wait event timeout elapses instead of wake up then
-         * the driver did not receive NMI interrupt and can not assume the FW
-         * is halted
-         */
-        int ret = wait_event_timeout(fwrt->trans->fw_halt_waitq,
-                                     !test_bit(STATUS_FW_WAIT_DUMP,
-                                               &fwrt->trans->status),
-                                     msecs_to_jiffies(2000));
-        if (!ret) {
-                /* failed to receive NMI interrupt, assuming the FW is stuck */
-                set_bit(STATUS_FW_ERROR, &fwrt->trans->status);
-
-                clear_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
-        }
-
-        /* Assuming the op mode mutex is held at this point */
         iwl_fw_dbg_collect_sync(fwrt);
 
         iwl_trans_stop_device(fwrt->trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/init.c b/drivers/net/wireless/intel/iwlwifi/fw/init.c
index 7adf4e4e841a..12310e3d2fc5 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -76,7 +76,6 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
         fwrt->ops_ctx = ops_ctx;
         INIT_DELAYED_WORK(&fwrt->dump.wk, iwl_fw_error_dump_wk);
         iwl_fwrt_dbgfs_register(fwrt, dbgfs_dir);
-        init_waitqueue_head(&fwrt->trans->fw_halt_waitq);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index f5f87773667b..93070848280a 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -549,8 +549,9 @@ extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
 extern const struct iwl_cfg iwl_ax101_cfg_qu_hr;
+extern const struct iwl_cfg iwl_ax101_cfg_quz_hr;
 extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
-extern const struct iwl_cfg iwl22260_2ax_cfg;
+extern const struct iwl_cfg iwl_ax200_cfg_cc;
 extern const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0;
 extern const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0;
 extern const struct iwl_cfg killer1650x_2ax_cfg;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index aea6d03e545a..e539bc94eff7 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -327,6 +327,7 @@ enum {
 #define CSR_HW_REV_TYPE_NONE            (0x00001F0)
 #define CSR_HW_REV_TYPE_QNJ             (0x0000360)
 #define CSR_HW_REV_TYPE_QNJ_B0          (0x0000364)
+#define CSR_HW_REV_TYPE_QUZ             (0x0000354)
 #define CSR_HW_REV_TYPE_HR_CDB          (0x0000340)
 #define CSR_HW_REV_TYPE_SO              (0x0000370)
 #define CSR_HW_REV_TYPE_TY              (0x0000420)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index bbebbf3efd57..d8690acee40c 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -338,7 +338,6 @@ enum iwl_d3_status {
  *      are sent
  * @STATUS_TRANS_IDLE: the trans is idle - general commands are not to be sent
  * @STATUS_TRANS_DEAD: trans is dead - avoid any read/write operation
- * @STATUS_FW_WAIT_DUMP: if set, wait until cleared before collecting dump
  */
 enum iwl_trans_status {
         STATUS_SYNC_HCMD_ACTIVE,
@@ -351,7 +350,6 @@ enum iwl_trans_status {
         STATUS_TRANS_GOING_IDLE,
         STATUS_TRANS_IDLE,
         STATUS_TRANS_DEAD,
-        STATUS_FW_WAIT_DUMP,
 };
 
 static inline int
@@ -618,6 +616,7 @@ struct iwl_trans_ops {
         struct iwl_trans_dump_data *(*dump_data)(struct iwl_trans *trans,
                                                  u32 dump_mask);
         void (*debugfs_cleanup)(struct iwl_trans *trans);
+        void (*sync_nmi)(struct iwl_trans *trans);
 };
 
 /**
@@ -831,7 +830,6 @@ struct iwl_trans {
         u32 lmac_error_event_table[2];
         u32 umac_error_event_table;
         unsigned int error_event_table_tlv_status;
-        wait_queue_head_t fw_halt_waitq;
 
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
@@ -1239,10 +1237,12 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans)
         /* prevent double restarts due to the same erroneous FW */
         if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status))
                 iwl_op_mode_nic_error(trans->op_mode);
+}
 
-        if (test_and_clear_bit(STATUS_FW_WAIT_DUMP, &trans->status))
-                wake_up(&trans->fw_halt_waitq);
-
+static inline void iwl_trans_sync_nmi(struct iwl_trans *trans)
+{
+        if (trans->ops->sync_nmi)
+                trans->ops->sync_nmi(trans);
 }
 
 /*****************************************************
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 3a92c09d4692..6a3b11dd2edf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2714,9 +2714,6 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
 
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
-        kfree(mvmvif->ap_wep_key);
-        mvmvif->ap_wep_key = NULL;
-
         mutex_unlock(&mvm->mutex);
 }
 
@@ -3183,24 +3180,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 ret = iwl_mvm_update_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
-                /* if wep is used, need to set the key for the station now */
-                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
-                        mvm_sta->wep_key =
-                                kmemdup(mvmvif->ap_wep_key,
-                                        sizeof(*mvmvif->ap_wep_key) +
-                                        mvmvif->ap_wep_key->keylen,
-                                        GFP_KERNEL);
-                        if (!mvm_sta->wep_key) {
-                                ret = -ENOMEM;
-                                goto out_unlock;
-                        }
-
-                        ret = iwl_mvm_set_sta_key(mvm, vif, sta,
-                                                  mvm_sta->wep_key,
-                                                  STA_KEY_IDX_INVALID);
-                } else {
-                        ret = 0;
-                }
+                ret = 0;
 
                 /* we don't support TDLS during DCM */
                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
@@ -3242,17 +3222,6 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                                    NL80211_TDLS_DISABLE_LINK);
                 }
 
-                /* Remove STA key if this is an AP using WEP */
-                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
-                        int rm_ret = iwl_mvm_remove_sta_key(mvm, vif, sta,
-                                                            mvm_sta->wep_key);
-
-                        if (!ret)
-                                ret = rm_ret;
-                        kfree(mvm_sta->wep_key);
-                        mvm_sta->wep_key = NULL;
-                }
-
                 if (unlikely(ret &&
                              test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
                                       &mvm->status)))
@@ -3289,6 +3258,13 @@ static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
                                   struct ieee80211_sta *sta, u32 changed)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (changed & (IEEE80211_RC_BW_CHANGED |
+                       IEEE80211_RC_SUPP_RATES_CHANGED |
+                       IEEE80211_RC_NSS_CHANGED))
+                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
+                                     true);
 
         if (vif->type == NL80211_IFTYPE_STATION &&
             changed & IEEE80211_RC_NSS_CHANGED)
@@ -3439,20 +3415,12 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                 break;
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
-                if (vif->type == NL80211_IFTYPE_AP) {
-                        struct iwl_mvm_vif *mvmvif =
-                                iwl_mvm_vif_from_mac80211(vif);
-
-                        mvmvif->ap_wep_key = kmemdup(key,
-                                                     sizeof(*key) + key->keylen,
-                                                     GFP_KERNEL);
-                        if (!mvmvif->ap_wep_key)
-                                return -ENOMEM;
-                }
-
-                if (vif->type != NL80211_IFTYPE_STATION)
-                        return 0;
-                break;
+                if (vif->type == NL80211_IFTYPE_STATION)
+                        break;
+                if (iwl_mvm_has_new_tx_api(mvm))
+                        return -EOPNOTSUPP;
+                /* support HW crypto on TX */
+                return 0;
         default:
                 /* currently FW supports only one optional cipher scheme */
                 if (hw->n_cipher_schemes &&
@@ -3540,12 +3508,17 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
                 if (ret) {
                         IWL_WARN(mvm, "set key failed\n");
+                        key->hw_key_idx = STA_KEY_IDX_INVALID;
                         /*
                          * can't add key for RX, but we don't need it
-                         * in the device for TX so still return 0
+                         * in the device for TX so still return 0,
+                         * unless we have new TX API where we cannot
+                         * put key material into the TX_CMD
                          */
-                        key->hw_key_idx = STA_KEY_IDX_INVALID;
-                        ret = 0;
+                        if (iwl_mvm_has_new_tx_api(mvm))
+                                ret = -EOPNOTSUPP;
+                        else
+                                ret = 0;
                 }
 
                 break;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index bca6f6b536d9..a50dc53df086 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -498,7 +498,6 @@ struct iwl_mvm_vif {
         netdev_features_t features;
 
         struct iwl_probe_resp_data __rcu *probe_resp_data;
-        struct ieee80211_key_conf *ap_wep_key;
 };
 
 static inline struct iwl_mvm_vif *
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 498c315291cf..98d123dd7177 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1399,7 +1399,9 @@ void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk)
 
                 iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, tid);
                 list_del_init(&mvmtxq->list);
+                local_bh_disable();
                 iwl_mvm_mac_itxq_xmit(mvm->hw, txq);
+                local_bh_enable();
         }
 
         mutex_unlock(&mvm->mutex);
@@ -2333,21 +2335,6 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 iwl_mvm_enable_txq(mvm, NULL, mvmvif->cab_queue, 0, &cfg,
                                    timeout);
 
-        if (mvmvif->ap_wep_key) {
-                u8 key_offset = iwl_mvm_set_fw_key_idx(mvm);
-
-                __set_bit(key_offset, mvm->fw_key_table);
-
-                if (key_offset == STA_KEY_IDX_INVALID)
-                        return -ENOSPC;
-
-                ret = iwl_mvm_send_sta_key(mvm, mvmvif->mcast_sta.sta_id,
-                                           mvmvif->ap_wep_key, true, 0, NULL, 0,
-                                           key_offset, 0);
-                if (ret)
-                        return ret;
-        }
-
         return 0;
 }
 
@@ -2419,28 +2406,6 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0);
 
-        if (mvmvif->ap_wep_key) {
-                int i;
-
-                if (!__test_and_clear_bit(mvmvif->ap_wep_key->hw_key_idx,
-                                          mvm->fw_key_table)) {
-                        IWL_ERR(mvm, "offset %d not used in fw key table.\n",
-                                mvmvif->ap_wep_key->hw_key_idx);
-                        return -ENOENT;
-                }
-
-                /* track which key was deleted last */
-                for (i = 0; i < STA_KEY_MAX_NUM; i++) {
-                        if (mvm->fw_key_deleted[i] < U8_MAX)
-                                mvm->fw_key_deleted[i]++;
-                }
-                mvm->fw_key_deleted[mvmvif->ap_wep_key->hw_key_idx] = 0;
-                ret = __iwl_mvm_remove_sta_key(mvm, mvmvif->mcast_sta.sta_id,
-                                               mvmvif->ap_wep_key, true);
-                if (ret)
-                        return ret;
-        }
-
         ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
         if (ret)
                 IWL_WARN(mvm, "Failed sending remove station\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 79700c7310a1..b4d4071b865d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -394,7 +394,6 @@ struct iwl_mvm_rxq_dup_data {
  *      the BA window. To be used for UAPSD only.
  * @ptk_pn: per-queue PTK PN data structures
  * @dup_data: per queue duplicate packet detection data
- * @wep_key: used in AP mode. Is a duplicate of the WEP key.
  * @deferred_traffic_tid_map: indication bitmap of deferred traffic per-TID
  * @tx_ant: the index of the antenna to use for data tx to this station. Only
  *      used during connection establishment (e.g. for the 4 way handshake
@@ -426,8 +425,6 @@ struct iwl_mvm_sta {
         struct iwl_mvm_key_pn __rcu *ptk_pn[4];
         struct iwl_mvm_rxq_dup_data *dup_data;
 
-        struct ieee80211_key_conf *wep_key;
-
         u8 reserved_queue;
 
         /* Temporary, until the new TLC will control the Tx protection */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 2b94e4cef56c..9f1af8da9dc1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -953,14 +953,15 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0xA0F0, 0x4070, iwl_ax101_cfg_qu_hr)},
 
-        {IWL_PCI_DEVICE(0x2723, 0x0080, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x0084, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x0088, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x008C, iwl22260_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x0080, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x0084, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x0088, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x008C, iwl_ax200_cfg_cc)},
         {IWL_PCI_DEVICE(0x2723, 0x1653, killer1650w_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x1654, killer1650x_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x4080, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x4088, iwl22260_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x2080, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x4080, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x4088, iwl_ax200_cfg_cc)},
 
         {IWL_PCI_DEVICE(0x1a56, 0x1653, killer1650w_2ax_cfg)},
         {IWL_PCI_DEVICE(0x1a56, 0x1654, killer1650x_2ax_cfg)},
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index bf8b61a476c5..59213164f35e 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -1043,7 +1043,7 @@ static inline bool iwl_pcie_dbg_on(struct iwl_trans *trans)
 
 void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state);
 void iwl_trans_pcie_dump_regs(struct iwl_trans *trans);
-void iwl_trans_sync_nmi(struct iwl_trans *trans);
+void iwl_trans_pcie_sync_nmi(struct iwl_trans *trans);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index fe8269d023de..79c1dc05f948 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3318,7 +3318,8 @@ static void iwl_trans_pcie_resume(struct iwl_trans *trans)
         .unref = iwl_trans_pcie_unref,                                  \
         .dump_data = iwl_trans_pcie_dump_data,                          \
         .d3_suspend = iwl_trans_pcie_d3_suspend,                        \
-        .d3_resume = iwl_trans_pcie_d3_resume
+        .d3_resume = iwl_trans_pcie_d3_resume,                          \
+        .sync_nmi = iwl_trans_pcie_sync_nmi
 
 #ifdef CONFIG_PM_SLEEP
 #define IWL_TRANS_PM_OPS                                                \
@@ -3542,6 +3543,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 }
         } else if (cfg == &iwl_ax101_cfg_qu_hr) {
                 if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+                    CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
+                    trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0) {
+                        trans->cfg = &iwl22000_2ax_cfg_qnj_hr_b0;
+                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                     CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
                         trans->cfg = &iwl_ax101_cfg_qu_hr;
                 } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
@@ -3560,7 +3565,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 }
         } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                    CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
-                   (trans->cfg != &iwl22260_2ax_cfg ||
+                   (trans->cfg != &iwl_ax200_cfg_cc ||
                     trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
                 u32 hw_status;
 
@@ -3637,7 +3642,7 @@ out_no_pci:
         return ERR_PTR(ret);
 }
 
-void iwl_trans_sync_nmi(struct iwl_trans *trans)
+void iwl_trans_pcie_sync_nmi(struct iwl_trans *trans)
 {
         unsigned long timeout = jiffies + IWL_TRANS_NMI_TIMEOUT;
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 88530d9f4a54..38d110338987 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -965,7 +965,7 @@ static int iwl_pcie_gen2_send_hcmd_sync(struct iwl_trans *trans,
                                cmd_str);
                 ret = -ETIMEDOUT;
 
-                iwl_trans_sync_nmi(trans);
+                iwl_trans_pcie_sync_nmi(trans);
                 goto cancel;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 9fbd37d23e85..7be73e2c4681 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -1960,7 +1960,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                iwl_get_cmd_string(trans, cmd->id));
                 ret = -ETIMEDOUT;
 
-                iwl_trans_sync_nmi(trans);
+                iwl_trans_pcie_sync_nmi(trans);
                 goto cancel;
         }
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 0838af04d681..524eb5805995 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2644,7 +2644,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
         enum nl80211_band band;
         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
         struct net *net;
-        int idx;
+        int idx, i;
         int n_limits = 0;
 
         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
@@ -2768,12 +2768,23 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                 goto failed_hw;
         }
 
+        data->if_combination.max_interfaces = 0;
+        for (i = 0; i < n_limits; i++)
+                data->if_combination.max_interfaces +=
+                        data->if_limits[i].max;
+
         data->if_combination.n_limits = n_limits;
-        data->if_combination.max_interfaces = 2048;
         data->if_combination.limits = data->if_limits;
 
-        hw->wiphy->iface_combinations = &data->if_combination;
-        hw->wiphy->n_iface_combinations = 1;
+        /*
+         * If we actually were asked to support combinations,
+         * advertise them - if there's only a single thing like
+         * only IBSS then don't advertise it as combinations.
+         */
+        if (data->if_combination.max_interfaces > 1) {
+                hw->wiphy->iface_combinations = &data->if_combination;
+                hw->wiphy->n_iface_combinations = 1;
+        }
 
         if (param->ciphers) {
                 memcpy(data->ciphers, param->ciphers,
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/init.c b/drivers/net/wireless/mediatek/mt76/mt7603/init.c
index d54dda67d036..3af45949e868 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/init.c
@@ -510,6 +510,8 @@ int mt7603_register_device(struct mt7603_dev *dev)
         bus_ops->rmw = mt7603_rmw;
         dev->mt76.bus = bus_ops;
 
+        spin_lock_init(&dev->ps_lock);
+
         INIT_DELAYED_WORK(&dev->mac_work, mt7603_mac_work);
         tasklet_init(&dev->pre_tbtt_tasklet, mt7603_pre_tbtt_tasklet,
                      (unsigned long)dev);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
index 5e31d7da96fc..5abc02b57818 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -343,7 +343,7 @@ void mt7603_mac_rx_ba_reset(struct mt7603_dev *dev, void *addr, u8 tid)
                  MT_BA_CONTROL_1_RESET));
 }
 
-void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid, int ssn,
+void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid,
                             int ba_size)
 {
         u32 addr = mt7603_wtbl2_addr(wcid);
@@ -358,43 +358,6 @@ void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid, int ssn,
                 mt76_clear(dev, addr + (15 * 4), tid_mask);
                 return;
         }
-        mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 0, 5000);
-
-        mt7603_mac_stop(dev);
-        switch (tid) {
-        case 0:
-                mt76_rmw_field(dev, addr + (2 * 4), MT_WTBL2_W2_TID0_SN, ssn);
-                break;
-        case 1:
-                mt76_rmw_field(dev, addr + (2 * 4), MT_WTBL2_W2_TID1_SN, ssn);
-                break;
-        case 2:
-                mt76_rmw_field(dev, addr + (2 * 4), MT_WTBL2_W2_TID2_SN_LO,
-                               ssn);
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID2_SN_HI,
-                               ssn >> 8);
-                break;
-        case 3:
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID3_SN, ssn);
-                break;
-        case 4:
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID4_SN, ssn);
-                break;
-        case 5:
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID5_SN_LO,
-                               ssn);
-                mt76_rmw_field(dev, addr + (4 * 4), MT_WTBL2_W4_TID5_SN_HI,
-                               ssn >> 4);
-                break;
-        case 6:
-                mt76_rmw_field(dev, addr + (4 * 4), MT_WTBL2_W4_TID6_SN, ssn);
-                break;
-        case 7:
-                mt76_rmw_field(dev, addr + (4 * 4), MT_WTBL2_W4_TID7_SN, ssn);
-                break;
-        }
-        mt7603_wtbl_update(dev, wcid, MT_WTBL_UPDATE_WTBL2);
-        mt7603_mac_start(dev);
 
         for (i = 7; i > 0; i--) {
                 if (ba_size >= MT_AGG_SIZE_LIMIT(i))
@@ -827,6 +790,7 @@ mt7603_mac_write_txwi(struct mt7603_dev *dev, __le32 *txwi,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *rate = &info->control.rates[0];
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
         struct ieee80211_vif *vif = info->control.vif;
         struct mt7603_vif *mvif;
         int wlan_idx;
@@ -834,6 +798,7 @@ mt7603_mac_write_txwi(struct mt7603_dev *dev, __le32 *txwi,
         int tx_count = 8;
         u8 frame_type, frame_subtype;
         u16 fc = le16_to_cpu(hdr->frame_control);
+        u16 seqno = 0;
         u8 vif_idx = 0;
         u32 val;
         u8 bw;
@@ -919,7 +884,17 @@ mt7603_mac_write_txwi(struct mt7603_dev *dev, __le32 *txwi,
                 tx_count = 0x1f;
 
         val = FIELD_PREP(MT_TXD3_REM_TX_COUNT, tx_count) |
-              FIELD_PREP(MT_TXD3_SEQ, le16_to_cpu(hdr->seq_ctrl));
+                  MT_TXD3_SN_VALID;
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                seqno = le16_to_cpu(hdr->seq_ctrl);
+        else if (ieee80211_is_back_req(hdr->frame_control))
+                seqno = le16_to_cpu(bar->start_seq_num);
+        else
+                val &= ~MT_TXD3_SN_VALID;
+
+        val |= FIELD_PREP(MT_TXD3_SEQ, seqno >> 4);
+
         txwi[3] = cpu_to_le32(val);
 
         if (key) {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
index cc0fe0933b2d..a3c4ef198bfe 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
@@ -372,7 +372,7 @@ mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
         struct mt7603_sta *msta = (struct mt7603_sta *)sta->drv_priv;
         struct sk_buff_head list;
 
-        mt76_stop_tx_queues(&dev->mt76, sta, false);
+        mt76_stop_tx_queues(&dev->mt76, sta, true);
         mt7603_wtbl_set_ps(dev, msta, ps);
         if (ps)
                 return;
@@ -584,13 +584,13 @@ mt7603_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 mtxq->aggr = true;
                 mtxq->send_bar = false;
-                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, *ssn, ba_size);
+                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, ba_size);
                 break;
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 mtxq->aggr = false;
                 ieee80211_send_bar(vif, sta->addr, tid, mtxq->agg_ssn);
-                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, *ssn, -1);
+                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, -1);
                 break;
         case IEEE80211_AMPDU_TX_START:
                 mtxq->agg_ssn = *ssn << 4;
@@ -598,7 +598,7 @@ mt7603_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 break;
         case IEEE80211_AMPDU_TX_STOP_CONT:
                 mtxq->aggr = false;
-                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, *ssn, -1);
+                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, -1);
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         }
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
index 79f332429432..6049f3b7c8fe 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
@@ -200,7 +200,7 @@ void mt7603_beacon_set_timer(struct mt7603_dev *dev, int idx, int intval);
 int mt7603_mac_fill_rx(struct mt7603_dev *dev, struct sk_buff *skb);
 void mt7603_mac_add_txs(struct mt7603_dev *dev, void *data);
 void mt7603_mac_rx_ba_reset(struct mt7603_dev *dev, void *addr, u8 tid);
-void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid, int ssn,
+void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid,
                             int ba_size);
 
 void mt7603_pse_client_reset(struct mt7603_dev *dev);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 9ed231abe916..4fe5a83ca5a4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -466,7 +466,6 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
                 return;
 
         rcu_read_lock();
-        mt76_tx_status_lock(mdev, &list);
 
         if (stat->wcid < ARRAY_SIZE(dev->mt76.wcid))
                 wcid = rcu_dereference(dev->mt76.wcid[stat->wcid]);
@@ -479,6 +478,8 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
                                           drv_priv);
         }
 
+        mt76_tx_status_lock(mdev, &list);
+
         if (wcid) {
                 if (stat->pktid >= MT_PACKET_ID_FIRST)
                         status.skb = mt76_tx_status_skb_get(mdev, wcid,
@@ -498,7 +499,9 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
                 if (*update == 0 && stat_val == stat_cache &&
                     stat->wcid == msta->status.wcid && msta->n_frames < 32) {
                         msta->n_frames++;
-                        goto out;
+                        mt76_tx_status_unlock(mdev, &list);
+                        rcu_read_unlock();
+                        return;
                 }
 
                 mt76x02_mac_fill_tx_status(dev, status.info, &msta->status,
@@ -514,11 +517,10 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
 
         if (status.skb)
                 mt76_tx_status_skb_done(mdev, status.skb, &list);
-        else
-                ieee80211_tx_status_ext(mt76_hw(dev), &status);
-
-out:
         mt76_tx_status_unlock(mdev, &list);
+
+        if (!status.skb)
+                ieee80211_tx_status_ext(mt76_hw(dev), &status);
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
index 4b1744e9fb78..50b92ca92bd7 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
@@ -673,7 +673,6 @@ enum rt2x00_state_flags {
         CONFIG_CHANNEL_HT40,
         CONFIG_POWERSAVING,
         CONFIG_HT_DISABLED,
-        CONFIG_QOS_DISABLED,
         CONFIG_MONITORING,
 
         /*
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
index 2825560e2424..e8462f25d252 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
@@ -642,19 +642,9 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                         rt2x00dev->intf_associated--;
 
                 rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
-
-                clear_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
         }
 
         /*
-         * Check for access point which do not support 802.11e . We have to
-         * generate data frames sequence number in S/W for such AP, because
-         * of H/W bug.
-         */
-        if (changes & BSS_CHANGED_QOS && !bss_conf->qos)
-                set_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
-
-        /*
          * When the erp information has changed, we should perform
          * additional configuration steps. For all other changes we are done.
          */
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
index 92ddc19e7bf7..4834b4eb0206 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
@@ -201,15 +201,18 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
         if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
                 /*
                  * rt2800 has a H/W (or F/W) bug, device incorrectly increase
-                 * seqno on retransmited data (non-QOS) frames. To workaround
-                 * the problem let's generate seqno in software if QOS is
-                 * disabled.
+                 * seqno on retransmitted data (non-QOS) and management frames.
+                 * To workaround the problem let's generate seqno in software.
+                 * Except for beacons which are transmitted periodically by H/W
+                 * hence hardware has to assign seqno for them.
                  */
-                if (test_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags))
-                        __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
-                else
+                if (ieee80211_is_beacon(hdr->frame_control)) {
+                        __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
                         /* H/W will generate sequence number */
                         return;
+                }
+
+                __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
         }
 
         /*
diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
index 2b26f762fbc3..01acb6e53365 100644
--- a/drivers/nfc/st95hf/core.c
+++ b/drivers/nfc/st95hf/core.c
@@ -1074,6 +1074,12 @@ static const struct spi_device_id st95hf_id[] = {
 };
 MODULE_DEVICE_TABLE(spi, st95hf_id);
 
+static const struct of_device_id st95hf_spi_of_match[] = {
+        { .compatible = "st,st95hf" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, st95hf_spi_of_match);
+
 static int st95hf_probe(struct spi_device *nfc_spi_dev)
 {
         int ret;
@@ -1260,6 +1266,7 @@ static struct spi_driver st95hf_driver = {
         .driver = {
                 .name = "st95hf",
                 .owner = THIS_MODULE,
+                .of_match_table = of_match_ptr(st95hf_spi_of_match),
         },
         .id_table = st95hf_id,
         .probe = st95hf_probe,
diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
index b72a303176c7..9486acc08402 100644
--- a/drivers/nvdimm/btt_devs.c
+++ b/drivers/nvdimm/btt_devs.c
@@ -198,14 +198,15 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
                 return NULL;
 
         nd_btt->id = ida_simple_get(&nd_region->btt_ida, 0, 0, GFP_KERNEL);
-        if (nd_btt->id < 0) {
-                kfree(nd_btt);
-                return NULL;
-        }
+        if (nd_btt->id < 0)
+                goto out_nd_btt;
 
         nd_btt->lbasize = lbasize;
-        if (uuid)
+        if (uuid) {
                 uuid = kmemdup(uuid, 16, GFP_KERNEL);
+                if (!uuid)
+                        goto out_put_id;
+        }
         nd_btt->uuid = uuid;
         dev = &nd_btt->dev;
         dev_set_name(dev, "btt%d.%d", nd_region->id, nd_btt->id);
@@ -220,6 +221,13 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
                 return NULL;
         }
         return dev;
+
+out_put_id:
+        ida_simple_remove(&nd_region->btt_ida, nd_btt->id);
+
+out_nd_btt:
+        kfree(nd_btt);
+        return NULL;
 }
 
 struct device *nd_btt_create(struct nd_region *nd_region)
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 7849bf1812c4..f293556cbbf6 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -2249,9 +2249,12 @@ static struct device *create_namespace_blk(struct nd_region *nd_region,
         if (!nsblk->uuid)
                 goto blk_err;
         memcpy(name, nd_label->name, NSLABEL_NAME_LEN);
-        if (name[0])
+        if (name[0]) {
                 nsblk->alt_name = kmemdup(name, NSLABEL_NAME_LEN,
                                 GFP_KERNEL);
+                if (!nsblk->alt_name)
+                        goto blk_err;
+        }
         res = nsblk_add_resource(nd_region, ndd, nsblk,
                         __le64_to_cpu(nd_label->dpa));
         if (!res)
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index bc2f700feef8..0279eb1da3ef 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -113,13 +113,13 @@ static void write_pmem(void *pmem_addr, struct page *page,
 
         while (len) {
                 mem = kmap_atomic(page);
-                chunk = min_t(unsigned int, len, PAGE_SIZE);
+                chunk = min_t(unsigned int, len, PAGE_SIZE - off);
                 memcpy_flushcache(pmem_addr, mem + off, chunk);
                 kunmap_atomic(mem);
                 len -= chunk;
                 off = 0;
                 page++;
-                pmem_addr += PAGE_SIZE;
+                pmem_addr += chunk;
         }
 }
 
@@ -132,7 +132,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off,
 
         while (len) {
                 mem = kmap_atomic(page);
-                chunk = min_t(unsigned int, len, PAGE_SIZE);
+                chunk = min_t(unsigned int, len, PAGE_SIZE - off);
                 rem = memcpy_mcsafe(mem + off, pmem_addr, chunk);
                 kunmap_atomic(mem);
                 if (rem)
@@ -140,7 +140,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off,
                 len -= chunk;
                 off = 0;
                 page++;
-                pmem_addr += PAGE_SIZE;
+                pmem_addr += chunk;
         }
         return BLK_STS_OK;
 }
diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
index f8bb746a549f..a570f2263a42 100644
--- a/drivers/nvdimm/security.c
+++ b/drivers/nvdimm/security.c
@@ -22,6 +22,8 @@ static bool key_revalidate = true;
 module_param(key_revalidate, bool, 0444);
 MODULE_PARM_DESC(key_revalidate, "Require key validation at init.");
 
+static const char zero_key[NVDIMM_PASSPHRASE_LEN];
+
 static void *key_data(struct key *key)
 {
         struct encrypted_key_payload *epayload = dereference_key_locked(key);
@@ -75,6 +77,16 @@ static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
         return key;
 }
 
+static const void *nvdimm_get_key_payload(struct nvdimm *nvdimm,
+                struct key **key)
+{
+        *key = nvdimm_request_key(nvdimm);
+        if (!*key)
+                return zero_key;
+
+        return key_data(*key);
+}
+
 static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
                 key_serial_t id, int subclass)
 {
@@ -105,36 +117,57 @@ static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
         return key;
 }
 
-static struct key *nvdimm_key_revalidate(struct nvdimm *nvdimm)
+static const void *nvdimm_get_user_key_payload(struct nvdimm *nvdimm,
+                key_serial_t id, int subclass, struct key **key)
+{
+        *key = NULL;
+        if (id == 0) {
+                if (subclass == NVDIMM_BASE_KEY)
+                        return zero_key;
+                else
+                        return NULL;
+        }
+
+        *key = nvdimm_lookup_user_key(nvdimm, id, subclass);
+        if (!*key)
+                return NULL;
+
+        return key_data(*key);
+}
+
+
+static int nvdimm_key_revalidate(struct nvdimm *nvdimm)
 {
         struct key *key;
         int rc;
+        const void *data;
 
         if (!nvdimm->sec.ops->change_key)
-                return NULL;
+                return -EOPNOTSUPP;
 
-        key = nvdimm_request_key(nvdimm);
-        if (!key)
-                return NULL;
+        data = nvdimm_get_key_payload(nvdimm, &key);
 
         /*
          * Send the same key to the hardware as new and old key to
          * verify that the key is good.
          */
-        rc = nvdimm->sec.ops->change_key(nvdimm, key_data(key),
-                        key_data(key), NVDIMM_USER);
+        rc = nvdimm->sec.ops->change_key(nvdimm, data, data, NVDIMM_USER);
         if (rc < 0) {
                 nvdimm_put_key(key);
-                key = NULL;
+                return rc;
         }
-        return key;
+
+        nvdimm_put_key(key);
+        nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER);
+        return 0;
 }
 
 static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
 {
         struct device *dev = &nvdimm->dev;
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
-        struct key *key = NULL;
+        struct key *key;
+        const void *data;
         int rc;
 
         /* The bus lock should be held at the top level of the call stack */
@@ -160,16 +193,11 @@ static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
                 if (!key_revalidate)
                         return 0;
 
-                key = nvdimm_key_revalidate(nvdimm);
-                if (!key)
-                        return nvdimm_security_freeze(nvdimm);
+                return nvdimm_key_revalidate(nvdimm);
         } else
-                key = nvdimm_request_key(nvdimm);
+                data = nvdimm_get_key_payload(nvdimm, &key);
 
-        if (!key)
-                return -ENOKEY;
-
-        rc = nvdimm->sec.ops->unlock(nvdimm, key_data(key));
+        rc = nvdimm->sec.ops->unlock(nvdimm, data);
         dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key),
                         rc == 0 ? "success" : "fail");
 
@@ -195,6 +223,7 @@ int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid)
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
         struct key *key;
         int rc;
+        const void *data;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -214,11 +243,12 @@ int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid)
                 return -EBUSY;
         }
 
-        key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-        if (!key)
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
                 return -ENOKEY;
 
-        rc = nvdimm->sec.ops->disable(nvdimm, key_data(key));
+        rc = nvdimm->sec.ops->disable(nvdimm, data);
         dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
                         rc == 0 ? "success" : "fail");
 
@@ -235,6 +265,7 @@ int nvdimm_security_update(struct nvdimm *nvdimm, unsigned int keyid,
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
         struct key *key, *newkey;
         int rc;
+        const void *data, *newdata;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -249,22 +280,19 @@ int nvdimm_security_update(struct nvdimm *nvdimm, unsigned int keyid,
                 return -EIO;
         }
 
-        if (keyid == 0)
-                key = NULL;
-        else {
-                key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-                if (!key)
-                        return -ENOKEY;
-        }
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
+                return -ENOKEY;
 
-        newkey = nvdimm_lookup_user_key(nvdimm, new_keyid, NVDIMM_NEW_KEY);
-        if (!newkey) {
+        newdata = nvdimm_get_user_key_payload(nvdimm, new_keyid,
+                        NVDIMM_NEW_KEY, &newkey);
+        if (!newdata) {
                 nvdimm_put_key(key);
                 return -ENOKEY;
         }
 
-        rc = nvdimm->sec.ops->change_key(nvdimm, key ? key_data(key) : NULL,
-                        key_data(newkey), pass_type);
+        rc = nvdimm->sec.ops->change_key(nvdimm, data, newdata, pass_type);
         dev_dbg(dev, "key: %d %d update%s: %s\n",
                         key_serial(key), key_serial(newkey),
                         pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
@@ -286,8 +314,9 @@ int nvdimm_security_erase(struct nvdimm *nvdimm, unsigned int keyid,
 {
         struct device *dev = &nvdimm->dev;
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
-        struct key *key;
+        struct key *key = NULL;
         int rc;
+        const void *data;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -319,11 +348,12 @@ int nvdimm_security_erase(struct nvdimm *nvdimm, unsigned int keyid,
                 return -EOPNOTSUPP;
         }
 
-        key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-        if (!key)
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
                 return -ENOKEY;
 
-        rc = nvdimm->sec.ops->erase(nvdimm, key_data(key), pass_type);
+        rc = nvdimm->sec.ops->erase(nvdimm, data, pass_type);
         dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key),
                         pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
                         rc == 0 ? "success" : "fail");
@@ -337,8 +367,9 @@ int nvdimm_security_overwrite(struct nvdimm *nvdimm, unsigned int keyid)
 {
         struct device *dev = &nvdimm->dev;
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
-        struct key *key;
+        struct key *key = NULL;
         int rc;
+        const void *data;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -368,15 +399,12 @@ int nvdimm_security_overwrite(struct nvdimm *nvdimm, unsigned int keyid)
                 return -EBUSY;
         }
 
-        if (keyid == 0)
-                key = NULL;
-        else {
-                key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-                if (!key)
-                        return -ENOKEY;
-        }
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
+                return -ENOKEY;
 
-        rc = nvdimm->sec.ops->overwrite(nvdimm, key ? key_data(key) : NULL);
+        rc = nvdimm->sec.ops->overwrite(nvdimm, data);
         dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key),
                         rc == 0 ? "success" : "fail");
 
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 470601980794..2c43e12b70af 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -288,7 +288,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
                                 "Cancelling I/O %d", req->tag);
 
         nvme_req(req)->status = NVME_SC_ABORT_REQ;
-        blk_mq_complete_request(req);
+        blk_mq_complete_request_sync(req);
         return true;
 }
 EXPORT_SYMBOL_GPL(nvme_cancel_request);
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index f3b9d91ba0df..6d8451356eac 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1845,7 +1845,7 @@ nvme_fc_init_queue(struct nvme_fc_ctrl *ctrl, int idx)
         memset(queue, 0, sizeof(*queue));
         queue->ctrl = ctrl;
         queue->qnum = idx;
-        atomic_set(&queue->csn, 1);
+        atomic_set(&queue->csn, 0);
         queue->dev = ctrl->dev;
 
         if (idx > 0)
@@ -1887,7 +1887,7 @@ nvme_fc_free_queue(struct nvme_fc_queue *queue)
          */
 
         queue->connection_id = 0;
-        atomic_set(&queue->csn, 1);
+        atomic_set(&queue->csn, 0);
 }
 
 static void
@@ -2183,7 +2183,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
 {
         struct nvme_fc_cmd_iu *cmdiu = &op->cmd_iu;
         struct nvme_command *sqe = &cmdiu->sqe;
-        u32 csn;
         int ret, opstate;
 
         /*
@@ -2198,8 +2197,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
 
         /* format the FC-NVME CMD IU and fcp_req */
         cmdiu->connection_id = cpu_to_be64(queue->connection_id);
-        csn = atomic_inc_return(&queue->csn);
-        cmdiu->csn = cpu_to_be32(csn);
         cmdiu->data_len = cpu_to_be32(data_len);
         switch (io_dir) {
         case NVMEFC_FCP_WRITE:
@@ -2257,11 +2254,24 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
         if (!(op->flags & FCOP_FLAGS_AEN))
                 blk_mq_start_request(op->rq);
 
+        cmdiu->csn = cpu_to_be32(atomic_inc_return(&queue->csn));
         ret = ctrl->lport->ops->fcp_io(&ctrl->lport->localport,
                                         &ctrl->rport->remoteport,
                                         queue->lldd_handle, &op->fcp_req);
 
         if (ret) {
+                /*
+                 * If the lld fails to send the command is there an issue with
+                 * the csn value?  If the command that fails is the Connect,
+                 * no - as the connection won't be live.  If it is a command
+                 * post-connect, it's possible a gap in csn may be created.
+                 * Does this matter?  As Linux initiators don't send fused
+                 * commands, no.  The gap would exist, but as there's nothing
+                 * that depends on csn order to be delivered on the target
+                 * side, it shouldn't hurt.  It would be difficult for a
+                 * target to even detect the csn gap as it has no idea when the
+                 * cmd with the csn was supposed to arrive.
+                 */
                 opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
                 __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
 
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 76250181fee0..9f72d515fc4b 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -24,6 +24,11 @@ u32 nvmet_get_log_page_len(struct nvme_command *cmd)
         return len;
 }
 
+u64 nvmet_get_log_page_offset(struct nvme_command *cmd)
+{
+        return le64_to_cpu(cmd->get_log_page.lpo);
+}
+
 static void nvmet_execute_get_log_page_noop(struct nvmet_req *req)
 {
         nvmet_req_complete(req, nvmet_zero_sgl(req, 0, req->data_len));
diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c
index c872b47a88f3..33ed95e72d6b 100644
--- a/drivers/nvme/target/discovery.c
+++ b/drivers/nvme/target/discovery.c
@@ -131,54 +131,76 @@ static void nvmet_set_disc_traddr(struct nvmet_req *req, struct nvmet_port *port
                 memcpy(traddr, port->disc_addr.traddr, NVMF_TRADDR_SIZE);
 }
 
+static size_t discovery_log_entries(struct nvmet_req *req)
+{
+        struct nvmet_ctrl *ctrl = req->sq->ctrl;
+        struct nvmet_subsys_link *p;
+        struct nvmet_port *r;
+        size_t entries = 0;
+
+        list_for_each_entry(p, &req->port->subsystems, entry) {
+                if (!nvmet_host_allowed(p->subsys, ctrl->hostnqn))
+                        continue;
+                entries++;
+        }
+        list_for_each_entry(r, &req->port->referrals, entry)
+                entries++;
+        return entries;
+}
+
 static void nvmet_execute_get_disc_log_page(struct nvmet_req *req)
 {
         const int entry_size = sizeof(struct nvmf_disc_rsp_page_entry);
         struct nvmet_ctrl *ctrl = req->sq->ctrl;
         struct nvmf_disc_rsp_page_hdr *hdr;
+        u64 offset = nvmet_get_log_page_offset(req->cmd);
         size_t data_len = nvmet_get_log_page_len(req->cmd);
-        size_t alloc_len = max(data_len, sizeof(*hdr));
-        int residual_len = data_len - sizeof(*hdr);
+        size_t alloc_len;
         struct nvmet_subsys_link *p;
         struct nvmet_port *r;
         u32 numrec = 0;
         u16 status = 0;
+        void *buffer;
+
+        /* Spec requires dword aligned offsets */
+        if (offset & 0x3) {
+                status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+                goto out;
+        }
 
         /*
          * Make sure we're passing at least a buffer of response header size.
          * If host provided data len is less than the header size, only the
          * number of bytes requested by host will be sent to host.
          */
-        hdr = kzalloc(alloc_len, GFP_KERNEL);
-        if (!hdr) {
+        down_read(&nvmet_config_sem);
+        alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);
+        buffer = kzalloc(alloc_len, GFP_KERNEL);
+        if (!buffer) {
+                up_read(&nvmet_config_sem);
                 status = NVME_SC_INTERNAL;
                 goto out;
         }
 
-        down_read(&nvmet_config_sem);
+        hdr = buffer;
         list_for_each_entry(p, &req->port->subsystems, entry) {
+                char traddr[NVMF_TRADDR_SIZE];
+
                 if (!nvmet_host_allowed(p->subsys, ctrl->hostnqn))
                         continue;
-                if (residual_len >= entry_size) {
-                        char traddr[NVMF_TRADDR_SIZE];
-
-                        nvmet_set_disc_traddr(req, req->port, traddr);
-                        nvmet_format_discovery_entry(hdr, req->port,
-                                        p->subsys->subsysnqn, traddr,
-                                        NVME_NQN_NVME, numrec);
-                        residual_len -= entry_size;
-                }
+
+                nvmet_set_disc_traddr(req, req->port, traddr);
+                nvmet_format_discovery_entry(hdr, req->port,
+                                p->subsys->subsysnqn, traddr,
+                                NVME_NQN_NVME, numrec);
                 numrec++;
         }
 
         list_for_each_entry(r, &req->port->referrals, entry) {
-                if (residual_len >= entry_size) {
-                        nvmet_format_discovery_entry(hdr, r,
-                                        NVME_DISC_SUBSYS_NAME,
-                                        r->disc_addr.traddr,
-                                        NVME_NQN_DISC, numrec);
-                        residual_len -= entry_size;
-                }
+                nvmet_format_discovery_entry(hdr, r,
+                                NVME_DISC_SUBSYS_NAME,
+                                r->disc_addr.traddr,
+                                NVME_NQN_DISC, numrec);
                 numrec++;
         }
 
@@ -190,8 +212,8 @@ static void nvmet_execute_get_disc_log_page(struct nvmet_req *req)
 
         up_read(&nvmet_config_sem);
 
-        status = nvmet_copy_to_sgl(req, 0, hdr, data_len);
-        kfree(hdr);
+        status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);
+        kfree(buffer);
 out:
         nvmet_req_complete(req, status);
 }
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 51e49efd7849..1653d19b187f 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -428,6 +428,7 @@ u16 nvmet_copy_from_sgl(struct nvmet_req *req, off_t off, void *buf,
 u16 nvmet_zero_sgl(struct nvmet_req *req, off_t off, size_t len);
 
 u32 nvmet_get_log_page_len(struct nvme_command *cmd);
+u64 nvmet_get_log_page_offset(struct nvme_command *cmd);
 
 extern struct list_head *nvmet_ports;
 void nvmet_port_disc_changed(struct nvmet_port *port,
diff --git a/drivers/of/of_net.c b/drivers/of/of_net.c
index 810ab0fbcccb..d820f3edd431 100644
--- a/drivers/of/of_net.c
+++ b/drivers/of/of_net.c
@@ -7,7 +7,6 @@
  */
 #include <linux/etherdevice.h>
 #include <linux/kernel.h>
-#include <linux/nvmem-consumer.h>
 #include <linux/of_net.h>
 #include <linux/phy.h>
 #include <linux/export.h>
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 1be571c20062..6bad04cbb1d3 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -157,8 +157,12 @@
 #define DBG_IRT(x...)
 #endif
 
+#ifdef CONFIG_64BIT
+#define COMPARE_IRTE_ADDR(irte, hpa)    ((irte)->dest_iosapic_addr == (hpa))
+#else
 #define COMPARE_IRTE_ADDR(irte, hpa)    \
-                ((irte)->dest_iosapic_addr == F_EXTEND(hpa))
+                ((irte)->dest_iosapic_addr == ((hpa) | 0xffffffff00000000ULL))
+#endif
 
 #define IOSAPIC_REG_SELECT              0x00
 #define IOSAPIC_REG_WINDOW              0x10
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 3f3df4c29f6e..905282a8ddaa 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -115,6 +115,10 @@ static void remove_board(struct controller *ctrl, bool safe_removal)
                  * removed from the slot/adapter.
                  */
                 msleep(1000);
+
+                /* Ignore link or presence changes caused by power off */
+                atomic_and(~(PCI_EXP_SLTSTA_DLLSC | PCI_EXP_SLTSTA_PDC),
+                           &ctrl->pending_events);
         }
 
         /* turn off Green LED */
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index a59ad09ce911..a077f67fe1da 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3877,6 +3877,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
                          quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9170,
+                         quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c47 + c57 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9172,
                          quirk_dma_func1_alias);
diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
index 8f018b3f3cd4..c7039f52ad51 100644
--- a/drivers/platform/x86/pmc_atom.c
+++ b/drivers/platform/x86/pmc_atom.c
@@ -17,6 +17,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/platform_data/x86/clk-pmc-atom.h>
@@ -391,11 +392,27 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
 }
 #endif /* CONFIG_DEBUG_FS */
 
+/*
+ * Some systems need one or more of their pmc_plt_clks to be
+ * marked as critical.
+ */
+static const struct dmi_system_id critclk_systems[] = {
+        {
+                .ident = "MPL CEC1x",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MPL AG"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CEC10 Family"),
+                },
+        },
+        { /*sentinel*/ }
+};
+
 static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
                           const struct pmc_data *pmc_data)
 {
         struct platform_device *clkdev;
         struct pmc_clk_data *clk_data;
+        const struct dmi_system_id *d = dmi_first_match(critclk_systems);
 
         clk_data = kzalloc(sizeof(*clk_data), GFP_KERNEL);
         if (!clk_data)
@@ -403,6 +420,10 @@ static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
 
         clk_data->base = pmc_regmap; /* offset is added by client */
         clk_data->clks = pmc_data->clks;
+        if (d) {
+                clk_data->critical = true;
+                pr_info("%s critclks quirk enabled\n", d->ident);
+        }
 
         clkdev = platform_device_register_data(&pdev->dev, "clk-pmc-atom",
                                                PLATFORM_DEVID_NONE,
diff --git a/drivers/power/supply/goldfish_battery.c b/drivers/power/supply/goldfish_battery.c
index ad969d9fc981..c2644a9fe80f 100644
--- a/drivers/power/supply/goldfish_battery.c
+++ b/drivers/power/supply/goldfish_battery.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Power supply driver for the goldfish emulator
  *
diff --git a/drivers/reset/reset-meson-audio-arb.c b/drivers/reset/reset-meson-audio-arb.c
index 91751617b37a..c53a2185a039 100644
--- a/drivers/reset/reset-meson-audio-arb.c
+++ b/drivers/reset/reset-meson-audio-arb.c
@@ -130,6 +130,7 @@ static int meson_audio_arb_probe(struct platform_device *pdev)
         arb->rstc.nr_resets = ARRAY_SIZE(axg_audio_arb_reset_bits);
         arb->rstc.ops = &meson_audio_arb_rstc_ops;
         arb->rstc.of_node = dev->of_node;
+        arb->rstc.owner = THIS_MODULE;
 
         /*
          * Enable general :
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index a71734c41693..f933c06bff4f 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -667,9 +667,9 @@ config RTC_DRV_S5M
           will be called rtc-s5m.
 
 config RTC_DRV_SD3078
-    tristate "ZXW Crystal SD3078"
+    tristate "ZXW Shenzhen whwave SD3078"
     help
-      If you say yes here you get support for the ZXW Crystal
+      If you say yes here you get support for the ZXW Shenzhen whwave
       SD3078 RTC chips.
 
       This driver can also be built as a module. If so, the module
diff --git a/drivers/rtc/rtc-cros-ec.c b/drivers/rtc/rtc-cros-ec.c
index e5444296075e..4d6bf9304ceb 100644
--- a/drivers/rtc/rtc-cros-ec.c
+++ b/drivers/rtc/rtc-cros-ec.c
@@ -298,7 +298,7 @@ static int cros_ec_rtc_suspend(struct device *dev)
         struct cros_ec_rtc *cros_ec_rtc = dev_get_drvdata(&pdev->dev);
 
         if (device_may_wakeup(dev))
-                enable_irq_wake(cros_ec_rtc->cros_ec->irq);
+                return enable_irq_wake(cros_ec_rtc->cros_ec->irq);
 
         return 0;
 }
@@ -309,7 +309,7 @@ static int cros_ec_rtc_resume(struct device *dev)
         struct cros_ec_rtc *cros_ec_rtc = dev_get_drvdata(&pdev->dev);
 
         if (device_may_wakeup(dev))
-                disable_irq_wake(cros_ec_rtc->cros_ec->irq);
+                return disable_irq_wake(cros_ec_rtc->cros_ec->irq);
 
         return 0;
 }
diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c
index b4e054c64bad..69b54e5556c0 100644
--- a/drivers/rtc/rtc-da9063.c
+++ b/drivers/rtc/rtc-da9063.c
@@ -480,6 +480,13 @@ static int da9063_rtc_probe(struct platform_device *pdev)
         da9063_data_to_tm(data, &rtc->alarm_time, rtc);
         rtc->rtc_sync = false;
 
+        /*
+         * TODO: some models have alarms on a minute boundary but still support
+         * real hardware interrupts. Add this once the core supports it.
+         */
+        if (config->rtc_data_start != RTC_SEC)
+                rtc->rtc_dev->uie_unsupported = 1;
+
         irq_alarm = platform_get_irq_byname(pdev, "ALARM");
         ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL,
                                         da9063_alarm_event,
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index d417b203cbc5..1d3de2a3d1a4 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -374,7 +374,7 @@ static int sh_rtc_set_time(struct device *dev, struct rtc_time *tm)
 static inline int sh_rtc_read_alarm_value(struct sh_rtc *rtc, int reg_off)
 {
         unsigned int byte;
-        int value = 0xff;       /* return 0xff for ignored values */
+        int value = -1;                 /* return -1 for ignored values */
 
         byte = readb(rtc->regbase + reg_off);
         if (byte & AR_ENB) {
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 6e294b4d3635..f89f9d02e788 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2004,14 +2004,14 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
         blk_per_trk = recs_per_track(&private->rdc_data, 0, block->bp_block);
 
 raw:
-        block->blocks = (private->real_cyl *
+        block->blocks = ((unsigned long) private->real_cyl *
                           private->rdc_data.trk_per_cyl *
                           blk_per_trk);
 
         dev_info(&device->cdev->dev,
-                 "DASD with %d KB/block, %d KB total size, %d KB/track, "
+                 "DASD with %u KB/block, %lu KB total size, %u KB/track, "
                  "%s\n", (block->bp_block >> 10),
-                 ((private->real_cyl *
+                 (((unsigned long) private->real_cyl *
                    private->rdc_data.trk_per_cyl *
                    blk_per_trk * (block->bp_block >> 9)) >> 1),
                  ((blk_per_trk * block->bp_block) >> 10),
diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
index fd2146bcc0ad..e17364e13d2f 100644
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -629,7 +629,7 @@ con3270_init(void)
                      (void (*)(unsigned long)) con3270_read_tasklet,
                      (unsigned long) condev->read);
 
-        raw3270_add_view(&condev->view, &con3270_fn, 1);
+        raw3270_add_view(&condev->view, &con3270_fn, 1, RAW3270_VIEW_LOCK_IRQ);
 
         INIT_LIST_HEAD(&condev->freemem);
         for (i = 0; i < CON3270_STRING_PAGES; i++) {
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 8f3a2eeb28dc..8b48ba9c598e 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -463,7 +463,8 @@ fs3270_open(struct inode *inode, struct file *filp)
 
         init_waitqueue_head(&fp->wait);
         fp->fs_pid = get_pid(task_pid(current));
-        rc = raw3270_add_view(&fp->view, &fs3270_fn, minor);
+        rc = raw3270_add_view(&fp->view, &fs3270_fn, minor,
+                              RAW3270_VIEW_LOCK_BH);
         if (rc) {
                 fs3270_free_view(&fp->view);
                 goto out;
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index f8cd2935fbfd..63a41b168761 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -920,7 +920,7 @@ raw3270_deactivate_view(struct raw3270_view *view)
  * Add view to device with minor "minor".
  */
 int
-raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor)
+raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor, int subclass)
 {
         unsigned long flags;
         struct raw3270 *rp;
@@ -942,6 +942,7 @@ raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor)
                 view->cols = rp->cols;
                 view->ascebc = rp->ascebc;
                 spin_lock_init(&view->lock);
+                lockdep_set_subclass(&view->lock, subclass);
                 list_add(&view->list, &rp->view_list);
                 rc = 0;
                 spin_unlock_irqrestore(get_ccwdev_lock(rp->cdev), flags);
diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h
index 114ca7cbf889..3afaa35f7351 100644
--- a/drivers/s390/char/raw3270.h
+++ b/drivers/s390/char/raw3270.h
@@ -150,6 +150,8 @@ struct raw3270_fn {
 struct raw3270_view {
         struct list_head list;
         spinlock_t lock;
+#define RAW3270_VIEW_LOCK_IRQ   0
+#define RAW3270_VIEW_LOCK_BH    1
         atomic_t ref_count;
         struct raw3270 *dev;
         struct raw3270_fn *fn;
@@ -158,7 +160,7 @@ struct raw3270_view {
         unsigned char *ascebc;          /* ascii -> ebcdic table */
 };
 
-int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int);
+int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int, int);
 int raw3270_activate_view(struct raw3270_view *);
 void raw3270_del_view(struct raw3270_view *);
 void raw3270_deactivate_view(struct raw3270_view *);
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 2b0c36c2c568..98d7fc152e32 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -980,7 +980,8 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
                 return PTR_ERR(tp);
 
         rc = raw3270_add_view(&tp->view, &tty3270_fn,
-                              tty->index + RAW3270_FIRSTMINOR);
+                              tty->index + RAW3270_FIRSTMINOR,
+                              RAW3270_VIEW_LOCK_BH);
         if (rc) {
                 tty3270_free_view(tp);
                 return rc;
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 6a340f2c3556..5ea83dc4f1d7 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -751,8 +751,8 @@ void ap_queue_prepare_remove(struct ap_queue *aq)
         __ap_flush_queue(aq);
         /* set REMOVE state to prevent new messages are queued in */
         aq->state = AP_STATE_REMOVE;
-        del_timer_sync(&aq->timeout);
         spin_unlock_bh(&aq->lock);
+        del_timer_sync(&aq->timeout);
 }
 
 void ap_queue_remove(struct ap_queue *aq)
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 3e85d665c572..45eb0c14b880 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -51,7 +51,8 @@ static debug_info_t *debug_info;
 
 static void __init pkey_debug_init(void)
 {
-        debug_info = debug_register("pkey", 1, 1, 4 * sizeof(long));
+        /* 5 arguments per dbf entry (including the format string ptr) */
+        debug_info = debug_register("pkey", 1, 1, 5 * sizeof(long));
         debug_register_view(debug_info, &debug_sprintf_view);
         debug_set_level(debug_info, 3);
 }
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 7617d21cb296..f63c5c871d3d 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1595,6 +1595,7 @@ static int ctcm_new_device(struct ccwgroup_device *cgdev)
                 if (priv->channel[direction] == NULL) {
                         if (direction == CTCM_WRITE)
                                 channel_free(priv->channel[CTCM_READ]);
+                        result = -ENODEV;
                         goto out_dev;
                 }
                 priv->channel[direction]->netdev = dev;
diff --git a/drivers/scsi/aic7xxx/aic7770_osm.c b/drivers/scsi/aic7xxx/aic7770_osm.c
index 3d401d02c019..bdd177e3d762 100644
--- a/drivers/scsi/aic7xxx/aic7770_osm.c
+++ b/drivers/scsi/aic7xxx/aic7770_osm.c
@@ -91,6 +91,7 @@ aic7770_probe(struct device *dev)
         ahc = ahc_alloc(&aic7xxx_driver_template, name);
         if (ahc == NULL)
                 return (ENOMEM);
+        ahc->dev = dev;
         error = aic7770_config(ahc, aic7770_ident_table + edev->id.driver_data,
                                eisaBase);
         if (error != 0) {
diff --git a/drivers/scsi/aic7xxx/aic7xxx.h b/drivers/scsi/aic7xxx/aic7xxx.h
index 5614921b4041..88b90f9806c9 100644
--- a/drivers/scsi/aic7xxx/aic7xxx.h
+++ b/drivers/scsi/aic7xxx/aic7xxx.h
@@ -943,6 +943,7 @@ struct ahc_softc {
          * Platform specific device information.
          */
         ahc_dev_softc_t           dev_softc;
+        struct device             *dev;
 
         /*
          * Bus specific device information.
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index 3c9c17450bb3..d5c4a0d23706 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -860,8 +860,8 @@ int
 ahc_dmamem_alloc(struct ahc_softc *ahc, bus_dma_tag_t dmat, void** vaddr,
                  int flags, bus_dmamap_t *mapp)
 {
-        *vaddr = pci_alloc_consistent(ahc->dev_softc,
-                                      dmat->maxsize, mapp);
+        /* XXX: check if we really need the GFP_ATOMIC and unwind this mess! */
+        *vaddr = dma_alloc_coherent(ahc->dev, dmat->maxsize, mapp, GFP_ATOMIC);
         if (*vaddr == NULL)
                 return ENOMEM;
         return 0;
@@ -871,8 +871,7 @@ void
 ahc_dmamem_free(struct ahc_softc *ahc, bus_dma_tag_t dmat,
                 void* vaddr, bus_dmamap_t map)
 {
-        pci_free_consistent(ahc->dev_softc, dmat->maxsize,
-                            vaddr, map);
+        dma_free_coherent(ahc->dev, dmat->maxsize, vaddr, map);
 }
 
 int
@@ -1123,8 +1122,7 @@ ahc_linux_register_host(struct ahc_softc *ahc, struct scsi_host_template *templa
 
         host->transportt = ahc_linux_transport_template;
 
-        retval = scsi_add_host(host,
-                        (ahc->dev_softc ? &ahc->dev_softc->dev : NULL));
+        retval = scsi_add_host(host, ahc->dev);
         if (retval) {
                 printk(KERN_WARNING "aic7xxx: scsi_add_host failed\n");
                 scsi_host_put(host);
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
index 0fc14dac7070..717d8d1082ce 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
@@ -250,6 +250,7 @@ ahc_linux_pci_dev_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
         ahc->dev_softc = pci;
+        ahc->dev = &pci->dev;
         error = ahc_pci_config(ahc, entry);
         if (error != 0) {
                 ahc_free(ahc);
diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c
index 462560b2855e..469d0bc9f5fe 100644
--- a/drivers/scsi/csiostor/csio_scsi.c
+++ b/drivers/scsi/csiostor/csio_scsi.c
@@ -1713,8 +1713,11 @@ csio_scsi_err_handler(struct csio_hw *hw, struct csio_ioreq *req)
         }
 
 out:
-        if (req->nsge > 0)
+        if (req->nsge > 0) {
                 scsi_dma_unmap(cmnd);
+                if (req->dcopy && (host_status == DID_OK))
+                        host_status = csio_scsi_copy_to_sgl(hw, req);
+        }
 
         cmnd->result = (((host_status) << 16) | scsi_status);
         cmnd->scsi_done(cmnd);
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index dfba4921b265..5bf61431434b 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -2162,7 +2162,6 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp)
                 FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n",
                              fc_rport_state(rdata));
 
-                rdata->flags &= ~FC_RP_STARTED;
                 fc_rport_enter_delete(rdata, RPORT_EV_STOP);
                 mutex_unlock(&rdata->rp_mutex);
                 kref_put(&rdata->kref, fc_rport_destroy);
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index c98f264f1d83..a497b2c0cb79 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -3878,10 +3878,9 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
          * wake up the thread.
          */
         spin_lock(&lpfc_cmd->buf_lock);
-        if (unlikely(lpfc_cmd->cur_iocbq.iocb_flag & LPFC_DRIVER_ABORTED)) {
-                lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED;
-                if (lpfc_cmd->waitq)
-                        wake_up(lpfc_cmd->waitq);
+        lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED;
+        if (lpfc_cmd->waitq) {
+                wake_up(lpfc_cmd->waitq);
                 lpfc_cmd->waitq = NULL;
         }
         spin_unlock(&lpfc_cmd->buf_lock);
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index e74a62448ba4..e5db9a9954dc 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1392,10 +1392,8 @@ static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 
 static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        struct qedi_nvm_iscsi_image nvm_image;
-
         qedi->iscsi_image = dma_alloc_coherent(&qedi->pdev->dev,
-                                               sizeof(nvm_image),
+                                               sizeof(struct qedi_nvm_iscsi_image),
                                                &qedi->nvm_buf_dma, GFP_KERNEL);
         if (!qedi->iscsi_image) {
                 QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
@@ -2236,14 +2234,13 @@ static void qedi_boot_release(void *data)
 static int qedi_get_boot_info(struct qedi_ctx *qedi)
 {
         int ret = 1;
-        struct qedi_nvm_iscsi_image nvm_image;
 
         QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "Get NVM iSCSI CFG image\n");
         ret = qedi_ops->common->nvm_get_image(qedi->cdev,
                                               QED_NVM_IMAGE_ISCSI_CFG,
                                               (char *)qedi->iscsi_image,
-                                              sizeof(nvm_image));
+                                              sizeof(struct qedi_nvm_iscsi_image));
         if (ret)
                 QEDI_ERR(&qedi->dbg_ctx,
                          "Could not get NVM image. ret = %d\n", ret);
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index c4cbfd07b916..a08ff3bd6310 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -238,6 +238,7 @@ static struct {
         {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"LENOVO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
index 5a58cbf3a75d..c14006ac98f9 100644
--- a/drivers/scsi/scsi_dh.c
+++ b/drivers/scsi/scsi_dh.c
@@ -75,6 +75,7 @@ static const struct scsi_dh_blist scsi_dh_blist[] = {
         {"NETAPP", "INF-01-00",         "rdac", },
         {"LSI", "INF-01-00",            "rdac", },
         {"ENGENIO", "INF-01-00",        "rdac", },
+        {"LENOVO", "DE_Series",         "rdac", },
         {NULL, NULL,                    NULL },
 };
 
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 601b9f1de267..07dfc17d4824 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1706,8 +1706,12 @@ out_put_budget:
                         ret = BLK_STS_DEV_RESOURCE;
                 break;
         default:
+                if (unlikely(!scsi_device_online(sdev)))
+                        scsi_req(req)->result = DID_NO_CONNECT << 16;
+                else
+                        scsi_req(req)->result = DID_ERROR << 16;
                 /*
-                 * Make sure to release all allocated ressources when
+                 * Make sure to release all allocated resources when
                  * we hit an error, as we will never see this command
                  * again.
                  */
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 84380bae20f1..8472de1007ff 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -385,7 +385,7 @@ enum storvsc_request_type {
  * This is the end of Protocol specific defines.
  */
 
-static int storvsc_ringbuffer_size = (256 * PAGE_SIZE);
+static int storvsc_ringbuffer_size = (128 * 1024);
 static u32 max_outstanding_req_per_channel;
 
 static int storvsc_vcpus_per_sub_channel = 4;
@@ -668,13 +668,22 @@ static void  handle_multichannel_storage(struct hv_device *device, int max_chns)
 {
         struct device *dev = &device->device;
         struct storvsc_device *stor_device;
-        int num_cpus = num_online_cpus();
         int num_sc;
         struct storvsc_cmd_request *request;
         struct vstor_packet *vstor_packet;
         int ret, t;
 
-        num_sc = ((max_chns > num_cpus) ? num_cpus : max_chns);
+        /*
+         * If the number of CPUs is artificially restricted, such as
+         * with maxcpus=1 on the kernel boot line, Hyper-V could offer
+         * sub-channels >= the number of CPUs. These sub-channels
+         * should not be created. The primary channel is already created
+         * and assigned to one CPU, so check against # CPUs - 1.
+         */
+        num_sc = min((int)(num_online_cpus() - 1), max_chns);
+        if (!num_sc)
+                return;
+
         stor_device = get_out_stor_device(device);
         if (!stor_device)
                 return;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 8af01777d09c..f8cb7c23305b 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -793,6 +793,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
 
         /* We need to know how many queues before we allocate. */
         num_queues = virtscsi_config_get(vdev, num_queues) ? : 1;
+        num_queues = min_t(unsigned int, nr_cpu_ids, num_queues);
 
         num_targets = virtscsi_config_get(vdev, max_target) + 1;
 
diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
index 808ed92ed66f..1bb1cb651349 100644
--- a/drivers/staging/comedi/drivers/ni_usb6501.c
+++ b/drivers/staging/comedi/drivers/ni_usb6501.c
@@ -463,10 +463,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev)
 
         size = usb_endpoint_maxp(devpriv->ep_tx);
         devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
-        if (!devpriv->usb_tx_buf) {
-                kfree(devpriv->usb_rx_buf);
+        if (!devpriv->usb_tx_buf)
                 return -ENOMEM;
-        }
 
         return 0;
 }
@@ -518,6 +516,9 @@ static int ni6501_auto_attach(struct comedi_device *dev,
         if (!devpriv)
                 return -ENOMEM;
 
+        mutex_init(&devpriv->mut);
+        usb_set_intfdata(intf, devpriv);
+
         ret = ni6501_find_endpoints(dev);
         if (ret)
                 return ret;
@@ -526,9 +527,6 @@ static int ni6501_auto_attach(struct comedi_device *dev,
         if (ret)
                 return ret;
 
-        mutex_init(&devpriv->mut);
-        usb_set_intfdata(intf, devpriv);
-
         ret = comedi_alloc_subdevices(dev, 2);
         if (ret)
                 return ret;
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 6234b649d887..65dc6c51037e 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -682,10 +682,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
 
         size = usb_endpoint_maxp(devpriv->ep_tx);
         devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
-        if (!devpriv->usb_tx_buf) {
-                kfree(devpriv->usb_rx_buf);
+        if (!devpriv->usb_tx_buf)
                 return -ENOMEM;
-        }
 
         return 0;
 }
@@ -800,6 +798,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
 
         devpriv->model = board->model;
 
+        sema_init(&devpriv->limit_sem, 8);
+
         ret = vmk80xx_find_usb_endpoints(dev);
         if (ret)
                 return ret;
@@ -808,8 +808,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
         if (ret)
                 return ret;
 
-        sema_init(&devpriv->limit_sem, 8);
-
         usb_set_intfdata(intf, devpriv);
 
         if (devpriv->model == VMK8055_MODEL)
diff --git a/drivers/staging/erofs/data.c b/drivers/staging/erofs/data.c
index 526e0dbea5b5..81af768e7248 100644
--- a/drivers/staging/erofs/data.c
+++ b/drivers/staging/erofs/data.c
@@ -298,7 +298,7 @@ submit_bio_retry:
         *last_block = current_block;
 
         /* shift in advance in case of it followed by too many gaps */
-        if (unlikely(bio->bi_vcnt >= bio->bi_max_vecs)) {
+        if (bio->bi_iter.bi_size >= bio->bi_max_vecs * PAGE_SIZE) {
                 /* err should reassign to 0 after submitting */
                 err = 0;
                 goto submit_bio_out;
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index acdbc07fd259..2fc8bc22b57b 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -109,10 +109,10 @@
 #define AD7192_CH_AIN3          BIT(6) /* AIN3 - AINCOM */
 #define AD7192_CH_AIN4          BIT(7) /* AIN4 - AINCOM */
 
-#define AD7193_CH_AIN1P_AIN2M   0x000  /* AIN1(+) - AIN2(-) */
-#define AD7193_CH_AIN3P_AIN4M   0x001  /* AIN3(+) - AIN4(-) */
-#define AD7193_CH_AIN5P_AIN6M   0x002  /* AIN5(+) - AIN6(-) */
-#define AD7193_CH_AIN7P_AIN8M   0x004  /* AIN7(+) - AIN8(-) */
+#define AD7193_CH_AIN1P_AIN2M   0x001  /* AIN1(+) - AIN2(-) */
+#define AD7193_CH_AIN3P_AIN4M   0x002  /* AIN3(+) - AIN4(-) */
+#define AD7193_CH_AIN5P_AIN6M   0x004  /* AIN5(+) - AIN6(-) */
+#define AD7193_CH_AIN7P_AIN8M   0x008  /* AIN7(+) - AIN8(-) */
 #define AD7193_CH_TEMP          0x100 /* Temp senseor */
 #define AD7193_CH_AIN2P_AIN2M   0x200 /* AIN2(+) - AIN2(-) */
 #define AD7193_CH_AIN1          0x401 /* AIN1 - AINCOM */
diff --git a/drivers/staging/iio/meter/ade7854.c b/drivers/staging/iio/meter/ade7854.c
index 029c3bf42d4d..07774c000c5a 100644
--- a/drivers/staging/iio/meter/ade7854.c
+++ b/drivers/staging/iio/meter/ade7854.c
@@ -269,7 +269,7 @@ static IIO_DEV_ATTR_VPEAK(0644,
 static IIO_DEV_ATTR_IPEAK(0644,
                 ade7854_read_32bit,
                 ade7854_write_32bit,
-                ADE7854_VPEAK);
+                ADE7854_IPEAK);
 static IIO_DEV_ATTR_APHCAL(0644,
                 ade7854_read_16bit,
                 ade7854_write_16bit,
diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
index 18936cdb1083..956daf8c3bd2 100644
--- a/drivers/staging/most/core.c
+++ b/drivers/staging/most/core.c
@@ -1431,7 +1431,7 @@ int most_register_interface(struct most_interface *iface)
 
         INIT_LIST_HEAD(&iface->p->channel_list);
         iface->p->dev_id = id;
-        snprintf(iface->p->name, STRING_SIZE, "mdev%d", id);
+        strcpy(iface->p->name, iface->description);
         iface->dev.init_name = iface->p->name;
         iface->dev.bus = &mc.bus;
         iface->dev.parent = &mc.dev;
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 09a183dfc526..a31db15cd7c0 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1520,11 +1520,13 @@ static int __init sc16is7xx_init(void)
 #endif
         return ret;
 
+#ifdef CONFIG_SERIAL_SC16IS7XX_SPI
 err_spi:
+#endif
 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
         i2c_del_driver(&sc16is7xx_i2c_uart_driver);
-#endif
 err_i2c:
+#endif
         uart_unregister_driver(&sc16is7xx_uart);
         return ret;
 }
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 2d1c626312cd..3cd139752d3f 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -2512,14 +2512,16 @@ done:
                          * center of the last stop bit in sampling clocks.
                          */
                         int last_stop = bits * 2 - 1;
-                        int deviation = min_err * srr * last_stop / 2 / baud;
+                        int deviation = DIV_ROUND_CLOSEST(min_err * last_stop *
+                                                          (int)(srr + 1),
+                                                          2 * (int)baud);
 
                         if (abs(deviation) >= 2) {
                                 /* At least two sampling clocks off at the
                                  * last stop bit; we can increase the error
                                  * margin by shifting the sampling point.
                                  */
-                                int shift = min(-8, max(7, deviation / 2));
+                                int shift = clamp(deviation / 2, -8, 7);
 
                                 hssrr |= (shift << HSCIF_SRHP_SHIFT) &
                                          HSCIF_SRHP_MASK;
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index d34984aa646d..650c66886c80 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1520,7 +1520,8 @@ static void csi_J(struct vc_data *vc, int vpar)
                         return;
         }
         scr_memsetw(start, vc->vc_video_erase_char, 2 * count);
-        update_region(vc, (unsigned long) start, count);
+        if (con_should_update(vc))
+                do_update_region(vc, (unsigned long) start, count);
         vc->vc_need_wrap = 0;
 }
 
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index a25659b5a5d1..3fa20e95a6bb 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -1661,11 +1661,11 @@ static void __init vfio_pci_fill_ids(void)
                 rc = pci_add_dynid(&vfio_pci_driver, vendor, device,
                                    subvendor, subdevice, class, class_mask, 0);
                 if (rc)
-                        pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",
+                        pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
                                 vendor, device, subvendor, subdevice,
                                 class, class_mask, rc);
                 else
-                        pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",
+                        pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
                                 vendor, device, subvendor, subdevice,
                                 class, class_mask);
         }
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 8dbb270998f4..6b64e45a5269 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -1398,7 +1398,7 @@ unlock_exit:
         mutex_unlock(&container->lock);
 }
 
-const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {
+static const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {
         .name           = "iommu-vfio-powerpc",
         .owner          = THIS_MODULE,
         .open           = tce_iommu_open,
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 73652e21efec..d0f731c9920a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -58,12 +58,18 @@ module_param_named(disable_hugepages,
 MODULE_PARM_DESC(disable_hugepages,
                  "Disable VFIO IOMMU support for IOMMU hugepages.");
 
+static unsigned int dma_entry_limit __read_mostly = U16_MAX;
+module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);
+MODULE_PARM_DESC(dma_entry_limit,
+                 "Maximum number of user DMA mappings per container (65535).");
+
 struct vfio_iommu {
         struct list_head        domain_list;
         struct vfio_domain      *external_domain; /* domain for external user */
         struct mutex            lock;
         struct rb_root          dma_list;
         struct blocking_notifier_head notifier;
+        unsigned int            dma_avail;
         bool                    v2;
         bool                    nesting;
 };
@@ -836,6 +842,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
         vfio_unlink_dma(iommu, dma);
         put_task_struct(dma->task);
         kfree(dma);
+        iommu->dma_avail++;
 }
 
 static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
@@ -1081,12 +1088,18 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                 goto out_unlock;
         }
 
+        if (!iommu->dma_avail) {
+                ret = -ENOSPC;
+                goto out_unlock;
+        }
+
         dma = kzalloc(sizeof(*dma), GFP_KERNEL);
         if (!dma) {
                 ret = -ENOMEM;
                 goto out_unlock;
         }
 
+        iommu->dma_avail--;
         dma->iova = iova;
         dma->vaddr = vaddr;
         dma->prot = prot;
@@ -1583,6 +1596,7 @@ static void *vfio_iommu_type1_open(unsigned long arg)
 
         INIT_LIST_HEAD(&iommu->domain_list);
         iommu->dma_list = RB_ROOT;
+        iommu->dma_avail = dma_entry_limit;
         mutex_init(&iommu->lock);
         BLOCKING_INIT_NOTIFIER_HEAD(&iommu->notifier);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 5ace833de746..351af88231ad 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -911,8 +911,12 @@ static int vhost_new_umem_range(struct vhost_umem *umem,
                                 u64 start, u64 size, u64 end,
                                 u64 userspace_addr, int perm)
 {
-        struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC);
+        struct vhost_umem_node *tmp, *node;
 
+        if (!size)
+                return -EFAULT;
+
+        node = kmalloc(sizeof(*node), GFP_ATOMIC);
         if (!node)
                 return -ENOMEM;
 
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index d0584c040c60..7a0398bb84f7 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev)
         for (i = 0; i < vp_dev->msix_used_vectors; ++i)
                 free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
 
-        for (i = 0; i < vp_dev->msix_vectors; i++)
-                if (vp_dev->msix_affinity_masks[i])
-                        free_cpumask_var(vp_dev->msix_affinity_masks[i]);
+        if (vp_dev->msix_affinity_masks) {
+                for (i = 0; i < vp_dev->msix_vectors; i++)
+                        if (vp_dev->msix_affinity_masks[i])
+                                free_cpumask_var(vp_dev->msix_affinity_masks[i]);
+        }
 
         if (vp_dev->msix_enabled) {
                 /* Disable the vector used for configuration */
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 18846afb39da..5df92c308286 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -882,6 +882,8 @@ static struct virtqueue *vring_create_virtqueue_split(
                                           GFP_KERNEL|__GFP_NOWARN|__GFP_ZERO);
                 if (queue)
                         break;
+                if (!may_reduce_num)
+                        return NULL;
         }
 
         if (!num)
diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
index de01a6d0059d..a1c61e351d3f 100644
--- a/drivers/xen/privcmd-buf.c
+++ b/drivers/xen/privcmd-buf.c
@@ -140,8 +140,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
         if (!(vma->vm_flags & VM_SHARED))
                 return -EINVAL;
 
-        vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
-                           GFP_KERNEL);
+        vma_priv = kzalloc(struct_size(vma_priv, pages, count), GFP_KERNEL);
         if (!vma_priv)
                 return -ENOMEM;
 
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index c3e201025ef0..0782ff3c2273 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -622,9 +622,7 @@ static int xenbus_file_open(struct inode *inode, struct file *filp)
         if (xen_store_evtchn == 0)
                 return -ENOENT;
 
-        nonseekable_open(inode, filp);
-
-        filp->f_mode &= ~FMODE_ATOMIC_POS; /* cdev-style semantics */
+        stream_open(inode, filp);
 
         u = kzalloc(sizeof(*u), GFP_KERNEL);
         if (u == NULL)
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index 1c7955f5cdaf..128f2dbe256a 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -203,8 +203,7 @@ void afs_put_cb_interest(struct afs_net *net, struct afs_cb_interest *cbi)
  */
 void afs_init_callback_state(struct afs_server *server)
 {
-        if (!test_and_clear_bit(AFS_SERVER_FL_NEW, &server->flags))
-                server->cb_s_break++;
+        server->cb_s_break++;
 }
 
 /*
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 8ee5972893ed..2f8acb4c556d 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -34,7 +34,7 @@ static void SRXAFSCB_TellMeAboutYourself(struct work_struct *);
 static int afs_deliver_yfs_cb_callback(struct afs_call *);
 
 #define CM_NAME(name) \
-        const char afs_SRXCB##name##_name[] __tracepoint_string =       \
+        char afs_SRXCB##name##_name[] __tracepoint_string =     \
                 "CB." #name
 
 /*
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 1a4ce07fb406..9cedc3fc1b77 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -216,9 +216,7 @@ struct inode *afs_iget_pseudo_dir(struct super_block *sb, bool root)
         set_nlink(inode, 2);
         inode->i_uid            = GLOBAL_ROOT_UID;
         inode->i_gid            = GLOBAL_ROOT_GID;
-        inode->i_ctime.tv_sec   = get_seconds();
-        inode->i_ctime.tv_nsec  = 0;
-        inode->i_atime          = inode->i_mtime = inode->i_ctime;
+        inode->i_ctime = inode->i_atime = inode->i_mtime = current_time(inode);
         inode->i_blocks         = 0;
         inode_set_iversion_raw(inode, 0);
         inode->i_generation     = 0;
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index bb1f244b2b3a..3904ab0b9563 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -474,7 +474,6 @@ struct afs_server {
         time64_t                put_time;       /* Time at which last put */
         time64_t                update_at;      /* Time at which to next update the record */
         unsigned long           flags;
-#define AFS_SERVER_FL_NEW       0               /* New server, don't inc cb_s_break */
 #define AFS_SERVER_FL_NOT_READY 1               /* The record is not ready for use */
 #define AFS_SERVER_FL_NOT_FOUND 2               /* VL server says no such server */
 #define AFS_SERVER_FL_VL_FAIL   3               /* Failed to access VL server */
@@ -827,7 +826,7 @@ static inline struct afs_cb_interest *afs_get_cb_interest(struct afs_cb_interest
 
 static inline unsigned int afs_calc_vnode_cb_break(struct afs_vnode *vnode)
 {
-        return vnode->cb_break + vnode->cb_s_break + vnode->cb_v_break;
+        return vnode->cb_break + vnode->cb_v_break;
 }
 
 static inline bool afs_cb_is_broken(unsigned int cb_break,
@@ -835,7 +834,6 @@ static inline bool afs_cb_is_broken(unsigned int cb_break,
                                     const struct afs_cb_interest *cbi)
 {
         return !cbi || cb_break != (vnode->cb_break +
-                                    cbi->server->cb_s_break +
                                     vnode->volume->cb_v_break);
 }
 
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 2c588f9bbbda..15c7e82d80cb 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -572,13 +572,17 @@ static void afs_deliver_to_call(struct afs_call *call)
                 case -ENODATA:
                 case -EBADMSG:
                 case -EMSGSIZE:
-                default:
                         abort_code = RXGEN_CC_UNMARSHAL;
                         if (state != AFS_CALL_CL_AWAIT_REPLY)
                                 abort_code = RXGEN_SS_UNMARSHAL;
                         rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
                                                 abort_code, ret, "KUM");
                         goto local_abort;
+                default:
+                        abort_code = RX_USER_ABORT;
+                        rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+                                                abort_code, ret, "KER");
+                        goto local_abort;
                 }
         }
 
@@ -610,6 +614,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
         bool stalled = false;
         u64 rtt;
         u32 life, last_life;
+        bool rxrpc_complete = false;
 
         DECLARE_WAITQUEUE(myself, current);
 
@@ -621,7 +626,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
                 rtt2 = 2;
 
         timeout = rtt2;
-        last_life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
+        rxrpc_kernel_check_life(call->net->socket, call->rxcall, &last_life);
 
         add_wait_queue(&call->waitq, &myself);
         for (;;) {
@@ -639,7 +644,12 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
                 if (afs_check_call_state(call, AFS_CALL_COMPLETE))
                         break;
 
-                life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
+                if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall, &life)) {
+                        /* rxrpc terminated the call. */
+                        rxrpc_complete = true;
+                        break;
+                }
+
                 if (timeout == 0 &&
                     life == last_life && signal_pending(current)) {
                         if (stalled)
@@ -663,12 +673,16 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
         remove_wait_queue(&call->waitq, &myself);
         __set_current_state(TASK_RUNNING);
 
-        /* Kill off the call if it's still live. */
         if (!afs_check_call_state(call, AFS_CALL_COMPLETE)) {
-                _debug("call interrupted");
-                if (rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
-                                            RX_USER_ABORT, -EINTR, "KWI"))
-                        afs_set_call_complete(call, -EINTR, 0);
+                if (rxrpc_complete) {
+                        afs_set_call_complete(call, call->error, call->abort_code);
+                } else {
+                        /* Kill off the call if it's still live. */
+                        _debug("call interrupted");
+                        if (rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+                                                    RX_USER_ABORT, -EINTR, "KWI"))
+                                afs_set_call_complete(call, -EINTR, 0);
+                }
         }
 
         spin_lock_bh(&call->state_lock);
diff --git a/fs/afs/server.c b/fs/afs/server.c
index 642afa2e9783..65b33b6da48b 100644
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -226,7 +226,6 @@ static struct afs_server *afs_alloc_server(struct afs_net *net,
         RCU_INIT_POINTER(server->addresses, alist);
         server->addr_version = alist->version;
         server->uuid = *uuid;
-        server->flags = (1UL << AFS_SERVER_FL_NEW);
         server->update_at = ktime_get_real_seconds() + afs_server_update_delay;
         rwlock_init(&server->fs_lock);
         INIT_HLIST_HEAD(&server->cb_volumes);
diff --git a/fs/afs/write.c b/fs/afs/write.c
index 72efcfcf9f95..0122d7445fba 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -264,6 +264,7 @@ static void afs_kill_pages(struct address_space *mapping,
                                 first = page->index + 1;
                         lock_page(page);
                         generic_error_remove_page(mapping, page);
+                        unlock_page(page);
                 }
 
                 __pagevec_release(&pv);
diff --git a/fs/aio.c b/fs/aio.c
index 38b741aef0bf..3490d1fa0e16 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -181,7 +181,7 @@ struct poll_iocb {
         struct file             *file;
         struct wait_queue_head  *head;
         __poll_t                events;
-        bool                    woken;
+        bool                    done;
         bool                    cancelled;
         struct wait_queue_entry wait;
         struct work_struct      work;
@@ -204,8 +204,7 @@ struct aio_kiocb {
         struct kioctx           *ki_ctx;
         kiocb_cancel_fn         *ki_cancel;
 
-        struct iocb __user      *ki_user_iocb;  /* user's aiocb */
-        __u64                   ki_user_data;   /* user's data for completion */
+        struct io_event         ki_res;
 
         struct list_head        ki_list;        /* the aio core uses this
                                                  * for cancellation */
@@ -1022,6 +1021,9 @@ static bool get_reqs_available(struct kioctx *ctx)
 /* aio_get_req
  *      Allocate a slot for an aio request.
  * Returns NULL if no requests are free.
+ *
+ * The refcount is initialized to 2 - one for the async op completion,
+ * one for the synchronous code that does this.
  */
 static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
 {
@@ -1031,10 +1033,15 @@ static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
         if (unlikely(!req))
                 return NULL;
 
+        if (unlikely(!get_reqs_available(ctx))) {
+                kmem_cache_free(kiocb_cachep, req);
+                return NULL;
+        }
+
         percpu_ref_get(&ctx->reqs);
         req->ki_ctx = ctx;
         INIT_LIST_HEAD(&req->ki_list);
-        refcount_set(&req->ki_refcnt, 0);
+        refcount_set(&req->ki_refcnt, 2);
         req->ki_eventfd = NULL;
         return req;
 }
@@ -1067,30 +1074,20 @@ out:
         return ret;
 }
 
-static inline void iocb_put(struct aio_kiocb *iocb)
-{
-        if (refcount_read(&iocb->ki_refcnt) == 0 ||
-            refcount_dec_and_test(&iocb->ki_refcnt)) {
-                if (iocb->ki_filp)
-                        fput(iocb->ki_filp);
-                percpu_ref_put(&iocb->ki_ctx->reqs);
-                kmem_cache_free(kiocb_cachep, iocb);
-        }
-}
-
-static void aio_fill_event(struct io_event *ev, struct aio_kiocb *iocb,
-                           long res, long res2)
+static inline void iocb_destroy(struct aio_kiocb *iocb)
 {
-        ev->obj = (u64)(unsigned long)iocb->ki_user_iocb;
-        ev->data = iocb->ki_user_data;
-        ev->res = res;
-        ev->res2 = res2;
+        if (iocb->ki_eventfd)
+                eventfd_ctx_put(iocb->ki_eventfd);
+        if (iocb->ki_filp)
+                fput(iocb->ki_filp);
+        percpu_ref_put(&iocb->ki_ctx->reqs);
+        kmem_cache_free(kiocb_cachep, iocb);
 }
 
 /* aio_complete
  *      Called when the io request on the given iocb is complete.
  */
-static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
+static void aio_complete(struct aio_kiocb *iocb)
 {
         struct kioctx   *ctx = iocb->ki_ctx;
         struct aio_ring *ring;
@@ -1114,14 +1111,14 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
         ev_page = kmap_atomic(ctx->ring_pages[pos / AIO_EVENTS_PER_PAGE]);
         event = ev_page + pos % AIO_EVENTS_PER_PAGE;
 
-        aio_fill_event(event, iocb, res, res2);
+        *event = iocb->ki_res;
 
         kunmap_atomic(ev_page);
         flush_dcache_page(ctx->ring_pages[pos / AIO_EVENTS_PER_PAGE]);
 
-        pr_debug("%p[%u]: %p: %p %Lx %lx %lx\n",
-                 ctx, tail, iocb, iocb->ki_user_iocb, iocb->ki_user_data,
-                 res, res2);
+        pr_debug("%p[%u]: %p: %p %Lx %Lx %Lx\n", ctx, tail, iocb,
+                 (void __user *)(unsigned long)iocb->ki_res.obj,
+                 iocb->ki_res.data, iocb->ki_res.res, iocb->ki_res.res2);
 
         /* after flagging the request as done, we
          * must never even look at it again
@@ -1148,10 +1145,8 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
          * eventfd. The eventfd_signal() function is safe to be called
          * from IRQ context.
          */
-        if (iocb->ki_eventfd) {
+        if (iocb->ki_eventfd)
                 eventfd_signal(iocb->ki_eventfd, 1);
-                eventfd_ctx_put(iocb->ki_eventfd);
-        }
 
         /*
          * We have to order our ring_info tail store above and test
@@ -1163,7 +1158,14 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
 
         if (waitqueue_active(&ctx->wait))
                 wake_up(&ctx->wait);
-        iocb_put(iocb);
+}
+
+static inline void iocb_put(struct aio_kiocb *iocb)
+{
+        if (refcount_dec_and_test(&iocb->ki_refcnt)) {
+                aio_complete(iocb);
+                iocb_destroy(iocb);
+        }
 }
 
 /* aio_read_events_ring
@@ -1437,7 +1439,9 @@ static void aio_complete_rw(struct kiocb *kiocb, long res, long res2)
                 file_end_write(kiocb->ki_filp);
         }
 
-        aio_complete(iocb, res, res2);
+        iocb->ki_res.res = res;
+        iocb->ki_res.res2 = res2;
+        iocb_put(iocb);
 }
 
 static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb)
@@ -1514,13 +1518,13 @@ static inline void aio_rw_done(struct kiocb *req, ssize_t ret)
         }
 }
 
-static ssize_t aio_read(struct kiocb *req, const struct iocb *iocb,
+static int aio_read(struct kiocb *req, const struct iocb *iocb,
                         bool vectored, bool compat)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct iov_iter iter;
         struct file *file;
-        ssize_t ret;
+        int ret;
 
         ret = aio_prep_rw(req, iocb);
         if (ret)
@@ -1542,13 +1546,13 @@ static ssize_t aio_read(struct kiocb *req, const struct iocb *iocb,
         return ret;
 }
 
-static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb,
+static int aio_write(struct kiocb *req, const struct iocb *iocb,
                          bool vectored, bool compat)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct iov_iter iter;
         struct file *file;
-        ssize_t ret;
+        int ret;
 
         ret = aio_prep_rw(req, iocb);
         if (ret)
@@ -1585,11 +1589,10 @@ static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb,
 
 static void aio_fsync_work(struct work_struct *work)
 {
-        struct fsync_iocb *req = container_of(work, struct fsync_iocb, work);
-        int ret;
+        struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work);
 
-        ret = vfs_fsync(req->file, req->datasync);
-        aio_complete(container_of(req, struct aio_kiocb, fsync), ret, 0);
+        iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync);
+        iocb_put(iocb);
 }
 
 static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
@@ -1608,11 +1611,6 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
         return 0;
 }
 
-static inline void aio_poll_complete(struct aio_kiocb *iocb, __poll_t mask)
-{
-        aio_complete(iocb, mangle_poll(mask), 0);
-}
-
 static void aio_poll_complete_work(struct work_struct *work)
 {
         struct poll_iocb *req = container_of(work, struct poll_iocb, work);
@@ -1638,9 +1636,11 @@ static void aio_poll_complete_work(struct work_struct *work)
                 return;
         }
         list_del_init(&iocb->ki_list);
+        iocb->ki_res.res = mangle_poll(mask);
+        req->done = true;
         spin_unlock_irq(&ctx->ctx_lock);
 
-        aio_poll_complete(iocb, mask);
+        iocb_put(iocb);
 }
 
 /* assumes we are called with irqs disabled */
@@ -1668,31 +1668,27 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
         __poll_t mask = key_to_poll(key);
         unsigned long flags;
 
-        req->woken = true;
-
         /* for instances that support it check for an event match first: */
-        if (mask) {
-                if (!(mask & req->events))
-                        return 0;
+        if (mask && !(mask & req->events))
+                return 0;
+
+        list_del_init(&req->wait.entry);
 
+        if (mask && spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
                 /*
                  * Try to complete the iocb inline if we can. Use
                  * irqsave/irqrestore because not all filesystems (e.g. fuse)
                  * call this function with IRQs disabled and because IRQs
                  * have to be disabled before ctx_lock is obtained.
                  */
-                if (spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
-                        list_del(&iocb->ki_list);
-                        spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
-
-                        list_del_init(&req->wait.entry);
-                        aio_poll_complete(iocb, mask);
-                        return 1;
-                }
+                list_del(&iocb->ki_list);
+                iocb->ki_res.res = mangle_poll(mask);
+                req->done = true;
+                spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
+                iocb_put(iocb);
+        } else {
+                schedule_work(&req->work);
         }
-
-        list_del_init(&req->wait.entry);
-        schedule_work(&req->work);
         return 1;
 }
 
@@ -1719,11 +1715,12 @@ aio_poll_queue_proc(struct file *file, struct wait_queue_head *head,
         add_wait_queue(head, &pt->iocb->poll.wait);
 }
 
-static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
+static int aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
 {
         struct kioctx *ctx = aiocb->ki_ctx;
         struct poll_iocb *req = &aiocb->poll;
         struct aio_poll_table apt;
+        bool cancel = false;
         __poll_t mask;
 
         /* reject any unknown events outside the normal event mask. */
@@ -1737,7 +1734,7 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
         req->events = demangle_poll(iocb->aio_buf) | EPOLLERR | EPOLLHUP;
 
         req->head = NULL;
-        req->woken = false;
+        req->done = false;
         req->cancelled = false;
 
         apt.pt._qproc = aio_poll_queue_proc;
@@ -1749,156 +1746,135 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
         INIT_LIST_HEAD(&req->wait.entry);
         init_waitqueue_func_entry(&req->wait, aio_poll_wake);
 
-        /* one for removal from waitqueue, one for this function */
-        refcount_set(&aiocb->ki_refcnt, 2);
-
         mask = vfs_poll(req->file, &apt.pt) & req->events;
-        if (unlikely(!req->head)) {
-                /* we did not manage to set up a waitqueue, done */
-                goto out;
-        }
-
         spin_lock_irq(&ctx->ctx_lock);
-        spin_lock(&req->head->lock);
-        if (req->woken) {
-                /* wake_up context handles the rest */
-                mask = 0;
+        if (likely(req->head)) {
+                spin_lock(&req->head->lock);
+                if (unlikely(list_empty(&req->wait.entry))) {
+                        if (apt.error)
+                                cancel = true;
+                        apt.error = 0;
+                        mask = 0;
+                }
+                if (mask || apt.error) {
+                        list_del_init(&req->wait.entry);
+                } else if (cancel) {
+                        WRITE_ONCE(req->cancelled, true);
+                } else if (!req->done) { /* actually waiting for an event */
+                        list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
+                        aiocb->ki_cancel = aio_poll_cancel;
+                }
+                spin_unlock(&req->head->lock);
+        }
+        if (mask) { /* no async, we'd stolen it */
+                aiocb->ki_res.res = mangle_poll(mask);
                 apt.error = 0;
-        } else if (mask || apt.error) {
-                /* if we get an error or a mask we are done */
-                WARN_ON_ONCE(list_empty(&req->wait.entry));
-                list_del_init(&req->wait.entry);
-        } else {
-                /* actually waiting for an event */
-                list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
-                aiocb->ki_cancel = aio_poll_cancel;
         }
-        spin_unlock(&req->head->lock);
         spin_unlock_irq(&ctx->ctx_lock);
-
-out:
-        if (unlikely(apt.error))
-                return apt.error;
-
         if (mask)
-                aio_poll_complete(aiocb, mask);
-        iocb_put(aiocb);
-        return 0;
+                iocb_put(aiocb);
+        return apt.error;
 }
 
 static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb,
-                           struct iocb __user *user_iocb, bool compat)
+                           struct iocb __user *user_iocb, struct aio_kiocb *req,
+                           bool compat)
 {
-        struct aio_kiocb *req;
-        ssize_t ret;
-
-        /* enforce forwards compatibility on users */
-        if (unlikely(iocb->aio_reserved2)) {
-                pr_debug("EINVAL: reserve field set\n");
-                return -EINVAL;
-        }
-
-        /* prevent overflows */
-        if (unlikely(
-            (iocb->aio_buf != (unsigned long)iocb->aio_buf) ||
-            (iocb->aio_nbytes != (size_t)iocb->aio_nbytes) ||
-            ((ssize_t)iocb->aio_nbytes < 0)
-           )) {
-                pr_debug("EINVAL: overflow check\n");
-                return -EINVAL;
-        }
-
-        if (!get_reqs_available(ctx))
-                return -EAGAIN;
-
-        ret = -EAGAIN;
-        req = aio_get_req(ctx);
-        if (unlikely(!req))
-                goto out_put_reqs_available;
-
         req->ki_filp = fget(iocb->aio_fildes);
-        ret = -EBADF;
         if (unlikely(!req->ki_filp))
-                goto out_put_req;
+                return -EBADF;
 
         if (iocb->aio_flags & IOCB_FLAG_RESFD) {
+                struct eventfd_ctx *eventfd;
                 /*
                  * If the IOCB_FLAG_RESFD flag of aio_flags is set, get an
                  * instance of the file* now. The file descriptor must be
                  * an eventfd() fd, and will be signaled for each completed
                  * event using the eventfd_signal() function.
                  */
-                req->ki_eventfd = eventfd_ctx_fdget((int) iocb->aio_resfd);
-                if (IS_ERR(req->ki_eventfd)) {
-                        ret = PTR_ERR(req->ki_eventfd);
-                        req->ki_eventfd = NULL;
-                        goto out_put_req;
-                }
+                eventfd = eventfd_ctx_fdget(iocb->aio_resfd);
+                if (IS_ERR(eventfd))
+                        return PTR_ERR(eventfd);
+
+                req->ki_eventfd = eventfd;
         }
 
-        ret = put_user(KIOCB_KEY, &user_iocb->aio_key);
-        if (unlikely(ret)) {
+        if (unlikely(put_user(KIOCB_KEY, &user_iocb->aio_key))) {
                 pr_debug("EFAULT: aio_key\n");
-                goto out_put_req;
+                return -EFAULT;
         }
 
-        req->ki_user_iocb = user_iocb;
-        req->ki_user_data = iocb->aio_data;
+        req->ki_res.obj = (u64)(unsigned long)user_iocb;
+        req->ki_res.data = iocb->aio_data;
+        req->ki_res.res = 0;
+        req->ki_res.res2 = 0;
 
         switch (iocb->aio_lio_opcode) {
         case IOCB_CMD_PREAD:
-                ret = aio_read(&req->rw, iocb, false, compat);
-                break;
+                return aio_read(&req->rw, iocb, false, compat);
         case IOCB_CMD_PWRITE:
-                ret = aio_write(&req->rw, iocb, false, compat);
-                break;
+                return aio_write(&req->rw, iocb, false, compat);
         case IOCB_CMD_PREADV:
-                ret = aio_read(&req->rw, iocb, true, compat);
-                break;
+                return aio_read(&req->rw, iocb, true, compat);
         case IOCB_CMD_PWRITEV:
-                ret = aio_write(&req->rw, iocb, true, compat);
-                break;
+                return aio_write(&req->rw, iocb, true, compat);
         case IOCB_CMD_FSYNC:
-                ret = aio_fsync(&req->fsync, iocb, false);
-                break;
+                return aio_fsync(&req->fsync, iocb, false);
         case IOCB_CMD_FDSYNC:
-                ret = aio_fsync(&req->fsync, iocb, true);
-                break;
+                return aio_fsync(&req->fsync, iocb, true);
         case IOCB_CMD_POLL:
-                ret = aio_poll(req, iocb);
-                break;
+                return aio_poll(req, iocb);
         default:
                 pr_debug("invalid aio operation %d\n", iocb->aio_lio_opcode);
-                ret = -EINVAL;
-                break;
+                return -EINVAL;
         }
-
-        /*
-         * If ret is 0, we'd either done aio_complete() ourselves or have
-         * arranged for that to be done asynchronously.  Anything non-zero
-         * means that we need to destroy req ourselves.
-         */
-        if (ret)
-                goto out_put_req;
-        return 0;
-out_put_req:
-        if (req->ki_eventfd)
-                eventfd_ctx_put(req->ki_eventfd);
-        iocb_put(req);
-out_put_reqs_available:
-        put_reqs_available(ctx, 1);
-        return ret;
 }
 
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                          bool compat)
 {
+        struct aio_kiocb *req;
         struct iocb iocb;
+        int err;
 
         if (unlikely(copy_from_user(&iocb, user_iocb, sizeof(iocb))))
                 return -EFAULT;
 
-        return __io_submit_one(ctx, &iocb, user_iocb, compat);
+        /* enforce forwards compatibility on users */
+        if (unlikely(iocb.aio_reserved2)) {
+                pr_debug("EINVAL: reserve field set\n");
+                return -EINVAL;
+        }
+
+        /* prevent overflows */
+        if (unlikely(
+            (iocb.aio_buf != (unsigned long)iocb.aio_buf) ||
+            (iocb.aio_nbytes != (size_t)iocb.aio_nbytes) ||
+            ((ssize_t)iocb.aio_nbytes < 0)
+           )) {
+                pr_debug("EINVAL: overflow check\n");
+                return -EINVAL;
+        }
+
+        req = aio_get_req(ctx);
+        if (unlikely(!req))
+                return -EAGAIN;
+
+        err = __io_submit_one(ctx, &iocb, user_iocb, req, compat);
+
+        /* Done with the synchronous reference */
+        iocb_put(req);
+
+        /*
+         * If err is 0, we'd either done aio_complete() ourselves or have
+         * arranged for that to be done asynchronously.  Anything non-zero
+         * means that we need to destroy req ourselves.
+         */
+        if (unlikely(err)) {
+                iocb_destroy(req);
+                put_reqs_available(ctx, 1);
+        }
+        return err;
 }
 
 /* sys_io_submit:
@@ -1997,24 +1973,6 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
 }
 #endif
 
-/* lookup_kiocb
- *      Finds a given iocb for cancellation.
- */
-static struct aio_kiocb *
-lookup_kiocb(struct kioctx *ctx, struct iocb __user *iocb)
-{
-        struct aio_kiocb *kiocb;
-
-        assert_spin_locked(&ctx->ctx_lock);
-
-        /* TODO: use a hash or array, this sucks. */
-        list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) {
-                if (kiocb->ki_user_iocb == iocb)
-                        return kiocb;
-        }
-        return NULL;
-}
-
 /* sys_io_cancel:
  *      Attempts to cancel an iocb previously passed to io_submit.  If
  *      the operation is successfully cancelled, the resulting event is
@@ -2032,6 +1990,7 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
         struct aio_kiocb *kiocb;
         int ret = -EINVAL;
         u32 key;
+        u64 obj = (u64)(unsigned long)iocb;
 
         if (unlikely(get_user(key, &iocb->aio_key)))
                 return -EFAULT;
@@ -2043,10 +2002,13 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
                 return -EINVAL;
 
         spin_lock_irq(&ctx->ctx_lock);
-        kiocb = lookup_kiocb(ctx, iocb);
-        if (kiocb) {
-                ret = kiocb->ki_cancel(&kiocb->rw);
-                list_del_init(&kiocb->ki_list);
+        /* TODO: use a hash or array, this sucks. */
+        list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) {
+                if (kiocb->ki_res.obj == obj) {
+                        ret = kiocb->ki_cancel(&kiocb->rw);
+                        list_del_init(&kiocb->ki_list);
+                        break;
+                }
         }
         spin_unlock_irq(&ctx->ctx_lock);
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 78d3257435c0..24615c76c1d0 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -307,10 +307,10 @@ static void blkdev_bio_end_io(struct bio *bio)
         struct blkdev_dio *dio = bio->bi_private;
         bool should_dirty = dio->should_dirty;
 
-        if (dio->multi_bio && !atomic_dec_and_test(&dio->ref)) {
-                if (bio->bi_status && !dio->bio.bi_status)
-                        dio->bio.bi_status = bio->bi_status;
-        } else {
+        if (bio->bi_status && !dio->bio.bi_status)
+                dio->bio.bi_status = bio->bi_status;
+
+        if (!dio->multi_bio || atomic_dec_and_test(&dio->ref)) {
                 if (!dio->is_sync) {
                         struct kiocb *iocb = dio->iocb;
                         ssize_t ret;
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index 920bf3b4b0ef..cccc75d15970 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -7,6 +7,7 @@
 #include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
+#include <linux/sched/mm.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "transaction.h"
@@ -427,9 +428,13 @@ blk_status_t btrfs_csum_one_bio(struct inode *inode, struct bio *bio,
         unsigned long this_sum_bytes = 0;
         int i;
         u64 offset;
+        unsigned nofs_flag;
+
+        nofs_flag = memalloc_nofs_save();
+        sums = kvzalloc(btrfs_ordered_sum_size(fs_info, bio->bi_iter.bi_size),
+                       GFP_KERNEL);
+        memalloc_nofs_restore(nofs_flag);
 
-        sums = kzalloc(btrfs_ordered_sum_size(fs_info, bio->bi_iter.bi_size),
-                       GFP_NOFS);
         if (!sums)
                 return BLK_STS_RESOURCE;
 
@@ -472,8 +477,10 @@ blk_status_t btrfs_csum_one_bio(struct inode *inode, struct bio *bio,
 
                                 bytes_left = bio->bi_iter.bi_size - total_bytes;
 
-                                sums = kzalloc(btrfs_ordered_sum_size(fs_info, bytes_left),
-                                               GFP_NOFS);
+                                nofs_flag = memalloc_nofs_save();
+                                sums = kvzalloc(btrfs_ordered_sum_size(fs_info,
+                                                      bytes_left), GFP_KERNEL);
+                                memalloc_nofs_restore(nofs_flag);
                                 BUG_ON(!sums); /* -ENOMEM */
                                 sums->len = bytes_left;
                                 ordered = btrfs_lookup_ordered_extent(inode,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index ec2d8919e7fb..cd4e693406a0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -501,6 +501,16 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        /*
+         * If the fs is mounted with nologreplay, which requires it to be
+         * mounted in RO mode as well, we can not allow discard on free space
+         * inside block groups, because log trees refer to extents that are not
+         * pinned in a block group's free space cache (pinning the extents is
+         * precisely the first phase of replaying a log tree).
+         */
+        if (btrfs_test_opt(fs_info, NOLOGREPLAY))
+                return -EROFS;
+
         rcu_read_lock();
         list_for_each_entry_rcu(device, &fs_info->fs_devices->devices,
                                 dev_list) {
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 6fde2b2741ef..45e3cfd1198b 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -6,6 +6,7 @@
 #include <linux/slab.h>
 #include <linux/blkdev.h>
 #include <linux/writeback.h>
+#include <linux/sched/mm.h>
 #include "ctree.h"
 #include "transaction.h"
 #include "btrfs_inode.h"
@@ -442,7 +443,7 @@ void btrfs_put_ordered_extent(struct btrfs_ordered_extent *entry)
                         cur = entry->list.next;
                         sum = list_entry(cur, struct btrfs_ordered_sum, list);
                         list_del(&sum->list);
-                        kfree(sum);
+                        kvfree(sum);
                 }
                 kmem_cache_free(btrfs_ordered_extent_cache, entry);
         }
diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
index dc6140013ae8..61d22a56c0ba 100644
--- a/fs/btrfs/props.c
+++ b/fs/btrfs/props.c
@@ -366,11 +366,11 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
 
 static int prop_compression_validate(const char *value, size_t len)
 {
-        if (!strncmp("lzo", value, len))
+        if (!strncmp("lzo", value, 3))
                 return 0;
-        else if (!strncmp("zlib", value, len))
+        else if (!strncmp("zlib", value, 4))
                 return 0;
-        else if (!strncmp("zstd", value, len))
+        else if (!strncmp("zstd", value, 4))
                 return 0;
 
         return -EINVAL;
@@ -396,7 +396,7 @@ static int prop_compression_apply(struct inode *inode,
                 btrfs_set_fs_incompat(fs_info, COMPRESS_LZO);
         } else if (!strncmp("zlib", value, 4)) {
                 type = BTRFS_COMPRESS_ZLIB;
-        } else if (!strncmp("zstd", value, len)) {
+        } else if (!strncmp("zstd", value, 4)) {
                 type = BTRFS_COMPRESS_ZSTD;
                 btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD);
         } else {
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index a8f429882249..0637149fb9f9 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1766,6 +1766,7 @@ static ssize_t ceph_read_dir(struct file *file, char __user *buf, size_t size,
 unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn)
 {
         struct ceph_inode_info *dci = ceph_inode(dir);
+        unsigned hash;
 
         switch (dci->i_dir_layout.dl_dir_hash) {
         case 0: /* for backward compat */
@@ -1773,8 +1774,11 @@ unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn)
                 return dn->d_name.hash;
 
         default:
-                return ceph_str_hash(dci->i_dir_layout.dl_dir_hash,
+                spin_lock(&dn->d_lock);
+                hash = ceph_str_hash(dci->i_dir_layout.dl_dir_hash,
                                      dn->d_name.name, dn->d_name.len);
+                spin_unlock(&dn->d_lock);
+                return hash;
         }
 }
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 2d61ddda9bf5..c2feb310ac1e 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1163,6 +1163,19 @@ static int splice_dentry(struct dentry **pdn, struct inode *in)
         return 0;
 }
 
+static int d_name_cmp(struct dentry *dentry, const char *name, size_t len)
+{
+        int ret;
+
+        /* take d_lock to ensure dentry->d_name stability */
+        spin_lock(&dentry->d_lock);
+        ret = dentry->d_name.len - len;
+        if (!ret)
+                ret = memcmp(dentry->d_name.name, name, len);
+        spin_unlock(&dentry->d_lock);
+        return ret;
+}
+
 /*
  * Incorporate results into the local cache.  This is either just
  * one inode, or a directory, dentry, and possibly linked-to inode (e.g.,
@@ -1412,7 +1425,8 @@ retry_lookup:
                 err = splice_dentry(&req->r_dentry, in);
                 if (err < 0)
                         goto done;
-        } else if (rinfo->head->is_dentry) {
+        } else if (rinfo->head->is_dentry &&
+                   !d_name_cmp(req->r_dentry, rinfo->dname, rinfo->dname_len)) {
                 struct ceph_vino *ptvino = NULL;
 
                 if ((le32_to_cpu(rinfo->diri.in->cap.caps) & CEPH_CAP_FILE_SHARED) ||
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 21c33ed048ed..9049c2a3e972 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1414,6 +1414,15 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
                         list_add(&ci->i_prealloc_cap_flush->i_list, &to_remove);
                         ci->i_prealloc_cap_flush = NULL;
                 }
+
+               if (drop &&
+                  ci->i_wrbuffer_ref_head == 0 &&
+                  ci->i_wr_ref == 0 &&
+                  ci->i_dirty_caps == 0 &&
+                  ci->i_flushing_caps == 0) {
+                      ceph_put_snap_context(ci->i_head_snapc);
+                      ci->i_head_snapc = NULL;
+               }
         }
         spin_unlock(&ci->i_ceph_lock);
         while (!list_empty(&to_remove)) {
@@ -2161,10 +2170,39 @@ retry:
         return path;
 }
 
+/* Duplicate the dentry->d_name.name safely */
+static int clone_dentry_name(struct dentry *dentry, const char **ppath,
+                             int *ppathlen)
+{
+        u32 len;
+        char *name;
+
+retry:
+        len = READ_ONCE(dentry->d_name.len);
+        name = kmalloc(len + 1, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
+        spin_lock(&dentry->d_lock);
+        if (dentry->d_name.len != len) {
+                spin_unlock(&dentry->d_lock);
+                kfree(name);
+                goto retry;
+        }
+        memcpy(name, dentry->d_name.name, len);
+        spin_unlock(&dentry->d_lock);
+
+        name[len] = '\0';
+        *ppath = name;
+        *ppathlen = len;
+        return 0;
+}
+
 static int build_dentry_path(struct dentry *dentry, struct inode *dir,
                              const char **ppath, int *ppathlen, u64 *pino,
-                             int *pfreepath)
+                             bool *pfreepath, bool parent_locked)
 {
+        int ret;
         char *path;
 
         rcu_read_lock();
@@ -2173,8 +2211,15 @@ static int build_dentry_path(struct dentry *dentry, struct inode *dir,
         if (dir && ceph_snap(dir) == CEPH_NOSNAP) {
                 *pino = ceph_ino(dir);
                 rcu_read_unlock();
-                *ppath = dentry->d_name.name;
-                *ppathlen = dentry->d_name.len;
+                if (parent_locked) {
+                        *ppath = dentry->d_name.name;
+                        *ppathlen = dentry->d_name.len;
+                } else {
+                        ret = clone_dentry_name(dentry, ppath, ppathlen);
+                        if (ret)
+                                return ret;
+                        *pfreepath = true;
+                }
                 return 0;
         }
         rcu_read_unlock();
@@ -2182,13 +2227,13 @@ static int build_dentry_path(struct dentry *dentry, struct inode *dir,
         if (IS_ERR(path))
                 return PTR_ERR(path);
         *ppath = path;
-        *pfreepath = 1;
+        *pfreepath = true;
         return 0;
 }
 
 static int build_inode_path(struct inode *inode,
                             const char **ppath, int *ppathlen, u64 *pino,
-                            int *pfreepath)
+                            bool *pfreepath)
 {
         struct dentry *dentry;
         char *path;
@@ -2204,7 +2249,7 @@ static int build_inode_path(struct inode *inode,
         if (IS_ERR(path))
                 return PTR_ERR(path);
         *ppath = path;
-        *pfreepath = 1;
+        *pfreepath = true;
         return 0;
 }
 
@@ -2215,7 +2260,7 @@ static int build_inode_path(struct inode *inode,
 static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
                                   struct inode *rdiri, const char *rpath,
                                   u64 rino, const char **ppath, int *pathlen,
-                                  u64 *ino, int *freepath)
+                                  u64 *ino, bool *freepath, bool parent_locked)
 {
         int r = 0;
 
@@ -2225,7 +2270,7 @@ static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
                      ceph_snap(rinode));
         } else if (rdentry) {
                 r = build_dentry_path(rdentry, rdiri, ppath, pathlen, ino,
-                                        freepath);
+                                        freepath, parent_locked);
                 dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen,
                      *ppath);
         } else if (rpath || rino) {
@@ -2251,7 +2296,7 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
         const char *path2 = NULL;
         u64 ino1 = 0, ino2 = 0;
         int pathlen1 = 0, pathlen2 = 0;
-        int freepath1 = 0, freepath2 = 0;
+        bool freepath1 = false, freepath2 = false;
         int len;
         u16 releases;
         void *p, *end;
@@ -2259,16 +2304,19 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
 
         ret = set_request_path_attr(req->r_inode, req->r_dentry,
                               req->r_parent, req->r_path1, req->r_ino1.ino,
-                              &path1, &pathlen1, &ino1, &freepath1);
+                              &path1, &pathlen1, &ino1, &freepath1,
+                              test_bit(CEPH_MDS_R_PARENT_LOCKED,
+                                        &req->r_req_flags));
         if (ret < 0) {
                 msg = ERR_PTR(ret);
                 goto out;
         }
 
+        /* If r_old_dentry is set, then assume that its parent is locked */
         ret = set_request_path_attr(NULL, req->r_old_dentry,
                               req->r_old_dentry_dir,
                               req->r_path2, req->r_ino2.ino,
-                              &path2, &pathlen2, &ino2, &freepath2);
+                              &path2, &pathlen2, &ino2, &freepath2, true);
         if (ret < 0) {
                 msg = ERR_PTR(ret);
                 goto out_free1;
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 89aa37fa0f84..b26e12cd8ec3 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -572,7 +572,12 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
         old_snapc = NULL;
 
 update_snapc:
-        if (ci->i_head_snapc) {
+       if (ci->i_wrbuffer_ref_head == 0 &&
+           ci->i_wr_ref == 0 &&
+           ci->i_dirty_caps == 0 &&
+           ci->i_flushing_caps == 0) {
+               ci->i_head_snapc = NULL;
+       } else {
                 ci->i_head_snapc = ceph_get_snap_context(new_snapc);
                 dout(" new snapc is %p\n", new_snapc);
         }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f9b71c12cc9f..a05bf1d6e1d0 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -559,6 +559,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                         tcon->ses->server->echo_interval / HZ);
         if (tcon->snapshot_time)
                 seq_printf(s, ",snapshot=%llu", tcon->snapshot_time);
+        if (tcon->handle_timeout)
+                seq_printf(s, ",handletimeout=%u", tcon->handle_timeout);
         /* convert actimeo and display it in seconds */
         seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 38feae812b47..585ad3207cb1 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -60,6 +60,12 @@
 #define CIFS_MAX_ACTIMEO (1 << 30)
 
 /*
+ * Max persistent and resilient handle timeout (milliseconds).
+ * Windows durable max was 960000 (16 minutes)
+ */
+#define SMB3_MAX_HANDLE_TIMEOUT 960000
+
+/*
  * MAX_REQ is the maximum number of requests that WE will send
  * on one socket concurrently.
  */
@@ -586,6 +592,7 @@ struct smb_vol {
         struct nls_table *local_nls;
         unsigned int echo_interval; /* echo interval in secs */
         __u64 snapshot_time; /* needed for timewarp tokens */
+        __u32 handle_timeout; /* persistent and durable handle timeout in ms */
         unsigned int max_credits; /* smb3 max_credits 10 < credits < 60000 */
 };
 
@@ -1058,6 +1065,7 @@ struct cifs_tcon {
         __u32 vol_serial_number;
         __le64 vol_create_time;
         __u64 snapshot_time; /* for timewarp tokens - timestamp of snapshot */
+        __u32 handle_timeout; /* persistent and durable handle timeout in ms */
         __u32 ss_flags;         /* sector size flags */
         __u32 perf_sector_size; /* best sector size for perf */
         __u32 max_chunks;
@@ -1325,6 +1333,7 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
 }
 
 struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file);
+void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr);
 void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
 
 #define CIFS_CACHE_READ_FLG     1
@@ -1847,6 +1856,7 @@ GLOBAL_EXTERN spinlock_t gidsidlock;
 #endif /* CONFIG_CIFS_ACL */
 
 void cifs_oplock_break(struct work_struct *work);
+void cifs_queue_oplock_break(struct cifsFileInfo *cfile);
 
 extern const struct slow_work_ops cifs_oplock_break_ops;
 extern struct workqueue_struct *cifsiod_wq;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a8e9738db691..4c0e44489f21 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -103,7 +103,7 @@ enum {
         Opt_cruid, Opt_gid, Opt_file_mode,
         Opt_dirmode, Opt_port,
         Opt_blocksize, Opt_rsize, Opt_wsize, Opt_actimeo,
-        Opt_echo_interval, Opt_max_credits,
+        Opt_echo_interval, Opt_max_credits, Opt_handletimeout,
         Opt_snapshot,
 
         /* Mount options which take string value */
@@ -208,6 +208,7 @@ static const match_table_t cifs_mount_option_tokens = {
         { Opt_rsize, "rsize=%s" },
         { Opt_wsize, "wsize=%s" },
         { Opt_actimeo, "actimeo=%s" },
+        { Opt_handletimeout, "handletimeout=%s" },
         { Opt_echo_interval, "echo_interval=%s" },
         { Opt_max_credits, "max_credits=%s" },
         { Opt_snapshot, "snapshot=%s" },
@@ -1619,6 +1620,9 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
         vol->actimeo = CIFS_DEF_ACTIMEO;
 
+        /* Most clients set timeout to 0, allows server to use its default */
+        vol->handle_timeout = 0; /* See MS-SMB2 spec section 2.2.14.2.12 */
+
         /* offer SMB2.1 and later (SMB3 etc). Secure and widely accepted */
         vol->ops = &smb30_operations;
         vol->vals = &smbdefault_values;
@@ -2017,6 +2021,18 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 goto cifs_parse_mount_err;
                         }
                         break;
+                case Opt_handletimeout:
+                        if (get_option_ul(args, &option)) {
+                                cifs_dbg(VFS, "%s: Invalid handletimeout value\n",
+                                         __func__);
+                                goto cifs_parse_mount_err;
+                        }
+                        vol->handle_timeout = option;
+                        if (vol->handle_timeout > SMB3_MAX_HANDLE_TIMEOUT) {
+                                cifs_dbg(VFS, "Invalid handle cache timeout, longer than 16 minutes\n");
+                                goto cifs_parse_mount_err;
+                        }
+                        break;
                 case Opt_echo_interval:
                         if (get_option_ul(args, &option)) {
                                 cifs_dbg(VFS, "%s: Invalid echo interval value\n",
@@ -3183,6 +3199,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb_vol *volume_info)
                 return 0;
         if (tcon->snapshot_time != volume_info->snapshot_time)
                 return 0;
+        if (tcon->handle_timeout != volume_info->handle_timeout)
+                return 0;
         return 1;
 }
 
@@ -3297,6 +3315,16 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                         tcon->snapshot_time = volume_info->snapshot_time;
         }
 
+        if (volume_info->handle_timeout) {
+                if (ses->server->vals->protocol_id == 0) {
+                        cifs_dbg(VFS,
+                             "Use SMB2.1 or later for handle timeout option\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                } else
+                        tcon->handle_timeout = volume_info->handle_timeout;
+        }
+
         tcon->ses = ses;
         if (volume_info->password) {
                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 89006e044973..7037a137fa53 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -360,13 +360,31 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file)
         return cifs_file;
 }
 
-/*
- * Release a reference on the file private data. This may involve closing
- * the filehandle out on the server. Must be called without holding
- * tcon->open_file_lock and cifs_file->file_info_lock.
+/**
+ * cifsFileInfo_put - release a reference of file priv data
+ *
+ * Always potentially wait for oplock handler. See _cifsFileInfo_put().
  */
 void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
 {
+        _cifsFileInfo_put(cifs_file, true);
+}
+
+/**
+ * _cifsFileInfo_put - release a reference of file priv data
+ *
+ * This may involve closing the filehandle @cifs_file out on the
+ * server. Must be called without holding tcon->open_file_lock and
+ * cifs_file->file_info_lock.
+ *
+ * If @wait_for_oplock_handler is true and we are releasing the last
+ * reference, wait for any running oplock break handler of the file
+ * and cancel any pending one. If calling this function from the
+ * oplock break handler, you need to pass false.
+ *
+ */
+void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+{
         struct inode *inode = d_inode(cifs_file->dentry);
         struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
         struct TCP_Server_Info *server = tcon->ses->server;
@@ -414,7 +432,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
 
         spin_unlock(&tcon->open_file_lock);
 
-        oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
+        oplock_break_cancelled = wait_oplock_handler ?
+                cancel_work_sync(&cifs_file->oplock_break) : false;
 
         if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
                 struct TCP_Server_Info *server = tcon->ses->server;
@@ -2858,7 +2877,6 @@ static void collect_uncached_write_data(struct cifs_aio_ctx *ctx)
         struct cifs_tcon *tcon;
         struct cifs_sb_info *cifs_sb;
         struct dentry *dentry = ctx->cfile->dentry;
-        unsigned int i;
         int rc;
 
         tcon = tlink_tcon(ctx->cfile->tlink);
@@ -2922,10 +2940,6 @@ restart_loop:
                 kref_put(&wdata->refcount, cifs_uncached_writedata_release);
         }
 
-        if (!ctx->direct_io)
-                for (i = 0; i < ctx->npages; i++)
-                        put_page(ctx->bv[i].bv_page);
-
         cifs_stats_bytes_written(tcon, ctx->total_len);
         set_bit(CIFS_INO_INVALID_MAPPING, &CIFS_I(dentry->d_inode)->flags);
 
@@ -3563,7 +3577,6 @@ collect_uncached_read_data(struct cifs_aio_ctx *ctx)
         struct iov_iter *to = &ctx->iter;
         struct cifs_sb_info *cifs_sb;
         struct cifs_tcon *tcon;
-        unsigned int i;
         int rc;
 
         tcon = tlink_tcon(ctx->cfile->tlink);
@@ -3647,15 +3660,8 @@ again:
                 kref_put(&rdata->refcount, cifs_uncached_readdata_release);
         }
 
-        if (!ctx->direct_io) {
-                for (i = 0; i < ctx->npages; i++) {
-                        if (ctx->should_dirty)
-                                set_page_dirty(ctx->bv[i].bv_page);
-                        put_page(ctx->bv[i].bv_page);
-                }
-
+        if (!ctx->direct_io)
                 ctx->total_len = ctx->len - iov_iter_count(to);
-        }
 
         /* mask nodata case */
         if (rc == -ENODATA)
@@ -4603,6 +4609,7 @@ void cifs_oplock_break(struct work_struct *work)
                                                              cinode);
                 cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
         }
+        _cifsFileInfo_put(cfile, false /* do not wait for ourself */);
         cifs_done_oplock_break(cinode);
 }
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 53fdb5df0d2e..538fd7d807e4 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1735,6 +1735,10 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry,
         if (rc == 0 || rc != -EBUSY)
                 goto do_rename_exit;
 
+        /* Don't fall back to using SMB on SMB 2+ mount */
+        if (server->vals->protocol_id != 0)
+                goto do_rename_exit;
+
         /* open-file renames don't work across directories */
         if (to_dentry->d_parent != from_dentry->d_parent)
                 goto do_rename_exit;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index bee203055b30..0dc6f08020ac 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -501,8 +501,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
                                            CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
                                            &pCifsInode->flags);
 
-                                queue_work(cifsoplockd_wq,
-                                           &netfile->oplock_break);
+                                cifs_queue_oplock_break(netfile);
                                 netfile->oplock_break_cancelled = false;
 
                                 spin_unlock(&tcon->open_file_lock);
@@ -607,6 +606,28 @@ void cifs_put_writer(struct cifsInodeInfo *cinode)
         spin_unlock(&cinode->writers_lock);
 }
 
+/**
+ * cifs_queue_oplock_break - queue the oplock break handler for cfile
+ *
+ * This function is called from the demultiplex thread when it
+ * receives an oplock break for @cfile.
+ *
+ * Assumes the tcon->open_file_lock is held.
+ * Assumes cfile->file_info_lock is NOT held.
+ */
+void cifs_queue_oplock_break(struct cifsFileInfo *cfile)
+{
+        /*
+         * Bump the handle refcount now while we hold the
+         * open_file_lock to enforce the validity of it for the oplock
+         * break handler. The matching put is done at the end of the
+         * handler.
+         */
+        cifsFileInfo_get(cfile);
+
+        queue_work(cifsoplockd_wq, &cfile->oplock_break);
+}
+
 void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
 {
         clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
@@ -768,6 +789,11 @@ cifs_aio_ctx_alloc(void)
 {
         struct cifs_aio_ctx *ctx;
 
+        /*
+         * Must use kzalloc to initialize ctx->bv to NULL and ctx->direct_io
+         * to false so that we know when we have to unreference pages within
+         * cifs_aio_ctx_release()
+         */
         ctx = kzalloc(sizeof(struct cifs_aio_ctx), GFP_KERNEL);
         if (!ctx)
                 return NULL;
@@ -786,7 +812,23 @@ cifs_aio_ctx_release(struct kref *refcount)
                                         struct cifs_aio_ctx, refcount);
 
         cifsFileInfo_put(ctx->cfile);
-        kvfree(ctx->bv);
+
+        /*
+         * ctx->bv is only set if setup_aio_ctx_iter() was call successfuly
+         * which means that iov_iter_get_pages() was a success and thus that
+         * we have taken reference on pages.
+         */
+        if (ctx->bv) {
+                unsigned i;
+
+                for (i = 0; i < ctx->npages; i++) {
+                        if (ctx->should_dirty)
+                                set_page_dirty(ctx->bv[i].bv_page);
+                        put_page(ctx->bv[i].bv_page);
+                }
+                kvfree(ctx->bv);
+        }
+
         kfree(ctx);
 }
 
diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
index b204e84b87fb..54bffb2a1786 100644
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -68,13 +68,15 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
 
 
          if (oparms->tcon->use_resilient) {
-                nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+                /* default timeout is 0, servers pick default (120 seconds) */
+                nr_ioctl_req.Timeout =
+                        cpu_to_le32(oparms->tcon->handle_timeout);
                 nr_ioctl_req.Reserved = 0;
                 rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
                         fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY,
                         true /* is_fsctl */,
                         (char *)&nr_ioctl_req, sizeof(nr_ioctl_req),
-                        NULL, NULL /* no return info */);
+                        CIFSMaxBufSize, NULL, NULL /* no return info */);
                 if (rc == -EOPNOTSUPP) {
                         cifs_dbg(VFS,
                              "resiliency not supported by server, disabling\n");
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 0e3570e40ff8..e311f58dc1c8 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -555,7 +555,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
                         clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
                                   &cinode->flags);
 
-                queue_work(cifsoplockd_wq, &cfile->oplock_break);
+                cifs_queue_oplock_break(cfile);
                 kfree(lw);
                 return true;
         }
@@ -712,8 +712,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
                                            CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
                                            &cinode->flags);
                                 spin_unlock(&cfile->file_info_lock);
-                                queue_work(cifsoplockd_wq,
-                                           &cfile->oplock_break);
+
+                                cifs_queue_oplock_break(cfile);
 
                                 spin_unlock(&tcon->open_file_lock);
                                 spin_unlock(&cifs_tcp_ses_lock);
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 1022a3771e14..c36ff0d1fe2a 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -581,7 +581,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                         FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */,
                         NULL /* no data input */, 0 /* no data input */,
-                        (char **)&out_buf, &ret_data_len);
+                        CIFSMaxBufSize, (char **)&out_buf, &ret_data_len);
         if (rc == -EOPNOTSUPP) {
                 cifs_dbg(FYI,
                          "server does not support query network interfaces\n");
@@ -717,32 +717,28 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
         oparms.fid->mid = le64_to_cpu(o_rsp->sync_hdr.MessageId);
 #endif /* CIFS_DEBUG2 */
 
-        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
-                oplock = smb2_parse_lease_state(server, o_rsp,
-                                                &oparms.fid->epoch,
-                                                oparms.fid->lease_key);
-        else
-                goto oshr_exit;
-
-
         memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
         tcon->crfid.tcon = tcon;
         tcon->crfid.is_valid = true;
         kref_init(&tcon->crfid.refcount);
-        kref_get(&tcon->crfid.refcount);
 
+        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE) {
+                kref_get(&tcon->crfid.refcount);
+                oplock = smb2_parse_lease_state(server, o_rsp,
+                                                &oparms.fid->epoch,
+                                                oparms.fid->lease_key);
+        } else
+                goto oshr_exit;
 
         qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
         if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info))
                 goto oshr_exit;
-        rc = smb2_validate_and_copy_iov(
+        if (!smb2_validate_and_copy_iov(
                                 le16_to_cpu(qi_rsp->OutputBufferOffset),
                                 sizeof(struct smb2_file_all_info),
                                 &rsp_iov[1], sizeof(struct smb2_file_all_info),
-                                (char *)&tcon->crfid.file_all_info);
-        if (rc)
-                goto oshr_exit;
-        tcon->crfid.file_all_info_is_valid = 1;
+                                (char *)&tcon->crfid.file_all_info))
+                tcon->crfid.file_all_info_is_valid = 1;
 
  oshr_exit:
         mutex_unlock(&tcon->crfid.fid_mutex);
@@ -1299,7 +1295,7 @@ SMB2_request_res_key(const unsigned int xid, struct cifs_tcon *tcon,
 
         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
                         FSCTL_SRV_REQUEST_RESUME_KEY, true /* is_fsctl */,
-                        NULL, 0 /* no input */,
+                        NULL, 0 /* no input */, CIFSMaxBufSize,
                         (char **)&res_key, &ret_data_len);
 
         if (rc) {
@@ -1404,7 +1400,7 @@ smb2_ioctl_query_info(const unsigned int xid,
                         rc = SMB2_ioctl_init(tcon, &rqst[1],
                                              COMPOUND_FID, COMPOUND_FID,
                                              qi.info_type, true, NULL,
-                                             0);
+                                             0, CIFSMaxBufSize);
                 }
         } else if (qi.flags == PASSTHRU_QUERY_INFO) {
                 memset(&qi_iov, 0, sizeof(qi_iov));
@@ -1532,8 +1528,8 @@ smb2_copychunk_range(const unsigned int xid,
                 rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
                         trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
                         true /* is_fsctl */, (char *)pcchunk,
-                        sizeof(struct copychunk_ioctl), (char **)&retbuf,
-                        &ret_data_len);
+                        sizeof(struct copychunk_ioctl), CIFSMaxBufSize,
+                        (char **)&retbuf, &ret_data_len);
                 if (rc == 0) {
                         if (ret_data_len !=
                                         sizeof(struct copychunk_ioctl_rsp)) {
@@ -1693,7 +1689,7 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid, FSCTL_SET_SPARSE,
                         true /* is_fctl */,
-                        &setsparse, 1, NULL, NULL);
+                        &setsparse, 1, CIFSMaxBufSize, NULL, NULL);
         if (rc) {
                 tcon->broken_sparse_sup = true;
                 cifs_dbg(FYI, "set sparse rc = %d\n", rc);
@@ -1766,7 +1762,7 @@ smb2_duplicate_extents(const unsigned int xid,
                         true /* is_fsctl */,
                         (char *)&dup_ext_buf,
                         sizeof(struct duplicate_extents_to_file),
-                        NULL,
+                        CIFSMaxBufSize, NULL,
                         &ret_data_len);
 
         if (ret_data_len > 0)
@@ -1801,7 +1797,7 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
                         true /* is_fsctl */,
                         (char *)&integr_info,
                         sizeof(struct fsctl_set_integrity_information_req),
-                        NULL,
+                        CIFSMaxBufSize, NULL,
                         &ret_data_len);
 
 }
@@ -1809,6 +1805,8 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
 /* GMT Token is @GMT-YYYY.MM.DD-HH.MM.SS Unicode which is 48 bytes + null */
 #define GMT_TOKEN_SIZE 50
 
+#define MIN_SNAPSHOT_ARRAY_SIZE 16 /* See MS-SMB2 section 3.3.5.15.1 */
+
 /*
  * Input buffer contains (empty) struct smb_snapshot array with size filled in
  * For output see struct SRV_SNAPSHOT_ARRAY in MS-SMB2 section 2.2.32.2
@@ -1820,13 +1818,29 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
         char *retbuf = NULL;
         unsigned int ret_data_len = 0;
         int rc;
+        u32 max_response_size;
         struct smb_snapshot_array snapshot_in;
 
+        if (get_user(ret_data_len, (unsigned int __user *)ioc_buf))
+                return -EFAULT;
+
+        /*
+         * Note that for snapshot queries that servers like Azure expect that
+         * the first query be minimal size (and just used to get the number/size
+         * of previous versions) so response size must be specified as EXACTLY
+         * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
+         * of eight bytes.
+         */
+        if (ret_data_len == 0)
+                max_response_size = MIN_SNAPSHOT_ARRAY_SIZE;
+        else
+                max_response_size = CIFSMaxBufSize;
+
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid,
                         FSCTL_SRV_ENUMERATE_SNAPSHOTS,
                         true /* is_fsctl */,
-                        NULL, 0 /* no input data */,
+                        NULL, 0 /* no input data */, max_response_size,
                         (char **)&retbuf,
                         &ret_data_len);
         cifs_dbg(FYI, "enum snaphots ioctl returned %d and ret buflen is %d\n",
@@ -2304,7 +2318,7 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
                 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                                 FSCTL_DFS_GET_REFERRALS,
                                 true /* is_fsctl */,
-                                (char *)dfs_req, dfs_req_size,
+                                (char *)dfs_req, dfs_req_size, CIFSMaxBufSize,
                                 (char **)&dfs_rsp, &dfs_rsp_size);
         } while (rc == -EAGAIN);
 
@@ -2375,6 +2389,8 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
 
         rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, &err_iov,
                        &resp_buftype);
+        if (!rc)
+                SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
         if (!rc || !err_iov.iov_base) {
                 rc = -ENOENT;
                 goto free_path;
@@ -2658,7 +2674,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
         rc = SMB2_ioctl_init(tcon, &rqst[num++], cfile->fid.persistent_fid,
                              cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
                              true /* is_fctl */, (char *)&fsctl_buf,
-                             sizeof(struct file_zero_data_information));
+                             sizeof(struct file_zero_data_information),
+                             CIFSMaxBufSize);
         if (rc)
                 goto zero_range_exit;
 
@@ -2735,7 +2752,8 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
                         true /* is_fctl */, (char *)&fsctl_buf,
-                        sizeof(struct file_zero_data_information), NULL, NULL);
+                        sizeof(struct file_zero_data_information),
+                        CIFSMaxBufSize, NULL, NULL);
         free_xid(xid);
         return rc;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 21ac19ff19cb..a37774a55f3a 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -832,8 +832,11 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
                 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
                         /* ops set to 3.0 by default for default so update */
                         ses->server->ops = &smb21_operations;
-                } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID))
+                        ses->server->vals = &smb21_values;
+                } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
                         ses->server->ops = &smb311_operations;
+                        ses->server->vals = &smb311_values;
+                }
         } else if (le16_to_cpu(rsp->DialectRevision) !=
                                 ses->server->vals->protocol_id) {
                 /* if requested single dialect ensure returned dialect matched */
@@ -1002,7 +1005,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                 FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
-                (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);
+                (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize,
+                (char **)&pneg_rsp, &rsplen);
         if (rc == -EOPNOTSUPP) {
                 /*
                  * Old Windows versions or Netapp SMB server can return
@@ -1858,8 +1862,9 @@ add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
 }
 
 static struct create_durable_v2 *
-create_durable_v2_buf(struct cifs_fid *pfid)
+create_durable_v2_buf(struct cifs_open_parms *oparms)
 {
+        struct cifs_fid *pfid = oparms->fid;
         struct create_durable_v2 *buf;
 
         buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
@@ -1873,7 +1878,14 @@ create_durable_v2_buf(struct cifs_fid *pfid)
                                 (struct create_durable_v2, Name));
         buf->ccontext.NameLength = cpu_to_le16(4);
 
-        buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
+        /*
+         * NB: Handle timeout defaults to 0, which allows server to choose
+         * (most servers default to 120 seconds) and most clients default to 0.
+         * This can be overridden at mount ("handletimeout=") if the user wants
+         * a different persistent (or resilient) handle timeout for all opens
+         * opens on a particular SMB3 mount.
+         */
+        buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout);
         buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
         generate_random_uuid(buf->dcontext.CreateGuid);
         memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
@@ -1926,7 +1938,7 @@ add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
         struct smb2_create_req *req = iov[0].iov_base;
         unsigned int num = *num_iovec;
 
-        iov[num].iov_base = create_durable_v2_buf(oparms->fid);
+        iov[num].iov_base = create_durable_v2_buf(oparms);
         if (iov[num].iov_base == NULL)
                 return -ENOMEM;
         iov[num].iov_len = sizeof(struct create_durable_v2);
@@ -2478,7 +2490,8 @@ creat_exit:
 int
 SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
                 u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                bool is_fsctl, char *in_data, u32 indatalen)
+                bool is_fsctl, char *in_data, u32 indatalen,
+                __u32 max_response_size)
 {
         struct smb2_ioctl_req *req;
         struct kvec *iov = rqst->rq_iov;
@@ -2520,16 +2533,21 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
         req->OutputCount = 0; /* MBZ */
 
         /*
-         * Could increase MaxOutputResponse, but that would require more
-         * than one credit. Windows typically sets this smaller, but for some
+         * In most cases max_response_size is set to 16K (CIFSMaxBufSize)
+         * We Could increase default MaxOutputResponse, but that could require
+         * more credits. Windows typically sets this smaller, but for some
          * ioctls it may be useful to allow server to send more. No point
          * limiting what the server can send as long as fits in one credit
-         * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
-         * (by default, note that it can be overridden to make max larger)
-         * in responses (except for read responses which can be bigger.
-         * We may want to bump this limit up
+         * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want
+         * to increase this limit up in the future.
+         * Note that for snapshot queries that servers like Azure expect that
+         * the first query be minimal size (and just used to get the number/size
+         * of previous versions) so response size must be specified as EXACTLY
+         * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
+         * of eight bytes.  Currently that is the only case where we set max
+         * response size smaller.
          */
-        req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
+        req->MaxOutputResponse = cpu_to_le32(max_response_size);
 
         if (is_fsctl)
                 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
@@ -2550,13 +2568,14 @@ SMB2_ioctl_free(struct smb_rqst *rqst)
                 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
 }
 
+
 /*
  *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
  */
 int
 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
            u64 volatile_fid, u32 opcode, bool is_fsctl,
-           char *in_data, u32 indatalen,
+           char *in_data, u32 indatalen, u32 max_out_data_len,
            char **out_data, u32 *plen /* returned data len */)
 {
         struct smb_rqst rqst;
@@ -2593,8 +2612,8 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         rqst.rq_iov = iov;
         rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE;
 
-        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid,
-                             opcode, is_fsctl, in_data, indatalen);
+        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid, opcode,
+                             is_fsctl, in_data, indatalen, max_out_data_len);
         if (rc)
                 goto ioctl_exit;
 
@@ -2672,7 +2691,8 @@ SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
                         FSCTL_SET_COMPRESSION, true /* is_fsctl */,
                         (char *)&fsctl_input /* data input */,
-                        2 /* in data len */, &ret_data /* out data */, NULL);
+                        2 /* in data len */, CIFSMaxBufSize /* max out data */,
+                        &ret_data /* out data */, NULL);
 
         cifs_dbg(FYI, "set compression rc %d\n", rc);
 
@@ -3431,8 +3451,6 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
         rqst.rq_nvec = 1;
 
         rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
-        cifs_small_buf_release(req);
-
         rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
 
         if (rc) {
@@ -3448,12 +3466,15 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
                                     io_parms->tcon->tid, ses->Suid,
                                     io_parms->offset, 0);
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
+                cifs_small_buf_release(req);
                 return rc == -ENODATA ? 0 : rc;
         } else
                 trace_smb3_read_done(xid, req->PersistentFileId,
                                     io_parms->tcon->tid, ses->Suid,
                                     io_parms->offset, io_parms->length);
 
+        cifs_small_buf_release(req);
+
         *nbytes = le32_to_cpu(rsp->DataLength);
         if ((*nbytes > CIFS_MAX_MSGSIZE) ||
             (*nbytes > io_parms->length)) {
@@ -3752,7 +3773,6 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
 
         rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
                             &resp_buftype, flags, &rsp_iov);
-        cifs_small_buf_release(req);
         rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
 
         if (rc) {
@@ -3770,6 +3790,7 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
                                      io_parms->offset, *nbytes);
         }
 
+        cifs_small_buf_release(req);
         free_rsp_buf(resp_buftype, rsp);
         return rc;
 }
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 3c32d0cfea69..52df125e9189 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -142,11 +142,12 @@ extern int SMB2_open_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
 extern void SMB2_open_free(struct smb_rqst *rqst);
 extern int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon,
                      u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                     bool is_fsctl, char *in_data, u32 indatalen,
+                     bool is_fsctl, char *in_data, u32 indatalen, u32 maxoutlen,
                      char **out_data, u32 *plen /* returned data len */);
 extern int SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
                            u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                           bool is_fsctl, char *in_data, u32 indatalen);
+                           bool is_fsctl, char *in_data, u32 indatalen,
+                           __u32 max_response_size);
 extern void SMB2_ioctl_free(struct smb_rqst *rqst);
 extern int SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
                       u64 persistent_file_id, u64 volatile_file_id);
diff --git a/fs/dax.c b/fs/dax.c
index ca0671d55aa6..e5e54da1715f 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -33,6 +33,7 @@
 #include <linux/sizes.h>
 #include <linux/mmu_notifier.h>
 #include <linux/iomap.h>
+#include <asm/pgalloc.h>
 #include "internal.h"
 
 #define CREATE_TRACE_POINTS
@@ -1407,7 +1408,9 @@ static vm_fault_t dax_pmd_load_hole(struct xa_state *xas, struct vm_fault *vmf,
 {
         struct address_space *mapping = vmf->vma->vm_file->f_mapping;
         unsigned long pmd_addr = vmf->address & PMD_MASK;
+        struct vm_area_struct *vma = vmf->vma;
         struct inode *inode = mapping->host;
+        pgtable_t pgtable = NULL;
         struct page *zero_page;
         spinlock_t *ptl;
         pmd_t pmd_entry;
@@ -1422,12 +1425,22 @@ static vm_fault_t dax_pmd_load_hole(struct xa_state *xas, struct vm_fault *vmf,
         *entry = dax_insert_entry(xas, mapping, vmf, *entry, pfn,
                         DAX_PMD | DAX_ZERO_PAGE, false);
 
+        if (arch_needs_pgtable_deposit()) {
+                pgtable = pte_alloc_one(vma->vm_mm);
+                if (!pgtable)
+                        return VM_FAULT_OOM;
+        }
+
         ptl = pmd_lock(vmf->vma->vm_mm, vmf->pmd);
         if (!pmd_none(*(vmf->pmd))) {
                 spin_unlock(ptl);
                 goto fallback;
         }
 
+        if (pgtable) {
+                pgtable_trans_huge_deposit(vma->vm_mm, vmf->pmd, pgtable);
+                mm_inc_nr_ptes(vma->vm_mm);
+        }
         pmd_entry = mk_pmd(zero_page, vmf->vma->vm_page_prot);
         pmd_entry = pmd_mkhuge(pmd_entry);
         set_pmd_at(vmf->vma->vm_mm, pmd_addr, vmf->pmd, pmd_entry);
@@ -1436,6 +1449,8 @@ static vm_fault_t dax_pmd_load_hole(struct xa_state *xas, struct vm_fault *vmf,
         return VM_FAULT_NOPAGE;
 
 fallback:
+        if (pgtable)
+                pte_free(vma->vm_mm, pgtable);
         trace_dax_pmd_load_hole_fallback(inode, vmf, zero_page, *entry);
         return VM_FAULT_FALLBACK;
 }
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 95b5e78c22b1..f25daa207421 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -163,19 +163,24 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
         return 0;
 }
 
-static void debugfs_evict_inode(struct inode *inode)
+static void debugfs_i_callback(struct rcu_head *head)
 {
-        truncate_inode_pages_final(&inode->i_data);
-        clear_inode(inode);
+        struct inode *inode = container_of(head, struct inode, i_rcu);
         if (S_ISLNK(inode->i_mode))
                 kfree(inode->i_link);
+        free_inode_nonrcu(inode);
+}
+
+static void debugfs_destroy_inode(struct inode *inode)
+{
+        call_rcu(&inode->i_rcu, debugfs_i_callback);
 }
 
 static const struct super_operations debugfs_super_operations = {
         .statfs         = simple_statfs,
         .remount_fs     = debugfs_remount,
         .show_options   = debugfs_show_options,
-        .evict_inode    = debugfs_evict_inode,
+        .destroy_inode  = debugfs_destroy_inode,
 };
 
 static void debugfs_release_dentry(struct dentry *dentry)
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 8a63e52785e9..9971a35cf1ef 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2056,10 +2056,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
                 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
 
         ret = -EINVAL;
-        if (rem < len) {
-                pipe_unlock(pipe);
-                goto out;
-        }
+        if (rem < len)
+                goto out_free;
 
         rem = len;
         while (rem) {
@@ -2077,7 +2075,9 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
                         pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
                         pipe->nrbufs--;
                 } else {
-                        pipe_buf_get(pipe, ibuf);
+                        if (!pipe_buf_get(pipe, ibuf))
+                                goto out_free;
+
                         *obuf = *ibuf;
                         obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
                         obuf->len = rem;
@@ -2100,11 +2100,11 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
         ret = fuse_dev_do_write(fud, &cs, len);
 
         pipe_lock(pipe);
+out_free:
         for (idx = 0; idx < nbuf; idx++)
                 pipe_buf_release(pipe, &bufs[idx]);
         pipe_unlock(pipe);
 
-out:
         kvfree(bufs);
         return ret;
 }
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index ec32fece5e1e..9285dd4f4b1c 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -755,11 +755,17 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                                         umode_t mode, dev_t dev)
 {
         struct inode *inode;
-        struct resv_map *resv_map;
+        struct resv_map *resv_map = NULL;
 
-        resv_map = resv_map_alloc();
-        if (!resv_map)
-                return NULL;
+        /*
+         * Reserve maps are only needed for inodes that can have associated
+         * page allocations.
+         */
+        if (S_ISREG(mode) || S_ISLNK(mode)) {
+                resv_map = resv_map_alloc();
+                if (!resv_map)
+                        return NULL;
+        }
 
         inode = new_inode(sb);
         if (inode) {
@@ -794,8 +800,10 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                         break;
                 }
                 lockdep_annotate_inode_mutex_key(inode);
-        } else
-                kref_put(&resv_map->refs, resv_map_release);
+        } else {
+                if (resv_map)
+                        kref_put(&resv_map->refs, resv_map_release);
+        }
 
         return inode;
 }
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bbdbd56cf2ac..0e9fb2cb1984 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -338,7 +338,7 @@ static struct io_uring_cqe *io_get_cqring(struct io_ring_ctx *ctx)
         tail = ctx->cached_cq_tail;
         /* See comment at the top of the file */
         smp_rmb();
-        if (tail + 1 == READ_ONCE(ring->r.head))
+        if (tail - READ_ONCE(ring->r.head) == ring->ring_entries)
                 return NULL;
 
         ctx->cached_cq_tail++;
@@ -682,11 +682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
                 list_add_tail(&req->list, &ctx->poll_list);
 }
 
-static void io_file_put(struct io_submit_state *state, struct file *file)
+static void io_file_put(struct io_submit_state *state)
 {
-        if (!state) {
-                fput(file);
-        } else if (state->file) {
+        if (state->file) {
                 int diff = state->has_refs - state->used_refs;
 
                 if (diff)
@@ -711,7 +709,7 @@ static struct file *io_file_get(struct io_submit_state *state, int fd)
                         state->ios_left--;
                         return state->file;
                 }
-                io_file_put(state, NULL);
+                io_file_put(state);
         }
         state->file = fget_many(fd, state->ios_left);
         if (!state->file)
@@ -742,7 +740,7 @@ static bool io_file_supports_async(struct file *file)
 }
 
 static int io_prep_rw(struct io_kiocb *req, const struct sqe_submit *s,
-                      bool force_nonblock, struct io_submit_state *state)
+                      bool force_nonblock)
 {
         const struct io_uring_sqe *sqe = s->sqe;
         struct io_ring_ctx *ctx = req->ctx;
@@ -940,7 +938,7 @@ static void io_async_list_note(int rw, struct io_kiocb *req, size_t len)
 }
 
 static int io_read(struct io_kiocb *req, const struct sqe_submit *s,
-                   bool force_nonblock, struct io_submit_state *state)
+                   bool force_nonblock)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct kiocb *kiocb = &req->rw;
@@ -949,7 +947,7 @@ static int io_read(struct io_kiocb *req, const struct sqe_submit *s,
         size_t iov_count;
         int ret;
 
-        ret = io_prep_rw(req, s, force_nonblock, state);
+        ret = io_prep_rw(req, s, force_nonblock);
         if (ret)
                 return ret;
         file = kiocb->ki_filp;
@@ -987,7 +985,7 @@ static int io_read(struct io_kiocb *req, const struct sqe_submit *s,
 }
 
 static int io_write(struct io_kiocb *req, const struct sqe_submit *s,
-                    bool force_nonblock, struct io_submit_state *state)
+                    bool force_nonblock)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct kiocb *kiocb = &req->rw;
@@ -996,7 +994,7 @@ static int io_write(struct io_kiocb *req, const struct sqe_submit *s,
         size_t iov_count;
         int ret;
 
-        ret = io_prep_rw(req, s, force_nonblock, state);
+        ret = io_prep_rw(req, s, force_nonblock);
         if (ret)
                 return ret;
 
@@ -1338,8 +1336,7 @@ static int io_poll_add(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 }
 
 static int __io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
-                           const struct sqe_submit *s, bool force_nonblock,
-                           struct io_submit_state *state)
+                           const struct sqe_submit *s, bool force_nonblock)
 {
         int ret, opcode;
 
@@ -1355,18 +1352,18 @@ static int __io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
         case IORING_OP_READV:
                 if (unlikely(s->sqe->buf_index))
                         return -EINVAL;
-                ret = io_read(req, s, force_nonblock, state);
+                ret = io_read(req, s, force_nonblock);
                 break;
         case IORING_OP_WRITEV:
                 if (unlikely(s->sqe->buf_index))
                         return -EINVAL;
-                ret = io_write(req, s, force_nonblock, state);
+                ret = io_write(req, s, force_nonblock);
                 break;
         case IORING_OP_READ_FIXED:
-                ret = io_read(req, s, force_nonblock, state);
+                ret = io_read(req, s, force_nonblock);
                 break;
         case IORING_OP_WRITE_FIXED:
-                ret = io_write(req, s, force_nonblock, state);
+                ret = io_write(req, s, force_nonblock);
                 break;
         case IORING_OP_FSYNC:
                 ret = io_fsync(req, s->sqe, force_nonblock);
@@ -1459,7 +1456,7 @@ restart:
                         s->has_user = cur_mm != NULL;
                         s->needs_lock = true;
                         do {
-                                ret = __io_submit_sqe(ctx, req, s, false, NULL);
+                                ret = __io_submit_sqe(ctx, req, s, false);
                                 /*
                                  * We can get EAGAIN for polled IO even though
                                  * we're forcing a sync submission from here,
@@ -1625,7 +1622,7 @@ static int io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s,
         if (unlikely(ret))
                 goto out;
 
-        ret = __io_submit_sqe(ctx, req, s, true, state);
+        ret = __io_submit_sqe(ctx, req, s, true);
         if (ret == -EAGAIN) {
                 struct io_uring_sqe *sqe_copy;
 
@@ -1671,7 +1668,7 @@ out:
 static void io_submit_state_end(struct io_submit_state *state)
 {
         blk_finish_plug(&state->plug);
-        io_file_put(state, NULL);
+        io_file_put(state);
         if (state->free_reqs)
                 kmem_cache_free_bulk(req_cachep, state->free_reqs,
                                         &state->reqs[state->cur_req]);
@@ -1741,7 +1738,8 @@ static bool io_get_sqring(struct io_ring_ctx *ctx, struct sqe_submit *s)
         head = ctx->cached_sq_head;
         /* See comment at the top of this file */
         smp_rmb();
-        if (head == READ_ONCE(ring->r.tail))
+        /* make sure SQ entry isn't read before tail */
+        if (head == smp_load_acquire(&ring->r.tail))
                 return false;
 
         head = READ_ONCE(ring->array[head & ctx->sq_mask]);
@@ -1866,7 +1864,8 @@ static int io_sq_thread(void *data)
 
                         /* Tell userspace we may need a wakeup call */
                         ctx->sq_ring->flags |= IORING_SQ_NEED_WAKEUP;
-                        smp_wmb();
+                        /* make sure to read SQ tail after writing flags */
+                        smp_mb();
 
                         if (!io_get_sqring(ctx, &sqes[0])) {
                                 if (kthread_should_stop()) {
@@ -1920,6 +1919,10 @@ static int io_sq_thread(void *data)
                 unuse_mm(cur_mm);
                 mmput(cur_mm);
         }
+
+        if (kthread_should_park())
+                kthread_parkme();
+
         return 0;
 }
 
@@ -2054,6 +2057,7 @@ static void io_sq_thread_stop(struct io_ring_ctx *ctx)
         if (ctx->sqo_thread) {
                 ctx->sqo_stop = 1;
                 mb();
+                kthread_park(ctx->sqo_thread);
                 kthread_stop(ctx->sqo_thread);
                 ctx->sqo_thread = NULL;
         }
@@ -2215,6 +2219,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
                         fput(ctx->user_files[i]);
 
                 kfree(ctx->user_files);
+                ctx->user_files = NULL;
                 ctx->nr_user_files = 0;
                 return ret;
         }
@@ -2235,19 +2240,27 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx,
         mmgrab(current->mm);
         ctx->sqo_mm = current->mm;
 
-        ctx->sq_thread_idle = msecs_to_jiffies(p->sq_thread_idle);
-        if (!ctx->sq_thread_idle)
-                ctx->sq_thread_idle = HZ;
-
         ret = -EINVAL;
         if (!cpu_possible(p->sq_thread_cpu))
                 goto err;
 
         if (ctx->flags & IORING_SETUP_SQPOLL) {
+                ret = -EPERM;
+                if (!capable(CAP_SYS_ADMIN))
+                        goto err;
+
+                ctx->sq_thread_idle = msecs_to_jiffies(p->sq_thread_idle);
+                if (!ctx->sq_thread_idle)
+                        ctx->sq_thread_idle = HZ;
+
                 if (p->flags & IORING_SETUP_SQ_AFF) {
                         int cpu;
 
                         cpu = array_index_nospec(p->sq_thread_cpu, NR_CPUS);
+                        ret = -EINVAL;
+                        if (!cpu_possible(p->sq_thread_cpu))
+                                goto err;
+
                         ctx->sqo_thread = kthread_create_on_cpu(io_sq_thread,
                                                         ctx, cpu,
                                                         "io_uring-sq");
@@ -2562,7 +2575,8 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait)
         poll_wait(file, &ctx->cq_wait, wait);
         /* See comment at the top of this file */
         smp_rmb();
-        if (READ_ONCE(ctx->sq_ring->r.tail) + 1 != ctx->cached_sq_head)
+        if (READ_ONCE(ctx->sq_ring->r.tail) - ctx->cached_sq_head !=
+            ctx->sq_ring->ring_entries)
                 mask |= EPOLLOUT | EPOLLWRNORM;
         if (READ_ONCE(ctx->cq_ring->r.head) != ctx->cached_cq_tail)
                 mask |= EPOLLIN | EPOLLRDNORM;
@@ -2917,11 +2931,31 @@ SYSCALL_DEFINE2(io_uring_setup, u32, entries,
 
 static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
                                void __user *arg, unsigned nr_args)
+        __releases(ctx->uring_lock)
+        __acquires(ctx->uring_lock)
 {
         int ret;
 
+        /*
+         * We're inside the ring mutex, if the ref is already dying, then
+         * someone else killed the ctx or is already going through
+         * io_uring_register().
+         */
+        if (percpu_ref_is_dying(&ctx->refs))
+                return -ENXIO;
+
         percpu_ref_kill(&ctx->refs);
+
+        /*
+         * Drop uring mutex before waiting for references to exit. If another
+         * thread is currently inside io_uring_enter() it might need to grab
+         * the uring_lock to make progress. If we hold it here across the drain
+         * wait, then we can deadlock. It's safe to drop the mutex here, since
+         * no new references will come in after we've killed the percpu ref.
+         */
+        mutex_unlock(&ctx->uring_lock);
         wait_for_completion(&ctx->ctx_done);
+        mutex_lock(&ctx->uring_lock);
 
         switch (opcode) {
         case IORING_REGISTER_BUFFERS:
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 389ea53ea487..bccfc40b3a74 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
 
         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
 
-        if (f->target) {
-                kfree(f->target);
-                f->target = NULL;
-        }
-
         fds = f->dents;
         while(fds) {
                 fd = fds;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index bb6ae387469f..05d892c79339 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
 static void jffs2_i_callback(struct rcu_head *head)
 {
         struct inode *inode = container_of(head, struct inode, i_rcu);
-        kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+
+        kfree(f->target);
+        kmem_cache_free(jffs2_inode_cachep, f);
 }
 
 static void jffs2_destroy_inode(struct inode *inode)
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index ff6f85fb676b..5196bfa7894d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -329,9 +329,6 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src,
         };
         ssize_t err, err2;
 
-        if (!nfs_server_capable(file_inode(dst), NFS_CAP_COPY))
-                return -EOPNOTSUPP;
-
         src_lock = nfs_get_lock_context(nfs_file_open_context(src));
         if (IS_ERR(src_lock))
                 return PTR_ERR(src_lock);
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 45b2322e092d..00d17198ee12 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -133,8 +133,10 @@ static ssize_t nfs4_copy_file_range(struct file *file_in, loff_t pos_in,
                                     struct file *file_out, loff_t pos_out,
                                     size_t count, unsigned int flags)
 {
+        if (!nfs_server_capable(file_inode(file_out), NFS_CAP_COPY))
+                return -EOPNOTSUPP;
         if (file_inode(file_in) == file_inode(file_out))
-                return -EINVAL;
+                return -EOPNOTSUPP;
         return nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index cfcabc33e24d..602446158bfb 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2589,7 +2589,7 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
                         ARRAY_SIZE(nfs4_acl_bitmap), &hdr);
 
         rpc_prepare_reply_pages(req, args->acl_pages, 0,
-                                args->acl_len, replen);
+                                args->acl_len, replen + 1);
         encode_nops(&hdr);
 }
 
@@ -2811,7 +2811,7 @@ static void nfs4_xdr_enc_fs_locations(struct rpc_rqst *req,
         }
 
         rpc_prepare_reply_pages(req, (struct page **)&args->page, 0,
-                                PAGE_SIZE, replen);
+                                PAGE_SIZE, replen + 1);
         encode_nops(&hdr);
 }
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 23790c7b2289..c27ac96a95bd 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2041,7 +2041,8 @@ static int nfs23_validate_mount_data(void *options,
                 memcpy(sap, &data->addr, sizeof(data->addr));
                 args->nfs_server.addrlen = sizeof(data->addr);
                 args->nfs_server.port = ntohs(data->addr.sin_port);
-                if (!nfs_verify_server_address(sap))
+                if (sap->sa_family != AF_INET ||
+                    !nfs_verify_server_address(sap))
                         goto out_no_address;
 
                 if (!(data->flags & NFS_MOUNT_TCP))
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index 8f933e84cec1..9bc32af4e2da 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -442,7 +442,9 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp)
         struct nfsd3_readdirargs *argp = rqstp->rq_argp;
         struct nfsd3_readdirres  *resp = rqstp->rq_resp;
         __be32          nfserr;
-        int             count;
+        int             count = 0;
+        struct page     **p;
+        caddr_t         page_addr = NULL;
 
         dprintk("nfsd: READDIR(3)  %s %d bytes at %d\n",
                                 SVCFH_fmt(&argp->fh),
@@ -462,7 +464,18 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp)
         nfserr = nfsd_readdir(rqstp, &resp->fh, (loff_t*) &argp->cookie, 
                                         &resp->common, nfs3svc_encode_entry);
         memcpy(resp->verf, argp->verf, 8);
-        resp->count = resp->buffer - argp->buffer;
+        count = 0;
+        for (p = rqstp->rq_respages + 1; p < rqstp->rq_next_page; p++) {
+                page_addr = page_address(*p);
+
+                if (((caddr_t)resp->buffer >= page_addr) &&
+                    ((caddr_t)resp->buffer < page_addr + PAGE_SIZE)) {
+                        count += (caddr_t)resp->buffer - page_addr;
+                        break;
+                }
+                count += PAGE_SIZE;
+        }
+        resp->count = count >> 2;
         if (resp->offset) {
                 loff_t offset = argp->cookie;
 
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 93fea246f676..8d789124ed3c 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -573,6 +573,7 @@ int
 nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p)
 {
         struct nfsd3_readdirargs *args = rqstp->rq_argp;
+        int len;
         u32 max_blocksize = svc_max_payload(rqstp);
 
         p = decode_fh(p, &args->fh);
@@ -582,8 +583,14 @@ nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p)
         args->verf   = p; p += 2;
         args->dircount = ~0;
         args->count  = ntohl(*p++);
-        args->count  = min_t(u32, args->count, max_blocksize);
-        args->buffer = page_address(*(rqstp->rq_next_page++));
+        len = args->count  = min_t(u32, args->count, max_blocksize);
+
+        while (len > 0) {
+                struct page *p = *(rqstp->rq_next_page++);
+                if (!args->buffer)
+                        args->buffer = page_address(p);
+                len -= PAGE_SIZE;
+        }
 
         return xdr_argsize_check(rqstp, p);
 }
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index d219159b98af..7caa3801ce72 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -1010,8 +1010,9 @@ static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata)
         cb->cb_seq_status = 1;
         cb->cb_status = 0;
         if (minorversion) {
-                if (!nfsd41_cb_get_slot(clp, task))
+                if (!cb->cb_holds_slot && !nfsd41_cb_get_slot(clp, task))
                         return;
+                cb->cb_holds_slot = true;
         }
         rpc_call_start(task);
 }
@@ -1038,6 +1039,9 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback
                 return true;
         }
 
+        if (!cb->cb_holds_slot)
+                goto need_restart;
+
         switch (cb->cb_seq_status) {
         case 0:
                 /*
@@ -1076,6 +1080,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback
                         cb->cb_seq_status);
         }
 
+        cb->cb_holds_slot = false;
         clear_bit(0, &clp->cl_cb_slot_busy);
         rpc_wake_up_next(&clp->cl_cb_waitq);
         dprintk("%s: freed slot, new seqid=%d\n", __func__,
@@ -1283,6 +1288,7 @@ void nfsd4_init_cb(struct nfsd4_callback *cb, struct nfs4_client *clp,
         cb->cb_seq_status = 1;
         cb->cb_status = 0;
         cb->cb_need_restart = false;
+        cb->cb_holds_slot = false;
 }
 
 void nfsd4_run_cb(struct nfsd4_callback *cb)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 6a45fb00c5fc..f056b1d3fecd 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -265,6 +265,7 @@ find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 static void
 free_blocked_lock(struct nfsd4_blocked_lock *nbl)
 {
+        locks_delete_block(&nbl->nbl_lock);
         locks_release_private(&nbl->nbl_lock);
         kfree(nbl);
 }
@@ -293,11 +294,18 @@ remove_blocked_locks(struct nfs4_lockowner *lo)
                 nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock,
                                         nbl_lru);
                 list_del_init(&nbl->nbl_lru);
-                locks_delete_block(&nbl->nbl_lock);
                 free_blocked_lock(nbl);
         }
 }
 
+static void
+nfsd4_cb_notify_lock_prepare(struct nfsd4_callback *cb)
+{
+        struct nfsd4_blocked_lock       *nbl = container_of(cb,
+                                                struct nfsd4_blocked_lock, nbl_cb);
+        locks_delete_block(&nbl->nbl_lock);
+}
+
 static int
 nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
 {
@@ -325,6 +333,7 @@ nfsd4_cb_notify_lock_release(struct nfsd4_callback *cb)
 }
 
 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops = {
+        .prepare        = nfsd4_cb_notify_lock_prepare,
         .done           = nfsd4_cb_notify_lock_done,
         .release        = nfsd4_cb_notify_lock_release,
 };
@@ -4863,7 +4872,6 @@ nfs4_laundromat(struct nfsd_net *nn)
                 nbl = list_first_entry(&reaplist,
                                         struct nfsd4_blocked_lock, nbl_lru);
                 list_del_init(&nbl->nbl_lru);
-                locks_delete_block(&nbl->nbl_lock);
                 free_blocked_lock(nbl);
         }
 out:
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 396c76755b03..9d6cb246c6c5 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -70,6 +70,7 @@ struct nfsd4_callback {
         int cb_seq_status;
         int cb_status;
         bool cb_need_restart;
+        bool cb_holds_slot;
 };
 
 struct nfsd4_callback_ops {
diff --git a/fs/open.c b/fs/open.c
index f1c2f855fd43..a00350018a47 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -1215,3 +1215,21 @@ int nonseekable_open(struct inode *inode, struct file *filp)
 }
 
 EXPORT_SYMBOL(nonseekable_open);
+
+/*
+ * stream_open is used by subsystems that want stream-like file descriptors.
+ * Such file descriptors are not seekable and don't have notion of position
+ * (file.f_pos is always 0). Contrary to file descriptors of other regular
+ * files, .read() and .write() can run simultaneously.
+ *
+ * stream_open never fails and is marked to return int so that it could be
+ * directly used as file_operations.open .
+ */
+int stream_open(struct inode *inode, struct file *filp)
+{
+        filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
+        filp->f_mode |= FMODE_STREAM;
+        return 0;
+}
+
+EXPORT_SYMBOL(stream_open);
diff --git a/fs/pipe.c b/fs/pipe.c
index 070aad543382..41065901106b 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -188,9 +188,9 @@ EXPORT_SYMBOL(generic_pipe_buf_steal);
  *      in the tee() system call, when we duplicate the buffers in one
  *      pipe into another.
  */
-void generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
+bool generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
 {
-        get_page(buf->page);
+        return try_get_page(buf->page);
 }
 EXPORT_SYMBOL(generic_pipe_buf_get);
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index ddef482f1334..6a803a0b75df 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -616,24 +616,25 @@ static int proc_pid_limits(struct seq_file *m, struct pid_namespace *ns,
 static int proc_pid_syscall(struct seq_file *m, struct pid_namespace *ns,
                             struct pid *pid, struct task_struct *task)
 {
-        long nr;
-        unsigned long args[6], sp, pc;
+        struct syscall_info info;
+        u64 *args = &info.data.args[0];
         int res;
 
         res = lock_trace(task);
         if (res)
                 return res;
 
-        if (task_current_syscall(task, &nr, args, 6, &sp, &pc))
+        if (task_current_syscall(task, &info))
                 seq_puts(m, "running\n");
-        else if (nr < 0)
-                seq_printf(m, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
+        else if (info.data.nr < 0)
+                seq_printf(m, "%d 0x%llx 0x%llx\n",
+                           info.data.nr, info.sp, info.data.instruction_pointer);
         else
                 seq_printf(m,
-                       "%ld 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx\n",
-                       nr,
+                       "%d 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx\n",
+                       info.data.nr,
                        args[0], args[1], args[2], args[3], args[4], args[5],
-                       sp, pc);
+                       info.sp, info.data.instruction_pointer);
         unlock_trace(task);
 
         return 0;
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index d65390727541..7325baa8f9d4 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1626,9 +1626,11 @@ static void drop_sysctl_table(struct ctl_table_header *header)
         if (--header->nreg)
                 return;
 
-        if (parent)
+        if (parent) {
                 put_links(header);
-        start_unregistering(header);
+                start_unregistering(header);
+        }
+
         if (!--header->count)
                 kfree_rcu(header, rcu);
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 92a91e7816d8..95ca1fe7283c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1143,6 +1143,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                                         count = -EINTR;
                                         goto out_mm;
                                 }
+                                /*
+                                 * Avoid to modify vma->vm_flags
+                                 * without locked ops while the
+                                 * coredump reads the vm_flags.
+                                 */
+                                if (!mmget_still_valid(mm)) {
+                                        /*
+                                         * Silently return "count"
+                                         * like if get_task_mm()
+                                         * failed. FIXME: should this
+                                         * function have returned
+                                         * -ESRCH if get_task_mm()
+                                         * failed like if
+                                         * get_proc_task() fails?
+                                         */
+                                        up_write(&mm->mmap_sem);
+                                        goto out_mm;
+                                }
                                 for (vma = mm->mmap; vma; vma = vma->vm_next) {
                                         vma->vm_flags &= ~VM_SOFTDIRTY;
                                         vma_set_page_prot(vma);
diff --git a/fs/read_write.c b/fs/read_write.c
index 177ccc3d405a..61b43ad7608e 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -560,12 +560,13 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
 
 static inline loff_t file_pos_read(struct file *file)
 {
-        return file->f_pos;
+        return file->f_mode & FMODE_STREAM ? 0 : file->f_pos;
 }
 
 static inline void file_pos_write(struct file *file, loff_t pos)
 {
-        file->f_pos = pos;
+        if ((file->f_mode & FMODE_STREAM) == 0)
+                file->f_pos = pos;
 }
 
 ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
diff --git a/fs/splice.c b/fs/splice.c
index 3ee7e82df48f..25212dcca2df 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -330,8 +330,8 @@ const struct pipe_buf_operations default_pipe_buf_ops = {
         .get = generic_pipe_buf_get,
 };
 
-static int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
-                                    struct pipe_buffer *buf)
+int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
+                             struct pipe_buffer *buf)
 {
         return 1;
 }
@@ -1593,7 +1593,11 @@ retry:
                          * Get a reference to this pipe buffer,
                          * so we can copy the contents over.
                          */
-                        pipe_buf_get(ipipe, ibuf);
+                        if (!pipe_buf_get(ipipe, ibuf)) {
+                                if (ret == 0)
+                                        ret = -EFAULT;
+                                break;
+                        }
                         *obuf = *ibuf;
 
                         /*
@@ -1667,7 +1671,11 @@ static int link_pipe(struct pipe_inode_info *ipipe,
                  * Get a reference to this pipe buffer,
                  * so we can copy the contents over.
                  */
-                pipe_buf_get(ipipe, ibuf);
+                if (!pipe_buf_get(ipipe, ibuf)) {
+                        if (ret == 0)
+                                ret = -EFAULT;
+                        break;
+                }
 
                 obuf = opipe->bufs + nbuf;
                 *obuf = *ibuf;
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 8dc2818fdd84..12628184772c 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -276,14 +276,12 @@ static void ubifs_i_callback(struct rcu_head *head)
 {
         struct inode *inode = container_of(head, struct inode, i_rcu);
         struct ubifs_inode *ui = ubifs_inode(inode);
+        kfree(ui->data);
         kmem_cache_free(ubifs_inode_slab, ui);
 }
 
 static void ubifs_destroy_inode(struct inode *inode)
 {
-        struct ubifs_inode *ui = ubifs_inode(inode);
-
-        kfree(ui->data);
         call_rcu(&inode->i_rcu, ubifs_i_callback);
 }
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 89800fc7dc9d..f5de1e726356 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -629,6 +629,8 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
 
                 /* the various vma->vm_userfaultfd_ctx still points to it */
                 down_write(&mm->mmap_sem);
+                /* no task can run (and in turn coredump) yet */
+                VM_WARN_ON(!mmget_still_valid(mm));
                 for (vma = mm->mmap; vma; vma = vma->vm_next)
                         if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
                                 vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
@@ -883,6 +885,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
          * taking the mmap_sem for writing.
          */
         down_write(&mm->mmap_sem);
+        if (!mmget_still_valid(mm))
+                goto skip_mm;
         prev = NULL;
         for (vma = mm->mmap; vma; vma = vma->vm_next) {
                 cond_resched();
@@ -905,6 +909,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
                 vma->vm_flags = new_flags;
                 vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
         }
+skip_mm:
         up_write(&mm->mmap_sem);
         mmput(mm);
 wakeup:
@@ -1333,6 +1338,8 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
                 goto out;
 
         down_write(&mm->mmap_sem);
+        if (!mmget_still_valid(mm))
+                goto out_unlock;
         vma = find_vma_prev(mm, start, &prev);
         if (!vma)
                 goto out_unlock;
@@ -1520,6 +1527,8 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
                 goto out;
 
         down_write(&mm->mmap_sem);
+        if (!mmget_still_valid(mm))
+                goto out_unlock;
         vma = find_vma_prev(mm, start, &prev);
         if (!vma)
                 goto out_unlock;
diff --git a/include/asm-generic/syscall.h b/include/asm-generic/syscall.h
index 0c938a4354f6..b88239e9efe4 100644
--- a/include/asm-generic/syscall.h
+++ b/include/asm-generic/syscall.h
@@ -105,41 +105,30 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  * syscall_get_arguments - extract system call parameter values
  * @task:       task of interest, must be blocked
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array filled with argument values
  *
- * Fetches @n arguments to the system call starting with the @i'th argument
- * (from 0 through 5).  Argument @i is stored in @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Fetches 6 arguments to the system call.  First argument is stored in
+*  @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n, unsigned long *args);
+                           unsigned long *args);
 
 /**
  * syscall_set_arguments - change system call parameter value
  * @task:       task of interest, must be in system call entry tracing
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array of argument values to store
  *
- * Changes @n arguments to the system call starting with the @i'th argument.
- * Argument @i gets value @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Changes 6 arguments to the system call.
+ * The first argument gets value @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n,
                            const unsigned long *args);
 
 /**
diff --git a/include/drm/drm_modeset_helper_vtables.h b/include/drm/drm_modeset_helper_vtables.h
index cfb7be40bed7..ce4de6b1e444 100644
--- a/include/drm/drm_modeset_helper_vtables.h
+++ b/include/drm/drm_modeset_helper_vtables.h
@@ -418,6 +418,8 @@ struct drm_crtc_helper_funcs {
          * Drivers can use the @old_crtc_state input parameter if the operations
          * needed to enable the CRTC don't depend solely on the new state but
          * also on the transition between the old state and the new state.
+         *
+         * This function is optional.
          */
         void (*atomic_enable)(struct drm_crtc *crtc,
                               struct drm_crtc_state *old_crtc_state);
@@ -441,6 +443,8 @@ struct drm_crtc_helper_funcs {
          * parameter @old_crtc_state which could be used to access the old
          * state. Atomic drivers should consider to use this one instead
          * of @disable.
+         *
+         * This function is optional.
          */
         void (*atomic_disable)(struct drm_crtc *crtc,
                                struct drm_crtc_state *old_crtc_state);
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index cbf3180cb612..668ad971cd7b 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -420,7 +420,6 @@ extern struct ttm_bo_global {
         /**
          * Protected by ttm_global_mutex.
          */
-        unsigned int use_count;
         struct list_head device_list;
 
         /**
diff --git a/include/dt-bindings/clock/sifive-fu540-prci.h b/include/dt-bindings/clock/sifive-fu540-prci.h
new file mode 100644
index 000000000000..6a0b70a37d78
--- /dev/null
+++ b/include/dt-bindings/clock/sifive-fu540-prci.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2018-2019 SiFive, Inc.
+ * Wesley Terpstra
+ * Paul Walmsley
+ */
+
+#ifndef __DT_BINDINGS_CLOCK_SIFIVE_FU540_PRCI_H
+#define __DT_BINDINGS_CLOCK_SIFIVE_FU540_PRCI_H
+
+/* Clock indexes for use by Device Tree data and the PRCI driver */
+
+#define PRCI_CLK_COREPLL               0
+#define PRCI_CLK_DDRPLL                1
+#define PRCI_CLK_GEMGXLPLL             2
+#define PRCI_CLK_TLCLK                 3
+
+#endif
diff --git a/include/dt-bindings/reset/amlogic,meson-g12a-reset.h b/include/dt-bindings/reset/amlogic,meson-g12a-reset.h
index 8063e8314eef..6d487c5eba2c 100644
--- a/include/dt-bindings/reset/amlogic,meson-g12a-reset.h
+++ b/include/dt-bindings/reset/amlogic,meson-g12a-reset.h
@@ -51,7 +51,10 @@
 #define RESET_SD_EMMC_A                 44
 #define RESET_SD_EMMC_B                 45
 #define RESET_SD_EMMC_C                 46
-/*                                      47-60 */
+/*                                      47      */
+#define RESET_USB_PHY20                 48
+#define RESET_USB_PHY21                 49
+/*                                      50-60   */
 #define RESET_AUDIO_CODEC               61
 /*                                      62-63   */
 /*      RESET2                                  */
diff --git a/include/keys/trusted.h b/include/keys/trusted.h
index adbcb6817826..0071298b9b28 100644
--- a/include/keys/trusted.h
+++ b/include/keys/trusted.h
@@ -38,7 +38,7 @@ enum {
 
 int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                         unsigned int keylen, unsigned char *h1,
-                        unsigned char *h2, unsigned char h3, ...);
+                        unsigned char *h2, unsigned int h3, ...);
 int TSS_checkhmac1(unsigned char *buffer,
                           const uint32_t command,
                           const unsigned char *ononce,
diff --git a/include/linux/bio.h b/include/linux/bio.h
index bb6090aa165d..e584673c1881 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -120,19 +120,23 @@ static inline bool bio_full(struct bio *bio)
         return bio->bi_vcnt >= bio->bi_max_vecs;
 }
 
-#define mp_bvec_for_each_segment(bv, bvl, i, iter_all)                  \
-        for (bv = bvec_init_iter_all(&iter_all);                        \
-                (iter_all.done < (bvl)->bv_len) &&                      \
-                (mp_bvec_next_segment((bvl), &iter_all), 1);            \
-                iter_all.done += bv->bv_len, i += 1)
+static inline bool bio_next_segment(const struct bio *bio,
+                                    struct bvec_iter_all *iter)
+{
+        if (iter->idx >= bio->bi_vcnt)
+                return false;
+
+        bvec_advance(&bio->bi_io_vec[iter->idx], iter);
+        return true;
+}
 
 /*
  * drivers should _never_ use the all version - the bio may have been split
  * before it got to the driver and the driver won't own all of it
  */
-#define bio_for_each_segment_all(bvl, bio, i, iter_all)         \
-        for (i = 0, iter_all.idx = 0; iter_all.idx < (bio)->bi_vcnt; iter_all.idx++)    \
-                mp_bvec_for_each_segment(bvl, &((bio)->bi_io_vec[iter_all.idx]), i, iter_all)
+#define bio_for_each_segment_all(bvl, bio, i, iter)                     \
+        for (i = 0, bvl = bvec_init_iter_all(&iter);                    \
+             bio_next_segment((bio), &iter); i++)
 
 static inline void bio_advance_iter(struct bio *bio, struct bvec_iter *iter,
                                     unsigned bytes)
diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h
index 50fb0dee23e8..d35b8ec1c485 100644
--- a/include/linux/bitrev.h
+++ b/include/linux/bitrev.h
@@ -34,41 +34,41 @@ static inline u32 __bitrev32(u32 x)
 
 #define __constant_bitrev32(x)  \
 ({                                      \
-        u32 __x = x;                    \
-        __x = (__x >> 16) | (__x << 16);        \
-        __x = ((__x & (u32)0xFF00FF00UL) >> 8) | ((__x & (u32)0x00FF00FFUL) << 8);      \
-        __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4);      \
-        __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2);      \
-        __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1);      \
-        __x;                                                            \
+        u32 ___x = x;                   \
+        ___x = (___x >> 16) | (___x << 16);     \
+        ___x = ((___x & (u32)0xFF00FF00UL) >> 8) | ((___x & (u32)0x00FF00FFUL) << 8);   \
+        ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4);   \
+        ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2);   \
+        ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1);   \
+        ___x;                                                           \
 })
 
 #define __constant_bitrev16(x)  \
 ({                                      \
-        u16 __x = x;                    \
-        __x = (__x >> 8) | (__x << 8);  \
-        __x = ((__x & (u16)0xF0F0U) >> 4) | ((__x & (u16)0x0F0FU) << 4);        \
-        __x = ((__x & (u16)0xCCCCU) >> 2) | ((__x & (u16)0x3333U) << 2);        \
-        __x = ((__x & (u16)0xAAAAU) >> 1) | ((__x & (u16)0x5555U) << 1);        \
-        __x;                                                            \
+        u16 ___x = x;                   \
+        ___x = (___x >> 8) | (___x << 8);       \
+        ___x = ((___x & (u16)0xF0F0U) >> 4) | ((___x & (u16)0x0F0FU) << 4);     \
+        ___x = ((___x & (u16)0xCCCCU) >> 2) | ((___x & (u16)0x3333U) << 2);     \
+        ___x = ((___x & (u16)0xAAAAU) >> 1) | ((___x & (u16)0x5555U) << 1);     \
+        ___x;                                                           \
 })
 
 #define __constant_bitrev8x4(x) \
 ({                      \
-        u32 __x = x;    \
-        __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4);      \
-        __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2);      \
-        __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1);      \
-        __x;                                                            \
+        u32 ___x = x;   \
+        ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4);   \
+        ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2);   \
+        ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1);   \
+        ___x;                                                           \
 })
 
 #define __constant_bitrev8(x)   \
 ({                                      \
-        u8 __x = x;                     \
-        __x = (__x >> 4) | (__x << 4);  \
-        __x = ((__x & (u8)0xCCU) >> 2) | ((__x & (u8)0x33U) << 2);      \
-        __x = ((__x & (u8)0xAAU) >> 1) | ((__x & (u8)0x55U) << 1);      \
-        __x;                                                            \
+        u8 ___x = x;                    \
+        ___x = (___x >> 4) | (___x << 4);       \
+        ___x = ((___x & (u8)0xCCU) >> 2) | ((___x & (u8)0x33U) << 2);   \
+        ___x = ((___x & (u8)0xAAU) >> 1) | ((___x & (u8)0x55U) << 1);   \
+        ___x;                                                           \
 })
 
 #define bitrev32(x) \
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index cb2aa7ecafff..db29928de467 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -302,6 +302,7 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list);
 void blk_mq_kick_requeue_list(struct request_queue *q);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
 bool blk_mq_complete_request(struct request *rq);
+void blk_mq_complete_request_sync(struct request *rq);
 bool blk_mq_bio_list_merge(struct request_queue *q, struct list_head *list,
                            struct bio *bio);
 bool blk_mq_queue_stopped(struct request_queue *q);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 5c58a3b2bf00..317ab30d2904 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -548,7 +548,6 @@ struct request_queue {
         struct rcu_head         rcu_head;
         wait_queue_head_t       mq_freeze_wq;
         struct percpu_ref       q_usage_counter;
-        struct list_head        all_q_node;
 
         struct blk_mq_tag_set   *tag_set;
         struct list_head        tag_set_list;
diff --git a/include/linux/bvec.h b/include/linux/bvec.h
index f6275c4da13a..ff13cbc1887d 100644
--- a/include/linux/bvec.h
+++ b/include/linux/bvec.h
@@ -145,26 +145,33 @@ static inline bool bvec_iter_advance(const struct bio_vec *bv,
 
 static inline struct bio_vec *bvec_init_iter_all(struct bvec_iter_all *iter_all)
 {
-        iter_all->bv.bv_page = NULL;
         iter_all->done = 0;
+        iter_all->idx = 0;
 
         return &iter_all->bv;
 }
 
-static inline void mp_bvec_next_segment(const struct bio_vec *bvec,
-                                        struct bvec_iter_all *iter_all)
+static inline void bvec_advance(const struct bio_vec *bvec,
+                                struct bvec_iter_all *iter_all)
 {
         struct bio_vec *bv = &iter_all->bv;
 
-        if (bv->bv_page) {
+        if (iter_all->done) {
                 bv->bv_page = nth_page(bv->bv_page, 1);
                 bv->bv_offset = 0;
         } else {
-                bv->bv_page = bvec->bv_page;
-                bv->bv_offset = bvec->bv_offset;
+                bv->bv_page = bvec_nth_page(bvec->bv_page, bvec->bv_offset /
+                                            PAGE_SIZE);
+                bv->bv_offset = bvec->bv_offset & ~PAGE_MASK;
         }
         bv->bv_len = min_t(unsigned int, PAGE_SIZE - bv->bv_offset,
                            bvec->bv_len - iter_all->done);
+        iter_all->done += bv->bv_len;
+
+        if (iter_all->done == bvec->bv_len) {
+                iter_all->idx++;
+                iter_all->done = 0;
+        }
 }
 
 /*
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 54357a258b35..6ebc2098cfe1 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1611,7 +1611,12 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg,
                            struct screen_info *si, efi_guid_t *proto,
                            unsigned long size);
 
-bool efi_runtime_disabled(void);
+#ifdef CONFIG_EFI
+extern bool efi_runtime_disabled(void);
+#else
+static inline bool efi_runtime_disabled(void) { return true; }
+#endif
+
 extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
 extern unsigned long efi_call_virt_save_flags(void);
 
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 2e9e2763bf47..6e8bc53740f0 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -31,6 +31,7 @@ struct elevator_mq_ops {
         void (*exit_sched)(struct elevator_queue *);
         int (*init_hctx)(struct blk_mq_hw_ctx *, unsigned int);
         void (*exit_hctx)(struct blk_mq_hw_ctx *, unsigned int);
+        void (*depth_updated)(struct blk_mq_hw_ctx *);
 
         bool (*allow_merge)(struct request_queue *, struct request *, struct bio *);
         bool (*bio_merge)(struct blk_mq_hw_ctx *, struct bio *);
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index e2f3b21cd72a..aa8bfd6f738c 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -449,6 +449,18 @@ static inline void eth_addr_dec(u8 *addr)
 }
 
 /**
+ * eth_addr_inc() - Increment the given MAC address.
+ * @addr: Pointer to a six-byte array containing Ethernet address to increment.
+ */
+static inline void eth_addr_inc(u8 *addr)
+{
+        u64 u = ether_addr_to_u64(addr);
+
+        u++;
+        u64_to_ether_addr(u, addr);
+}
+
+/**
  * is_etherdev_addr - Tell if given Ethernet address belongs to the device.
  * @dev: Pointer to a device structure
  * @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 8b42df09b04c..dd28e7679089 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -158,6 +158,9 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 #define FMODE_OPENED            ((__force fmode_t)0x80000)
 #define FMODE_CREATED           ((__force fmode_t)0x100000)
 
+/* File is stream-like */
+#define FMODE_STREAM            ((__force fmode_t)0x200000)
+
 /* File was opened by fanotify and shouldn't generate fanotify events */
 #define FMODE_NONOTIFY          ((__force fmode_t)0x4000000)
 
@@ -3074,6 +3077,7 @@ extern loff_t no_seek_end_llseek_size(struct file *, loff_t, int, loff_t);
 extern loff_t no_seek_end_llseek(struct file *, loff_t, int);
 extern int generic_file_open(struct inode * inode, struct file * filp);
 extern int nonseekable_open(struct inode * inode, struct file * filp);
+extern int stream_open(struct inode * inode, struct file * filp);
 
 #ifdef CONFIG_BLOCK
 typedef void (dio_submit_t)(struct bio *bio, struct inode *inode,
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 34a5036debd3..2d14e21c16c0 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -47,8 +47,8 @@
 
 #define u64_to_user_ptr(x) (            \
 {                                       \
-        typecheck(u64, x);              \
-        (void __user *)(uintptr_t)x;    \
+        typecheck(u64, (x));            \
+        (void __user *)(uintptr_t)(x);  \
 }                                       \
 )
 
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index 201f0f2683f2..9a897256e481 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -173,6 +173,7 @@ struct kretprobe_instance {
         struct kretprobe *rp;
         kprobe_opcode_t *ret_addr;
         struct task_struct *task;
+        void *fp;
         char data[0];
 };
 
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 9d55c63db09b..640a03642766 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -28,6 +28,7 @@
 #include <linux/irqbypass.h>
 #include <linux/swait.h>
 #include <linux/refcount.h>
+#include <linux/nospec.h>
 #include <asm/signal.h>
 
 #include <linux/kvm.h>
@@ -513,10 +514,10 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx)
 
 static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
 {
-        /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu, in case
-         * the caller has read kvm->online_vcpus before (as is the case
-         * for kvm_for_each_vcpu, for example).
-         */
+        int num_vcpus = atomic_read(&kvm->online_vcpus);
+        i = array_index_nospec(i, num_vcpus);
+
+        /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu.  */
         smp_rmb();
         return kvm->vcpus[i];
 }
@@ -600,6 +601,7 @@ void kvm_put_kvm(struct kvm *kvm);
 
 static inline struct kvm_memslots *__kvm_memslots(struct kvm *kvm, int as_id)
 {
+        as_id = array_index_nospec(as_id, KVM_ADDRESS_SPACE_NUM);
         return srcu_dereference_check(kvm->memslots[as_id], &kvm->srcu,
                         lockdep_is_held(&kvm->slots_lock) ||
                         !refcount_read(&kvm->users_count));
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 1f3d880b7ca1..dbb6118370c1 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -566,7 +566,10 @@ struct mem_cgroup *lock_page_memcg(struct page *page);
 void __unlock_page_memcg(struct mem_cgroup *memcg);
 void unlock_page_memcg(struct page *page);
 
-/* idx can be of type enum memcg_stat_item or node_stat_item */
+/*
+ * idx can be of type enum memcg_stat_item or node_stat_item.
+ * Keep in sync with memcg_exact_page_state().
+ */
 static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
                                              int idx)
 {
diff --git a/include/linux/mii.h b/include/linux/mii.h
index 6fee8b1a4400..5cd824c1c0ca 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -469,7 +469,7 @@ static inline u32 linkmode_adv_to_lcl_adv_t(unsigned long *advertising)
         if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
                               advertising))
                 lcl_adv |= ADVERTISE_PAUSE_CAP;
-        if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
+        if (linkmode_test_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
                               advertising))
                 lcl_adv |= ADVERTISE_PAUSE_ASYM;
 
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 022541dc5dbf..0d0729648844 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -594,6 +594,8 @@ enum mlx5_pagefault_type_flags {
 };
 
 struct mlx5_td {
+        /* protects tirs list changes while tirs refresh */
+        struct mutex     list_lock;
         struct list_head tirs_list;
         u32              tdn;
 };
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 76769749b5a5..6b10c21630f5 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -966,6 +966,10 @@ static inline bool is_pci_p2pdma_page(const struct page *page)
 }
 #endif /* CONFIG_DEV_PAGEMAP_OPS */
 
+/* 127: arbitrary random number, small enough to assemble well */
+#define page_ref_zero_or_close_to_overflow(page) \
+        ((unsigned int) page_ref_count(page) + 127u <= 127u)
+
 static inline void get_page(struct page *page)
 {
         page = compound_head(page);
@@ -973,8 +977,17 @@ static inline void get_page(struct page *page)
          * Getting a normal page or the head of a compound page
          * requires to already have an elevated page->_refcount.
          */
-        VM_BUG_ON_PAGE(page_ref_count(page) <= 0, page);
+        VM_BUG_ON_PAGE(page_ref_zero_or_close_to_overflow(page), page);
+        page_ref_inc(page);
+}
+
+static inline __must_check bool try_get_page(struct page *page)
+{
+        page = compound_head(page);
+        if (WARN_ON_ONCE(page_ref_count(page) <= 0))
+                return false;
         page_ref_inc(page);
+        return true;
 }
 
 static inline void put_page(struct page *page)
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 7eade9132f02..4ef4bbe78a1d 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -671,7 +671,7 @@ enum vm_fault_reason {
 
 /* Encode hstate index for a hwpoisoned large page */
 #define VM_FAULT_SET_HINDEX(x) ((__force vm_fault_t)((x) << 16))
-#define VM_FAULT_GET_HINDEX(x) (((x) >> 16) & 0xf)
+#define VM_FAULT_GET_HINDEX(x) (((__force unsigned int)(x) >> 16) & 0xf)
 
 #define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS |        \
                         VM_FAULT_SIGSEGV | VM_FAULT_HWPOISON |  \
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 26f69cf763f4..324e872c91d1 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1500,6 +1500,7 @@ struct net_device_ops {
  * @IFF_FAILOVER: device is a failover master device
  * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
  * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
+ * @IFF_LIVE_RENAME_OK: rename is allowed while device is up and running
  */
 enum netdev_priv_flags {
         IFF_802_1Q_VLAN                 = 1<<0,
@@ -1532,6 +1533,7 @@ enum netdev_priv_flags {
         IFF_FAILOVER                    = 1<<27,
         IFF_FAILOVER_SLAVE              = 1<<28,
         IFF_L3MDEV_RX_HANDLER           = 1<<29,
+        IFF_LIVE_RENAME_OK              = 1<<30,
 };
 
 #define IFF_802_1Q_VLAN                 IFF_802_1Q_VLAN
@@ -1563,6 +1565,7 @@ enum netdev_priv_flags {
 #define IFF_FAILOVER                    IFF_FAILOVER
 #define IFF_FAILOVER_SLAVE              IFF_FAILOVER_SLAVE
 #define IFF_L3MDEV_RX_HANDLER           IFF_L3MDEV_RX_HANDLER
+#define IFF_LIVE_RENAME_OK              IFF_LIVE_RENAME_OK
 
 /**
  *      struct net_device - The DEVICE structure.
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index baa49e6a23cc..c40720cb59ac 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -967,8 +967,13 @@ struct nvme_get_log_page_command {
         __le16                  numdl;
         __le16                  numdu;
         __u16                   rsvd11;
-        __le32                  lpol;
-        __le32                  lpou;
+        union {
+                struct {
+                        __le32 lpol;
+                        __le32 lpou;
+                };
+                __le64 lpo;
+        };
         __u32                   rsvd14[2];
 };
 
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 787d224ff43e..5c626fdc10db 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -101,18 +101,20 @@ struct pipe_buf_operations {
         /*
          * Get a reference to the pipe buffer.
          */
-        void (*get)(struct pipe_inode_info *, struct pipe_buffer *);
+        bool (*get)(struct pipe_inode_info *, struct pipe_buffer *);
 };
 
 /**
  * pipe_buf_get - get a reference to a pipe_buffer
  * @pipe:       the pipe that the buffer belongs to
  * @buf:        the buffer to get a reference to
+ *
+ * Return: %true if the reference was successfully obtained.
  */
-static inline void pipe_buf_get(struct pipe_inode_info *pipe,
+static inline __must_check bool pipe_buf_get(struct pipe_inode_info *pipe,
                                 struct pipe_buffer *buf)
 {
-        buf->ops->get(pipe, buf);
+        return buf->ops->get(pipe, buf);
 }
 
 /**
@@ -171,9 +173,10 @@ struct pipe_inode_info *alloc_pipe_info(void);
 void free_pipe_info(struct pipe_inode_info *);
 
 /* Generic pipe buffer ops functions */
-void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+bool generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
 int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
 int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
+int generic_pipe_buf_nosteal(struct pipe_inode_info *, struct pipe_buffer *);
 void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
 void pipe_buf_mark_unmergeable(struct pipe_buffer *buf);
 
diff --git a/include/linux/platform_data/x86/clk-pmc-atom.h b/include/linux/platform_data/x86/clk-pmc-atom.h
index 3ab892208343..7a37ac27d0fb 100644
--- a/include/linux/platform_data/x86/clk-pmc-atom.h
+++ b/include/linux/platform_data/x86/clk-pmc-atom.h
@@ -35,10 +35,13 @@ struct pmc_clk {
  *
  * @base:       PMC clock register base offset
  * @clks:       pointer to set of registered clocks, typically 0..5
+ * @critical:   flag to indicate if firmware enabled pmc_plt_clks
+ *              should be marked as critial or not
  */
 struct pmc_clk_data {
         void __iomem *base;
         const struct pmc_clk *clks;
+        bool critical;
 };
 
 #endif /* __PLATFORM_DATA_X86_CLK_PMC_ATOM_H */
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index edb9b040c94c..d5084ebd9f03 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -9,6 +9,13 @@
 #include <linux/bug.h>                  /* For BUG_ON.  */
 #include <linux/pid_namespace.h>        /* For task_active_pid_ns.  */
 #include <uapi/linux/ptrace.h>
+#include <linux/seccomp.h>
+
+/* Add sp to seccomp_data, as seccomp is user API, we don't want to modify it */
+struct syscall_info {
+        __u64                   sp;
+        struct seccomp_data     data;
+};
 
 extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
                             void *buf, int len, unsigned int gup_flags);
@@ -407,9 +414,7 @@ static inline void user_single_step_report(struct pt_regs *regs)
 #define current_user_stack_pointer() user_stack_pointer(current_pt_regs())
 #endif
 
-extern int task_current_syscall(struct task_struct *target, long *callno,
-                                unsigned long args[6], unsigned int maxargs,
-                                unsigned long *sp, unsigned long *pc);
+extern int task_current_syscall(struct task_struct *target, struct syscall_info *info);
 
 extern void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact);
 #endif
diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index 0cd9f10423fb..a3fda9f024c3 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -49,6 +49,27 @@ static inline void mmdrop(struct mm_struct *mm)
                 __mmdrop(mm);
 }
 
+/*
+ * This has to be called after a get_task_mm()/mmget_not_zero()
+ * followed by taking the mmap_sem for writing before modifying the
+ * vmas or anything the coredump pretends not to change from under it.
+ *
+ * NOTE: find_extend_vma() called from GUP context is the only place
+ * that can modify the "mm" (notably the vm_start/end) under mmap_sem
+ * for reading and outside the context of the process, so it is also
+ * the only case that holds the mmap_sem for reading that must call
+ * this function. Generally if the mmap_sem is hold for reading
+ * there's no need of this check after get_task_mm()/mmget_not_zero().
+ *
+ * This function can be obsoleted and the check can be removed, after
+ * the coredump code will hold the mmap_sem for writing before
+ * invoking the ->core_dump methods.
+ */
+static inline bool mmget_still_valid(struct mm_struct *mm)
+{
+        return likely(!mm->core_state);
+}
+
 /**
  * mmget() - Pin the address space associated with a &struct mm_struct.
  * @mm: The address space to pin.
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index f3fb1edb3526..20d815a33145 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -21,6 +21,7 @@ struct shmem_inode_info {
         struct list_head        swaplist;       /* chain of maybes on swap */
         struct shared_policy    policy;         /* NUMA memory alloc policy */
         struct simple_xattrs    xattrs;         /* list of xattrs */
+        atomic_t                stop_eviction;  /* hold when working on inode */
         struct inode            vfs_inode;
 };
 
diff --git a/include/linux/string.h b/include/linux/string.h
index 7927b875f80c..6ab0a6fa512e 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -150,6 +150,9 @@ extern void * memscan(void *,int,__kernel_size_t);
 #ifndef __HAVE_ARCH_MEMCMP
 extern int memcmp(const void *,const void *,__kernel_size_t);
 #endif
+#ifndef __HAVE_ARCH_BCMP
+extern int bcmp(const void *,const void *,__kernel_size_t);
+#endif
 #ifndef __HAVE_ARCH_MEMCHR
 extern void * memchr(const void *,int,__kernel_size_t);
 #endif
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index ec861cd0cfe8..52d41d0c1ae1 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -304,12 +304,4 @@ rpc_clnt_swap_deactivate(struct rpc_clnt *clnt)
 }
 #endif /* CONFIG_SUNRPC_SWAP */
 
-static inline bool
-rpc_task_need_resched(const struct rpc_task *task)
-{
-        if (RPC_IS_QUEUED(task) || task->tk_callback)
-                return true;
-        return false;
-}
-
 #endif /* _LINUX_SUNRPC_SCHED_H_ */
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index fab02133a919..3dc70adfe5f5 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -63,7 +63,7 @@ struct virtqueue;
 /*
  * Creates a virtqueue and allocates the descriptor ring.  If
  * may_reduce_num is set, then this may allocate a smaller ring than
- * expected.  The caller should query virtqueue_get_ring_size to learn
+ * expected.  The caller should query virtqueue_get_vring_size to learn
  * the actual size of the ring.
  */
 struct virtqueue *vring_create_virtqueue(unsigned int index,
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 2bfb87eb98ce..78c856cba4f5 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -61,10 +61,12 @@ int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t,
                                rxrpc_user_attach_call_t, unsigned long, gfp_t,
                                unsigned int);
 void rxrpc_kernel_set_tx_length(struct socket *, struct rxrpc_call *, s64);
-u32 rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
+bool rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *,
+                             u32 *);
 void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
 u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
 bool rxrpc_kernel_get_reply_time(struct socket *, struct rxrpc_call *,
                                  ktime_t *);
+bool rxrpc_kernel_call_is_complete(struct rxrpc_call *);
 
 #endif /* _NET_RXRPC_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index bb307a11ee63..13bfeb712d36 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -7183,6 +7183,11 @@ void cfg80211_pmsr_complete(struct wireless_dev *wdev,
 #define wiphy_info(wiphy, format, args...)                      \
         dev_info(&(wiphy)->dev, format, ##args)
 
+#define wiphy_err_ratelimited(wiphy, format, args...)           \
+        dev_err_ratelimited(&(wiphy)->dev, format, ##args)
+#define wiphy_warn_ratelimited(wiphy, format, args...)          \
+        dev_warn_ratelimited(&(wiphy)->dev, format, ##args)
+
 #define wiphy_debug(wiphy, format, args...)                     \
         wiphy_printk(KERN_DEBUG, wiphy, format, ##args)
 
diff --git a/include/net/ip.h b/include/net/ip.h
index be3cad9c2e4c..583526aad1d0 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -677,7 +677,7 @@ int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                              unsigned char __user *data, int optlen);
 void ip_options_undo(struct ip_options *opt);
 void ip_forward_options(struct sk_buff *skb);
-int ip_options_rcv_srr(struct sk_buff *skb);
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev);
 
 /*
  *      Functions provided by ip_sockglue.c
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ac2ed8ec662b..112dc18c658f 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -6231,8 +6231,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @ac: AC number to return packets from.
  *
- * Should only be called between calls to ieee80211_txq_schedule_start()
- * and ieee80211_txq_schedule_end().
  * Returns the next txq if successful, %NULL if no queue is eligible. If a txq
  * is returned, it should be returned with ieee80211_return_txq() after the
  * driver has finished scheduling it.
@@ -6240,51 +6238,58 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac);
 
 /**
- * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
- *
- * @hw: pointer as obtained from ieee80211_alloc_hw()
- * @txq: pointer obtained from station or virtual interface
- *
- * Should only be called between calls to ieee80211_txq_schedule_start()
- * and ieee80211_txq_schedule_end().
- */
-void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
-
-/**
- * ieee80211_txq_schedule_start - acquire locks for safe scheduling of an AC
+ * ieee80211_txq_schedule_start - start new scheduling round for TXQs
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @ac: AC number to acquire locks for
  *
- * Acquire locks needed to schedule TXQs from the given AC. Should be called
- * before ieee80211_next_txq() or ieee80211_return_txq().
+ * Should be called before ieee80211_next_txq() or ieee80211_return_txq().
+ * The driver must not call multiple TXQ scheduling rounds concurrently.
  */
-void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
-        __acquires(txq_lock);
+void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac);
+
+/* (deprecated) */
+static inline void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
+{
+}
+
+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+                              struct ieee80211_txq *txq, bool force);
 
 /**
- * ieee80211_txq_schedule_end - release locks for safe scheduling of an AC
+ * ieee80211_schedule_txq - schedule a TXQ for transmission
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
- * @ac: AC number to acquire locks for
+ * @txq: pointer obtained from station or virtual interface
  *
- * Release locks previously acquired by ieee80211_txq_schedule_end().
+ * Schedules a TXQ for transmission if it is not already scheduled,
+ * even if mac80211 does not have any packets buffered.
+ *
+ * The driver may call this function if it has buffered packets for
+ * this TXQ internally.
  */
-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
-        __releases(txq_lock);
+static inline void
+ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
+{
+        __ieee80211_schedule_txq(hw, txq, true);
+}
 
 /**
- * ieee80211_schedule_txq - schedule a TXQ for transmission
+ * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @txq: pointer obtained from station or virtual interface
+ * @force: schedule txq even if mac80211 does not have any buffered packets.
  *
- * Schedules a TXQ for transmission if it is not already scheduled. Takes a
- * lock, which means it must *not* be called between
- * ieee80211_txq_schedule_start() and ieee80211_txq_schedule_end()
+ * The driver may set force=true if it has buffered packets for this TXQ
+ * internally.
  */
-void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
-        __acquires(txq_lock) __releases(txq_lock);
+static inline void
+ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
+                     bool force)
+{
+        __ieee80211_schedule_txq(hw, txq, force);
+}
 
 /**
  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index a68ced28d8f4..12689ddfc24c 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -59,6 +59,7 @@ struct net {
                                                  */
         spinlock_t              rules_mod_lock;
 
+        u32                     hash_mix;
         atomic64_t              cookie_gen;
 
         struct list_head        list;           /* list of network namespaces */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 5ee7b30b4917..d2bc733a2ef1 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -316,6 +316,8 @@ struct nf_conn *nf_ct_tmpl_alloc(struct net *net,
                                  gfp_t flags);
 void nf_ct_tmpl_free(struct nf_conn *tmpl);
 
+u32 nf_ct_get_id(const struct nf_conn *ct);
+
 static inline void
 nf_ct_set(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info info)
 {
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 778087591983..a49edfdf47e8 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -75,6 +75,12 @@ bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
 bool nf_conntrack_invert_icmpv6_tuple(struct nf_conntrack_tuple *tuple,
                                       const struct nf_conntrack_tuple *orig);
 
+int nf_conntrack_inet_error(struct nf_conn *tmpl, struct sk_buff *skb,
+                            unsigned int dataoff,
+                            const struct nf_hook_state *state,
+                            u8 l4proto,
+                            union nf_inet_addr *outer_daddr);
+
 int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
                               struct sk_buff *skb,
                               unsigned int dataoff,
diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h
index 16a842456189..d9b665151f3d 100644
--- a/include/net/netns/hash.h
+++ b/include/net/netns/hash.h
@@ -2,16 +2,10 @@
 #ifndef __NET_NS_HASH_H__
 #define __NET_NS_HASH_H__
 
-#include <asm/cache.h>
-
-struct net;
+#include <net/net_namespace.h>
 
 static inline u32 net_hash_mix(const struct net *net)
 {
-#ifdef CONFIG_NET_NS
-        return (u32)(((unsigned long)net) >> ilog2(sizeof(*net)));
-#else
-        return 0;
-#endif
+        return net->hash_mix;
 }
 #endif
diff --git a/include/net/netrom.h b/include/net/netrom.h
index 5a0714ff500f..80f15b1c1a48 100644
--- a/include/net/netrom.h
+++ b/include/net/netrom.h
@@ -266,7 +266,7 @@ void nr_stop_idletimer(struct sock *);
 int nr_t1timer_running(struct sock *);
 
 /* sysctl_net_netrom.c */
-void nr_register_sysctl(void);
+int nr_register_sysctl(void);
 void nr_unregister_sysctl(void);
 
 #endif
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 87499b6b35d6..df5c69db68af 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -166,7 +166,7 @@ struct nci_conn_info {
  * According to specification 102 622 chapter 4.4 Pipes,
  * the pipe identifier is 7 bits long.
  */
-#define NCI_HCI_MAX_PIPES          127
+#define NCI_HCI_MAX_PIPES          128
 
 struct nci_hci_gate {
         u8 gate;
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 7d1a0483a17b..a2b38b3deeca 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -923,6 +923,41 @@ static inline void qdisc_qstats_overlimit(struct Qdisc *sch)
         sch->qstats.overlimits++;
 }
 
+static inline int qdisc_qstats_copy(struct gnet_dump *d, struct Qdisc *sch)
+{
+        __u32 qlen = qdisc_qlen_sum(sch);
+
+        return gnet_stats_copy_queue(d, sch->cpu_qstats, &sch->qstats, qlen);
+}
+
+static inline void qdisc_qstats_qlen_backlog(struct Qdisc *sch,  __u32 *qlen,
+                                             __u32 *backlog)
+{
+        struct gnet_stats_queue qstats = { 0 };
+        __u32 len = qdisc_qlen_sum(sch);
+
+        __gnet_stats_copy_queue(&qstats, sch->cpu_qstats, &sch->qstats, len);
+        *qlen = qstats.qlen;
+        *backlog = qstats.backlog;
+}
+
+static inline void qdisc_tree_flush_backlog(struct Qdisc *sch)
+{
+        __u32 qlen, backlog;
+
+        qdisc_qstats_qlen_backlog(sch, &qlen, &backlog);
+        qdisc_tree_reduce_backlog(sch, qlen, backlog);
+}
+
+static inline void qdisc_purge_queue(struct Qdisc *sch)
+{
+        __u32 qlen, backlog;
+
+        qdisc_qstats_qlen_backlog(sch, &qlen, &backlog);
+        qdisc_reset(sch);
+        qdisc_tree_reduce_backlog(sch, qlen, backlog);
+}
+
 static inline void qdisc_skb_head_init(struct qdisc_skb_head *qh)
 {
         qh->head = NULL;
@@ -1106,13 +1141,8 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
         sch_tree_lock(sch);
         old = *pold;
         *pold = new;
-        if (old != NULL) {
-                unsigned int qlen = old->q.qlen;
-                unsigned int backlog = old->qstats.backlog;
-
-                qdisc_reset(old);
-                qdisc_tree_reduce_backlog(old, qlen, backlog);
-        }
+        if (old != NULL)
+                qdisc_tree_flush_backlog(old);
         sch_tree_unlock(sch);
 
         return old;
diff --git a/include/net/sock.h b/include/net/sock.h
index 8de5ee258b93..341f8bafa0cf 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2084,12 +2084,6 @@ static inline bool skwq_has_sleeper(struct socket_wq *wq)
  * @p:              poll_table
  *
  * See the comments in the wq_has_sleeper function.
- *
- * Do not derive sock from filp->private_data here. An SMC socket establishes
- * an internal TCP socket that is used in the fallback case. All socket
- * operations on the SMC socket are then forwarded to the TCP socket. In case of
- * poll, the filp->private_data pointer references the SMC socket because the
- * TCP socket has no file assigned.
  */
 static inline void sock_poll_wait(struct file *filp, struct socket *sock,
                                   poll_table *p)
diff --git a/include/net/tls.h b/include/net/tls.h
index a5a938583295..5934246b2c6f 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -307,6 +307,7 @@ int tls_device_sendmsg(struct sock *sk, struct msghdr *msg, size_t size);
 int tls_device_sendpage(struct sock *sk, struct page *page,
                         int offset, size_t size, int flags);
 void tls_device_sk_destruct(struct sock *sk);
+void tls_device_free_resources_tx(struct sock *sk);
 void tls_device_init(void);
 void tls_device_cleanup(void);
 int tls_tx_records(struct sock *sk, int flags);
@@ -330,6 +331,7 @@ int tls_push_sg(struct sock *sk, struct tls_context *ctx,
                 int flags);
 int tls_push_partial_record(struct sock *sk, struct tls_context *ctx,
                             int flags);
+bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx);
 
 static inline struct tls_msg *tls_msg(struct sk_buff *skb)
 {
@@ -379,7 +381,7 @@ tls_validate_xmit_skb(struct sock *sk, struct net_device *dev,
 static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
 {
 #ifdef CONFIG_SOCK_VALIDATE_XMIT
-        return sk_fullsock(sk) &
+        return sk_fullsock(sk) &&
                (smp_load_acquire(&sk->sk_validate_xmit_skb) ==
                &tls_validate_xmit_skb);
 #else
diff --git a/include/sound/soc.h b/include/sound/soc.h
index eb7db605955b..482b4ea87c3c 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -802,8 +802,13 @@ struct snd_soc_component_driver {
         int probe_order;
         int remove_order;
 
-        /* signal if the module handling the component cannot be removed */
-        unsigned int ignore_module_refcount:1;
+        /*
+         * signal if the module handling the component should not be removed
+         * if a pcm is open. Setting this would prevent the module
+         * refcount being incremented in probe() but allow it be incremented
+         * when a pcm is opened and decremented when it is closed.
+         */
+        unsigned int module_get_upon_open:1;
 
         /* bits */
         unsigned int idle_bias_on:1;
@@ -1083,6 +1088,8 @@ struct snd_soc_card {
         struct mutex mutex;
         struct mutex dapm_mutex;
 
+        spinlock_t dpcm_lock;
+
         bool instantiated;
         bool topology_shortname_created;
 
diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h
index 44a3259ed4a5..b6e0cbc2c71f 100644
--- a/include/trace/events/syscalls.h
+++ b/include/trace/events/syscalls.h
@@ -28,7 +28,7 @@ TRACE_EVENT_FN(sys_enter,
 
         TP_fast_assign(
                 __entry->id     = id;
-                syscall_get_arguments(current, regs, 0, 6, __entry->args);
+                syscall_get_arguments(current, regs, __entry->args);
         ),
 
         TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 3652b239dad1..d473e5ed044c 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1591,7 +1591,7 @@ enum ethtool_link_mode_bit_indices {
 
 static inline int ethtool_validate_speed(__u32 speed)
 {
-        return speed <= INT_MAX || speed == SPEED_UNKNOWN;
+        return speed <= INT_MAX || speed == (__u32)SPEED_UNKNOWN;
 }
 
 /* Duplex, half or full. */
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 7f14d4a66c28..64cee116928e 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -439,10 +439,12 @@
 #define KEY_TITLE               0x171
 #define KEY_SUBTITLE            0x172
 #define KEY_ANGLE               0x173
-#define KEY_ZOOM                0x174
+#define KEY_FULL_SCREEN         0x174   /* AC View Toggle */
+#define KEY_ZOOM                KEY_FULL_SCREEN
 #define KEY_MODE                0x175
 #define KEY_KEYBOARD            0x176
-#define KEY_SCREEN              0x177
+#define KEY_ASPECT_RATIO        0x177   /* HUTRR37: Aspect */
+#define KEY_SCREEN              KEY_ASPECT_RATIO
 #define KEY_PC                  0x178   /* Media Select Computer */
 #define KEY_TV                  0x179   /* Media Select TV */
 #define KEY_TV2                 0x17a   /* Media Select Cable */
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index 87b3198f4b5d..f4d4010b7e3e 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -238,6 +238,7 @@ enum mlx5_ib_query_dev_resp_flags {
         MLX5_IB_QUERY_DEV_RESP_FLAGS_CQE_128B_COMP = 1 << 0,
         MLX5_IB_QUERY_DEV_RESP_FLAGS_CQE_128B_PAD  = 1 << 1,
         MLX5_IB_QUERY_DEV_RESP_PACKET_BASED_CREDIT_MODE = 1 << 2,
+        MLX5_IB_QUERY_DEV_RESP_FLAGS_SCAT2CQE_DCT = 1 << 3,
 };
 
 enum mlx5_ib_tunnel_offloads {
diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h
index 404d4b9ffe76..df1153cea0b7 100644
--- a/include/uapi/sound/asound.h
+++ b/include/uapi/sound/asound.h
@@ -32,6 +32,7 @@
 
 #ifndef __KERNEL__
 #include <stdlib.h>
+#include <time.h>
 #endif
 
 /*
diff --git a/init/main.c b/init/main.c
index 598e278b46f7..7d4025d665eb 100644
--- a/init/main.c
+++ b/init/main.c
@@ -582,6 +582,8 @@ asmlinkage __visible void __init start_kernel(void)
         page_alloc_init();
 
         pr_notice("Kernel command line: %s\n", boot_command_line);
+        /* parameters may set static keys */
+        jump_label_init();
         parse_early_param();
         after_dashes = parse_args("Booting kernel",
                                   static_command_line, __start___param,
@@ -591,8 +593,6 @@ asmlinkage __visible void __init start_kernel(void)
                 parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
                            NULL, set_init_arg);
 
-        jump_label_init();
-
         /*
          * These use large bootmem allocations and must precede
          * kmem_cache_init()
diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
index 8974b3755670..3c18260403dd 100644
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
 static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
                                          struct xdp_frame *xdpf)
 {
+        unsigned int hard_start_headroom;
         unsigned int frame_size;
         void *pkt_data_start;
         struct sk_buff *skb;
 
+        /* Part of headroom was reserved to xdpf */
+        hard_start_headroom = sizeof(struct xdp_frame) +  xdpf->headroom;
+
         /* build_skb need to place skb_shared_info after SKB end, and
          * also want to know the memory "truesize".  Thus, need to
          * know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
          * is not at a fixed memory location, with mixed length
          * packets, which is bad for cache-line hotness.
          */
-        frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
+        frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
                 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
-        pkt_data_start = xdpf->data - xdpf->headroom;
+        pkt_data_start = xdpf->data - hard_start_headroom;
         skb = build_skb(pkt_data_start, frame_size);
         if (!skb)
                 return NULL;
 
-        skb_reserve(skb, xdpf->headroom);
+        skb_reserve(skb, hard_start_headroom);
         __skb_put(skb, xdpf->len);
         if (xdpf->metasize)
                 skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
          * - RX ring dev queue index    (skb_record_rx_queue)
          */
 
+        /* Allow SKB to reuse area used by xdp_frame */
+        xdp_scrub_frame(xdpf);
+
         return skb;
 }
 
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 2ada5e21dfa6..4a8f390a2b82 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ
 }
 EXPORT_SYMBOL(bpf_prog_get_type_path);
 
-static void bpf_evict_inode(struct inode *inode)
-{
-        enum bpf_type type;
-
-        truncate_inode_pages_final(&inode->i_data);
-        clear_inode(inode);
-
-        if (S_ISLNK(inode->i_mode))
-                kfree(inode->i_link);
-        if (!bpf_inode_type(inode, &type))
-                bpf_any_put(inode->i_private, type);
-}
-
 /*
  * Display the mount options in /proc/mounts.
  */
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
         return 0;
 }
 
+static void bpf_destroy_inode_deferred(struct rcu_head *head)
+{
+        struct inode *inode = container_of(head, struct inode, i_rcu);
+        enum bpf_type type;
+
+        if (S_ISLNK(inode->i_mode))
+                kfree(inode->i_link);
+        if (!bpf_inode_type(inode, &type))
+                bpf_any_put(inode->i_private, type);
+        free_inode_nonrcu(inode);
+}
+
+static void bpf_destroy_inode(struct inode *inode)
+{
+        call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
+}
+
 static const struct super_operations bpf_super_ops = {
         .statfs         = simple_statfs,
         .drop_inode     = generic_delete_inode,
         .show_options   = bpf_show_options,
-        .evict_inode    = bpf_evict_inode,
+        .destroy_inode  = bpf_destroy_inode,
 };
 
 enum {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fd502c1f71eb..6c5a41f7f338 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1897,8 +1897,9 @@ continue_func:
                 }
                 frame++;
                 if (frame >= MAX_CALL_FRAMES) {
-                        WARN_ONCE(1, "verifier bug. Call stack is too deep\n");
-                        return -EFAULT;
+                        verbose(env, "the call stack of %d frames is too deep !\n",
+                                frame);
+                        return -E2BIG;
                 }
                 goto process_func;
         }
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index 45d51e8e26f6..a218e43cc382 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -706,7 +706,7 @@ static struct dma_debug_entry *dma_entry_alloc(void)
 #ifdef CONFIG_STACKTRACE
         entry->stacktrace.max_entries = DMA_DEBUG_STACKTRACE_ENTRIES;
         entry->stacktrace.entries = entry->st_entries;
-        entry->stacktrace.skip = 2;
+        entry->stacktrace.skip = 1;
         save_stack_trace(&entry->stacktrace);
 #endif
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 72d06e302e99..dc7dead2d2cc 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2009,8 +2009,8 @@ event_sched_out(struct perf_event *event,
         event->pmu->del(event, 0);
         event->oncpu = -1;
 
-        if (event->pending_disable) {
-                event->pending_disable = 0;
+        if (READ_ONCE(event->pending_disable) >= 0) {
+                WRITE_ONCE(event->pending_disable, -1);
                 state = PERF_EVENT_STATE_OFF;
         }
         perf_event_set_state(event, state);
@@ -2198,7 +2198,8 @@ EXPORT_SYMBOL_GPL(perf_event_disable);
 
 void perf_event_disable_inatomic(struct perf_event *event)
 {
-        event->pending_disable = 1;
+        WRITE_ONCE(event->pending_disable, smp_processor_id());
+        /* can fail, see perf_pending_event_disable() */
         irq_work_queue(&event->pending);
 }
 
@@ -5810,10 +5811,45 @@ void perf_event_wakeup(struct perf_event *event)
         }
 }
 
+static void perf_pending_event_disable(struct perf_event *event)
+{
+        int cpu = READ_ONCE(event->pending_disable);
+
+        if (cpu < 0)
+                return;
+
+        if (cpu == smp_processor_id()) {
+                WRITE_ONCE(event->pending_disable, -1);
+                perf_event_disable_local(event);
+                return;
+        }
+
+        /*
+         *  CPU-A                       CPU-B
+         *
+         *  perf_event_disable_inatomic()
+         *    @pending_disable = CPU-A;
+         *    irq_work_queue();
+         *
+         *  sched-out
+         *    @pending_disable = -1;
+         *
+         *                              sched-in
+         *                              perf_event_disable_inatomic()
+         *                                @pending_disable = CPU-B;
+         *                                irq_work_queue(); // FAILS
+         *
+         *  irq_work_run()
+         *    perf_pending_event()
+         *
+         * But the event runs on CPU-B and wants disabling there.
+         */
+        irq_work_queue_on(&event->pending, cpu);
+}
+
 static void perf_pending_event(struct irq_work *entry)
 {
-        struct perf_event *event = container_of(entry,
-                        struct perf_event, pending);
+        struct perf_event *event = container_of(entry, struct perf_event, pending);
         int rctx;
 
         rctx = perf_swevent_get_recursion_context();
@@ -5822,10 +5858,7 @@ static void perf_pending_event(struct irq_work *entry)
          * and we won't recurse 'further'.
          */
 
-        if (event->pending_disable) {
-                event->pending_disable = 0;
-                perf_event_disable_local(event);
-        }
+        perf_pending_event_disable(event);
 
         if (event->pending_wakeup) {
                 event->pending_wakeup = 0;
@@ -9044,26 +9077,29 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         if (task == TASK_TOMBSTONE)
                 return;
 
-        if (!ifh->nr_file_filters)
-                return;
-
-        mm = get_task_mm(event->ctx->task);
-        if (!mm)
-                goto restart;
+        if (ifh->nr_file_filters) {
+                mm = get_task_mm(event->ctx->task);
+                if (!mm)
+                        goto restart;
 
-        down_read(&mm->mmap_sem);
+                down_read(&mm->mmap_sem);
+        }
 
         raw_spin_lock_irqsave(&ifh->lock, flags);
         list_for_each_entry(filter, &ifh->list, entry) {
-                event->addr_filter_ranges[count].start = 0;
-                event->addr_filter_ranges[count].size = 0;
+                if (filter->path.dentry) {
+                        /*
+                         * Adjust base offset if the filter is associated to a
+                         * binary that needs to be mapped:
+                         */
+                        event->addr_filter_ranges[count].start = 0;
+                        event->addr_filter_ranges[count].size = 0;
 
-                /*
-                 * Adjust base offset if the filter is associated to a binary
-                 * that needs to be mapped:
-                 */
-                if (filter->path.dentry)
                         perf_addr_filter_apply(filter, mm, &event->addr_filter_ranges[count]);
+                } else {
+                        event->addr_filter_ranges[count].start = filter->offset;
+                        event->addr_filter_ranges[count].size  = filter->size;
+                }
 
                 count++;
         }
@@ -9071,9 +9107,11 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         event->addr_filters_gen++;
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
-        up_read(&mm->mmap_sem);
+        if (ifh->nr_file_filters) {
+                up_read(&mm->mmap_sem);
 
-        mmput(mm);
+                mmput(mm);
+        }
 
 restart:
         perf_event_stop(event, 1);
@@ -10236,6 +10274,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 
 
         init_waitqueue_head(&event->waitq);
+        event->pending_disable = -1;
         init_irq_work(&event->pending, perf_pending_event);
 
         mutex_init(&event->mmap_mutex);
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index a4047321d7d8..5eedb49a65ea 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -392,7 +392,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
                  * store that will be enabled on successful return
                  */
                 if (!handle->size) { /* A, matches D */
-                        event->pending_disable = 1;
+                        event->pending_disable = smp_processor_id();
                         perf_output_wakeup(handle);
                         local_set(&rb->aux_nest, 0);
                         goto err_put;
@@ -455,24 +455,21 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
                 rb->aux_head += size;
         }
 
-        if (size || handle->aux_flags) {
-                /*
-                 * Only send RECORD_AUX if we have something useful to communicate
-                 *
-                 * Note: the OVERWRITE records by themselves are not considered
-                 * useful, as they don't communicate any *new* information,
-                 * aside from the short-lived offset, that becomes history at
-                 * the next event sched-in and therefore isn't useful.
-                 * The userspace that needs to copy out AUX data in overwrite
-                 * mode should know to use user_page::aux_head for the actual
-                 * offset. So, from now on we don't output AUX records that
-                 * have *only* OVERWRITE flag set.
-                 */
-
-                if (handle->aux_flags & ~(u64)PERF_AUX_FLAG_OVERWRITE)
-                        perf_event_aux_event(handle->event, aux_head, size,
-                                             handle->aux_flags);
-        }
+        /*
+         * Only send RECORD_AUX if we have something useful to communicate
+         *
+         * Note: the OVERWRITE records by themselves are not considered
+         * useful, as they don't communicate any *new* information,
+         * aside from the short-lived offset, that becomes history at
+         * the next event sched-in and therefore isn't useful.
+         * The userspace that needs to copy out AUX data in overwrite
+         * mode should know to use user_page::aux_head for the actual
+         * offset. So, from now on we don't output AUX records that
+         * have *only* OVERWRITE flag set.
+         */
+        if (size || (handle->aux_flags & ~(u64)PERF_AUX_FLAG_OVERWRITE))
+                perf_event_aux_event(handle->event, aux_head, size,
+                                     handle->aux_flags);
 
         rb->user_page->aux_head = rb->aux_head;
         if (rb_need_aux_wakeup(rb))
@@ -480,7 +477,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
 
         if (wakeup) {
                 if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED)
-                        handle->event->pending_disable = 1;
+                        handle->event->pending_disable = smp_processor_id();
                 perf_output_wakeup(handle);
         }
 
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 3faef4a77f71..51128bea3846 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1449,6 +1449,10 @@ int irq_chip_set_vcpu_affinity_parent(struct irq_data *data, void *vcpu_info)
 int irq_chip_set_wake_parent(struct irq_data *data, unsigned int on)
 {
         data = data->parent_data;
+
+        if (data->chip->flags & IRQCHIP_SKIP_SET_WAKE)
+                return 0;
+
         if (data->chip->irq_set_wake)
                 return data->chip->irq_set_wake(data, on);
 
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 13539e12cd80..9f8a709337cf 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -558,6 +558,7 @@ int __init early_irq_init(void)
                 alloc_masks(&desc[i], node);
                 raw_spin_lock_init(&desc[i].lock);
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
+                mutex_init(&desc[i].request_mutex);
                 desc_set_defaults(i, &desc[i], node, NULL, NULL);
         }
         return arch_early_irq_init();
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index c83e54727131..b1ea30a5540e 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -709,7 +709,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
 static int reuse_unused_kprobe(struct kprobe *ap)
 {
         struct optimized_kprobe *op;
-        int ret;
 
         /*
          * Unused kprobe MUST be on the way of delayed unoptimizing (means
@@ -720,9 +719,8 @@ static int reuse_unused_kprobe(struct kprobe *ap)
         /* Enable the probe again */
         ap->flags &= ~KPROBE_FLAG_DISABLED;
         /* Optimize it again (remove from op->list) */
-        ret = kprobe_optready(ap);
-        if (ret)
-                return ret;
+        if (!kprobe_optready(ap))
+                return -EINVAL;
 
         optimize_kprobe(ap);
         return 0;
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 34cdcbedda49..e221be724fe8 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -4689,8 +4689,8 @@ static void free_zapped_rcu(struct rcu_head *ch)
                 return;
 
         raw_local_irq_save(flags);
-        if (!graph_lock())
-                goto out_irq;
+        arch_spin_lock(&lockdep_lock);
+        current->lockdep_recursion = 1;
 
         /* closed head */
         pf = delayed_free.pf + (delayed_free.index ^ 1);
@@ -4702,8 +4702,8 @@ static void free_zapped_rcu(struct rcu_head *ch)
          */
         call_rcu_zapped(delayed_free.pf + delayed_free.index);
 
-        graph_unlock();
-out_irq:
+        current->lockdep_recursion = 0;
+        arch_spin_unlock(&lockdep_lock);
         raw_local_irq_restore(flags);
 }
 
@@ -4744,21 +4744,17 @@ static void lockdep_free_key_range_reg(void *start, unsigned long size)
 {
         struct pending_free *pf;
         unsigned long flags;
-        int locked;
 
         init_data_structures_once();
 
         raw_local_irq_save(flags);
-        locked = graph_lock();
-        if (!locked)
-                goto out_irq;
-
+        arch_spin_lock(&lockdep_lock);
+        current->lockdep_recursion = 1;
         pf = get_pending_free();
         __lockdep_free_key_range(pf, start, size);
         call_rcu_zapped(pf);
-
-        graph_unlock();
-out_irq:
+        current->lockdep_recursion = 0;
+        arch_spin_unlock(&lockdep_lock);
         raw_local_irq_restore(flags);
 
         /*
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 6a73e41a2016..43901fa3f269 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -252,7 +252,6 @@ static void task_non_contending(struct task_struct *p)
         if (dl_entity_is_special(dl_se))
                 return;
 
-        WARN_ON(hrtimer_active(&dl_se->inactive_timer));
         WARN_ON(dl_se->dl_non_contending);
 
         zerolag_time = dl_se->deadline -
@@ -269,7 +268,7 @@ static void task_non_contending(struct task_struct *p)
          * If the "0-lag time" already passed, decrease the active
          * utilization now, instead of starting a timer
          */
-        if (zerolag_time < 0) {
+        if ((zerolag_time < 0) || hrtimer_active(&dl_se->inactive_timer)) {
                 if (dl_task(p))
                         sub_running_bw(dl_se, dl_rq);
                 if (!dl_task(p) || p->state == TASK_DEAD) {
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fdab7eb6f351..35f3ea375084 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2007,6 +2007,10 @@ static u64 numa_get_avg_runtime(struct task_struct *p, u64 *period)
         if (p->last_task_numa_placement) {
                 delta = runtime - p->last_sum_exec_runtime;
                 *period = now - p->last_task_numa_placement;
+
+                /* Avoid time going backwards, prevent potential divide error: */
+                if (unlikely((s64)*period < 0))
+                        *period = 0;
         } else {
                 delta = p->se.avg.load_sum;
                 *period = LOAD_AVG_MAX;
@@ -4885,6 +4889,8 @@ static enum hrtimer_restart sched_cfs_slack_timer(struct hrtimer *timer)
         return HRTIMER_NORESTART;
 }
 
+extern const u64 max_cfs_quota_period;
+
 static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
 {
         struct cfs_bandwidth *cfs_b =
@@ -4892,6 +4898,7 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
         unsigned long flags;
         int overrun;
         int idle = 0;
+        int count = 0;
 
         raw_spin_lock_irqsave(&cfs_b->lock, flags);
         for (;;) {
@@ -4899,6 +4906,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
                 if (!overrun)
                         break;
 
+                if (++count > 3) {
+                        u64 new, old = ktime_to_ns(cfs_b->period);
+
+                        new = (old * 147) / 128; /* ~115% */
+                        new = min(new, max_cfs_quota_period);
+
+                        cfs_b->period = ns_to_ktime(new);
+
+                        /* since max is 1s, this is limited to 1e9^2, which fits in u64 */
+                        cfs_b->quota *= new;
+                        cfs_b->quota = div64_u64(cfs_b->quota, old);
+
+                        pr_warn_ratelimited(
+        "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n",
+                                smp_processor_id(),
+                                div_u64(new, NSEC_PER_USEC),
+                                div_u64(cfs_b->quota, NSEC_PER_USEC));
+
+                        /* reset count so we don't come right back in here */
+                        count = 0;
+                }
+
                 idle = do_sched_cfs_period_timer(cfs_b, overrun, flags);
         }
         if (idle)
@@ -7784,10 +7813,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
         if (cfs_rq->last_h_load_update == now)
                 return;
 
-        cfs_rq->h_load_next = NULL;
+        WRITE_ONCE(cfs_rq->h_load_next, NULL);
         for_each_sched_entity(se) {
                 cfs_rq = cfs_rq_of(se);
-                cfs_rq->h_load_next = se;
+                WRITE_ONCE(cfs_rq->h_load_next, se);
                 if (cfs_rq->last_h_load_update == now)
                         break;
         }
@@ -7797,7 +7826,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
                 cfs_rq->last_h_load_update = now;
         }
 
-        while ((se = cfs_rq->h_load_next) != NULL) {
+        while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) {
                 load = cfs_rq->h_load;
                 load = div64_ul(load * se->avg.load_avg,
                         cfs_rq_load_avg(cfs_rq) + 1);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 54a0347ca812..3582eeb59893 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -149,7 +149,7 @@ static void populate_seccomp_data(struct seccomp_data *sd)
 
         sd->nr = syscall_get_nr(task, regs);
         sd->arch = syscall_get_arch();
-        syscall_get_arguments(task, regs, 0, 6, args);
+        syscall_get_arguments(task, regs, args);
         sd->args[0] = args[0];
         sd->args[1] = args[1];
         sd->args[2] = args[2];
@@ -502,7 +502,10 @@ out:
  *
  * Caller must be holding current->sighand->siglock lock.
  *
- * Returns 0 on success, -ve on error.
+ * Returns 0 on success, -ve on error, or
+ *   - in TSYNC mode: the pid of a thread which was either not in the correct
+ *     seccomp mode or did not have an ancestral seccomp filter
+ *   - in NEW_LISTENER mode: the fd of the new listener
  */
 static long seccomp_attach_filter(unsigned int flags,
                                   struct seccomp_filter *filter)
@@ -1258,6 +1261,16 @@ static long seccomp_set_mode_filter(unsigned int flags,
         if (flags & ~SECCOMP_FILTER_FLAG_MASK)
                 return -EINVAL;
 
+        /*
+         * In the successful case, NEW_LISTENER returns the new listener fd.
+         * But in the failure case, TSYNC returns the thread that died. If you
+         * combine these two flags, there's no way to tell whether something
+         * succeeded or failed. So, let's disallow this combination.
+         */
+        if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
+            (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER))
+                return -EINVAL;
+
         /* Prepare the new filter before holding any locks. */
         prepared = seccomp_prepare_user_filter(filter);
         if (IS_ERR(prepared))
@@ -1304,7 +1317,7 @@ out:
                 mutex_unlock(&current->signal->cred_guard_mutex);
 out_put_fd:
         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
-                if (ret < 0) {
+                if (ret) {
                         listener_f->private_data = NULL;
                         fput(listener_f);
                         put_unused_fd(listener);
diff --git a/kernel/signal.c b/kernel/signal.c
index b7953934aa99..227ba170298e 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3581,7 +3581,7 @@ SYSCALL_DEFINE4(pidfd_send_signal, int, pidfd, int, sig,
         if (flags)
                 return -EINVAL;
 
-        f = fdget_raw(pidfd);
+        f = fdget(pidfd);
         if (!f.file)
                 return -EBADF;
 
@@ -3605,16 +3605,11 @@ SYSCALL_DEFINE4(pidfd_send_signal, int, pidfd, int, sig,
                 if (unlikely(sig != kinfo.si_signo))
                         goto err;
 
+                /* Only allow sending arbitrary signals to yourself. */
+                ret = -EPERM;
                 if ((task_pid(current) != pid) &&
-                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) {
-                        /* Only allow sending arbitrary signals to yourself. */
-                        ret = -EPERM;
-                        if (kinfo.si_code != SI_USER)
-                                goto err;
-
-                        /* Turn this into a regular kill signal. */
-                        prepare_kill_siginfo(sig, &kinfo);
-                }
+                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
+                        goto err;
         } else {
                 prepare_kill_siginfo(sig, &kinfo);
         }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index e5da394d1ca3..c9ec050bcf46 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -128,6 +128,7 @@ static int zero;
 static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
+static unsigned long zero_ul;
 static unsigned long one_ul = 1;
 static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
@@ -1750,7 +1751,7 @@ static struct ctl_table fs_table[] = {
                 .maxlen         = sizeof(files_stat.max_files),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &zero,
+                .extra1         = &zero_ul,
                 .extra2         = &long_max,
         },
         {
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 2c97e8c2d29f..0519a8805aab 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -594,7 +594,7 @@ static ktime_t alarm_timer_remaining(struct k_itimer *timr, ktime_t now)
 {
         struct alarm *alarm = &timr->it.alarm.alarmtimer;
 
-        return ktime_sub(now, alarm->node.expires);
+        return ktime_sub(alarm->node.expires, now);
 }
 
 /**
diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c
index 094b82ca95e5..930113b9799a 100644
--- a/kernel/time/sched_clock.c
+++ b/kernel/time/sched_clock.c
@@ -272,7 +272,7 @@ static u64 notrace suspended_sched_clock_read(void)
         return cd.read_data[seq & 1].epoch_cyc;
 }
 
-static int sched_clock_suspend(void)
+int sched_clock_suspend(void)
 {
         struct clock_read_data *rd = &cd.read_data[0];
 
@@ -283,7 +283,7 @@ static int sched_clock_suspend(void)
         return 0;
 }
 
-static void sched_clock_resume(void)
+void sched_clock_resume(void)
 {
         struct clock_read_data *rd = &cd.read_data[0];
 
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 529143b4c8d2..df401463a191 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -487,6 +487,7 @@ void tick_freeze(void)
                 trace_suspend_resume(TPS("timekeeping_freeze"),
                                      smp_processor_id(), true);
                 system_state = SYSTEM_SUSPEND;
+                sched_clock_suspend();
                 timekeeping_suspend();
         } else {
                 tick_suspend_local();
@@ -510,6 +511,7 @@ void tick_unfreeze(void)
 
         if (tick_freeze_depth == num_online_cpus()) {
                 timekeeping_resume();
+                sched_clock_resume();
                 system_state = SYSTEM_RUNNING;
                 trace_suspend_resume(TPS("timekeeping_freeze"),
                                      smp_processor_id(), false);
diff --git a/kernel/time/timekeeping.h b/kernel/time/timekeeping.h
index 7a9b4eb7a1d5..141ab3ab0354 100644
--- a/kernel/time/timekeeping.h
+++ b/kernel/time/timekeeping.h
@@ -14,6 +14,13 @@ extern u64 timekeeping_max_deferment(void);
 extern void timekeeping_warp_clock(void);
 extern int timekeeping_suspend(void);
 extern void timekeeping_resume(void);
+#ifdef CONFIG_GENERIC_SCHED_CLOCK
+extern int sched_clock_suspend(void);
+extern void sched_clock_resume(void);
+#else
+static inline int sched_clock_suspend(void) { return 0; }
+static inline void sched_clock_resume(void) { }
+#endif
 
 extern void do_timer(unsigned long ticks);
 extern void update_wall_time(void);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 26c8ca9bd06b..b920358dd8f7 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -33,6 +33,7 @@
 #include <linux/list.h>
 #include <linux/hash.h>
 #include <linux/rcupdate.h>
+#include <linux/kprobes.h>
 
 #include <trace/events/sched.h>
 
@@ -6246,7 +6247,7 @@ void ftrace_reset_array_ops(struct trace_array *tr)
         tr->ops->func = ftrace_stub;
 }
 
-static inline void
+static nokprobe_inline void
 __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
                        struct ftrace_ops *ignored, struct pt_regs *regs)
 {
@@ -6306,11 +6307,13 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
 {
         __ftrace_ops_list_func(ip, parent_ip, NULL, regs);
 }
+NOKPROBE_SYMBOL(ftrace_ops_list_func);
 #else
 static void ftrace_ops_no_ops(unsigned long ip, unsigned long parent_ip)
 {
         __ftrace_ops_list_func(ip, parent_ip, NULL, NULL);
 }
+NOKPROBE_SYMBOL(ftrace_ops_no_ops);
 #endif
 
 /*
@@ -6337,6 +6340,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
         preempt_enable_notrace();
         trace_clear_recursion(bit);
 }
+NOKPROBE_SYMBOL(ftrace_ops_assist_func);
 
 /**
  * ftrace_ops_get_func - get the function a trampoline should call
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 41b6f96e5366..4ee8d8aa3d0f 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -762,7 +762,7 @@ u64 ring_buffer_time_stamp(struct ring_buffer *buffer, int cpu)
 
         preempt_disable_notrace();
         time = rb_time_stamp(buffer);
-        preempt_enable_no_resched_notrace();
+        preempt_enable_notrace();
 
         return time;
 }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 21153e64bf1c..ca1ee656d6d8 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -496,8 +496,10 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
          * not modified.
          */
         pid_list = kmalloc(sizeof(*pid_list), GFP_KERNEL);
-        if (!pid_list)
+        if (!pid_list) {
+                trace_parser_put(&parser);
                 return -ENOMEM;
+        }
 
         pid_list->pid_max = READ_ONCE(pid_max);
 
@@ -507,6 +509,7 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
 
         pid_list->pids = vzalloc((pid_list->pid_max + 7) >> 3);
         if (!pid_list->pids) {
+                trace_parser_put(&parser);
                 kfree(pid_list);
                 return -ENOMEM;
         }
@@ -7025,35 +7028,43 @@ struct buffer_ref {
         struct ring_buffer      *buffer;
         void                    *page;
         int                     cpu;
-        int                     ref;
+        refcount_t              refcount;
 };
 
+static void buffer_ref_release(struct buffer_ref *ref)
+{
+        if (!refcount_dec_and_test(&ref->refcount))
+                return;
+        ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
+        kfree(ref);
+}
+
 static void buffer_pipe_buf_release(struct pipe_inode_info *pipe,
                                     struct pipe_buffer *buf)
 {
         struct buffer_ref *ref = (struct buffer_ref *)buf->private;
 
-        if (--ref->ref)
-                return;
-
-        ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
-        kfree(ref);
+        buffer_ref_release(ref);
         buf->private = 0;
 }
 
-static void buffer_pipe_buf_get(struct pipe_inode_info *pipe,
+static bool buffer_pipe_buf_get(struct pipe_inode_info *pipe,
                                 struct pipe_buffer *buf)
 {
         struct buffer_ref *ref = (struct buffer_ref *)buf->private;
 
-        ref->ref++;
+        if (refcount_read(&ref->refcount) > INT_MAX/2)
+                return false;
+
+        refcount_inc(&ref->refcount);
+        return true;
 }
 
 /* Pipe buffer operations for a buffer. */
 static const struct pipe_buf_operations buffer_pipe_buf_ops = {
         .confirm                = generic_pipe_buf_confirm,
         .release                = buffer_pipe_buf_release,
-        .steal                  = generic_pipe_buf_steal,
+        .steal                  = generic_pipe_buf_nosteal,
         .get                    = buffer_pipe_buf_get,
 };
 
@@ -7066,11 +7077,7 @@ static void buffer_spd_release(struct splice_pipe_desc *spd, unsigned int i)
         struct buffer_ref *ref =
                 (struct buffer_ref *)spd->partial[i].private;
 
-        if (--ref->ref)
-                return;
-
-        ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
-        kfree(ref);
+        buffer_ref_release(ref);
         spd->partial[i].private = 0;
 }
 
@@ -7125,7 +7132,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                         break;
                 }
 
-                ref->ref = 1;
+                refcount_set(&ref->refcount, 1);
                 ref->buffer = iter->trace_buffer->buffer;
                 ref->page = ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file);
                 if (IS_ERR(ref->page)) {
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index f93a56d2db27..fa8fbff736d6 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -314,6 +314,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
         unsigned long irq_flags;
+        unsigned long args[6];
         int pc;
         int syscall_nr;
         int size;
@@ -347,7 +348,8 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
 
         entry = ring_buffer_event_data(event);
         entry->nr = syscall_nr;
-        syscall_get_arguments(current, regs, 0, sys_data->nb_args, entry->args);
+        syscall_get_arguments(current, regs, args);
+        memcpy(entry->args, args, sizeof(unsigned long) * sys_data->nb_args);
 
         event_trigger_unlock_commit(trace_file, buffer, event, entry,
                                     irq_flags, pc);
@@ -583,6 +585,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
         struct syscall_metadata *sys_data;
         struct syscall_trace_enter *rec;
         struct hlist_head *head;
+        unsigned long args[6];
         bool valid_prog_array;
         int syscall_nr;
         int rctx;
@@ -613,8 +616,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
                 return;
 
         rec->nr = syscall_nr;
-        syscall_get_arguments(current, regs, 0, sys_data->nb_args,
-                               (unsigned long *)&rec->args);
+        syscall_get_arguments(current, regs, args);
+        memcpy(&rec->args, args, sizeof(unsigned long) * sys_data->nb_args);
 
         if ((valid_prog_array &&
              !perf_call_bpf_enter(sys_data->enter_event, regs, sys_data, rec)) ||
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 71381168dede..247bf0b1582c 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -135,7 +135,8 @@ static void watchdog_overflow_callback(struct perf_event *event,
                 if (__this_cpu_read(hard_watchdog_warn) == true)
                         return;
 
-                pr_emerg("Watchdog detected hard LOCKUP on cpu %d", this_cpu);
+                pr_emerg("Watchdog detected hard LOCKUP on cpu %d\n",
+                         this_cpu);
                 print_modules();
                 print_irqtrace_events(current);
                 if (regs)
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 0d9e81779e37..d5a4a4036d2f 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -753,9 +753,9 @@ endmenu # "Memory Debugging"
 config ARCH_HAS_KCOV
         bool
         help
-          KCOV does not have any arch-specific code, but currently it is enabled
-          only for x86_64. KCOV requires testing on other archs, and most likely
-          disabling of instrumentation for some early boot code.
+          An architecture should select this when it can successfully
+          build and run with CONFIG_KCOV. This typically requires
+          disabling instrumentation for some early boot code.
 
 config CC_HAS_SANCOV_TRACE_PC
         def_bool $(cc-option,-fsanitize-coverage=trace-pc)
@@ -1929,6 +1929,7 @@ config TEST_KMOD
         depends on m
         depends on BLOCK && (64BIT || LBDAF)      # for XFS, BTRFS
         depends on NETDEVICES && NET_CORE && INET # for TUN
+        depends on BLOCK
         select TEST_LKM
         select XFS_FS
         select TUN
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ea36dc355da1..b396d328a764 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1528,6 +1528,7 @@ EXPORT_SYMBOL(csum_and_copy_to_iter);
 size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
                 struct iov_iter *i)
 {
+#ifdef CONFIG_CRYPTO
         struct ahash_request *hash = hashp;
         struct scatterlist sg;
         size_t copied;
@@ -1537,6 +1538,9 @@ size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
         ahash_request_set_crypt(hash, &sg, NULL, copied);
         crypto_ahash_update(hash);
         return copied;
+#else
+        return 0;
+#endif
 }
 EXPORT_SYMBOL(hash_and_copy_to_iter);
 
diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
index 4525fb094844..a8ede77afe0d 100644
--- a/lib/lzo/lzo1x_compress.c
+++ b/lib/lzo/lzo1x_compress.c
@@ -291,13 +291,14 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
 {
         const unsigned char *ip = in;
         unsigned char *op = out;
+        unsigned char *data_start;
         size_t l = in_len;
         size_t t = 0;
         signed char state_offset = -2;
         unsigned int m4_max_offset;
 
-        // LZO v0 will never write 17 as first byte,
-        // so this is used to version the bitstream
+        // LZO v0 will never write 17 as first byte (except for zero-length
+        // input), so this is used to version the bitstream
         if (bitstream_version > 0) {
                 *op++ = 17;
                 *op++ = bitstream_version;
@@ -306,6 +307,8 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
                 m4_max_offset = M4_MAX_OFFSET_V0;
         }
 
+        data_start = op;
+
         while (l > 20) {
                 size_t ll = l <= (m4_max_offset + 1) ? l : (m4_max_offset + 1);
                 uintptr_t ll_end = (uintptr_t) ip + ll;
@@ -324,7 +327,7 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
         if (t > 0) {
                 const unsigned char *ii = in + in_len - t;
 
-                if (op == out && t <= 238) {
+                if (op == data_start && t <= 238) {
                         *op++ = (17 + t);
                 } else if (t <= 3) {
                         op[state_offset] |= t;
diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
index 6d2600ea3b55..9e07e9ef1aad 100644
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -54,11 +54,9 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
         if (unlikely(in_len < 3))
                 goto input_overrun;
 
-        if (likely(*ip == 17)) {
+        if (likely(in_len >= 5) && likely(*ip == 17)) {
                 bitstream_version = ip[1];
                 ip += 2;
-                if (unlikely(in_len < 5))
-                        goto input_overrun;
         } else {
                 bitstream_version = 0;
         }
diff --git a/lib/string.c b/lib/string.c
index 38e4ca08e757..3ab861c1a857 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -866,6 +866,26 @@ __visible int memcmp(const void *cs, const void *ct, size_t count)
 EXPORT_SYMBOL(memcmp);
 #endif
 
+#ifndef __HAVE_ARCH_BCMP
+/**
+ * bcmp - returns 0 if and only if the buffers have identical contents.
+ * @a: pointer to first buffer.
+ * @b: pointer to second buffer.
+ * @len: size of buffers.
+ *
+ * The sign or magnitude of a non-zero return value has no particular
+ * meaning, and architectures may implement their own more efficient bcmp(). So
+ * while this particular implementation is a simple (tail) call to memcmp, do
+ * not rely on anything but whether the return value is zero or non-zero.
+ */
+#undef bcmp
+int bcmp(const void *a, const void *b, size_t len)
+{
+        return memcmp(a, b, len);
+}
+EXPORT_SYMBOL(bcmp);
+#endif
+
 #ifndef __HAVE_ARCH_MEMSCAN
 /**
  * memscan - Find a character in an area of memory.
diff --git a/lib/syscall.c b/lib/syscall.c
index 1a7077f20eae..fb328e7ccb08 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -5,16 +5,14 @@
 #include <linux/export.h>
 #include <asm/syscall.h>
 
-static int collect_syscall(struct task_struct *target, long *callno,
-                           unsigned long args[6], unsigned int maxargs,
-                           unsigned long *sp, unsigned long *pc)
+static int collect_syscall(struct task_struct *target, struct syscall_info *info)
 {
         struct pt_regs *regs;
 
         if (!try_get_task_stack(target)) {
                 /* Task has no stack, so the task isn't in a syscall. */
-                *sp = *pc = 0;
-                *callno = -1;
+                memset(info, 0, sizeof(*info));
+                info->data.nr = -1;
                 return 0;
         }
 
@@ -24,12 +22,13 @@ static int collect_syscall(struct task_struct *target, long *callno,
                 return -EAGAIN;
         }
 
-        *sp = user_stack_pointer(regs);
-        *pc = instruction_pointer(regs);
+        info->sp = user_stack_pointer(regs);
+        info->data.instruction_pointer = instruction_pointer(regs);
 
-        *callno = syscall_get_nr(target, regs);
-        if (*callno != -1L && maxargs > 0)
-                syscall_get_arguments(target, regs, 0, maxargs, args);
+        info->data.nr = syscall_get_nr(target, regs);
+        if (info->data.nr != -1L)
+                syscall_get_arguments(target, regs,
+                                      (unsigned long *)&info->data.args[0]);
 
         put_task_stack(target);
         return 0;
@@ -38,41 +37,35 @@ static int collect_syscall(struct task_struct *target, long *callno,
 /**
  * task_current_syscall - Discover what a blocked task is doing.
  * @target:             thread to examine
- * @callno:             filled with system call number or -1
- * @args:               filled with @maxargs system call arguments
- * @maxargs:            number of elements in @args to fill
- * @sp:                 filled with user stack pointer
- * @pc:                 filled with user PC
+ * @info:               structure with the following fields:
+ *                       .sp        - filled with user stack pointer
+ *                       .data.nr   - filled with system call number or -1
+ *                       .data.args - filled with @maxargs system call arguments
+ *                       .data.instruction_pointer - filled with user PC
  *
- * If @target is blocked in a system call, returns zero with *@callno
- * set to the the call's number and @args filled in with its arguments.
- * Registers not used for system call arguments may not be available and
- * it is not kosher to use &struct user_regset calls while the system
+ * If @target is blocked in a system call, returns zero with @info.data.nr
+ * set to the the call's number and @info.data.args filled in with its
+ * arguments. Registers not used for system call arguments may not be available
+ * and it is not kosher to use &struct user_regset calls while the system
  * call is still in progress.  Note we may get this result if @target
  * has finished its system call but not yet returned to user mode, such
  * as when it's stopped for signal handling or syscall exit tracing.
  *
  * If @target is blocked in the kernel during a fault or exception,
- * returns zero with *@callno set to -1 and does not fill in @args.
- * If so, it's now safe to examine @target using &struct user_regset
- * get() calls as long as we're sure @target won't return to user mode.
+ * returns zero with *@info.data.nr set to -1 and does not fill in
+ * @info.data.args. If so, it's now safe to examine @target using
+ * &struct user_regset get() calls as long as we're sure @target won't return
+ * to user mode.
  *
  * Returns -%EAGAIN if @target does not remain blocked.
- *
- * Returns -%EINVAL if @maxargs is too large (maximum is six).
  */
-int task_current_syscall(struct task_struct *target, long *callno,
-                         unsigned long args[6], unsigned int maxargs,
-                         unsigned long *sp, unsigned long *pc)
+int task_current_syscall(struct task_struct *target, struct syscall_info *info)
 {
         long state;
         unsigned long ncsw;
 
-        if (unlikely(maxargs > 6))
-                return -EINVAL;
-
         if (target == current)
-                return collect_syscall(target, callno, args, maxargs, sp, pc);
+                return collect_syscall(target, info);
 
         state = target->state;
         if (unlikely(!state))
@@ -80,7 +73,7 @@ int task_current_syscall(struct task_struct *target, long *callno,
 
         ncsw = wait_task_inactive(target, state);
         if (unlikely(!ncsw) ||
-            unlikely(collect_syscall(target, callno, args, maxargs, sp, pc)) ||
+            unlikely(collect_syscall(target, info)) ||
             unlikely(wait_task_inactive(target, state) != ncsw))
                 return -EAGAIN;
 
diff --git a/lib/test_vmalloc.c b/lib/test_vmalloc.c
index 83cdcaa82bf6..f832b095afba 100644
--- a/lib/test_vmalloc.c
+++ b/lib/test_vmalloc.c
@@ -383,14 +383,14 @@ static void shuffle_array(int *arr, int n)
 static int test_func(void *private)
 {
         struct test_driver *t = private;
-        cpumask_t newmask = CPU_MASK_NONE;
         int random_array[ARRAY_SIZE(test_case_array)];
         int index, i, j, ret;
         ktime_t kt;
         u64 delta;
 
-        cpumask_set_cpu(t->cpu, &newmask);
-        set_cpus_allowed_ptr(current, &newmask);
+        ret = set_cpus_allowed_ptr(current, cpumask_of(t->cpu));
+        if (ret < 0)
+                pr_err("Failed to set affinity to %d CPU\n", t->cpu);
 
         for (i = 0; i < ARRAY_SIZE(test_case_array); i++)
                 random_array[i] = i;
diff --git a/mm/compaction.c b/mm/compaction.c
index f171a83707ce..3319e0872d01 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -242,6 +242,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
                                                         bool check_target)
 {
         struct page *page = pfn_to_online_page(pfn);
+        struct page *block_page;
         struct page *end_page;
         unsigned long block_pfn;
 
@@ -267,20 +268,26 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
             get_pageblock_migratetype(page) != MIGRATE_MOVABLE)
                 return false;
 
+        /* Ensure the start of the pageblock or zone is online and valid */
+        block_pfn = pageblock_start_pfn(pfn);
+        block_page = pfn_to_online_page(max(block_pfn, zone->zone_start_pfn));
+        if (block_page) {
+                page = block_page;
+                pfn = block_pfn;
+        }
+
+        /* Ensure the end of the pageblock or zone is online and valid */
+        block_pfn += pageblock_nr_pages;
+        block_pfn = min(block_pfn, zone_end_pfn(zone) - 1);
+        end_page = pfn_to_online_page(block_pfn);
+        if (!end_page)
+                return false;
+
         /*
          * Only clear the hint if a sample indicates there is either a
          * free page or an LRU page in the block. One or other condition
          * is necessary for the block to be a migration source/target.
          */
-        block_pfn = pageblock_start_pfn(pfn);
-        pfn = max(block_pfn, zone->zone_start_pfn);
-        page = pfn_to_page(pfn);
-        if (zone != page_zone(page))
-                return false;
-        pfn = block_pfn + pageblock_nr_pages;
-        pfn = min(pfn, zone_end_pfn(zone));
-        end_page = pfn_to_page(pfn);
-
         do {
                 if (pfn_valid_within(pfn)) {
                         if (check_source && PageLRU(page)) {
@@ -309,7 +316,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
 static void __reset_isolation_suitable(struct zone *zone)
 {
         unsigned long migrate_pfn = zone->zone_start_pfn;
-        unsigned long free_pfn = zone_end_pfn(zone);
+        unsigned long free_pfn = zone_end_pfn(zone) - 1;
         unsigned long reset_migrate = free_pfn;
         unsigned long reset_free = migrate_pfn;
         bool source_set = false;
@@ -1363,7 +1370,7 @@ fast_isolate_freepages(struct compact_control *cc)
                                 count_compact_events(COMPACTISOLATED, nr_isolated);
                         } else {
                                 /* If isolation fails, abort the search */
-                                order = -1;
+                                order = cc->search_order + 1;
                                 page = NULL;
                         }
                 }
diff --git a/mm/gup.c b/mm/gup.c
index f84e22685aaa..91819b8ad9cc 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -160,8 +160,12 @@ retry:
                 goto retry;
         }
 
-        if (flags & FOLL_GET)
-                get_page(page);
+        if (flags & FOLL_GET) {
+                if (unlikely(!try_get_page(page))) {
+                        page = ERR_PTR(-ENOMEM);
+                        goto out;
+                }
+        }
         if (flags & FOLL_TOUCH) {
                 if ((flags & FOLL_WRITE) &&
                     !pte_dirty(pte) && !PageDirty(page))
@@ -298,7 +302,10 @@ retry_locked:
                         if (pmd_trans_unstable(pmd))
                                 ret = -EBUSY;
                 } else {
-                        get_page(page);
+                        if (unlikely(!try_get_page(page))) {
+                                spin_unlock(ptl);
+                                return ERR_PTR(-ENOMEM);
+                        }
                         spin_unlock(ptl);
                         lock_page(page);
                         ret = split_huge_page(page);
@@ -500,7 +507,10 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
                 if (is_device_public_page(*page))
                         goto unmap;
         }
-        get_page(*page);
+        if (unlikely(!try_get_page(*page))) {
+                ret = -ENOMEM;
+                goto unmap;
+        }
 out:
         ret = 0;
 unmap:
@@ -1545,6 +1555,20 @@ static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages)
         }
 }
 
+/*
+ * Return the compund head page with ref appropriately incremented,
+ * or NULL if that failed.
+ */
+static inline struct page *try_get_compound_head(struct page *page, int refs)
+{
+        struct page *head = compound_head(page);
+        if (WARN_ON_ONCE(page_ref_count(head) < 0))
+                return NULL;
+        if (unlikely(!page_cache_add_speculative(head, refs)))
+                return NULL;
+        return head;
+}
+
 #ifdef CONFIG_ARCH_HAS_PTE_SPECIAL
 static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
                          int write, struct page **pages, int *nr)
@@ -1579,9 +1603,9 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
 
                 VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
                 page = pte_page(pte);
-                head = compound_head(page);
 
-                if (!page_cache_get_speculative(head))
+                head = try_get_compound_head(page, 1);
+                if (!head)
                         goto pte_unmap;
 
                 if (unlikely(pte_val(pte) != pte_val(*ptep))) {
@@ -1720,8 +1744,8 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
                 refs++;
         } while (addr += PAGE_SIZE, addr != end);
 
-        head = compound_head(pmd_page(orig));
-        if (!page_cache_add_speculative(head, refs)) {
+        head = try_get_compound_head(pmd_page(orig), refs);
+        if (!head) {
                 *nr -= refs;
                 return 0;
         }
@@ -1758,8 +1782,8 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
                 refs++;
         } while (addr += PAGE_SIZE, addr != end);
 
-        head = compound_head(pud_page(orig));
-        if (!page_cache_add_speculative(head, refs)) {
+        head = try_get_compound_head(pud_page(orig), refs);
+        if (!head) {
                 *nr -= refs;
                 return 0;
         }
@@ -1795,8 +1819,8 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
                 refs++;
         } while (addr += PAGE_SIZE, addr != end);
 
-        head = compound_head(pgd_page(orig));
-        if (!page_cache_add_speculative(head, refs)) {
+        head = try_get_compound_head(pgd_page(orig), refs);
+        if (!head) {
                 *nr -= refs;
                 return 0;
         }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 404acdcd0455..165ea46bf149 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -755,6 +755,21 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
         spinlock_t *ptl;
 
         ptl = pmd_lock(mm, pmd);
+        if (!pmd_none(*pmd)) {
+                if (write) {
+                        if (pmd_pfn(*pmd) != pfn_t_to_pfn(pfn)) {
+                                WARN_ON_ONCE(!is_huge_zero_pmd(*pmd));
+                                goto out_unlock;
+                        }
+                        entry = pmd_mkyoung(*pmd);
+                        entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
+                        if (pmdp_set_access_flags(vma, addr, pmd, entry, 1))
+                                update_mmu_cache_pmd(vma, addr, pmd);
+                }
+
+                goto out_unlock;
+        }
+
         entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));
         if (pfn_t_devmap(pfn))
                 entry = pmd_mkdevmap(entry);
@@ -766,11 +781,16 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
         if (pgtable) {
                 pgtable_trans_huge_deposit(mm, pmd, pgtable);
                 mm_inc_nr_ptes(mm);
+                pgtable = NULL;
         }
 
         set_pmd_at(mm, addr, pmd, entry);
         update_mmu_cache_pmd(vma, addr, pmd);
+
+out_unlock:
         spin_unlock(ptl);
+        if (pgtable)
+                pte_free(mm, pgtable);
 }
 
 vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
@@ -821,6 +841,20 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
         spinlock_t *ptl;
 
         ptl = pud_lock(mm, pud);
+        if (!pud_none(*pud)) {
+                if (write) {
+                        if (pud_pfn(*pud) != pfn_t_to_pfn(pfn)) {
+                                WARN_ON_ONCE(!is_huge_zero_pud(*pud));
+                                goto out_unlock;
+                        }
+                        entry = pud_mkyoung(*pud);
+                        entry = maybe_pud_mkwrite(pud_mkdirty(entry), vma);
+                        if (pudp_set_access_flags(vma, addr, pud, entry, 1))
+                                update_mmu_cache_pud(vma, addr, pud);
+                }
+                goto out_unlock;
+        }
+
         entry = pud_mkhuge(pfn_t_pud(pfn, prot));
         if (pfn_t_devmap(pfn))
                 entry = pud_mkdevmap(entry);
@@ -830,6 +864,8 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
         }
         set_pud_at(mm, addr, pud, entry);
         update_mmu_cache_pud(vma, addr, pud);
+
+out_unlock:
         spin_unlock(ptl);
 }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 97b1e0290c66..6cdc7b2d9100 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4299,6 +4299,19 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
 
                 pfn_offset = (vaddr & ~huge_page_mask(h)) >> PAGE_SHIFT;
                 page = pte_page(huge_ptep_get(pte));
+
+                /*
+                 * Instead of doing 'try_get_page()' below in the same_page
+                 * loop, just check the count once here.
+                 */
+                if (unlikely(page_count(page) <= 0)) {
+                        if (pages) {
+                                spin_unlock(ptl);
+                                remainder = 0;
+                                err = -ENOMEM;
+                                break;
+                        }
+                }
 same_page:
                 if (pages) {
                         pages[i] = mem_map_offset(page, pfn_offset);
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 707fa5579f66..2e435b8142e5 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1401,6 +1401,7 @@ static void scan_block(void *_start, void *_end,
 /*
  * Scan a large memory block in MAX_SCAN_SIZE chunks to reduce the latency.
  */
+#ifdef CONFIG_SMP
 static void scan_large_block(void *start, void *end)
 {
         void *next;
@@ -1412,6 +1413,7 @@ static void scan_large_block(void *start, void *end)
                 cond_resched();
         }
 }
+#endif
 
 /*
  * Scan a memory block corresponding to a kmemleak_object. A condition is
@@ -1529,11 +1531,6 @@ static void kmemleak_scan(void)
         }
         rcu_read_unlock();
 
-        /* data/bss scanning */
-        scan_large_block(_sdata, _edata);
-        scan_large_block(__bss_start, __bss_stop);
-        scan_large_block(__start_ro_after_init, __end_ro_after_init);
-
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
         for_each_possible_cpu(i)
@@ -2071,6 +2068,17 @@ void __init kmemleak_init(void)
         }
         local_irq_restore(flags);
 
+        /* register the data/bss sections */
+        create_object((unsigned long)_sdata, _edata - _sdata,
+                      KMEMLEAK_GREY, GFP_ATOMIC);
+        create_object((unsigned long)__bss_start, __bss_stop - __bss_start,
+                      KMEMLEAK_GREY, GFP_ATOMIC);
+        /* only register .data..ro_after_init if not within .data */
+        if (__start_ro_after_init < _sdata || __end_ro_after_init > _edata)
+                create_object((unsigned long)__start_ro_after_init,
+                              __end_ro_after_init - __start_ro_after_init,
+                              KMEMLEAK_GREY, GFP_ATOMIC);
+
         /*
          * This is the point where tracking allocations is safe. Automatic
          * scanning is started during the late initcall. Add the early logged
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 532e0e2a4817..81a0d3914ec9 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3882,6 +3882,22 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
         return &memcg->cgwb_domain;
 }
 
+/*
+ * idx can be of type enum memcg_stat_item or node_stat_item.
+ * Keep in sync with memcg_exact_page().
+ */
+static unsigned long memcg_exact_page_state(struct mem_cgroup *memcg, int idx)
+{
+        long x = atomic_long_read(&memcg->stat[idx]);
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                x += per_cpu_ptr(memcg->stat_cpu, cpu)->count[idx];
+        if (x < 0)
+                x = 0;
+        return x;
+}
+
 /**
  * mem_cgroup_wb_stats - retrieve writeback related stats from its memcg
  * @wb: bdi_writeback in question
@@ -3907,10 +3923,10 @@ void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages,
         struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
         struct mem_cgroup *parent;
 
-        *pdirty = memcg_page_state(memcg, NR_FILE_DIRTY);
+        *pdirty = memcg_exact_page_state(memcg, NR_FILE_DIRTY);
 
         /* this should eventually include NR_UNSTABLE_NFS */
-        *pwriteback = memcg_page_state(memcg, NR_WRITEBACK);
+        *pwriteback = memcg_exact_page_state(memcg, NR_WRITEBACK);
         *pfilepages = mem_cgroup_nr_lru_pages(memcg, (1 << LRU_INACTIVE_FILE) |
                                                      (1 << LRU_ACTIVE_FILE));
         *pheadroom = PAGE_COUNTER_MAX;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 0082d699be94..b236069ff0d8 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -874,6 +874,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
          */
         mem = find_memory_block(__pfn_to_section(pfn));
         nid = mem->nid;
+        put_device(&mem->dev);
 
         /* associate pfn range with the zone */
         zone = move_pfn_range(online_type, nid, pfn, nr_pages);
diff --git a/mm/mmap.c b/mm/mmap.c
index 41eb48d9b527..bd7b9f293b39 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -45,6 +45,7 @@
 #include <linux/moduleparam.h>
 #include <linux/pkeys.h>
 #include <linux/oom.h>
+#include <linux/sched/mm.h>
 
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
@@ -2525,7 +2526,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
         vma = find_vma_prev(mm, addr, &prev);
         if (vma && (vma->vm_start <= addr))
                 return vma;
-        if (!prev || expand_stack(prev, addr))
+        /* don't alter vm_end if the coredump is running */
+        if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr))
                 return NULL;
         if (prev->vm_flags & VM_LOCKED)
                 populate_vma_page_range(prev, addr, prev->vm_end, NULL);
@@ -2551,6 +2553,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
                 return vma;
         if (!(vma->vm_flags & VM_GROWSDOWN))
                 return NULL;
+        /* don't alter vm_start if the coredump is running */
+        if (!mmget_still_valid(mm))
+                return NULL;
         start = vma->vm_start;
         if (expand_stack(vma, addr))
                 return NULL;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d96ca5bc555b..c02cff1ed56e 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -266,7 +266,20 @@ compound_page_dtor * const compound_page_dtors[] = {
 
 int min_free_kbytes = 1024;
 int user_min_free_kbytes = -1;
+#ifdef CONFIG_DISCONTIGMEM
+/*
+ * DiscontigMem defines memory ranges as separate pg_data_t even if the ranges
+ * are not on separate NUMA nodes. Functionally this works but with
+ * watermark_boost_factor, it can reclaim prematurely as the ranges can be
+ * quite small. By default, do not boost watermarks on discontigmem as in
+ * many cases very high-order allocations like THP are likely to be
+ * unsupported and the premature reclaim offsets the advantage of long-term
+ * fragmentation avoidance.
+ */
+int watermark_boost_factor __read_mostly;
+#else
 int watermark_boost_factor __read_mostly = 15000;
+#endif
 int watermark_scale_factor = 10;
 
 static unsigned long nr_kernel_pages __initdata;
@@ -3419,8 +3432,11 @@ alloc_flags_nofragment(struct zone *zone, gfp_t gfp_mask)
                 alloc_flags |= ALLOC_KSWAPD;
 
 #ifdef CONFIG_ZONE_DMA32
+        if (!zone)
+                return alloc_flags;
+
         if (zone_idx(zone) != ZONE_NORMAL)
-                goto out;
+                return alloc_flags;
 
         /*
          * If ZONE_DMA32 exists, assume it is the one after ZONE_NORMAL and
@@ -3429,9 +3445,9 @@ alloc_flags_nofragment(struct zone *zone, gfp_t gfp_mask)
          */
         BUILD_BUG_ON(ZONE_NORMAL - ZONE_DMA32 != 1);
         if (nr_online_nodes > 1 && !populated_zone(--zone))
-                goto out;
+                return alloc_flags;
 
-out:
+        alloc_flags |= ALLOC_NOFRAGMENT;
 #endif /* CONFIG_ZONE_DMA32 */
         return alloc_flags;
 }
@@ -3773,11 +3789,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         memalloc_noreclaim_restore(noreclaim_flag);
         psi_memstall_leave(&pflags);
 
-        if (*compact_result <= COMPACT_INACTIVE) {
-                WARN_ON_ONCE(page);
-                return NULL;
-        }
-
         /*
          * At least in one zone compaction wasn't deferred or skipped, so let's
          * count a compaction stall
@@ -8005,7 +8016,10 @@ void *__init alloc_large_system_hash(const char *tablename,
 bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
                          int migratetype, int flags)
 {
-        unsigned long pfn, iter, found;
+        unsigned long found;
+        unsigned long iter = 0;
+        unsigned long pfn = page_to_pfn(page);
+        const char *reason = "unmovable page";
 
         /*
          * TODO we could make this much more efficient by not checking every
@@ -8015,17 +8029,20 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
          * can still lead to having bootmem allocations in zone_movable.
          */
 
-        /*
-         * CMA allocations (alloc_contig_range) really need to mark isolate
-         * CMA pageblocks even when they are not movable in fact so consider
-         * them movable here.
-         */
-        if (is_migrate_cma(migratetype) &&
-                        is_migrate_cma(get_pageblock_migratetype(page)))
-                return false;
+        if (is_migrate_cma_page(page)) {
+                /*
+                 * CMA allocations (alloc_contig_range) really need to mark
+                 * isolate CMA pageblocks even when they are not movable in fact
+                 * so consider them movable here.
+                 */
+                if (is_migrate_cma(migratetype))
+                        return false;
+
+                reason = "CMA page";
+                goto unmovable;
+        }
 
-        pfn = page_to_pfn(page);
-        for (found = 0, iter = 0; iter < pageblock_nr_pages; iter++) {
+        for (found = 0; iter < pageblock_nr_pages; iter++) {
                 unsigned long check = pfn + iter;
 
                 if (!pfn_valid_within(check))
@@ -8105,7 +8122,7 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
 unmovable:
         WARN_ON_ONCE(zone_idx(zone) == ZONE_MOVABLE);
         if (flags & REPORT_FAILURE)
-                dump_page(pfn_to_page(pfn+iter), "unmovable page");
+                dump_page(pfn_to_page(pfn + iter), reason);
         return true;
 }
 
diff --git a/mm/percpu.c b/mm/percpu.c
index 2e6fc8d552c9..68dd2e7e73b5 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -2567,8 +2567,8 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
                 ai->groups[group].base_offset = areas[group] - base;
         }
 
-        pr_info("Embedded %zu pages/cpu @%p s%zu r%zu d%zu u%zu\n",
-                PFN_DOWN(size_sum), base, ai->static_size, ai->reserved_size,
+        pr_info("Embedded %zu pages/cpu s%zu r%zu d%zu u%zu\n",
+                PFN_DOWN(size_sum), ai->static_size, ai->reserved_size,
                 ai->dyn_size, ai->unit_size);
 
         rc = pcpu_setup_first_chunk(ai, base);
@@ -2692,8 +2692,8 @@ int __init pcpu_page_first_chunk(size_t reserved_size,
         }
 
         /* we're ready, commit */
-        pr_info("%d %s pages/cpu @%p s%zu r%zu d%zu\n",
-                unit_pages, psize_str, vm.addr, ai->static_size,
+        pr_info("%d %s pages/cpu s%zu r%zu d%zu\n",
+                unit_pages, psize_str, ai->static_size,
                 ai->reserved_size, ai->dyn_size);
 
         rc = pcpu_setup_first_chunk(ai, vm.addr);
diff --git a/mm/shmem.c b/mm/shmem.c
index b3db3779a30a..2275a0ff7c30 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1081,9 +1081,14 @@ static void shmem_evict_inode(struct inode *inode)
                         }
                         spin_unlock(&sbinfo->shrinklist_lock);
                 }
-                if (!list_empty(&info->swaplist)) {
+                while (!list_empty(&info->swaplist)) {
+                        /* Wait while shmem_unuse() is scanning this inode... */
+                        wait_var_event(&info->stop_eviction,
+                                       !atomic_read(&info->stop_eviction));
                         mutex_lock(&shmem_swaplist_mutex);
-                        list_del_init(&info->swaplist);
+                        /* ...but beware of the race if we peeked too early */
+                        if (!atomic_read(&info->stop_eviction))
+                                list_del_init(&info->swaplist);
                         mutex_unlock(&shmem_swaplist_mutex);
                 }
         }
@@ -1099,10 +1104,11 @@ extern struct swap_info_struct *swap_info[];
 static int shmem_find_swap_entries(struct address_space *mapping,
                                    pgoff_t start, unsigned int nr_entries,
                                    struct page **entries, pgoff_t *indices,
-                                   bool frontswap)
+                                   unsigned int type, bool frontswap)
 {
         XA_STATE(xas, &mapping->i_pages, start);
         struct page *page;
+        swp_entry_t entry;
         unsigned int ret = 0;
 
         if (!nr_entries)
@@ -1116,13 +1122,12 @@ static int shmem_find_swap_entries(struct address_space *mapping,
                 if (!xa_is_value(page))
                         continue;
 
-                if (frontswap) {
-                        swp_entry_t entry = radix_to_swp_entry(page);
-
-                        if (!frontswap_test(swap_info[swp_type(entry)],
-                                            swp_offset(entry)))
-                                continue;
-                }
+                entry = radix_to_swp_entry(page);
+                if (swp_type(entry) != type)
+                        continue;
+                if (frontswap &&
+                    !frontswap_test(swap_info[type], swp_offset(entry)))
+                        continue;
 
                 indices[ret] = xas.xa_index;
                 entries[ret] = page;
@@ -1194,7 +1199,7 @@ static int shmem_unuse_inode(struct inode *inode, unsigned int type,
 
                 pvec.nr = shmem_find_swap_entries(mapping, start, nr_entries,
                                                   pvec.pages, indices,
-                                                  frontswap);
+                                                  type, frontswap);
                 if (pvec.nr == 0) {
                         ret = 0;
                         break;
@@ -1227,36 +1232,27 @@ int shmem_unuse(unsigned int type, bool frontswap,
                 unsigned long *fs_pages_to_unuse)
 {
         struct shmem_inode_info *info, *next;
-        struct inode *inode;
-        struct inode *prev_inode = NULL;
         int error = 0;
 
         if (list_empty(&shmem_swaplist))
                 return 0;
 
         mutex_lock(&shmem_swaplist_mutex);
-
-        /*
-         * The extra refcount on the inode is necessary to safely dereference
-         * p->next after re-acquiring the lock. New shmem inodes with swap
-         * get added to the end of the list and we will scan them all.
-         */
         list_for_each_entry_safe(info, next, &shmem_swaplist, swaplist) {
                 if (!info->swapped) {
                         list_del_init(&info->swaplist);
                         continue;
                 }
-
-                inode = igrab(&info->vfs_inode);
-                if (!inode)
-                        continue;
-
+                /*
+                 * Drop the swaplist mutex while searching the inode for swap;
+                 * but before doing so, make sure shmem_evict_inode() will not
+                 * remove placeholder inode from swaplist, nor let it be freed
+                 * (igrab() would protect from unlink, but not from unmount).
+                 */
+                atomic_inc(&info->stop_eviction);
                 mutex_unlock(&shmem_swaplist_mutex);
-                if (prev_inode)
-                        iput(prev_inode);
-                prev_inode = inode;
 
-                error = shmem_unuse_inode(inode, type, frontswap,
+                error = shmem_unuse_inode(&info->vfs_inode, type, frontswap,
                                           fs_pages_to_unuse);
                 cond_resched();
 
@@ -1264,14 +1260,13 @@ int shmem_unuse(unsigned int type, bool frontswap,
                 next = list_next_entry(info, swaplist);
                 if (!info->swapped)
                         list_del_init(&info->swaplist);
+                if (atomic_dec_and_test(&info->stop_eviction))
+                        wake_up_var(&info->stop_eviction);
                 if (error)
                         break;
         }
         mutex_unlock(&shmem_swaplist_mutex);
 
-        if (prev_inode)
-                iput(prev_inode);
-
         return error;
 }
 
@@ -2238,6 +2233,7 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode
                 info = SHMEM_I(inode);
                 memset(info, 0, (char *)inode - (char *)info);
                 spin_lock_init(&info->lock);
+                atomic_set(&info->stop_eviction, 0);
                 info->seals = F_SEAL_SEAL;
                 info->flags = flags & VM_NORESERVE;
                 INIT_LIST_HEAD(&info->shrinklist);
diff --git a/mm/slab.c b/mm/slab.c
index 329bfe67f2ca..9142ee992493 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2374,7 +2374,6 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
                 /* Slab management obj is off-slab. */
                 freelist = kmem_cache_alloc_node(cachep->freelist_cache,
                                               local_flags, nodeid);
-                freelist = kasan_reset_tag(freelist);
                 if (!freelist)
                         return NULL;
         } else {
@@ -4308,7 +4307,8 @@ static void show_symbol(struct seq_file *m, unsigned long address)
 
 static int leaks_show(struct seq_file *m, void *p)
 {
-        struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list);
+        struct kmem_cache *cachep = list_entry(p, struct kmem_cache,
+                                               root_caches_node);
         struct page *page;
         struct kmem_cache_node *n;
         const char *name;
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 2b8d9c3fbb47..cf63b5f01adf 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2023,7 +2023,6 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,
  * If the boolean frontswap is true, only unuse pages_to_unuse pages;
  * pages_to_unuse==0 means all pages; ignored if frontswap is false
  */
-#define SWAP_UNUSE_MAX_TRIES 3
 int try_to_unuse(unsigned int type, bool frontswap,
                  unsigned long pages_to_unuse)
 {
@@ -2035,7 +2034,6 @@ int try_to_unuse(unsigned int type, bool frontswap,
         struct page *page;
         swp_entry_t entry;
         unsigned int i;
-        int retries = 0;
 
         if (!si->inuse_pages)
                 return 0;
@@ -2053,11 +2051,9 @@ retry:
 
         spin_lock(&mmlist_lock);
         p = &init_mm.mmlist;
-        while ((p = p->next) != &init_mm.mmlist) {
-                if (signal_pending(current)) {
-                        retval = -EINTR;
-                        break;
-                }
+        while (si->inuse_pages &&
+               !signal_pending(current) &&
+               (p = p->next) != &init_mm.mmlist) {
 
                 mm = list_entry(p, struct mm_struct, mmlist);
                 if (!mmget_not_zero(mm))
@@ -2084,7 +2080,9 @@ retry:
         mmput(prev_mm);
 
         i = 0;
-        while ((i = find_next_to_unuse(si, i, frontswap)) != 0) {
+        while (si->inuse_pages &&
+               !signal_pending(current) &&
+               (i = find_next_to_unuse(si, i, frontswap)) != 0) {
 
                 entry = swp_entry(type, i);
                 page = find_get_page(swap_address_space(entry), i);
@@ -2117,14 +2115,18 @@ retry:
          * If yes, we would need to do retry the unuse logic again.
          * Under global memory pressure, swap entries can be reinserted back
          * into process space after the mmlist loop above passes over them.
-         * Its not worth continuosuly retrying to unuse the swap in this case.
-         * So we try SWAP_UNUSE_MAX_TRIES times.
+         *
+         * Limit the number of retries? No: when mmget_not_zero() above fails,
+         * that mm is likely to be freeing swap from exit_mmap(), which proceeds
+         * at its own independent pace; and even shmem_writepage() could have
+         * been preempted after get_swap_page(), temporarily hiding that swap.
+         * It's easy and robust (though cpu-intensive) just to keep retrying.
          */
-        if (++retries >= SWAP_UNUSE_MAX_TRIES)
-                retval = -EBUSY;
-        else if (si->inuse_pages)
-                goto retry;
-
+        if (si->inuse_pages) {
+                if (!signal_pending(current))
+                        goto retry;
+                retval = -EINTR;
+        }
 out:
         return (retval == FRONTSWAP_PAGES_UNUSED) ? 0 : retval;
 }
diff --git a/mm/util.c b/mm/util.c
index d559bde497a9..43a2984bccaa 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -204,7 +204,7 @@ EXPORT_SYMBOL(vmemdup_user);
  * @s: The string to duplicate
  * @n: Maximum number of bytes to copy, including the trailing NUL.
  *
- * Return: newly allocated copy of @s or %NULL in case of error
+ * Return: newly allocated copy of @s or an ERR_PTR() in case of error
  */
 char *strndup_user(const char __user *s, long n)
 {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a5ad0b35ab8e..a815f73ee4d5 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2176,7 +2176,6 @@ static void shrink_active_list(unsigned long nr_to_scan,
  *   10TB     320        32GB
  */
 static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
-                                 struct mem_cgroup *memcg,
                                  struct scan_control *sc, bool actual_reclaim)
 {
         enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE;
@@ -2197,16 +2196,12 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
         inactive = lruvec_lru_size(lruvec, inactive_lru, sc->reclaim_idx);
         active = lruvec_lru_size(lruvec, active_lru, sc->reclaim_idx);
 
-        if (memcg)
-                refaults = memcg_page_state(memcg, WORKINGSET_ACTIVATE);
-        else
-                refaults = node_page_state(pgdat, WORKINGSET_ACTIVATE);
-
         /*
          * When refaults are being observed, it means a new workingset
          * is being established. Disable active list protection to get
          * rid of the stale workingset quickly.
          */
+        refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
         if (file && actual_reclaim && lruvec->refaults != refaults) {
                 inactive_ratio = 0;
         } else {
@@ -2227,12 +2222,10 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
 }
 
 static unsigned long shrink_list(enum lru_list lru, unsigned long nr_to_scan,
-                                 struct lruvec *lruvec, struct mem_cgroup *memcg,
-                                 struct scan_control *sc)
+                                 struct lruvec *lruvec, struct scan_control *sc)
 {
         if (is_active_lru(lru)) {
-                if (inactive_list_is_low(lruvec, is_file_lru(lru),
-                                         memcg, sc, true))
+                if (inactive_list_is_low(lruvec, is_file_lru(lru), sc, true))
                         shrink_active_list(nr_to_scan, lruvec, sc, lru);
                 return 0;
         }
@@ -2332,7 +2325,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
                          * anonymous pages on the LRU in eligible zones.
                          * Otherwise, the small LRU gets thrashed.
                          */
-                        if (!inactive_list_is_low(lruvec, false, memcg, sc, false) &&
+                        if (!inactive_list_is_low(lruvec, false, sc, false) &&
                             lruvec_lru_size(lruvec, LRU_INACTIVE_ANON, sc->reclaim_idx)
                                         >> sc->priority) {
                                 scan_balance = SCAN_ANON;
@@ -2350,7 +2343,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
          * lruvec even if it has plenty of old anonymous pages unless the
          * system is under heavy pressure.
          */
-        if (!inactive_list_is_low(lruvec, true, memcg, sc, false) &&
+        if (!inactive_list_is_low(lruvec, true, sc, false) &&
             lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, sc->reclaim_idx) >> sc->priority) {
                 scan_balance = SCAN_FILE;
                 goto out;
@@ -2503,7 +2496,7 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
                                 nr[lru] -= nr_to_scan;
 
                                 nr_reclaimed += shrink_list(lru, nr_to_scan,
-                                                            lruvec, memcg, sc);
+                                                            lruvec, sc);
                         }
                 }
 
@@ -2570,7 +2563,7 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
          * Even if we did not try to evict anon pages at all, we want to
          * rebalance the anon lru active/inactive ratio.
          */
-        if (inactive_list_is_low(lruvec, false, memcg, sc, true))
+        if (inactive_list_is_low(lruvec, false, sc, true))
                 shrink_active_list(SWAP_CLUSTER_MAX, lruvec,
                                    sc, LRU_ACTIVE_ANON);
 }
@@ -2969,12 +2962,8 @@ static void snapshot_refaults(struct mem_cgroup *root_memcg, pg_data_t *pgdat)
                 unsigned long refaults;
                 struct lruvec *lruvec;
 
-                if (memcg)
-                        refaults = memcg_page_state(memcg, WORKINGSET_ACTIVATE);
-                else
-                        refaults = node_page_state(pgdat, WORKINGSET_ACTIVATE);
-
                 lruvec = mem_cgroup_lruvec(pgdat, memcg);
+                refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
                 lruvec->refaults = refaults;
         } while ((memcg = mem_cgroup_iter(root_memcg, memcg, NULL)));
 }
@@ -3339,7 +3328,7 @@ static void age_active_anon(struct pglist_data *pgdat,
         do {
                 struct lruvec *lruvec = mem_cgroup_lruvec(pgdat, memcg);
 
-                if (inactive_list_is_low(lruvec, false, memcg, sc, true))
+                if (inactive_list_is_low(lruvec, false, sc, true))
                         shrink_active_list(SWAP_CLUSTER_MAX, lruvec,
                                            sc, LRU_ACTIVE_ANON);
 
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 36b56f858f0f..a7d493366a65 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1274,13 +1274,8 @@ const char * const vmstat_text[] = {
 #endif
 #endif /* CONFIG_MEMORY_BALLOON */
 #ifdef CONFIG_DEBUG_TLBFLUSH
-#ifdef CONFIG_SMP
         "nr_tlb_remote_flush",
         "nr_tlb_remote_flush_received",
-#else
-        "", /* nr_tlb_remote_flush */
-        "", /* nr_tlb_remote_flush_received */
-#endif /* CONFIG_SMP */
         "nr_tlb_local_flush_all",
         "nr_tlb_local_flush_one",
 #endif /* CONFIG_DEBUG_TLBFLUSH */
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 15293c2a5dd8..8d77b6ee4477 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -443,27 +443,29 @@ static int vlan_dev_fcoe_disable(struct net_device *dev)
         return rc;
 }
 
-static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
+static int vlan_dev_fcoe_ddp_target(struct net_device *dev, u16 xid,
+                                    struct scatterlist *sgl, unsigned int sgc)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
         const struct net_device_ops *ops = real_dev->netdev_ops;
-        int rc = -EINVAL;
+        int rc = 0;
+
+        if (ops->ndo_fcoe_ddp_target)
+                rc = ops->ndo_fcoe_ddp_target(real_dev, xid, sgl, sgc);
 
-        if (ops->ndo_fcoe_get_wwn)
-                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
         return rc;
 }
+#endif
 
-static int vlan_dev_fcoe_ddp_target(struct net_device *dev, u16 xid,
-                                    struct scatterlist *sgl, unsigned int sgc)
+#ifdef NETDEV_FCOE_WWNN
+static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
         const struct net_device_ops *ops = real_dev->netdev_ops;
-        int rc = 0;
-
-        if (ops->ndo_fcoe_ddp_target)
-                rc = ops->ndo_fcoe_ddp_target(real_dev, xid, sgl, sgc);
+        int rc = -EINVAL;
 
+        if (ops->ndo_fcoe_get_wwn)
+                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
         return rc;
 }
 #endif
@@ -794,9 +796,11 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
-        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
         .ndo_fcoe_ddp_target    = vlan_dev_fcoe_ddp_target,
 #endif
+#ifdef NETDEV_FCOE_WWNN
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = vlan_dev_poll_controller,
         .ndo_netpoll_setup      = vlan_dev_netpoll_setup,
diff --git a/net/atm/lec.c b/net/atm/lec.c
index d7f5cf5b7594..ad4f829193f0 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -710,7 +710,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
 static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
 {
-        if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
+        if (arg < 0 || arg >= MAX_LEC_ITF)
+                return -EINVAL;
+        arg = array_index_nospec(arg, MAX_LEC_ITF);
+        if (!dev_lec[arg])
                 return -EINVAL;
         vcc->proto_data = dev_lec[arg];
         return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc);
@@ -728,6 +731,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                 i = arg;
         if (arg >= MAX_LEC_ITF)
                 return -EINVAL;
+        i = array_index_nospec(arg, MAX_LEC_ITF);
         if (!dev_lec[i]) {
                 int size;
 
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index a9b7919c9de5..d5df0114f08a 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -104,8 +104,10 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
 
                 ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
 
-                /* free the TID stats immediately */
-                cfg80211_sinfo_release_content(&sinfo);
+                if (!ret) {
+                        /* free the TID stats immediately */
+                        cfg80211_sinfo_release_content(&sinfo);
+                }
 
                 dev_put(real_netdev);
                 if (ret == -ENOENT) {
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index ef39aabdb694..4fb01108e5f5 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -803,6 +803,8 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
                                  const u8 *mac, const unsigned short vid)
 {
         struct batadv_bla_claim search_claim, *claim;
+        struct batadv_bla_claim *claim_removed_entry;
+        struct hlist_node *claim_removed_node;
 
         ether_addr_copy(search_claim.addr, mac);
         search_claim.vid = vid;
@@ -813,10 +815,18 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "%s(): %pM, vid %d\n", __func__,
                    mac, batadv_print_vid(vid));
 
-        batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim,
-                           batadv_choose_claim, claim);
-        batadv_claim_put(claim); /* reference from the hash is gone */
+        claim_removed_node = batadv_hash_remove(bat_priv->bla.claim_hash,
+                                                batadv_compare_claim,
+                                                batadv_choose_claim, claim);
+        if (!claim_removed_node)
+                goto free_claim;
 
+        /* reference from the hash is gone */
+        claim_removed_entry = hlist_entry(claim_removed_node,
+                                          struct batadv_bla_claim, hash_entry);
+        batadv_claim_put(claim_removed_entry);
+
+free_claim:
         /* don't need the reference from hash_find() anymore */
         batadv_claim_put(claim);
 }
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index 0b4b3fb778a6..208655cf6717 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -1116,9 +1116,9 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
                                                 struct attribute *attr,
                                                 char *buff, size_t count)
 {
-        struct batadv_priv *bat_priv = batadv_kobj_to_batpriv(kobj);
         struct net_device *net_dev = batadv_kobj_to_netdev(kobj);
         struct batadv_hard_iface *hard_iface;
+        struct batadv_priv *bat_priv;
         u32 tp_override;
         u32 old_tp_override;
         bool ret;
@@ -1147,7 +1147,10 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
 
         atomic_set(&hard_iface->bat_v.throughput_override, tp_override);
 
-        batadv_netlink_notify_hardif(bat_priv, hard_iface);
+        if (hard_iface->soft_iface) {
+                bat_priv = netdev_priv(hard_iface->soft_iface);
+                batadv_netlink_notify_hardif(bat_priv, hard_iface);
+        }
 
 out:
         batadv_hardif_put(hard_iface);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index f73d79139ae7..26c4e2493ddf 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -616,14 +616,26 @@ static void batadv_tt_global_free(struct batadv_priv *bat_priv,
                                   struct batadv_tt_global_entry *tt_global,
                                   const char *message)
 {
+        struct batadv_tt_global_entry *tt_removed_entry;
+        struct hlist_node *tt_removed_node;
+
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Deleting global tt entry %pM (vid: %d): %s\n",
                    tt_global->common.addr,
                    batadv_print_vid(tt_global->common.vid), message);
 
-        batadv_hash_remove(bat_priv->tt.global_hash, batadv_compare_tt,
-                           batadv_choose_tt, &tt_global->common);
-        batadv_tt_global_entry_put(tt_global);
+        tt_removed_node = batadv_hash_remove(bat_priv->tt.global_hash,
+                                             batadv_compare_tt,
+                                             batadv_choose_tt,
+                                             &tt_global->common);
+        if (!tt_removed_node)
+                return;
+
+        /* drop reference of remove hash entry */
+        tt_removed_entry = hlist_entry(tt_removed_node,
+                                       struct batadv_tt_global_entry,
+                                       common.hash_entry);
+        batadv_tt_global_entry_put(tt_removed_entry);
 }
 
 /**
@@ -1337,9 +1349,10 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
                            unsigned short vid, const char *message,
                            bool roaming)
 {
+        struct batadv_tt_local_entry *tt_removed_entry;
         struct batadv_tt_local_entry *tt_local_entry;
         u16 flags, curr_flags = BATADV_NO_FLAGS;
-        void *tt_entry_exists;
+        struct hlist_node *tt_removed_node;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
         if (!tt_local_entry)
@@ -1368,15 +1381,18 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
          */
         batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
 
-        tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
+        tt_removed_node = batadv_hash_remove(bat_priv->tt.local_hash,
                                              batadv_compare_tt,
                                              batadv_choose_tt,
                                              &tt_local_entry->common);
-        if (!tt_entry_exists)
+        if (!tt_removed_node)
                 goto out;
 
-        /* extra call to free the local tt entry */
-        batadv_tt_local_entry_put(tt_local_entry);
+        /* drop reference of remove hash entry */
+        tt_removed_entry = hlist_entry(tt_removed_node,
+                                       struct batadv_tt_local_entry,
+                                       common.hash_entry);
+        batadv_tt_local_entry_put(tt_removed_entry);
 
 out:
         if (tt_local_entry)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 9a580999ca57..d892b7c3cc42 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -523,12 +523,12 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
         struct sock *sk = sock->sk;
         int err = 0;
 
-        BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
-
         if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
             addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
+        BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
+
         lock_sock(sk);
 
         if (sk->sk_state != BT_OPEN) {
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 5ea7e56119c1..ba303ee99b9b 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -197,13 +197,10 @@ static void __br_handle_local_finish(struct sk_buff *skb)
 /* note: already called with rcu_read_lock */
 static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
-
         __br_handle_local_finish(skb);
 
-        BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
-        br_pass_frame_up(skb);
-        return 0;
+        /* return 1 to signal the okfn() was called so it's ok to use the skb */
+        return 1;
 }
 
 /*
@@ -280,10 +277,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                                 goto forward;
                 }
 
-                /* Deliver packet to local host only */
-                NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev),
-                        NULL, skb, skb->dev, NULL, br_handle_local_finish);
-                return RX_HANDLER_CONSUMED;
+                /* The else clause should be hit when nf_hook():
+                 *   - returns < 0 (drop/error)
+                 *   - returns = 0 (stolen/nf_queue)
+                 * Thus return 1 from the okfn() to signal the skb is ok to pass
+                 */
+                if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
+                            dev_net(skb->dev), NULL, skb, skb->dev, NULL,
+                            br_handle_local_finish) == 1) {
+                        return RX_HANDLER_PASS;
+                } else {
+                        return RX_HANDLER_CONSUMED;
+                }
         }
 
 forward:
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a0e369179f6d..45e7f4173bba 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -601,6 +601,7 @@ static int br_ip4_multicast_add_group(struct net_bridge *br,
         if (ipv4_is_local_multicast(group))
                 return 0;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
@@ -1497,6 +1498,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
 
         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
@@ -1520,6 +1522,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 
         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip6 = *group;
         br_group.proto = htons(ETH_P_IPV6);
         br_group.vid = vid;
@@ -2028,7 +2031,8 @@ static void br_multicast_start_querier(struct net_bridge *br,
 
         __br_multicast_open(br, query);
 
-        list_for_each_entry(port, &br->port_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(port, &br->port_list, list) {
                 if (port->state == BR_STATE_DISABLED ||
                     port->state == BR_STATE_BLOCKING)
                         continue;
@@ -2040,6 +2044,7 @@ static void br_multicast_start_querier(struct net_bridge *br,
                         br_multicast_enable(&port->ip6_own_query);
 #endif
         }
+        rcu_read_unlock();
 }
 
 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 9c07591b0232..7104cf13da84 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1441,7 +1441,7 @@ static int br_fill_info(struct sk_buff *skb, const struct net_device *brdev)
             nla_put_u8(skb, IFLA_BR_VLAN_STATS_ENABLED,
                        br_opt_get(br, BROPT_VLAN_STATS_ENABLED)) ||
             nla_put_u8(skb, IFLA_BR_VLAN_STATS_PER_PORT,
-                       br_opt_get(br, IFLA_BR_VLAN_STATS_PER_PORT)))
+                       br_opt_get(br, BROPT_VLAN_STATS_PER_PORT)))
                 return -EMSGSIZE;
 #endif
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index eb15891f8b9f..3cad01ac64e4 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2032,7 +2032,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
                 if (match_kern)
                         match_kern->match_size = ret;
 
-                if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+                /* rule should have no remaining data after target */
+                if (type == EBT_COMPAT_TARGET && size_left)
                         return -EINVAL;
 
                 match32 = (struct compat_ebt_entry_mwt *) buf;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b2651bb6d2a3..e657289db4ac 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -279,7 +279,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
                         break;
 
                 sk_busy_loop(sk, flags & MSG_DONTWAIT);
-        } while (!skb_queue_empty(&sk->sk_receive_queue));
+        } while (sk->sk_receive_queue.prev != *last);
 
         error = -EAGAIN;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 2b67f2aa59dd..f409406254dd 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1184,7 +1184,21 @@ int dev_change_name(struct net_device *dev, const char *newname)
         BUG_ON(!dev_net(dev));
 
         net = dev_net(dev);
-        if (dev->flags & IFF_UP)
+
+        /* Some auto-enslaved devices e.g. failover slaves are
+         * special, as userspace might rename the device after
+         * the interface had been brought up and running since
+         * the point kernel initiated auto-enslavement. Allow
+         * live name change even when these slave devices are
+         * up and running.
+         *
+         * Typically, users of these auto-enslaving devices
+         * don't actually care about slave name change, as
+         * they are supposed to operate on master interface
+         * directly.
+         */
+        if (dev->flags & IFF_UP &&
+            likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
                 return -EBUSY;
 
         write_seqcount_begin(&devnet_rename_seq);
@@ -5014,8 +5028,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head,
         if (pt_prev->list_func != NULL)
                 pt_prev->list_func(head, pt_prev, orig_dev);
         else
-                list_for_each_entry_safe(skb, next, head, list)
+                list_for_each_entry_safe(skb, next, head, list) {
+                        skb_list_del_init(skb);
                         pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+                }
 }
 
 static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index b1eb32419732..36ed619faf36 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1797,11 +1797,16 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         WARN_ON_ONCE(!ret);
 
         gstrings.len = ret;
-        data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
-        if (gstrings.len && !data)
-                return -ENOMEM;
 
-        __ethtool_get_strings(dev, gstrings.string_set, data);
+        if (gstrings.len) {
+                data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
+                if (!data)
+                        return -ENOMEM;
+
+                __ethtool_get_strings(dev, gstrings.string_set, data);
+        } else {
+                data = NULL;
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
@@ -1897,11 +1902,15 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(array_size(n_stats, sizeof(u64)));
-        if (n_stats && !data)
-                return -ENOMEM;
 
-        ops->get_ethtool_stats(dev, &stats, data);
+        if (n_stats) {
+                data = vzalloc(array_size(n_stats, sizeof(u64)));
+                if (!data)
+                        return -ENOMEM;
+                ops->get_ethtool_stats(dev, &stats, data);
+        } else {
+                data = NULL;
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &stats, sizeof(stats)))
@@ -1941,16 +1950,21 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(array_size(n_stats, sizeof(u64)));
-        if (n_stats && !data)
-                return -ENOMEM;
 
-        if (dev->phydev && !ops->get_ethtool_phy_stats) {
-                ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
-                if (ret < 0)
-                        return ret;
+        if (n_stats) {
+                data = vzalloc(array_size(n_stats, sizeof(u64)));
+                if (!data)
+                        return -ENOMEM;
+
+                if (dev->phydev && !ops->get_ethtool_phy_stats) {
+                        ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
+                        if (ret < 0)
+                                goto out;
+                } else {
+                        ops->get_ethtool_phy_stats(dev, &stats, data);
+                }
         } else {
-                ops->get_ethtool_phy_stats(dev, &stats, data);
+                data = NULL;
         }
 
         ret = -EFAULT;
diff --git a/net/core/failover.c b/net/core/failover.c
index 4a92a98ccce9..b5cd3c727285 100644
--- a/net/core/failover.c
+++ b/net/core/failover.c
@@ -80,14 +80,14 @@ static int failover_slave_register(struct net_device *slave_dev)
                 goto err_upper_link;
         }
 
-        slave_dev->priv_flags |= IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags |= (IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 
         if (fops && fops->slave_register &&
             !fops->slave_register(slave_dev, failover_dev))
                 return NOTIFY_OK;
 
         netdev_upper_dev_unlink(slave_dev, failover_dev);
-        slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 err_upper_link:
         netdev_rx_handler_unregister(slave_dev);
 done:
@@ -121,7 +121,7 @@ int failover_slave_unregister(struct net_device *slave_dev)
 
         netdev_rx_handler_unregister(slave_dev);
         netdev_upper_dev_unlink(slave_dev, failover_dev);
-        slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 
         if (fops && fops->slave_unregister &&
             !fops->slave_unregister(slave_dev, failover_dev))
diff --git a/net/core/filter.c b/net/core/filter.c
index 647c63a7b25b..27e61ffd9039 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4383,6 +4383,8 @@ BPF_CALL_3(bpf_bind, struct bpf_sock_addr_kern *, ctx, struct sockaddr *, addr,
          * Only binding to IP is supported.
          */
         err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return err;
         if (addr->sa_family == AF_INET) {
                 if (addr_len < sizeof(struct sockaddr_in))
                         return err;
@@ -6613,14 +6615,8 @@ static bool flow_dissector_is_valid_access(int off, int size,
                                            const struct bpf_prog *prog,
                                            struct bpf_insn_access_aux *info)
 {
-        if (type == BPF_WRITE) {
-                switch (off) {
-                case bpf_ctx_range_till(struct __sk_buff, cb[0], cb[4]):
-                        break;
-                default:
-                        return false;
-                }
-        }
+        if (type == BPF_WRITE)
+                return false;
 
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, data):
@@ -6632,11 +6628,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
         case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 info->reg_type = PTR_TO_FLOW_KEYS;
                 break;
-        case bpf_ctx_range(struct __sk_buff, tc_classid):
-        case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range_till(struct __sk_buff, family, local_port):
-        case bpf_ctx_range(struct __sk_buff, tstamp):
-        case bpf_ctx_range(struct __sk_buff, wire_len):
+        default:
                 return false;
         }
 
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index bb1a54747d64..94a450b2191a 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -707,6 +707,7 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
         /* Pass parameters to the BPF program */
         memset(flow_keys, 0, sizeof(*flow_keys));
         cb->qdisc_cb.flow_keys = flow_keys;
+        flow_keys->n_proto = skb->protocol;
         flow_keys->nhoff = skb_network_offset(skb);
         flow_keys->thoff = flow_keys->nhoff;
 
@@ -716,7 +717,8 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
         /* Restore state */
         memcpy(cb, &cb_saved, sizeof(cb_saved));
 
-        flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, skb->len);
+        flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff,
+                                   skb_network_offset(skb), skb->len);
         flow_keys->thoff = clamp_t(u16, flow_keys->thoff,
                                    flow_keys->nhoff, skb->len);
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index f8f94303a1f5..8f8b7b6c2945 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1747,20 +1747,16 @@ int netdev_register_kobject(struct net_device *ndev)
 
         error = device_add(dev);
         if (error)
-                goto error_put_device;
+                return error;
 
         error = register_queue_kobjects(ndev);
-        if (error)
-                goto error_device_del;
+        if (error) {
+                device_del(dev);
+                return error;
+        }
 
         pm_runtime_set_memalloc_noio(dev, true);
 
-        return 0;
-
-error_device_del:
-        device_del(dev);
-error_put_device:
-        put_device(dev);
         return error;
 }
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 17f36317363d..7e6dcc625701 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -304,6 +304,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 
         refcount_set(&net->count, 1);
         refcount_set(&net->passive, 1);
+        get_random_bytes(&net->hash_mix, sizeof(u32));
         net->dev_base_seq = 1;
         net->user_ns = user_ns;
         idr_init(&net->netns_ids);
diff --git a/net/core/ptp_classifier.c b/net/core/ptp_classifier.c
index 703cf76aa7c2..7109c168b5e0 100644
--- a/net/core/ptp_classifier.c
+++ b/net/core/ptp_classifier.c
@@ -185,9 +185,10 @@ void __init ptp_classifier_init(void)
                 { 0x16,  0,  0, 0x00000000 },
                 { 0x06,  0,  0, 0x00000000 },
         };
-        struct sock_fprog_kern ptp_prog = {
-                .len = ARRAY_SIZE(ptp_filter), .filter = ptp_filter,
-        };
+        struct sock_fprog_kern ptp_prog;
+
+        ptp_prog.len = ARRAY_SIZE(ptp_filter);
+        ptp_prog.filter = ptp_filter;
 
         BUG_ON(bpf_prog_create(&ptp_insns, &ptp_prog));
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a51cab95ba64..220c56e93659 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4948,7 +4948,7 @@ static int rtnl_valid_stats_req(const struct nlmsghdr *nlh, bool strict_check,
 {
         struct if_stats_msg *ifsm;
 
-        if (nlh->nlmsg_len < sizeof(*ifsm)) {
+        if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifsm))) {
                 NL_SET_ERR_MSG(extack, "Invalid header for stats dump");
                 return -EINVAL;
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2415d9cb9b89..40796b8bf820 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3801,7 +3801,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
         unsigned int delta_truesize;
         struct sk_buff *lp;
 
-        if (unlikely(p->len + len >= 65536))
+        if (unlikely(p->len + len >= 65536 || NAPI_GRO_CB(skb)->flush))
                 return -E2BIG;
 
         lp = NAPI_GRO_CB(p)->last;
@@ -5083,7 +5083,8 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
 
 static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
 {
-        int mac_len;
+        int mac_len, meta_len;
+        void *meta;
 
         if (skb_cow(skb, skb_headroom(skb)) < 0) {
                 kfree_skb(skb);
@@ -5095,6 +5096,13 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
                 memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
                         mac_len - VLAN_HLEN - ETH_TLEN);
         }
+
+        meta_len = skb_metadata_len(skb);
+        if (meta_len) {
+                meta = skb_metadata_end(skb) - meta_len;
+                memmove(meta + VLAN_HLEN, meta, meta_len);
+        }
+
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 782343bb925b..067878a1e4c5 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -348,7 +348,7 @@ static int sock_get_timeout(long timeo, void *optval, bool old_timeval)
                 tv.tv_usec = ((timeo % HZ) * USEC_PER_SEC) / HZ;
         }
 
-        if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
+        if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
                 struct old_timeval32 tv32 = { tv.tv_sec, tv.tv_usec };
                 *(struct old_timeval32 *)optval = tv32;
                 return sizeof(tv32);
@@ -372,7 +372,7 @@ static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen, bool
 {
         struct __kernel_sock_timeval tv;
 
-        if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
+        if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
                 struct old_timeval32 tv32;
 
                 if (optlen < sizeof(tv32))
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index f227f002c73d..db87d9f58019 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -738,7 +738,12 @@ static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
         if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
                 return -ENOMEM;
 
-        return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
+        if (dccp_feat_push_change(fn, feat, is_local, mandatory, &fval)) {
+                kfree(fval.sp.vec);
+                return -ENOMEM;
+        }
+
+        return 0;
 }
 
 /**
diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
index ed4f6dc26365..85c22ada4744 100644
--- a/net/dsa/tag_qca.c
+++ b/net/dsa/tag_qca.c
@@ -98,8 +98,18 @@ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev,
         return skb;
 }
 
+static int qca_tag_flow_dissect(const struct sk_buff *skb, __be16 *proto,
+                                int *offset)
+{
+        *offset = QCA_HDR_LEN;
+        *proto = ((__be16 *)skb->data)[0];
+
+        return 0;
+}
+
 const struct dsa_device_ops qca_netdev_ops = {
         .xmit   = qca_tag_xmit,
         .rcv    = qca_tag_rcv,
+        .flow_dissect = qca_tag_flow_dissect,
         .overhead = QCA_HDR_LEN,
 };
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 79e98e21cdd7..12ce6c526d72 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -121,6 +121,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
         struct guehdr *guehdr;
         void *data;
         u16 doffset = 0;
+        u8 proto_ctype;
 
         if (!fou)
                 return 1;
@@ -212,13 +213,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
         if (unlikely(guehdr->control))
                 return gue_control_message(skb, guehdr);
 
+        proto_ctype = guehdr->proto_ctype;
         __skb_pull(skb, sizeof(struct udphdr) + hdrlen);
         skb_reset_transport_header(skb);
 
         if (iptunnel_pull_offloads(skb))
                 goto drop;
 
-        return -guehdr->proto_ctype;
+        return -proto_ctype;
 
 drop:
         kfree_skb(skb);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index fd219f7bd3ea..4b0526441476 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         struct net *net = dev_net(skb->dev);
         struct metadata_dst *tun_dst = NULL;
         struct erspan_base_hdr *ershdr;
-        struct erspan_metadata *pkt_md;
         struct ip_tunnel_net *itn;
         struct ip_tunnel *tunnel;
         const struct iphdr *iph;
@@ -282,9 +281,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                 if (unlikely(!pskb_may_pull(skb, len)))
                         return PACKET_REJECT;
 
-                ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
-                pkt_md = (struct erspan_metadata *)(ershdr + 1);
-
                 if (__iptunnel_pull_header(skb,
                                            len,
                                            htons(ETH_P_TEB),
@@ -292,8 +288,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                         goto drop;
 
                 if (tunnel->collect_md) {
+                        struct erspan_metadata *pkt_md, *md;
                         struct ip_tunnel_info *info;
-                        struct erspan_metadata *md;
+                        unsigned char *gh;
                         __be64 tun_id;
                         __be16 flags;
 
@@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                         if (!tun_dst)
                                 return PACKET_REJECT;
 
+                        /* skb can be uncloned in __iptunnel_pull_header, so
+                         * old pkt_md is no longer valid and we need to reset
+                         * it
+                         */
+                        gh = skb_network_header(skb) +
+                             skb_network_header_len(skb);
+                        pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
+                                                            sizeof(*ershdr));
                         md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
                         md->version = ver;
                         md2 = &md->u.md2;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index ecce2dc78f17..1132d6d1796a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -257,11 +257,10 @@ int ip_local_deliver(struct sk_buff *skb)
                        ip_local_deliver_finish);
 }
 
-static inline bool ip_rcv_options(struct sk_buff *skb)
+static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_options *opt;
         const struct iphdr *iph;
-        struct net_device *dev = skb->dev;
 
         /* It looks as overkill, because not all
            IP options require packet mangling.
@@ -297,7 +296,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb)
                         }
                 }
 
-                if (ip_options_rcv_srr(skb))
+                if (ip_options_rcv_srr(skb, dev))
                         goto drop;
         }
 
@@ -353,7 +352,7 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
         }
 #endif
 
-        if (iph->ihl > 5 && ip_rcv_options(skb))
+        if (iph->ihl > 5 && ip_rcv_options(skb, dev))
                 goto drop;
 
         rt = skb_rtable(skb);
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 32a35043c9f5..3db31bb9df50 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb)
         }
 }
 
-int ip_options_rcv_srr(struct sk_buff *skb)
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_options *opt = &(IPCB(skb)->opt);
         int srrspace, srrptr;
@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 
                 orefdst = skb->_skb_refdst;
                 skb_dst_set(skb, NULL);
-                err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);
+                err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev);
                 rt2 = skb_rtable(skb);
                 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {
                         skb_dst_drop(skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a5da63e5faa2..6fdf1c195d8e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1183,11 +1183,39 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
         return dst;
 }
 
+static void ipv4_send_dest_unreach(struct sk_buff *skb)
+{
+        struct ip_options opt;
+        int res;
+
+        /* Recompile ip options since IPCB may not be valid anymore.
+         * Also check we have a reasonable ipv4 header.
+         */
+        if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) ||
+            ip_hdr(skb)->version != 4 || ip_hdr(skb)->ihl < 5)
+                return;
+
+        memset(&opt, 0, sizeof(opt));
+        if (ip_hdr(skb)->ihl > 5) {
+                if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
+                        return;
+                opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);
+
+                rcu_read_lock();
+                res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
+                rcu_read_unlock();
+
+                if (res)
+                        return;
+        }
+        __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
+}
+
 static void ipv4_link_failure(struct sk_buff *skb)
 {
         struct rtable *rt;
 
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+        ipv4_send_dest_unreach(skb);
 
         rt = skb_rtable(skb);
         if (rt)
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index ba0fc4b18465..eeb4041fa5f9 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -49,6 +49,7 @@ static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 static int comp_sack_nr_max = 255;
 static u32 u32_max_div_HZ = UINT_MAX / HZ;
+static int one_day_secs = 24 * 3600;
 
 /* obsolete */
 static int sysctl_tcp_low_latency __read_mostly;
@@ -1151,7 +1152,9 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_tcp_min_rtt_wlen,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one_day_secs
         },
         {
                 .procname       = "tcp_autocorking",
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index cd4814f7e962..477cb4aa456c 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -49,9 +49,8 @@
 #define DCTCP_MAX_ALPHA 1024U
 
 struct dctcp {
-        u32 acked_bytes_ecn;
-        u32 acked_bytes_total;
-        u32 prior_snd_una;
+        u32 old_delivered;
+        u32 old_delivered_ce;
         u32 prior_rcv_nxt;
         u32 dctcp_alpha;
         u32 next_seq;
@@ -67,19 +66,14 @@ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
 module_param(dctcp_alpha_on_init, uint, 0644);
 MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value");
 
-static unsigned int dctcp_clamp_alpha_on_loss __read_mostly;
-module_param(dctcp_clamp_alpha_on_loss, uint, 0644);
-MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss,
-                 "parameter for clamping alpha on loss");
-
 static struct tcp_congestion_ops dctcp_reno;
 
 static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
 {
         ca->next_seq = tp->snd_nxt;
 
-        ca->acked_bytes_ecn = 0;
-        ca->acked_bytes_total = 0;
+        ca->old_delivered = tp->delivered;
+        ca->old_delivered_ce = tp->delivered_ce;
 }
 
 static void dctcp_init(struct sock *sk)
@@ -91,7 +85,6 @@ static void dctcp_init(struct sock *sk)
              sk->sk_state == TCP_CLOSE)) {
                 struct dctcp *ca = inet_csk_ca(sk);
 
-                ca->prior_snd_una = tp->snd_una;
                 ca->prior_rcv_nxt = tp->rcv_nxt;
 
                 ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
@@ -123,37 +116,25 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         struct dctcp *ca = inet_csk_ca(sk);
-        u32 acked_bytes = tp->snd_una - ca->prior_snd_una;
-
-        /* If ack did not advance snd_una, count dupack as MSS size.
-         * If ack did update window, do not count it at all.
-         */
-        if (acked_bytes == 0 && !(flags & CA_ACK_WIN_UPDATE))
-                acked_bytes = inet_csk(sk)->icsk_ack.rcv_mss;
-        if (acked_bytes) {
-                ca->acked_bytes_total += acked_bytes;
-                ca->prior_snd_una = tp->snd_una;
-
-                if (flags & CA_ACK_ECE)
-                        ca->acked_bytes_ecn += acked_bytes;
-        }
 
         /* Expired RTT */
         if (!before(tp->snd_una, ca->next_seq)) {
-                u64 bytes_ecn = ca->acked_bytes_ecn;
+                u32 delivered_ce = tp->delivered_ce - ca->old_delivered_ce;
                 u32 alpha = ca->dctcp_alpha;
 
                 /* alpha = (1 - g) * alpha + g * F */
 
                 alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
-                if (bytes_ecn) {
+                if (delivered_ce) {
+                        u32 delivered = tp->delivered - ca->old_delivered;
+
                         /* If dctcp_shift_g == 1, a 32bit value would overflow
-                         * after 8 Mbytes.
+                         * after 8 M packets.
                          */
-                        bytes_ecn <<= (10 - dctcp_shift_g);
-                        do_div(bytes_ecn, max(1U, ca->acked_bytes_total));
+                        delivered_ce <<= (10 - dctcp_shift_g);
+                        delivered_ce /= max(1U, delivered);
 
-                        alpha = min(alpha + (u32)bytes_ecn, DCTCP_MAX_ALPHA);
+                        alpha = min(alpha + delivered_ce, DCTCP_MAX_ALPHA);
                 }
                 /* dctcp_alpha can be read from dctcp_get_info() without
                  * synchro, so we ask compiler to not use dctcp_alpha
@@ -164,21 +145,23 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
         }
 }
 
-static void dctcp_state(struct sock *sk, u8 new_state)
+static void dctcp_react_to_loss(struct sock *sk)
 {
-        if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) {
-                struct dctcp *ca = inet_csk_ca(sk);
+        struct dctcp *ca = inet_csk_ca(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
 
-                /* If this extension is enabled, we clamp dctcp_alpha to
-                 * max on packet loss; the motivation is that dctcp_alpha
-                 * is an indicator to the extend of congestion and packet
-                 * loss is an indicator of extreme congestion; setting
-                 * this in practice turned out to be beneficial, and
-                 * effectively assumes total congestion which reduces the
-                 * window by half.
-                 */
-                ca->dctcp_alpha = DCTCP_MAX_ALPHA;
-        }
+        ca->loss_cwnd = tp->snd_cwnd;
+        tp->snd_ssthresh = max(tp->snd_cwnd >> 1U, 2U);
+}
+
+static void dctcp_state(struct sock *sk, u8 new_state)
+{
+        if (new_state == TCP_CA_Recovery &&
+            new_state != inet_csk(sk)->icsk_ca_state)
+                dctcp_react_to_loss(sk);
+        /* We handle RTO in dctcp_cwnd_event to ensure that we perform only
+         * one loss-adjustment per RTT.
+         */
 }
 
 static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
@@ -190,6 +173,9 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
         case CA_EVENT_ECN_NO_CE:
                 dctcp_ece_ack_update(sk, ev, &ca->prior_rcv_nxt, &ca->ce_state);
                 break;
+        case CA_EVENT_LOSS:
+                dctcp_react_to_loss(sk);
+                break;
         default:
                 /* Don't care for the rest. */
                 break;
@@ -200,6 +186,7 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
                              union tcp_cc_info *info)
 {
         const struct dctcp *ca = inet_csk_ca(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
 
         /* Fill it also in case of VEGASINFO due to req struct limits.
          * We can still correctly retrieve it later.
@@ -211,8 +198,10 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
                         info->dctcp.dctcp_enabled = 1;
                         info->dctcp.dctcp_ce_state = (u16) ca->ce_state;
                         info->dctcp.dctcp_alpha = ca->dctcp_alpha;
-                        info->dctcp.dctcp_ab_ecn = ca->acked_bytes_ecn;
-                        info->dctcp.dctcp_ab_tot = ca->acked_bytes_total;
+                        info->dctcp.dctcp_ab_ecn = tp->mss_cache *
+                                                   (tp->delivered_ce - ca->old_delivered_ce);
+                        info->dctcp.dctcp_ab_tot = tp->mss_cache *
+                                                   (tp->delivered - ca->old_delivered);
                 }
 
                 *attr = INET_DIAG_DCTCPINFO;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5def3c48870e..731d3045b50a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -402,11 +402,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
 static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        int room;
+
+        room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh;
 
         /* Check #1 */
-        if (tp->rcv_ssthresh < tp->window_clamp &&
-            (int)tp->rcv_ssthresh < tcp_space(sk) &&
-            !tcp_under_memory_pressure(sk)) {
+        if (room > 0 && !tcp_under_memory_pressure(sk)) {
                 int incr;
 
                 /* Check #2. Increase window, if skb with such overhead
@@ -419,8 +420,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 
                 if (incr) {
                         incr = max_t(int, incr, 2 * skb->len);
-                        tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
-                                               tp->window_clamp);
+                        tp->rcv_ssthresh += min(room, incr);
                         inet_csk(sk)->icsk_ack.quick |= 1;
                 }
         }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 277d71239d75..2f8039a26b08 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2578,7 +2578,8 @@ static void __net_exit tcp_sk_exit(struct net *net)
 {
         int cpu;
 
-        module_put(net->ipv4.tcp_congestion_control->owner);
+        if (net->ipv4.tcp_congestion_control)
+                module_put(net->ipv4.tcp_congestion_control->owner);
 
         for_each_possible_cpu(cpu)
                 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index d43d076c98f5..1766325423b5 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -476,7 +476,7 @@ static int ip6addrlbl_valid_dump_req(const struct nlmsghdr *nlh,
         }
 
         if (nlmsg_attrlen(nlh, sizeof(*ifal))) {
-                NL_SET_ERR_MSG_MOD(extack, "Invalid data after header for address label dump requewst");
+                NL_SET_ERR_MSG_MOD(extack, "Invalid data after header for address label dump request");
                 return -EINVAL;
         }
 
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 79d2e43c05c5..5fc1f4e0c0cf 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -417,6 +417,7 @@ int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info)
 
 done:
         rhashtable_walk_stop(&iter);
+        rhashtable_walk_exit(&iter);
         return ret;
 }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b32c95f02128..655e46b227f9 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -525,10 +525,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
 }
 
 static int ip6erspan_rcv(struct sk_buff *skb,
-                         struct tnl_ptk_info *tpi)
+                         struct tnl_ptk_info *tpi,
+                         int gre_hdr_len)
 {
         struct erspan_base_hdr *ershdr;
-        struct erspan_metadata *pkt_md;
         const struct ipv6hdr *ipv6h;
         struct erspan_md2 *md2;
         struct ip6_tnl *tunnel;
@@ -547,18 +547,16 @@ static int ip6erspan_rcv(struct sk_buff *skb,
                 if (unlikely(!pskb_may_pull(skb, len)))
                         return PACKET_REJECT;
 
-                ershdr = (struct erspan_base_hdr *)skb->data;
-                pkt_md = (struct erspan_metadata *)(ershdr + 1);
-
                 if (__iptunnel_pull_header(skb, len,
                                            htons(ETH_P_TEB),
                                            false, false) < 0)
                         return PACKET_REJECT;
 
                 if (tunnel->parms.collect_md) {
+                        struct erspan_metadata *pkt_md, *md;
                         struct metadata_dst *tun_dst;
                         struct ip_tunnel_info *info;
-                        struct erspan_metadata *md;
+                        unsigned char *gh;
                         __be64 tun_id;
                         __be16 flags;
 
@@ -571,6 +569,14 @@ static int ip6erspan_rcv(struct sk_buff *skb,
                         if (!tun_dst)
                                 return PACKET_REJECT;
 
+                        /* skb can be uncloned in __iptunnel_pull_header, so
+                         * old pkt_md is no longer valid and we need to reset
+                         * it
+                         */
+                        gh = skb_network_header(skb) +
+                             skb_network_header_len(skb);
+                        pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
+                                                            sizeof(*ershdr));
                         info = &tun_dst->u.tun_info;
                         md = ip_tunnel_info_opts(info);
                         md->version = ver;
@@ -607,7 +613,7 @@ static int gre_rcv(struct sk_buff *skb)
 
         if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
                      tpi.proto == htons(ETH_P_ERSPAN2))) {
-                if (ip6erspan_rcv(skb, &tpi) == PACKET_RCVD)
+                if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
                         return 0;
                 goto out;
         }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index edbd12067170..e51f3c648b09 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -601,7 +601,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                                 inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
-        unsigned int mtu, hlen, left, len;
+        unsigned int mtu, hlen, left, len, nexthdr_offset;
         int hroom, troom;
         __be32 frag_id;
         int ptr, offset = 0, err = 0;
@@ -612,6 +612,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 goto fail;
         hlen = err;
         nexthdr = *prevhdr;
+        nexthdr_offset = prevhdr - skb_network_header(skb);
 
         mtu = ip6_skb_dst_mtu(skb);
 
@@ -646,6 +647,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
             (err = skb_checksum_help(skb)))
                 goto fail;
 
+        prevhdr = skb_network_header(skb) + nexthdr_offset;
         hroom = LL_RESERVED_SPACE(rt->dst.dev);
         if (skb_has_frag_list(skb)) {
                 unsigned int first_len = skb_pagelen(skb);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0c6403cf8b52..ade1390c6348 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -627,7 +627,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
                                            eiph->daddr, eiph->saddr, 0, 0,
                                            IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
-                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL) {
+                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL6) {
                         if (!IS_ERR(rt))
                                 ip_rt_put(rt);
                         goto out;
@@ -636,7 +636,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         } else {
                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
                                    skb2->dev) ||
-                    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
+                    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6)
                         goto out;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0302e0eb07af..7178e32eb15d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2330,6 +2330,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
 
                 rcu_read_lock();
                 from = rcu_dereference(rt6->from);
+                if (!from) {
+                        rcu_read_unlock();
+                        return;
+                }
                 nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
                 if (nrt6) {
                         rt6_do_update_pmtu(nrt6, mtu);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 07e21a82ce4c..b2109b74857d 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -669,6 +669,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                     !net_eq(tunnel->net, dev_net(tunnel->dev))))
                         goto out;
 
+                /* skb can be uncloned in iptunnel_pull_header, so
+                 * old iph is no longer valid
+                 */
+                iph = (const struct iphdr *)skb_mac_header(skb);
                 err = IP_ECN_decapsulate(iph, skb);
                 if (unlikely(err)) {
                         if (log_ecn_error)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index b444483cdb2b..622eeaf5732b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1047,6 +1047,8 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
                              int addr_len)
 {
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         /* The following checks are replicated from __ip6_datagram_connect()
          * and intended to prevent BPF program called below from accessing
          * bytes that are out of the bound specified by user in addr_len.
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index c5c5ab6c5a1c..44fdc641710d 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -2054,14 +2054,14 @@ static int __init kcm_init(void)
         if (err)
                 goto fail;
 
-        err = sock_register(&kcm_family_ops);
-        if (err)
-                goto sock_register_fail;
-
         err = register_pernet_device(&kcm_net_ops);
         if (err)
                 goto net_ops_fail;
 
+        err = sock_register(&kcm_family_ops);
+        if (err)
+                goto sock_register_fail;
+
         err = kcm_proc_init();
         if (err)
                 goto proc_init_fail;
@@ -2069,12 +2069,12 @@ static int __init kcm_init(void)
         return 0;
 
 proc_init_fail:
-        unregister_pernet_device(&kcm_net_ops);
-
-net_ops_fail:
         sock_unregister(PF_KCM);
 
 sock_register_fail:
+        unregister_pernet_device(&kcm_net_ops);
+
+net_ops_fail:
         proto_unregister(&kcm_proto);
 
 fail:
@@ -2090,8 +2090,8 @@ fail:
 static void __exit kcm_exit(void)
 {
         kcm_proc_exit();
-        unregister_pernet_device(&kcm_net_ops);
         sock_unregister(PF_KCM);
+        unregister_pernet_device(&kcm_net_ops);
         proto_unregister(&kcm_proto);
         destroy_workqueue(kcm_wq);
 
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b99e73a7e7e0..2017b7d780f5 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -320,14 +320,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         struct llc_sap *sap;
         int rc = -EINVAL;
 
-        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
-
         lock_sock(sk);
         if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
         if (unlikely(addr->sllc_family != AF_LLC))
                 goto out;
+        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
         rc = -ENODEV;
         rcu_read_lock();
         if (sk->sk_bound_dev_if) {
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 28d022a3eee3..ae4f0be3b393 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1195,6 +1195,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
 
+        if (local->in_reconfig)
+                return;
+
         if (!check_sdata_in_driver(sdata))
                 return;
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 4700718e010f..37e372896230 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -167,8 +167,10 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                  * The driver doesn't know anything about VLAN interfaces.
                  * Hence, don't send GTKs for VLAN interfaces to the driver.
                  */
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                        ret = 1;
                         goto out_unsupported;
+                }
         }
 
         ret = drv_set_key(key->local, SET_KEY, sdata,
@@ -213,11 +215,8 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 /* all of these we can do in software - if driver can */
                 if (ret == 1)
                         return 0;
-                if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL)) {
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                return 0;
+                if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL))
                         return -EINVAL;
-                }
                 return 0;
         default:
                 return -EINVAL;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 95eb5064fa91..b76a2aefa9ec 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -23,7 +23,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
 static u32 mesh_table_hash(const void *addr, u32 len, u32 seed)
 {
         /* Use last four bytes of hw addr as hash index */
-        return jhash_1word(*(u32 *)(addr+2), seed);
+        return jhash_1word(__get_unaligned_cpu32((u8 *)addr + 2), seed);
 }
 
 static const struct rhashtable_params mesh_rht_params = {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7f8d93401ce0..bf0b187f994e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1568,7 +1568,15 @@ static void sta_ps_start(struct sta_info *sta)
                 return;
 
         for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
-                if (txq_has_queue(sta->sta.txq[tid]))
+                struct ieee80211_txq *txq = sta->sta.txq[tid];
+                struct txq_info *txqi = to_txq_info(txq);
+
+                spin_lock(&local->active_txq_lock[txq->ac]);
+                if (!list_empty(&txqi->schedule_order))
+                        list_del_init(&txqi->schedule_order);
+                spin_unlock(&local->active_txq_lock[txq->ac]);
+
+                if (txq_has_queue(txq))
                         set_bit(tid, &sta->txq_buffered_tids);
                 else
                         clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/net/mac80211/trace_msg.h b/net/mac80211/trace_msg.h
index 366b9e6f043e..40141df09f25 100644
--- a/net/mac80211/trace_msg.h
+++ b/net/mac80211/trace_msg.h
@@ -1,4 +1,9 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Portions of this file
+ * Copyright (C) 2019 Intel Corporation
+ */
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 
 #if !defined(__MAC80211_MSG_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
@@ -11,7 +16,7 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
 
-#define MAX_MSG_LEN     100
+#define MAX_MSG_LEN     120
 
 DECLARE_EVENT_CLASS(mac80211_msg_event,
         TP_PROTO(struct va_format *vaf),
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8a49a74c0a37..2e816dd67be7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3221,6 +3221,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         u8 max_subframes = sta->sta.max_amsdu_subframes;
         int max_frags = local->hw.max_tx_fragments;
         int max_amsdu_len = sta->sta.max_amsdu_len;
+        int orig_truesize;
         __be16 len;
         void *data;
         bool ret = false;
@@ -3261,6 +3262,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (!head || skb_is_gso(head))
                 goto out;
 
+        orig_truesize = head->truesize;
         orig_len = head->len;
 
         if (skb->len + head->len > max_amsdu_len)
@@ -3318,6 +3320,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         *frag_tail = skb;
 
 out_recalc:
+        fq->memory_usage += head->truesize - orig_truesize;
         if (head->len != orig_len) {
                 flow->backlog += head->len - orig_len;
                 tin->backlog_bytes += head->len - orig_len;
@@ -3646,16 +3649,17 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
 struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_txq *ret = NULL;
         struct txq_info *txqi = NULL;
 
-        lockdep_assert_held(&local->active_txq_lock[ac]);
+        spin_lock_bh(&local->active_txq_lock[ac]);
 
  begin:
         txqi = list_first_entry_or_null(&local->active_txqs[ac],
                                         struct txq_info,
                                         schedule_order);
         if (!txqi)
-                return NULL;
+                goto out;
 
         if (txqi->txq.sta) {
                 struct sta_info *sta = container_of(txqi->txq.sta,
@@ -3672,24 +3676,30 @@ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
 
 
         if (txqi->schedule_round == local->schedule_round[ac])
-                return NULL;
+                goto out;
 
         list_del_init(&txqi->schedule_order);
         txqi->schedule_round = local->schedule_round[ac];
-        return &txqi->txq;
+        ret = &txqi->txq;
+
+out:
+        spin_unlock_bh(&local->active_txq_lock[ac]);
+        return ret;
 }
 EXPORT_SYMBOL(ieee80211_next_txq);
 
-void ieee80211_return_txq(struct ieee80211_hw *hw,
-                          struct ieee80211_txq *txq)
+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+                              struct ieee80211_txq *txq,
+                              bool force)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct txq_info *txqi = to_txq_info(txq);
 
-        lockdep_assert_held(&local->active_txq_lock[txq->ac]);
+        spin_lock_bh(&local->active_txq_lock[txq->ac]);
 
         if (list_empty(&txqi->schedule_order) &&
-            (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
+            (force || !skb_queue_empty(&txqi->frags) ||
+             txqi->tin.backlog_packets)) {
                 /* If airtime accounting is active, always enqueue STAs at the
                  * head of the list to ensure that they only get moved to the
                  * back by the airtime DRR scheduler once they have a negative
@@ -3706,20 +3716,10 @@ void ieee80211_return_txq(struct ieee80211_hw *hw,
                         list_add_tail(&txqi->schedule_order,
                                       &local->active_txqs[txq->ac]);
         }
-}
-EXPORT_SYMBOL(ieee80211_return_txq);
 
-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
-                            struct ieee80211_txq *txq)
-        __acquires(txq_lock) __releases(txq_lock)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
-        spin_lock_bh(&local->active_txq_lock[txq->ac]);
-        ieee80211_return_txq(hw, txq);
         spin_unlock_bh(&local->active_txq_lock[txq->ac]);
 }
-EXPORT_SYMBOL(ieee80211_schedule_txq);
+EXPORT_SYMBOL(__ieee80211_schedule_txq);
 
 bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
                                 struct ieee80211_txq *txq)
@@ -3729,7 +3729,7 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
         struct sta_info *sta;
         u8 ac = txq->ac;
 
-        lockdep_assert_held(&local->active_txq_lock[ac]);
+        spin_lock_bh(&local->active_txq_lock[ac]);
 
         if (!txqi->txq.sta)
                 goto out;
@@ -3759,34 +3759,27 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
 
         sta->airtime[ac].deficit += sta->airtime_weight;
         list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+        spin_unlock_bh(&local->active_txq_lock[ac]);
 
         return false;
 out:
         if (!list_empty(&txqi->schedule_order))
                 list_del_init(&txqi->schedule_order);
+        spin_unlock_bh(&local->active_txq_lock[ac]);
 
         return true;
 }
 EXPORT_SYMBOL(ieee80211_txq_may_transmit);
 
 void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
-        __acquires(txq_lock)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
         spin_lock_bh(&local->active_txq_lock[ac]);
         local->schedule_round[ac]++;
-}
-EXPORT_SYMBOL(ieee80211_txq_schedule_start);
-
-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
-        __releases(txq_lock)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
         spin_unlock_bh(&local->active_txq_lock[ac]);
 }
-EXPORT_SYMBOL(ieee80211_txq_schedule_end);
+EXPORT_SYMBOL(ieee80211_txq_schedule_start);
 
 void __ieee80211_subif_start_xmit(struct sk_buff *skb,
                                   struct net_device *dev,
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index dc07fcc7938e..802db01e3075 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 
 #include <net/ncsi.h>
@@ -667,7 +668,10 @@ static int ncsi_rsp_handler_oem_bcm_gma(struct ncsi_request *nr)
         ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
         memcpy(saddr.sa_data, &rsp->data[BCM_MAC_ADDR_OFFSET], ETH_ALEN);
         /* Increase mac address by 1 for BMC's address */
-        saddr.sa_data[ETH_ALEN - 1]++;
+        eth_addr_inc((u8 *)saddr.sa_data);
+        if (!is_valid_ether_addr((const u8 *)saddr.sa_data))
+                return -ENXIO;
+
         ret = ops->ndo_set_mac_address(ndev, &saddr);
         if (ret < 0)
                 netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n");
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 43bbaa32b1d6..14457551bcb4 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1678,7 +1678,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
         if (!cp) {
                 int v;
 
-                if (!sysctl_schedule_icmp(ipvs))
+                if (ipip || !sysctl_schedule_icmp(ipvs))
                         return NF_ACCEPT;
 
                 if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph))
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 82bfbeef46af..2a714527cde1 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/random.h>
 #include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <linux/err.h>
 #include <linux/percpu.h>
 #include <linux/moduleparam.h>
@@ -449,6 +450,40 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 }
 EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 
+/* Generate a almost-unique pseudo-id for a given conntrack.
+ *
+ * intentionally doesn't re-use any of the seeds used for hash
+ * table location, we assume id gets exposed to userspace.
+ *
+ * Following nf_conn items do not change throughout lifetime
+ * of the nf_conn after it has been committed to main hash table:
+ *
+ * 1. nf_conn address
+ * 2. nf_conn->ext address
+ * 3. nf_conn->master address (normally NULL)
+ * 4. tuple
+ * 5. the associated net namespace
+ */
+u32 nf_ct_get_id(const struct nf_conn *ct)
+{
+        static __read_mostly siphash_key_t ct_id_seed;
+        unsigned long a, b, c, d;
+
+        net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
+
+        a = (unsigned long)ct;
+        b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
+        c = (unsigned long)ct->ext;
+        d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
+                                   &ct_id_seed);
+#ifdef CONFIG_64BIT
+        return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
+#else
+        return siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &ct_id_seed);
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_get_id);
+
 static void
 clean_from_lists(struct nf_conn *ct)
 {
@@ -982,12 +1017,9 @@ __nf_conntrack_confirm(struct sk_buff *skb)
 
         /* set conntrack timestamp, if enabled. */
         tstamp = nf_conn_tstamp_find(ct);
-        if (tstamp) {
-                if (skb->tstamp == 0)
-                        __net_timestamp(skb);
+        if (tstamp)
+                tstamp->start = ktime_get_real_ns();
 
-                tstamp->start = ktime_to_ns(skb->tstamp);
-        }
         /* Since the lookup is lockless, hash insertion must be done after
          * starting the timer and setting the CONFIRMED bit. The RCU barriers
          * guarantee that no other CPU can find the conntrack before the above
@@ -1350,6 +1382,7 @@ __nf_conntrack_alloc(struct net *net,
         /* save hash for reusing when confirming */
         *(unsigned long *)(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev) = hash;
         ct->status = 0;
+        ct->timeout = 0;
         write_pnet(&ct->ct_net, net);
         memset(&ct->__nfct_init_offset[0], 0,
                offsetof(struct nf_conn, proto) -
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 66c596d287a5..d7f61b0547c6 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -29,6 +29,7 @@
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/slab.h>
+#include <linux/siphash.h>
 
 #include <linux/netfilter.h>
 #include <net/netlink.h>
@@ -485,7 +486,9 @@ nla_put_failure:
 
 static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))
+        __be32 id = (__force __be32)nf_ct_get_id(ct);
+
+        if (nla_put_be32(skb, CTA_ID, id))
                 goto nla_put_failure;
         return 0;
 
@@ -1286,8 +1289,9 @@ static int ctnetlink_del_conntrack(struct net *net, struct sock *ctnl,
         }
 
         if (cda[CTA_ID]) {
-                u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
-                if (id != (u32)(unsigned long)ct) {
+                __be32 id = nla_get_be32(cda[CTA_ID]);
+
+                if (id != (__force __be32)nf_ct_get_id(ct)) {
                         nf_ct_put(ct);
                         return -ENOENT;
                 }
@@ -2692,6 +2696,25 @@ nla_put_failure:
 
 static const union nf_inet_addr any_addr;
 
+static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp)
+{
+        static __read_mostly siphash_key_t exp_id_seed;
+        unsigned long a, b, c, d;
+
+        net_get_random_once(&exp_id_seed, sizeof(exp_id_seed));
+
+        a = (unsigned long)exp;
+        b = (unsigned long)exp->helper;
+        c = (unsigned long)exp->master;
+        d = (unsigned long)siphash(&exp->tuple, sizeof(exp->tuple), &exp_id_seed);
+
+#ifdef CONFIG_64BIT
+        return (__force __be32)siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &exp_id_seed);
+#else
+        return (__force __be32)siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &exp_id_seed);
+#endif
+}
+
 static int
 ctnetlink_exp_dump_expect(struct sk_buff *skb,
                           const struct nf_conntrack_expect *exp)
@@ -2739,7 +2762,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
         }
 #endif
         if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
-            nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||
+            nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) ||
             nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
             nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
                 goto nla_put_failure;
@@ -3044,7 +3067,8 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl,
 
         if (cda[CTA_EXPECT_ID]) {
                 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
-                if (ntohl(id) != (u32)(unsigned long)exp) {
+
+                if (id != nf_expect_get_id(exp)) {
                         nf_ct_expect_put(exp);
                         return -ENOENT;
                 }
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index b9403a266a2e..37bb530d848f 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -55,7 +55,7 @@ void nf_l4proto_log_invalid(const struct sk_buff *skb,
         struct va_format vaf;
         va_list args;
 
-        if (net->ct.sysctl_log_invalid != protonum ||
+        if (net->ct.sysctl_log_invalid != protonum &&
             net->ct.sysctl_log_invalid != IPPROTO_RAW)
                 return;
 
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 7df477996b16..9becac953587 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -103,49 +103,94 @@ int nf_conntrack_icmp_packet(struct nf_conn *ct,
         return NF_ACCEPT;
 }
 
-/* Returns conntrack if it dealt with ICMP, and filled in skb fields */
-static int
-icmp_error_message(struct nf_conn *tmpl, struct sk_buff *skb,
-                   const struct nf_hook_state *state)
+/* Check inner header is related to any of the existing connections */
+int nf_conntrack_inet_error(struct nf_conn *tmpl, struct sk_buff *skb,
+                            unsigned int dataoff,
+                            const struct nf_hook_state *state,
+                            u8 l4proto, union nf_inet_addr *outer_daddr)
 {
         struct nf_conntrack_tuple innertuple, origtuple;
         const struct nf_conntrack_tuple_hash *h;
         const struct nf_conntrack_zone *zone;
         enum ip_conntrack_info ctinfo;
         struct nf_conntrack_zone tmp;
+        union nf_inet_addr *ct_daddr;
+        enum ip_conntrack_dir dir;
+        struct nf_conn *ct;
 
         WARN_ON(skb_nfct(skb));
         zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
 
         /* Are they talking about one of our connections? */
-        if (!nf_ct_get_tuplepr(skb,
-                               skb_network_offset(skb) + ip_hdrlen(skb)
-                                                       + sizeof(struct icmphdr),
-                               PF_INET, state->net, &origtuple)) {
-                pr_debug("icmp_error_message: failed to get tuple\n");
+        if (!nf_ct_get_tuplepr(skb, dataoff,
+                               state->pf, state->net, &origtuple))
                 return -NF_ACCEPT;
-        }
 
         /* Ordinarily, we'd expect the inverted tupleproto, but it's
            been preserved inside the ICMP. */
-        if (!nf_ct_invert_tuple(&innertuple, &origtuple)) {
-                pr_debug("icmp_error_message: no match\n");
+        if (!nf_ct_invert_tuple(&innertuple, &origtuple))
                 return -NF_ACCEPT;
-        }
-
-        ctinfo = IP_CT_RELATED;
 
         h = nf_conntrack_find_get(state->net, zone, &innertuple);
-        if (!h) {
-                pr_debug("icmp_error_message: no match\n");
+        if (!h)
+                return -NF_ACCEPT;
+
+        /* Consider: A -> T (=This machine) -> B
+         *   Conntrack entry will look like this:
+         *      Original:  A->B
+         *      Reply:     B->T (SNAT case) OR A
+         *
+         * When this function runs, we got packet that looks like this:
+         * iphdr|icmphdr|inner_iphdr|l4header (tcp, udp, ..).
+         *
+         * Above nf_conntrack_find_get() makes lookup based on inner_hdr,
+         * so we should expect that destination of the found connection
+         * matches outer header destination address.
+         *
+         * In above example, we can consider these two cases:
+         *  1. Error coming in reply direction from B or M (middle box) to
+         *     T (SNAT case) or A.
+         *     Inner saddr will be B, dst will be T or A.
+         *     The found conntrack will be reply tuple (B->T/A).
+         *  2. Error coming in original direction from A or M to B.
+         *     Inner saddr will be A, inner daddr will be B.
+         *     The found conntrack will be original tuple (A->B).
+         *
+         * In both cases, conntrack[dir].dst == inner.dst.
+         *
+         * A bogus packet could look like this:
+         *   Inner: B->T
+         *   Outer: B->X (other machine reachable by T).
+         *
+         * In this case, lookup yields connection A->B and will
+         * set packet from B->X as *RELATED*, even though no connection
+         * from X was ever seen.
+         */
+        ct = nf_ct_tuplehash_to_ctrack(h);
+        dir = NF_CT_DIRECTION(h);
+        ct_daddr = &ct->tuplehash[dir].tuple.dst.u3;
+        if (!nf_inet_addr_cmp(outer_daddr, ct_daddr)) {
+                if (state->pf == AF_INET) {
+                        nf_l4proto_log_invalid(skb, state->net, state->pf,
+                                               l4proto,
+                                               "outer daddr %pI4 != inner %pI4",
+                                               &outer_daddr->ip, &ct_daddr->ip);
+                } else if (state->pf == AF_INET6) {
+                        nf_l4proto_log_invalid(skb, state->net, state->pf,
+                                               l4proto,
+                                               "outer daddr %pI6 != inner %pI6",
+                                               &outer_daddr->ip6, &ct_daddr->ip6);
+                }
+                nf_ct_put(ct);
                 return -NF_ACCEPT;
         }
 
-        if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
+        ctinfo = IP_CT_RELATED;
+        if (dir == IP_CT_DIR_REPLY)
                 ctinfo += IP_CT_IS_REPLY;
 
         /* Update skb to refer to this connection */
-        nf_ct_set(skb, nf_ct_tuplehash_to_ctrack(h), ctinfo);
+        nf_ct_set(skb, ct, ctinfo);
         return NF_ACCEPT;
 }
 
@@ -162,11 +207,12 @@ int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
                               struct sk_buff *skb, unsigned int dataoff,
                               const struct nf_hook_state *state)
 {
+        union nf_inet_addr outer_daddr;
         const struct icmphdr *icmph;
         struct icmphdr _ih;
 
         /* Not enough header? */
-        icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
+        icmph = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
         if (icmph == NULL) {
                 icmp_error_log(skb, state, "short packet");
                 return -NF_ACCEPT;
@@ -199,7 +245,12 @@ int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
             icmph->type != ICMP_REDIRECT)
                 return NF_ACCEPT;
 
-        return icmp_error_message(tmpl, skb, state);
+        memset(&outer_daddr, 0, sizeof(outer_daddr));
+        outer_daddr.ip = ip_hdr(skb)->daddr;
+
+        dataoff += sizeof(*icmph);
+        return nf_conntrack_inet_error(tmpl, skb, dataoff, state,
+                                       IPPROTO_ICMP, &outer_daddr);
 }
 
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index bec4a3211658..c63ee3612855 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -123,51 +123,6 @@ int nf_conntrack_icmpv6_packet(struct nf_conn *ct,
         return NF_ACCEPT;
 }
 
-static int
-icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
-                     struct sk_buff *skb,
-                     unsigned int icmp6off)
-{
-        struct nf_conntrack_tuple intuple, origtuple;
-        const struct nf_conntrack_tuple_hash *h;
-        enum ip_conntrack_info ctinfo;
-        struct nf_conntrack_zone tmp;
-
-        WARN_ON(skb_nfct(skb));
-
-        /* Are they talking about one of our connections? */
-        if (!nf_ct_get_tuplepr(skb,
-                               skb_network_offset(skb)
-                                + sizeof(struct ipv6hdr)
-                                + sizeof(struct icmp6hdr),
-                               PF_INET6, net, &origtuple)) {
-                pr_debug("icmpv6_error: Can't get tuple\n");
-                return -NF_ACCEPT;
-        }
-
-        /* Ordinarily, we'd expect the inverted tupleproto, but it's
-           been preserved inside the ICMP. */
-        if (!nf_ct_invert_tuple(&intuple, &origtuple)) {
-                pr_debug("icmpv6_error: Can't invert tuple\n");
-                return -NF_ACCEPT;
-        }
-
-        ctinfo = IP_CT_RELATED;
-
-        h = nf_conntrack_find_get(net, nf_ct_zone_tmpl(tmpl, skb, &tmp),
-                                  &intuple);
-        if (!h) {
-                pr_debug("icmpv6_error: no match\n");
-                return -NF_ACCEPT;
-        } else {
-                if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
-                        ctinfo += IP_CT_IS_REPLY;
-        }
-
-        /* Update skb to refer to this connection */
-        nf_ct_set(skb, nf_ct_tuplehash_to_ctrack(h), ctinfo);
-        return NF_ACCEPT;
-}
 
 static void icmpv6_error_log(const struct sk_buff *skb,
                              const struct nf_hook_state *state,
@@ -182,6 +137,7 @@ int nf_conntrack_icmpv6_error(struct nf_conn *tmpl,
                               unsigned int dataoff,
                               const struct nf_hook_state *state)
 {
+        union nf_inet_addr outer_daddr;
         const struct icmp6hdr *icmp6h;
         struct icmp6hdr _ih;
         int type;
@@ -210,7 +166,11 @@ int nf_conntrack_icmpv6_error(struct nf_conn *tmpl,
         if (icmp6h->icmp6_type >= 128)
                 return NF_ACCEPT;
 
-        return icmpv6_error_message(state->net, tmpl, skb, dataoff);
+        memcpy(&outer_daddr.ip6, &ipv6_hdr(skb)->daddr,
+               sizeof(outer_daddr.ip6));
+        dataoff += sizeof(*icmp6h);
+        return nf_conntrack_inet_error(tmpl, skb, dataoff, state,
+                                       IPPROTO_ICMPV6, &outer_daddr);
 }
 
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index af7dc6537758..000952719adf 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -415,9 +415,14 @@ static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple,
         case IPPROTO_ICMPV6:
                 /* id is same for either direction... */
                 keyptr = &tuple->src.u.icmp.id;
-                min = range->min_proto.icmp.id;
-                range_size = ntohs(range->max_proto.icmp.id) -
-                             ntohs(range->min_proto.icmp.id) + 1;
+                if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) {
+                        min = 0;
+                        range_size = 65536;
+                } else {
+                        min = ntohs(range->min_proto.icmp.id);
+                        range_size = ntohs(range->max_proto.icmp.id) -
+                                     ntohs(range->min_proto.icmp.id) + 1;
+                }
                 goto find_free_id;
 #if IS_ENABLED(CONFIG_NF_CT_PROTO_GRE)
         case IPPROTO_GRE:
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ef7772e976cc..1606eaa5ae0d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1545,7 +1545,7 @@ static int nft_chain_parse_hook(struct net *net,
                 if (IS_ERR(type))
                         return PTR_ERR(type);
         }
-        if (!(type->hook_mask & (1 << hook->num)))
+        if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
                 return -EOPNOTSUPP;
 
         if (type->type == NFT_CHAIN_T_NAT &&
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index b1f9c5303f02..0b3347570265 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -540,7 +540,7 @@ __build_packet_message(struct nfnl_log_net *log,
                         goto nla_put_failure;
         }
 
-        if (skb->tstamp) {
+        if (hooknum <= NF_INET_FORWARD && skb->tstamp) {
                 struct nfulnl_msg_packet_timestamp ts;
                 struct timespec64 kts = ktime_to_timespec64(skb->tstamp);
                 ts.sec = cpu_to_be64(kts.tv_sec);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 0dcc3592d053..e057b2961d31 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -582,7 +582,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         if (nfqnl_put_bridge(entry, skb) < 0)
                 goto nla_put_failure;
 
-        if (entskb->tstamp) {
+        if (entry->state.hook <= NF_INET_FORWARD && entskb->tstamp) {
                 struct nfqnl_msg_packet_timestamp ts;
                 struct timespec64 kts = ktime_to_timespec64(entskb->tstamp);
 
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index c13bcd0ab491..8dbb4d48f2ed 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -163,19 +163,24 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par)
         s64 stamp;
 
         /*
-         * We cannot use get_seconds() instead of __net_timestamp() here.
+         * We need real time here, but we can neither use skb->tstamp
+         * nor __net_timestamp().
+         *
+         * skb->tstamp and skb->skb_mstamp_ns overlap, however, they
+         * use different clock types (real vs monotonic).
+         *
          * Suppose you have two rules:
-         *      1. match before 13:00
-         *      2. match after 13:00
+         *      1. match before 13:00
+         *      2. match after 13:00
+         *
          * If you match against processing time (get_seconds) it
          * may happen that the same packet matches both rules if
-         * it arrived at the right moment before 13:00.
+         * it arrived at the right moment before 13:00, so it would be
+         * better to check skb->tstamp and set it via __net_timestamp()
+         * if needed.  This however breaks outgoing packets tx timestamp,
+         * and causes them to get delayed forever by fq packet scheduler.
          */
-        if (skb->tstamp == 0)
-                __net_timestamp((struct sk_buff *)skb);
-
-        stamp = ktime_to_ns(skb->tstamp);
-        stamp = div_s64(stamp, NSEC_PER_SEC);
+        stamp = get_seconds();
 
         if (info->flags & XT_TIME_LOCAL_TZ)
                 /* Adjust for local timezone */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f28e937320a3..216ab915dd54 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -988,7 +988,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
         struct netlink_sock *nlk = nlk_sk(sk);
         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
         int err = 0;
-        unsigned long groups = nladdr->nl_groups;
+        unsigned long groups;
         bool bound;
 
         if (addr_len < sizeof(struct sockaddr_nl))
@@ -996,6 +996,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 
         if (nladdr->nl_family != AF_NETLINK)
                 return -EINVAL;
+        groups = nladdr->nl_groups;
 
         /* Only superuser is allowed to listen multicasts */
         if (groups) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 1d3144d19903..71ffd1a6dc7c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1392,18 +1392,22 @@ static int __init nr_proto_init(void)
         int i;
         int rc = proto_register(&nr_proto, 0);
 
-        if (rc != 0)
-                goto out;
+        if (rc)
+                return rc;
 
         if (nr_ndevs > 0x7fffffff/sizeof(struct net_device *)) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - nr_ndevs parameter to large\n");
-                return -1;
+                pr_err("NET/ROM: %s - nr_ndevs parameter too large\n",
+                       __func__);
+                rc = -EINVAL;
+                goto unregister_proto;
         }
 
         dev_nr = kcalloc(nr_ndevs, sizeof(struct net_device *), GFP_KERNEL);
-        if (dev_nr == NULL) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device array\n");
-                return -1;
+        if (!dev_nr) {
+                pr_err("NET/ROM: %s - unable to allocate device array\n",
+                       __func__);
+                rc = -ENOMEM;
+                goto unregister_proto;
         }
 
         for (i = 0; i < nr_ndevs; i++) {
@@ -1413,13 +1417,13 @@ static int __init nr_proto_init(void)
                 sprintf(name, "nr%d", i);
                 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, nr_setup);
                 if (!dev) {
-                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device structure\n");
+                        rc = -ENOMEM;
                         goto fail;
                 }
 
                 dev->base_addr = i;
-                if (register_netdev(dev)) {
-                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register network device\n");
+                rc = register_netdev(dev);
+                if (rc) {
                         free_netdev(dev);
                         goto fail;
                 }
@@ -1427,36 +1431,64 @@ static int __init nr_proto_init(void)
                 dev_nr[i] = dev;
         }
 
-        if (sock_register(&nr_family_ops)) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register socket family\n");
+        rc = sock_register(&nr_family_ops);
+        if (rc)
                 goto fail;
-        }
 
-        register_netdevice_notifier(&nr_dev_notifier);
+        rc = register_netdevice_notifier(&nr_dev_notifier);
+        if (rc)
+                goto out_sock;
 
         ax25_register_pid(&nr_pid);
         ax25_linkfail_register(&nr_linkfail_notifier);
 
 #ifdef CONFIG_SYSCTL
-        nr_register_sysctl();
+        rc = nr_register_sysctl();
+        if (rc)
+                goto out_sysctl;
 #endif
 
         nr_loopback_init();
 
-        proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops);
-        proc_create_seq("nr_neigh", 0444, init_net.proc_net, &nr_neigh_seqops);
-        proc_create_seq("nr_nodes", 0444, init_net.proc_net, &nr_node_seqops);
-out:
-        return rc;
+        rc = -ENOMEM;
+        if (!proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops))
+                goto proc_remove1;
+        if (!proc_create_seq("nr_neigh", 0444, init_net.proc_net,
+                             &nr_neigh_seqops))
+                goto proc_remove2;
+        if (!proc_create_seq("nr_nodes", 0444, init_net.proc_net,
+                             &nr_node_seqops))
+                goto proc_remove3;
+
+        return 0;
+
+proc_remove3:
+        remove_proc_entry("nr_neigh", init_net.proc_net);
+proc_remove2:
+        remove_proc_entry("nr", init_net.proc_net);
+proc_remove1:
+
+        nr_loopback_clear();
+        nr_rt_free();
+
+#ifdef CONFIG_SYSCTL
+        nr_unregister_sysctl();
+out_sysctl:
+#endif
+        ax25_linkfail_release(&nr_linkfail_notifier);
+        ax25_protocol_release(AX25_P_NETROM);
+        unregister_netdevice_notifier(&nr_dev_notifier);
+out_sock:
+        sock_unregister(PF_NETROM);
 fail:
         while (--i >= 0) {
                 unregister_netdev(dev_nr[i]);
                 free_netdev(dev_nr[i]);
         }
         kfree(dev_nr);
+unregister_proto:
         proto_unregister(&nr_proto);
-        rc = -1;
-        goto out;
+        return rc;
 }
 
 module_init(nr_proto_init);
diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
index 215ad22a9647..93d13f019981 100644
--- a/net/netrom/nr_loopback.c
+++ b/net/netrom/nr_loopback.c
@@ -70,7 +70,7 @@ static void nr_loopback_timer(struct timer_list *unused)
         }
 }
 
-void __exit nr_loopback_clear(void)
+void nr_loopback_clear(void)
 {
         del_timer_sync(&loopback_timer);
         skb_queue_purge(&loopback_queue);
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 6485f593e2f0..b76aa668a94b 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -953,7 +953,7 @@ const struct seq_operations nr_neigh_seqops = {
 /*
  *      Free all memory associated with the nodes and routes lists.
  */
-void __exit nr_rt_free(void)
+void nr_rt_free(void)
 {
         struct nr_neigh *s = NULL;
         struct nr_node  *t = NULL;
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index ba1c368b3f18..771011b84270 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -146,9 +146,12 @@ static struct ctl_table nr_table[] = {
         { }
 };
 
-void __init nr_register_sysctl(void)
+int __init nr_register_sysctl(void)
 {
         nr_table_header = register_net_sysctl(&init_net, "net/netrom", nr_table);
+        if (!nr_table_header)
+                return -ENOMEM;
+        return 0;
 }
 
 void nr_unregister_sysctl(void)
diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index ddfc52ac1f9b..c0d323b58e73 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
                 create_info = (struct nci_hci_create_pipe_resp *)skb->data;
                 dest_gate = create_info->dest_gate;
                 new_pipe = create_info->pipe;
+                if (new_pipe >= NCI_HCI_MAX_PIPES) {
+                        status = NCI_HCI_ANY_E_NOK;
+                        goto exit;
+                }
 
                 /* Save the new created pipe and bind with local gate,
                  * the description for skb->data[3] is destination gate id
@@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
                         goto exit;
                 }
                 delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
+                if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
+                        status = NCI_HCI_ANY_E_NOK;
+                        goto exit;
+                }
 
                 ndev->hci_dev->pipes[delete_info->pipe].gate =
                                                 NCI_HCI_INVALID_GATE;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 691da853bef5..4bdf5e3ac208 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2306,14 +2306,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
 
         struct sw_flow_actions *acts;
         int new_acts_size;
-        int req_size = NLA_ALIGN(attr_len);
+        size_t req_size = NLA_ALIGN(attr_len);
         int next_offset = offsetof(struct sw_flow_actions, actions) +
                                         (*sfa)->actions_len;
 
         if (req_size <= (ksize(*sfa) - next_offset))
                 goto out;
 
-        new_acts_size = ksize(*sfa) * 2;
+        new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
 
         if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
                 if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index d6cc97fbbbb0..2b969f99ef13 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -543,6 +543,9 @@ static int rds_connect(struct socket *sock, struct sockaddr *uaddr,
         struct rds_sock *rs = rds_sk_to_rs(sk);
         int ret = 0;
 
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
+
         lock_sock(sk);
 
         switch (uaddr->sa_family) {
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 17c9d9f0c848..0f4398e7f2a7 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -173,6 +173,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         /* We allow an RDS socket to be bound to either IPv4 or IPv6
          * address.
          */
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         if (uaddr->sa_family == AF_INET) {
                 struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
 
diff --git a/net/rds/ib_fmr.c b/net/rds/ib_fmr.c
index 31cf37da4510..93c0437e6a5f 100644
--- a/net/rds/ib_fmr.c
+++ b/net/rds/ib_fmr.c
@@ -44,6 +44,17 @@ struct rds_ib_mr *rds_ib_alloc_fmr(struct rds_ib_device *rds_ibdev, int npages)
         else
                 pool = rds_ibdev->mr_1m_pool;
 
+        if (atomic_read(&pool->dirty_count) >= pool->max_items / 10)
+                queue_delayed_work(rds_ib_mr_wq, &pool->flush_worker, 10);
+
+        /* Switch pools if one of the pool is reaching upper limit */
+        if (atomic_read(&pool->dirty_count) >=  pool->max_items * 9 / 10) {
+                if (pool->pool_type == RDS_IB_MR_8K_POOL)
+                        pool = rds_ibdev->mr_1m_pool;
+                else
+                        pool = rds_ibdev->mr_8k_pool;
+        }
+
         ibmr = rds_ib_try_reuse_ibmr(pool);
         if (ibmr)
                 return ibmr;
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 63c8d107adcf..d664e9ade74d 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -454,9 +454,6 @@ struct rds_ib_mr *rds_ib_try_reuse_ibmr(struct rds_ib_mr_pool *pool)
         struct rds_ib_mr *ibmr = NULL;
         int iter = 0;
 
-        if (atomic_read(&pool->dirty_count) >= pool->max_items_soft / 10)
-                queue_delayed_work(rds_ib_mr_wq, &pool->flush_worker, 10);
-
         while (1) {
                 ibmr = rds_ib_reuse_mr(pool);
                 if (ibmr)
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index fd2694174607..faf726e00e27 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -608,7 +608,7 @@ static void rds_tcp_kill_sock(struct net *net)
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
                 struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
 
-                if (net != c_net || !tc->t_sock)
+                if (net != c_net)
                         continue;
                 if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
                         list_move_tail(&tc->t_tcp_node, &tmp_list);
diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index 7af4f99c4a93..094a6621f8e8 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 
 static struct sk_buff_head loopback_queue;
+#define ROSE_LOOPBACK_LIMIT 1000
 static struct timer_list loopback_timer;
 
 static void rose_set_loopback_timer(void);
@@ -35,29 +36,27 @@ static int rose_loopback_running(void)
 
 int rose_loopback_queue(struct sk_buff *skb, struct rose_neigh *neigh)
 {
-        struct sk_buff *skbn;
+        struct sk_buff *skbn = NULL;
 
-        skbn = skb_clone(skb, GFP_ATOMIC);
+        if (skb_queue_len(&loopback_queue) < ROSE_LOOPBACK_LIMIT)
+                skbn = skb_clone(skb, GFP_ATOMIC);
 
-        kfree_skb(skb);
-
-        if (skbn != NULL) {
+        if (skbn) {
+                consume_skb(skb);
                 skb_queue_tail(&loopback_queue, skbn);
 
                 if (!rose_loopback_running())
                         rose_set_loopback_timer();
+        } else {
+                kfree_skb(skb);
         }
 
         return 1;
 }
 
-
 static void rose_set_loopback_timer(void)
 {
-        del_timer(&loopback_timer);
-
-        loopback_timer.expires  = jiffies + 10;
-        add_timer(&loopback_timer);
+        mod_timer(&loopback_timer, jiffies + 10);
 }
 
 static void rose_loopback_timer(struct timer_list *unused)
@@ -68,8 +67,12 @@ static void rose_loopback_timer(struct timer_list *unused)
         struct sock *sk;
         unsigned short frametype;
         unsigned int lci_i, lci_o;
+        int count;
 
-        while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
+        for (count = 0; count < ROSE_LOOPBACK_LIMIT; count++) {
+                skb = skb_dequeue(&loopback_queue);
+                if (!skb)
+                        return;
                 if (skb->len < ROSE_MIN_LEN) {
                         kfree_skb(skb);
                         continue;
@@ -106,6 +109,8 @@ static void rose_loopback_timer(struct timer_list *unused)
                         kfree_skb(skb);
                 }
         }
+        if (!skb_queue_empty(&loopback_queue))
+                mod_timer(&loopback_timer, jiffies + 1);
 }
 
 void __exit rose_loopback_clear(void)
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 96f2952bbdfd..ae8c5d7f3bf1 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -135,7 +135,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
         struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr;
         struct rxrpc_local *local;
         struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
-        u16 service_id = srx->srx_service;
+        u16 service_id;
         int ret;
 
         _enter("%p,%p,%d", rx, saddr, len);
@@ -143,6 +143,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
         ret = rxrpc_validate_address(rx, srx, len);
         if (ret < 0)
                 goto error;
+        service_id = srx->srx_service;
 
         lock_sock(&rx->sk);
 
@@ -370,18 +371,22 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
  * rxrpc_kernel_check_life - Check to see whether a call is still alive
  * @sock: The socket the call is on
  * @call: The call to check
+ * @_life: Where to store the life value
  *
  * Allow a kernel service to find out whether a call is still alive - ie. we're
- * getting ACKs from the server.  Returns a number representing the life state
- * which can be compared to that returned by a previous call.
+ * getting ACKs from the server.  Passes back in *_life a number representing
+ * the life state which can be compared to that returned by a previous call and
+ * return true if the call is still alive.
  *
  * If the life state stalls, rxrpc_kernel_probe_life() should be called and
  * then 2RTT waited.
  */
-u32 rxrpc_kernel_check_life(const struct socket *sock,
-                            const struct rxrpc_call *call)
+bool rxrpc_kernel_check_life(const struct socket *sock,
+                             const struct rxrpc_call *call,
+                             u32 *_life)
 {
-        return call->acks_latest;
+        *_life = call->acks_latest;
+        return call->state != RXRPC_CALL_COMPLETE;
 }
 EXPORT_SYMBOL(rxrpc_kernel_check_life);
 
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 4b1a534d290a..062ca9dc29b8 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -654,6 +654,7 @@ struct rxrpc_call {
         u8                      ackr_reason;    /* reason to ACK */
         u16                     ackr_skew;      /* skew on packet being ACK'd */
         rxrpc_serial_t          ackr_serial;    /* serial of packet being ACK'd */
+        rxrpc_serial_t          ackr_first_seq; /* first sequence number received */
         rxrpc_seq_t             ackr_prev_seq;  /* previous sequence number received */
         rxrpc_seq_t             ackr_consumed;  /* Highest packet shown consumed */
         rxrpc_seq_t             ackr_seen;      /* Highest packet shown seen */
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index b6fca8ebb117..8d31fb4c51e1 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -153,7 +153,8 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
  * pass a connection-level abort onto all calls on that connection
  */
 static void rxrpc_abort_calls(struct rxrpc_connection *conn,
-                              enum rxrpc_call_completion compl)
+                              enum rxrpc_call_completion compl,
+                              rxrpc_serial_t serial)
 {
         struct rxrpc_call *call;
         int i;
@@ -173,6 +174,9 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn,
                                                   call->call_id, 0,
                                                   conn->abort_code,
                                                   conn->error);
+                        else
+                                trace_rxrpc_rx_abort(call, serial,
+                                                     conn->abort_code);
                         if (rxrpc_set_call_completion(call, compl,
                                                       conn->abort_code,
                                                       conn->error))
@@ -213,8 +217,6 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
         conn->state = RXRPC_CONN_LOCALLY_ABORTED;
         spin_unlock_bh(&conn->state_lock);
 
-        rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED);
-
         msg.msg_name    = &conn->params.peer->srx.transport;
         msg.msg_namelen = conn->params.peer->srx.transport_len;
         msg.msg_control = NULL;
@@ -242,6 +244,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
         len = iov[0].iov_len + iov[1].iov_len;
 
         serial = atomic_inc_return(&conn->serial);
+        rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED, serial);
         whdr.serial = htonl(serial);
         _proto("Tx CONN ABORT %%%u { %d }", serial, conn->abort_code);
 
@@ -321,7 +324,7 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                 conn->error = -ECONNABORTED;
                 conn->abort_code = abort_code;
                 conn->state = RXRPC_CONN_REMOTELY_ABORTED;
-                rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED);
+                rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED, sp->hdr.serial);
                 return -ECONNABORTED;
 
         case RXRPC_PACKET_TYPE_CHALLENGE:
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 9128aa0e40aa..c2c35cf4e308 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -837,7 +837,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                 u8 acks[RXRPC_MAXACKS];
         } buf;
         rxrpc_serial_t acked_serial;
-        rxrpc_seq_t first_soft_ack, hard_ack;
+        rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
         int nr_acks, offset, ioffset;
 
         _enter("");
@@ -851,13 +851,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
         acked_serial = ntohl(buf.ack.serial);
         first_soft_ack = ntohl(buf.ack.firstPacket);
+        prev_pkt = ntohl(buf.ack.previousPacket);
         hard_ack = first_soft_ack - 1;
         nr_acks = buf.ack.nAcks;
         summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
                               buf.ack.reason : RXRPC_ACK__INVALID);
 
         trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
-                           first_soft_ack, ntohl(buf.ack.previousPacket),
+                           first_soft_ack, prev_pkt,
                            summary.ack_reason, nr_acks);
 
         if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
@@ -878,8 +879,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                                   rxrpc_propose_ack_respond_to_ack);
         }
 
-        /* Discard any out-of-order or duplicate ACKs. */
-        if (before_eq(sp->hdr.serial, call->acks_latest))
+        /* Discard any out-of-order or duplicate ACKs (outside lock). */
+        if (before(first_soft_ack, call->ackr_first_seq) ||
+            before(prev_pkt, call->ackr_prev_seq))
                 return;
 
         buf.info.rxMTU = 0;
@@ -890,12 +892,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
         spin_lock(&call->input_lock);
 
-        /* Discard any out-of-order or duplicate ACKs. */
-        if (before_eq(sp->hdr.serial, call->acks_latest))
+        /* Discard any out-of-order or duplicate ACKs (inside lock). */
+        if (before(first_soft_ack, call->ackr_first_seq) ||
+            before(prev_pkt, call->ackr_prev_seq))
                 goto out;
         call->acks_latest_ts = skb->tstamp;
         call->acks_latest = sp->hdr.serial;
 
+        call->ackr_first_seq = first_soft_ack;
+        call->ackr_prev_seq = prev_pkt;
+
         /* Parse rwind and mtu sizes if provided. */
         if (buf.info.rxMTU)
                 rxrpc_input_ackinfo(call, skb, &buf.info);
@@ -1155,19 +1161,19 @@ int rxrpc_extract_header(struct rxrpc_skb_priv *sp, struct sk_buff *skb)
  * handle data received on the local endpoint
  * - may be called in interrupt context
  *
- * The socket is locked by the caller and this prevents the socket from being
- * shut down and the local endpoint from going away, thus sk_user_data will not
- * be cleared until this function returns.
+ * [!] Note that as this is called from the encap_rcv hook, the socket is not
+ * held locked by the caller and nothing prevents sk_user_data on the UDP from
+ * being cleared in the middle of processing this function.
  *
  * Called with the RCU read lock held from the IP layer via UDP.
  */
 int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
 {
+        struct rxrpc_local *local = rcu_dereference_sk_user_data(udp_sk);
         struct rxrpc_connection *conn;
         struct rxrpc_channel *chan;
         struct rxrpc_call *call = NULL;
         struct rxrpc_skb_priv *sp;
-        struct rxrpc_local *local = udp_sk->sk_user_data;
         struct rxrpc_peer *peer = NULL;
         struct rxrpc_sock *rx = NULL;
         unsigned int channel;
@@ -1175,6 +1181,10 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
 
         _enter("%p", udp_sk);
 
+        if (unlikely(!local)) {
+                kfree_skb(skb);
+                return 0;
+        }
         if (skb->tstamp == 0)
                 skb->tstamp = ktime_get_real();
 
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 15cf42d5b53a..01959db51445 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -304,7 +304,8 @@ nomem:
         ret = -ENOMEM;
 sock_error:
         mutex_unlock(&rxnet->local_mutex);
-        kfree(local);
+        if (local)
+                call_rcu(&local->rcu, rxrpc_local_rcu);
         _leave(" = %d", ret);
         return ERR_PTR(ret);
 
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index bc05af89fc38..6e84d878053c 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -157,6 +157,11 @@ void rxrpc_error_report(struct sock *sk)
 
         _enter("%p{%d}", sk, local->debug_id);
 
+        /* Clear the outstanding error value on the socket so that it doesn't
+         * cause kernel_sendmsg() to return it later.
+         */
+        sock_error(sk);
+
         skb = sock_dequeue_err_skb(sk);
         if (!skb) {
                 _leave("UDP socket errqueue empty");
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 46c9312085b1..bec64deb7b0a 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -152,12 +152,13 @@ static void rxrpc_notify_end_tx(struct rxrpc_sock *rx, struct rxrpc_call *call,
 }
 
 /*
- * Queue a DATA packet for transmission, set the resend timeout and send the
- * packet immediately
+ * Queue a DATA packet for transmission, set the resend timeout and send
+ * the packet immediately.  Returns the error from rxrpc_send_data_packet()
+ * in case the caller wants to do something with it.
  */
-static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
-                               struct sk_buff *skb, bool last,
-                               rxrpc_notify_end_tx_t notify_end_tx)
+static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
+                              struct sk_buff *skb, bool last,
+                              rxrpc_notify_end_tx_t notify_end_tx)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned long now;
@@ -250,7 +251,8 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
 
 out:
         rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
-        _leave("");
+        _leave(" = %d", ret);
+        return ret;
 }
 
 /*
@@ -423,9 +425,10 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                         if (ret < 0)
                                 goto out;
 
-                        rxrpc_queue_packet(rx, call, skb,
-                                           !msg_data_left(msg) && !more,
-                                           notify_end_tx);
+                        ret = rxrpc_queue_packet(rx, call, skb,
+                                                 !msg_data_left(msg) && !more,
+                                                 notify_end_tx);
+                        /* Should check for failure here */
                         skb = NULL;
                 }
         } while (msg_data_left(msg) > 0);
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 4060b0955c97..0f82d50ea232 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -45,8 +45,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_SAMPLE_MAX + 1];
         struct psample_group *psample_group;
         struct tcf_chain *goto_ch = NULL;
+        u32 psample_group_num, rate;
         struct tc_sample *parm;
-        u32 psample_group_num;
         struct tcf_sample *s;
         bool exists = false;
         int ret, err;
@@ -85,6 +85,12 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         if (err < 0)
                 goto release_idr;
 
+        rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
+        if (!rate) {
+                NL_SET_ERR_MSG(extack, "invalid sample rate");
+                err = -EINVAL;
+                goto put_chain;
+        }
         psample_group_num = nla_get_u32(tb[TCA_SAMPLE_PSAMPLE_GROUP]);
         psample_group = psample_group_get(net, psample_group_num);
         if (!psample_group) {
@@ -96,7 +102,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
 
         spin_lock_bh(&s->tcf_lock);
         goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
-        s->rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
+        s->rate = rate;
         s->psample_group_num = psample_group_num;
         RCU_INIT_POINTER(s->psample_group, psample_group);
 
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 459921bd3d87..a13bc351a414 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -130,6 +130,11 @@ static void mall_destroy(struct tcf_proto *tp, bool rtnl_held,
 
 static void *mall_get(struct tcf_proto *tp, u32 handle)
 {
+        struct cls_mall_head *head = rtnl_dereference(tp->root);
+
+        if (head && head->handle == handle)
+                return head;
+
         return NULL;
 }
 
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index acc9b9da985f..259d97bc2abd 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1517,16 +1517,27 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
 
 static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
 {
+        int wlen = skb_network_offset(skb);
         u8 dscp;
 
-        switch (skb->protocol) {
+        switch (tc_skb_protocol(skb)) {
         case htons(ETH_P_IP):
+                wlen += sizeof(struct iphdr);
+                if (!pskb_may_pull(skb, wlen) ||
+                    skb_try_make_writable(skb, wlen))
+                        return 0;
+
                 dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
                 if (wash && dscp)
                         ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
                 return dscp;
 
         case htons(ETH_P_IPV6):
+                wlen += sizeof(struct ipv6hdr);
+                if (!pskb_may_pull(skb, wlen) ||
+                    skb_try_make_writable(skb, wlen))
+                        return 0;
+
                 dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
                 if (wash && dscp)
                         ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4dc05409e3fb..114b9048ea7e 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1358,9 +1358,11 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl = (struct cbq_class *)arg;
+        __u32 qlen;
 
         cl->xstats.avgidle = cl->avgidle;
         cl->xstats.undertime = 0;
+        qdisc_qstats_qlen_backlog(cl->q, &qlen, &cl->qstats.backlog);
 
         if (cl->undertime != PSCHED_PASTPERFECT)
                 cl->xstats.undertime = cl->undertime - q->now;
@@ -1368,7 +1370,7 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->q->q.qlen) < 0)
+            gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &cl->xstats, sizeof(cl->xstats));
@@ -1665,17 +1667,13 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl = (struct cbq_class *)arg;
-        unsigned int qlen, backlog;
 
         if (cl->filters || cl->children || cl == &q->link)
                 return -EBUSY;
 
         sch_tree_lock(sch);
 
-        qlen = cl->q->q.qlen;
-        backlog = cl->q->qstats.backlog;
-        qdisc_reset(cl->q);
-        qdisc_tree_reduce_backlog(cl->q, qlen, backlog);
+        qdisc_purge_queue(cl->q);
 
         if (cl->next_alive)
                 cbq_deactivate_class(cl);
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 09b800991065..430df9a55ec4 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -50,15 +50,6 @@ static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid)
         return container_of(clc, struct drr_class, common);
 }
 
-static void drr_purge_queue(struct drr_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
 static const struct nla_policy drr_policy[TCA_DRR_MAX + 1] = {
         [TCA_DRR_QUANTUM]       = { .type = NLA_U32 },
 };
@@ -167,7 +158,7 @@ static int drr_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        drr_purge_queue(cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->common);
 
         sch_tree_unlock(sch);
@@ -269,7 +260,8 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
                                 struct gnet_dump *d)
 {
         struct drr_class *cl = (struct drr_class *)arg;
-        __u32 qlen = cl->qdisc->q.qlen;
+        __u32 qlen = qdisc_qlen_sum(cl->qdisc);
+        struct Qdisc *cl_q = cl->qdisc;
         struct tc_drr_stats xstats;
 
         memset(&xstats, 0, sizeof(xstats));
@@ -279,7 +271,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qdisc->qstats, qlen) < 0)
+            gnet_stats_copy_queue(d, cl_q->cpu_qstats, &cl_q->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 24cc220a3218..d2ab463f22ae 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -845,16 +845,6 @@ qdisc_peek_len(struct Qdisc *sch)
 }
 
 static void
-hfsc_purge_queue(struct Qdisc *sch, struct hfsc_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
-static void
 hfsc_adjust_levels(struct hfsc_class *cl)
 {
         struct hfsc_class *p;
@@ -1076,7 +1066,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
         qdisc_class_hash_insert(&q->clhash, &cl->cl_common);
         list_add_tail(&cl->siblings, &parent->children);
         if (parent->level == 0)
-                hfsc_purge_queue(sch, parent);
+                qdisc_purge_queue(parent->qdisc);
         hfsc_adjust_levels(parent);
         sch_tree_unlock(sch);
 
@@ -1112,7 +1102,7 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
         list_del(&cl->siblings);
         hfsc_adjust_levels(cl->cl_parent);
 
-        hfsc_purge_queue(sch, cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->cl_common);
 
         sch_tree_unlock(sch);
@@ -1328,8 +1318,9 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
         struct tc_hfsc_stats xstats;
+        __u32 qlen;
 
-        cl->qstats.backlog = cl->qdisc->qstats.backlog;
+        qdisc_qstats_qlen_backlog(cl->qdisc, &qlen, &cl->qstats.backlog);
         xstats.level   = cl->level;
         xstats.period  = cl->cl_vtperiod;
         xstats.work    = cl->cl_total;
@@ -1337,7 +1328,7 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->qdisc->q.qlen) < 0)
+            gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 30f9da7e1076..2f9883b196e8 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1127,10 +1127,9 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
         };
         __u32 qlen = 0;
 
-        if (!cl->level && cl->leaf.q) {
-                qlen = cl->leaf.q->q.qlen;
-                qs.backlog = cl->leaf.q->qstats.backlog;
-        }
+        if (!cl->level && cl->leaf.q)
+                qdisc_qstats_qlen_backlog(cl->leaf.q, &qlen, &qs.backlog);
+
         cl->xstats.tokens = clamp_t(s64, PSCHED_NS2TICKS(cl->tokens),
                                     INT_MIN, INT_MAX);
         cl->xstats.ctokens = clamp_t(s64, PSCHED_NS2TICKS(cl->ctokens),
@@ -1270,13 +1269,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        if (!cl->level) {
-                unsigned int qlen = cl->leaf.q->q.qlen;
-                unsigned int backlog = cl->leaf.q->qstats.backlog;
-
-                qdisc_reset(cl->leaf.q);
-                qdisc_tree_reduce_backlog(cl->leaf.q, qlen, backlog);
-        }
+        if (!cl->level)
+                qdisc_purge_queue(cl->leaf.q);
 
         /* delete from hash and active; remainder in destroy_class */
         qdisc_class_hash_remove(&q->clhash, &cl->common);
@@ -1404,12 +1398,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                                           classid, NULL);
                 sch_tree_lock(sch);
                 if (parent && !parent->level) {
-                        unsigned int qlen = parent->leaf.q->q.qlen;
-                        unsigned int backlog = parent->leaf.q->qstats.backlog;
-
                         /* turn parent into inner node */
-                        qdisc_reset(parent->leaf.q);
-                        qdisc_tree_reduce_backlog(parent->leaf.q, qlen, backlog);
+                        qdisc_purge_queue(parent->leaf.q);
                         qdisc_put(parent->leaf.q);
                         if (parent->prio_activity)
                                 htb_deactivate(q, parent);
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index 203659bc3906..3a3312467692 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -249,7 +249,7 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 
         sch = dev_queue->qdisc_sleeping;
         if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+            qdisc_qstats_copy(d, sch) < 0)
                 return -1;
         return 0;
 }
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index d364e63c396d..ea0dc112b38d 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -561,8 +561,7 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
                 sch = dev_queue->qdisc_sleeping;
                 if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                           d, NULL, &sch->bstats) < 0 ||
-                    gnet_stats_copy_queue(d, NULL,
-                                          &sch->qstats, sch->q.qlen) < 0)
+                    qdisc_qstats_copy(d, sch) < 0)
                         return -1;
         }
         return 0;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 7410ce4d0321..35b03ae08e0f 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -201,9 +201,9 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
         for (i = q->bands; i < q->max_bands; i++) {
                 if (q->queues[i] != &noop_qdisc) {
                         struct Qdisc *child = q->queues[i];
+
                         q->queues[i] = &noop_qdisc;
-                        qdisc_tree_reduce_backlog(child, child->q.qlen,
-                                                  child->qstats.backlog);
+                        qdisc_tree_flush_backlog(child);
                         qdisc_put(child);
                 }
         }
@@ -225,9 +225,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
                                         qdisc_hash_add(child, true);
 
                                 if (old != &noop_qdisc) {
-                                        qdisc_tree_reduce_backlog(old,
-                                                                  old->q.qlen,
-                                                                  old->qstats.backlog);
+                                        qdisc_tree_flush_backlog(old);
                                         qdisc_put(old);
                                 }
                                 sch_tree_unlock(sch);
@@ -344,7 +342,7 @@ static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         cl_q = q->queues[cl - 1];
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl_q->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl_q) < 0)
                 return -1;
 
         return 0;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 847141cd900f..d519b21535b3 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -216,12 +216,8 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,
         q->bands = qopt->bands;
         memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1);
 
-        for (i = q->bands; i < oldbands; i++) {
-                struct Qdisc *child = q->queues[i];
-
-                qdisc_tree_reduce_backlog(child, child->q.qlen,
-                                          child->qstats.backlog);
-        }
+        for (i = q->bands; i < oldbands; i++)
+                qdisc_tree_flush_backlog(q->queues[i]);
 
         for (i = oldbands; i < q->bands; i++) {
                 q->queues[i] = queues[i];
@@ -365,7 +361,7 @@ static int prio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         cl_q = q->queues[cl - 1];
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl_q->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl_q) < 0)
                 return -1;
 
         return 0;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 29f5c4a24688..1589364b54da 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -217,15 +217,6 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
         return container_of(clc, struct qfq_class, common);
 }
 
-static void qfq_purge_queue(struct qfq_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
 static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
         [TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
         [TCA_QFQ_LMAX] = { .type = NLA_U32 },
@@ -551,7 +542,7 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        qfq_purge_queue(cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->common);
 
         sch_tree_unlock(sch);
@@ -655,8 +646,7 @@ static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL,
-                                  &cl->qdisc->qstats, cl->qdisc->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl->qdisc) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 9df9942340ea..4e8c0abf6194 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -233,8 +233,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
         q->flags = ctl->flags;
         q->limit = ctl->limit;
         if (child) {
-                qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                          q->qdisc->qstats.backlog);
+                qdisc_tree_flush_backlog(q->qdisc);
                 old_child = q->qdisc;
                 q->qdisc = child;
         }
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index bab506b01a32..2419fdb75966 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -521,8 +521,7 @@ static int sfb_change(struct Qdisc *sch, struct nlattr *opt,
                 qdisc_hash_add(child, true);
         sch_tree_lock(sch);
 
-        qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                  q->qdisc->qstats.backlog);
+        qdisc_tree_flush_backlog(q->qdisc);
         qdisc_put(q->qdisc);
         q->qdisc = child;
 
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 206e4dbed12f..c7041999eb5d 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -895,7 +895,7 @@ static int taprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 
         sch = dev_queue->qdisc_sleeping;
         if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+            qdisc_qstats_copy(d, sch) < 0)
                 return -1;
         return 0;
 }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7f272a9070c5..f71578dbb9e3 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -391,8 +391,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
 
         sch_tree_lock(sch);
         if (child) {
-                qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                          q->qdisc->qstats.backlog);
+                qdisc_tree_flush_backlog(q->qdisc);
                 qdisc_put(q->qdisc);
                 q->qdisc = child;
         }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 6abc8b274270..951afdeea5e9 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -600,6 +600,7 @@ out:
 static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr)
 {
         /* No address mapping for V4 sockets */
+        memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
         return sizeof(struct sockaddr_in);
 }
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9874e60c9b0d..4583fa914e62 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4847,7 +4847,8 @@ static int sctp_connect(struct sock *sk, struct sockaddr *addr,
         }
 
         /* Validate addr_len before calling common connect/connectx routine. */
-        af = sctp_get_af_specific(addr->sa_family);
+        af = addr_len < offsetofend(struct sockaddr, sa_family) ? NULL :
+                sctp_get_af_specific(addr->sa_family);
         if (!af || addr_len < af->sockaddr_len) {
                 err = -EINVAL;
         } else {
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 77ef53596d18..6f869ef49b32 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -167,10 +167,9 @@ static int smc_release(struct socket *sock)
 
         if (sk->sk_state == SMC_CLOSED) {
                 if (smc->clcsock) {
-                        mutex_lock(&smc->clcsock_release_lock);
-                        sock_release(smc->clcsock);
-                        smc->clcsock = NULL;
-                        mutex_unlock(&smc->clcsock_release_lock);
+                        release_sock(sk);
+                        smc_clcsock_release(smc);
+                        lock_sock(sk);
                 }
                 if (!smc->use_fallback)
                         smc_conn_free(&smc->conn);
@@ -446,10 +445,19 @@ static void smc_link_save_peer_info(struct smc_link *link,
         link->peer_mtu = clc->qp_mtu;
 }
 
+static void smc_switch_to_fallback(struct smc_sock *smc)
+{
+        smc->use_fallback = true;
+        if (smc->sk.sk_socket && smc->sk.sk_socket->file) {
+                smc->clcsock->file = smc->sk.sk_socket->file;
+                smc->clcsock->file->private_data = smc->clcsock;
+        }
+}
+
 /* fall back during connect */
 static int smc_connect_fallback(struct smc_sock *smc, int reason_code)
 {
-        smc->use_fallback = true;
+        smc_switch_to_fallback(smc);
         smc->fallback_rsn = reason_code;
         smc_copy_sock_settings_to_clc(smc);
         if (smc->sk.sk_state == SMC_INIT)
@@ -775,10 +783,14 @@ static void smc_connect_work(struct work_struct *work)
                 smc->sk.sk_err = -rc;
 
 out:
-        if (smc->sk.sk_err)
-                smc->sk.sk_state_change(&smc->sk);
-        else
-                smc->sk.sk_write_space(&smc->sk);
+        if (!sock_flag(&smc->sk, SOCK_DEAD)) {
+                if (smc->sk.sk_err) {
+                        smc->sk.sk_state_change(&smc->sk);
+                } else { /* allow polling before and after fallback decision */
+                        smc->clcsock->sk->sk_write_space(smc->clcsock->sk);
+                        smc->sk.sk_write_space(&smc->sk);
+                }
+        }
         kfree(smc->connect_info);
         smc->connect_info = NULL;
         release_sock(&smc->sk);
@@ -872,11 +884,11 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
         if  (rc < 0)
                 lsk->sk_err = -rc;
         if (rc < 0 || lsk->sk_state == SMC_CLOSED) {
+                new_sk->sk_prot->unhash(new_sk);
                 if (new_clcsock)
                         sock_release(new_clcsock);
                 new_sk->sk_state = SMC_CLOSED;
                 sock_set_flag(new_sk, SOCK_DEAD);
-                new_sk->sk_prot->unhash(new_sk);
                 sock_put(new_sk); /* final */
                 *new_smc = NULL;
                 goto out;
@@ -927,16 +939,21 @@ struct sock *smc_accept_dequeue(struct sock *parent,
 
                 smc_accept_unlink(new_sk);
                 if (new_sk->sk_state == SMC_CLOSED) {
+                        new_sk->sk_prot->unhash(new_sk);
                         if (isk->clcsock) {
                                 sock_release(isk->clcsock);
                                 isk->clcsock = NULL;
                         }
-                        new_sk->sk_prot->unhash(new_sk);
                         sock_put(new_sk); /* final */
                         continue;
                 }
-                if (new_sock)
+                if (new_sock) {
                         sock_graft(new_sk, new_sock);
+                        if (isk->use_fallback) {
+                                smc_sk(new_sk)->clcsock->file = new_sock->file;
+                                isk->clcsock->file->private_data = isk->clcsock;
+                        }
+                }
                 return new_sk;
         }
         return NULL;
@@ -956,6 +973,7 @@ void smc_close_non_accepted(struct sock *sk)
                 sock_set_flag(sk, SOCK_DEAD);
                 sk->sk_shutdown |= SHUTDOWN_MASK;
         }
+        sk->sk_prot->unhash(sk);
         if (smc->clcsock) {
                 struct socket *tcp;
 
@@ -971,7 +989,6 @@ void smc_close_non_accepted(struct sock *sk)
                         smc_conn_free(&smc->conn);
         }
         release_sock(sk);
-        sk->sk_prot->unhash(sk);
         sock_put(sk); /* final sock_put */
 }
 
@@ -1037,13 +1054,13 @@ static void smc_listen_out(struct smc_sock *new_smc)
         struct smc_sock *lsmc = new_smc->listen_smc;
         struct sock *newsmcsk = &new_smc->sk;
 
-        lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
         if (lsmc->sk.sk_state == SMC_LISTEN) {
+                lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
                 smc_accept_enqueue(&lsmc->sk, newsmcsk);
+                release_sock(&lsmc->sk);
         } else { /* no longer listening */
                 smc_close_non_accepted(newsmcsk);
         }
-        release_sock(&lsmc->sk);
 
         /* Wake up accept */
         lsmc->sk.sk_data_ready(&lsmc->sk);
@@ -1087,7 +1104,7 @@ static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,
                 return;
         }
         smc_conn_free(&new_smc->conn);
-        new_smc->use_fallback = true;
+        smc_switch_to_fallback(new_smc);
         new_smc->fallback_rsn = reason_code;
         if (reason_code && reason_code != SMC_CLC_DECL_PEERDECL) {
                 if (smc_clc_send_decline(new_smc, reason_code) < 0) {
@@ -1237,6 +1254,9 @@ static void smc_listen_work(struct work_struct *work)
         int rc = 0;
         u8 ibport;
 
+        if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)
+                return smc_listen_out_err(new_smc);
+
         if (new_smc->use_fallback) {
                 smc_listen_out_connected(new_smc);
                 return;
@@ -1244,7 +1264,7 @@ static void smc_listen_work(struct work_struct *work)
 
         /* check if peer is smc capable */
         if (!tcp_sk(newclcsock->sk)->syn_smc) {
-                new_smc->use_fallback = true;
+                smc_switch_to_fallback(new_smc);
                 new_smc->fallback_rsn = SMC_CLC_DECL_PEERNOSMC;
                 smc_listen_out_connected(new_smc);
                 return;
@@ -1501,7 +1521,7 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 
         if (msg->msg_flags & MSG_FASTOPEN) {
                 if (sk->sk_state == SMC_INIT) {
-                        smc->use_fallback = true;
+                        smc_switch_to_fallback(smc);
                         smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                 } else {
                         rc = -EINVAL;
@@ -1703,7 +1723,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
         case TCP_FASTOPEN_NO_COOKIE:
                 /* option not supported by SMC */
                 if (sk->sk_state == SMC_INIT) {
-                        smc->use_fallback = true;
+                        smc_switch_to_fallback(smc);
                         smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                 } else {
                         if (!smc->use_fallback)
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 2ad37e998509..fc06720b53c1 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -21,6 +21,22 @@
 
 #define SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME      (5 * HZ)
 
+/* release the clcsock that is assigned to the smc_sock */
+void smc_clcsock_release(struct smc_sock *smc)
+{
+        struct socket *tcp;
+
+        if (smc->listen_smc && current_work() != &smc->smc_listen_work)
+                cancel_work_sync(&smc->smc_listen_work);
+        mutex_lock(&smc->clcsock_release_lock);
+        if (smc->clcsock) {
+                tcp = smc->clcsock;
+                smc->clcsock = NULL;
+                sock_release(tcp);
+        }
+        mutex_unlock(&smc->clcsock_release_lock);
+}
+
 static void smc_close_cleanup_listen(struct sock *parent)
 {
         struct sock *sk;
@@ -321,6 +337,7 @@ static void smc_close_passive_work(struct work_struct *work)
                                                    close_work);
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
         struct smc_cdc_conn_state_flags *rxflags;
+        bool release_clcsock = false;
         struct sock *sk = &smc->sk;
         int old_state;
 
@@ -400,13 +417,13 @@ wakeup:
                 if ((sk->sk_state == SMC_CLOSED) &&
                     (sock_flag(sk, SOCK_DEAD) || !sk->sk_socket)) {
                         smc_conn_free(conn);
-                        if (smc->clcsock) {
-                                sock_release(smc->clcsock);
-                                smc->clcsock = NULL;
-                        }
+                        if (smc->clcsock)
+                                release_clcsock = true;
                 }
         }
         release_sock(sk);
+        if (release_clcsock)
+                smc_clcsock_release(smc);
         sock_put(sk); /* sock_hold done by schedulers of close_work */
 }
 
diff --git a/net/smc/smc_close.h b/net/smc/smc_close.h
index 19eb6a211c23..e0e3b5df25d2 100644
--- a/net/smc/smc_close.h
+++ b/net/smc/smc_close.h
@@ -23,5 +23,6 @@ void smc_close_wake_tx_prepared(struct smc_sock *smc);
 int smc_close_active(struct smc_sock *smc);
 int smc_close_shutdown_write(struct smc_sock *smc);
 void smc_close_init(struct smc_sock *smc);
+void smc_clcsock_release(struct smc_sock *smc);
 
 #endif /* SMC_CLOSE_H */
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index 2fff79db1a59..e89e918b88e0 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -289,6 +289,11 @@ struct smcd_dev *smcd_alloc_dev(struct device *parent, const char *name,
         INIT_LIST_HEAD(&smcd->vlan);
         smcd->event_wq = alloc_ordered_workqueue("ism_evt_wq-%s)",
                                                  WQ_MEM_RECLAIM, name);
+        if (!smcd->event_wq) {
+                kfree(smcd->conn);
+                kfree(smcd);
+                return NULL;
+        }
         return smcd;
 }
 EXPORT_SYMBOL_GPL(smcd_alloc_dev);
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 8d2f6296279c..0285c7f9e79b 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -603,7 +603,8 @@ static int smc_pnet_flush(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = genl_info_net(info);
 
-        return smc_pnet_remove_by_pnetid(net, NULL);
+        smc_pnet_remove_by_pnetid(net, NULL);
+        return 0;
 }
 
 /* SMC_PNETID generic netlink operation definition */
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 860dcfb95ee4..fa6c977b4c41 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -140,13 +140,11 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                         /* We are going to append to the frags_list of head.
                          * Need to unshare the frag_list.
                          */
-                        if (skb_has_frag_list(head)) {
-                                err = skb_unclone(head, GFP_ATOMIC);
-                                if (err) {
-                                        STRP_STATS_INCR(strp->stats.mem_fail);
-                                        desc->error = err;
-                                        return 0;
-                                }
+                        err = skb_unclone(head, GFP_ATOMIC);
+                        if (err) {
+                                STRP_STATS_INCR(strp->stats.mem_fail);
+                                desc->error = err;
+                                return 0;
                         }
 
                         if (unlikely(skb_shinfo(head)->frag_list)) {
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 12bb23b8e0c5..261131dfa1f1 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -54,6 +54,7 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
         h->last_refresh = now;
 }
 
+static inline int cache_is_valid(struct cache_head *h);
 static void cache_fresh_locked(struct cache_head *head, time_t expiry,
                                 struct cache_detail *detail);
 static void cache_fresh_unlocked(struct cache_head *head,
@@ -105,6 +106,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,
                         if (cache_is_expired(detail, tmp)) {
                                 hlist_del_init_rcu(&tmp->cache_list);
                                 detail->entries --;
+                                if (cache_is_valid(tmp) == -EAGAIN)
+                                        set_bit(CACHE_NEGATIVE, &tmp->flags);
                                 cache_fresh_locked(tmp, 0, detail);
                                 freeme = tmp;
                                 break;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 187d10443a15..8ff11dc98d7f 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1540,7 +1540,6 @@ call_start(struct rpc_task *task)
         clnt->cl_stats->rpccnt++;
         task->tk_action = call_reserve;
         rpc_task_set_transport(task, clnt);
-        call_reserve(task);
 }
 
 /*
@@ -1554,9 +1553,6 @@ call_reserve(struct rpc_task *task)
         task->tk_status  = 0;
         task->tk_action  = call_reserveresult;
         xprt_reserve(task);
-        if (rpc_task_need_resched(task))
-                return;
-         call_reserveresult(task);
 }
 
 static void call_retry_reserve(struct rpc_task *task);
@@ -1579,7 +1575,6 @@ call_reserveresult(struct rpc_task *task)
         if (status >= 0) {
                 if (task->tk_rqstp) {
                         task->tk_action = call_refresh;
-                        call_refresh(task);
                         return;
                 }
 
@@ -1605,7 +1600,6 @@ call_reserveresult(struct rpc_task *task)
                 /* fall through */
         case -EAGAIN:   /* woken up; retry */
                 task->tk_action = call_retry_reserve;
-                call_retry_reserve(task);
                 return;
         case -EIO:      /* probably a shutdown */
                 break;
@@ -1628,9 +1622,6 @@ call_retry_reserve(struct rpc_task *task)
         task->tk_status  = 0;
         task->tk_action  = call_reserveresult;
         xprt_retry_reserve(task);
-        if (rpc_task_need_resched(task))
-                return;
-        call_reserveresult(task);
 }
 
 /*
@@ -1645,9 +1636,6 @@ call_refresh(struct rpc_task *task)
         task->tk_status = 0;
         task->tk_client->cl_stats->rpcauthrefresh++;
         rpcauth_refreshcred(task);
-        if (rpc_task_need_resched(task))
-                return;
-        call_refreshresult(task);
 }
 
 /*
@@ -1666,7 +1654,6 @@ call_refreshresult(struct rpc_task *task)
         case 0:
                 if (rpcauth_uptodatecred(task)) {
                         task->tk_action = call_allocate;
-                        call_allocate(task);
                         return;
                 }
                 /* Use rate-limiting and a max number of retries if refresh
@@ -1685,7 +1672,6 @@ call_refreshresult(struct rpc_task *task)
                 task->tk_cred_retry--;
                 dprintk("RPC: %5u %s: retry refresh creds\n",
                                 task->tk_pid, __func__);
-                call_refresh(task);
                 return;
         }
         dprintk("RPC: %5u %s: refresh creds failed with error %d\n",
@@ -1711,10 +1697,8 @@ call_allocate(struct rpc_task *task)
         task->tk_status = 0;
         task->tk_action = call_encode;
 
-        if (req->rq_buffer) {
-                call_encode(task);
+        if (req->rq_buffer)
                 return;
-        }
 
         if (proc->p_proc != 0) {
                 BUG_ON(proc->p_arglen == 0);
@@ -1740,12 +1724,8 @@ call_allocate(struct rpc_task *task)
 
         status = xprt->ops->buf_alloc(task);
         xprt_inject_disconnect(xprt);
-        if (status == 0) {
-                if (rpc_task_need_resched(task))
-                        return;
-                call_encode(task);
+        if (status == 0)
                 return;
-        }
         if (status != -ENOMEM) {
                 rpc_exit(task, status);
                 return;
@@ -1828,8 +1808,12 @@ call_encode(struct rpc_task *task)
                 xprt_request_enqueue_receive(task);
         xprt_request_enqueue_transmit(task);
 out:
-        task->tk_action = call_bind;
-        call_bind(task);
+        task->tk_action = call_transmit;
+        /* Check that the connection is OK */
+        if (!xprt_bound(task->tk_xprt))
+                task->tk_action = call_bind;
+        else if (!xprt_connected(task->tk_xprt))
+                task->tk_action = call_connect;
 }
 
 /*
@@ -1847,7 +1831,6 @@ rpc_task_handle_transmitted(struct rpc_task *task)
 {
         xprt_end_transmit(task);
         task->tk_action = call_transmit_status;
-        call_transmit_status(task);
 }
 
 /*
@@ -1865,7 +1848,6 @@ call_bind(struct rpc_task *task)
 
         if (xprt_bound(xprt)) {
                 task->tk_action = call_connect;
-                call_connect(task);
                 return;
         }
 
@@ -1896,7 +1878,6 @@ call_bind_status(struct rpc_task *task)
                 dprint_status(task);
                 task->tk_status = 0;
                 task->tk_action = call_connect;
-                call_connect(task);
                 return;
         }
 
@@ -1981,7 +1962,6 @@ call_connect(struct rpc_task *task)
 
         if (xprt_connected(xprt)) {
                 task->tk_action = call_transmit;
-                call_transmit(task);
                 return;
         }
 
@@ -2051,7 +2031,6 @@ call_connect_status(struct rpc_task *task)
         case 0:
                 clnt->cl_stats->netreconn++;
                 task->tk_action = call_transmit;
-                call_transmit(task);
                 return;
         }
         rpc_exit(task, status);
@@ -2087,9 +2066,6 @@ call_transmit(struct rpc_task *task)
                 xprt_transmit(task);
         }
         xprt_end_transmit(task);
-        if (rpc_task_need_resched(task))
-                return;
-        call_transmit_status(task);
 }
 
 /*
@@ -2105,11 +2081,8 @@ call_transmit_status(struct rpc_task *task)
          * test first.
          */
         if (rpc_task_transmitted(task)) {
-                if (task->tk_status == 0)
-                        xprt_request_wait_receive(task);
-                if (rpc_task_need_resched(task))
-                        return;
-                call_status(task);
+                task->tk_status = 0;
+                xprt_request_wait_receive(task);
                 return;
         }
 
@@ -2170,7 +2143,6 @@ call_bc_encode(struct rpc_task *task)
 {
         xprt_request_enqueue_transmit(task);
         task->tk_action = call_bc_transmit;
-        call_bc_transmit(task);
 }
 
 /*
@@ -2195,6 +2167,9 @@ call_bc_transmit_status(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
 
+        if (rpc_task_transmitted(task))
+                task->tk_status = 0;
+
         dprint_status(task);
 
         switch (task->tk_status) {
@@ -2261,7 +2236,6 @@ call_status(struct rpc_task *task)
         status = task->tk_status;
         if (status >= 0) {
                 task->tk_action = call_decode;
-                call_decode(task);
                 return;
         }
 
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 89a63391d4d4..30cfc0efe699 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -90,7 +90,7 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
         /* Flush Receives, then wait for deferred Reply work
          * to complete.
          */
-        ib_drain_qp(ia->ri_id->qp);
+        ib_drain_rq(ia->ri_id->qp);
         drain_workqueue(buf->rb_completion_wq);
 
         /* Deferred Reply processing might have scheduled
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 341ecd796aa4..131aa2f0fd27 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -869,6 +869,8 @@ void tipc_link_reset(struct tipc_link *l)
         __skb_queue_head_init(&list);
 
         l->in_session = false;
+        /* Force re-synch of peer session number before establishing */
+        l->peer_session--;
         l->session++;
         l->mtu = l->advertised_mtu;
 
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index bff241f03525..89993afe0fbd 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -909,7 +909,8 @@ static int tipc_nl_service_list(struct net *net, struct tipc_nl_msg *msg,
         for (; i < TIPC_NAMETBL_SIZE; i++) {
                 head = &tn->nametbl->services[i];
 
-                if (*last_type) {
+                if (*last_type ||
+                    (!i && *last_key && (*last_lower == *last_key))) {
                         service = tipc_service_find(net, *last_type);
                         if (!service)
                                 return -EPIPE;
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4ad3586da8f0..340a6e7c43a7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -267,8 +267,14 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         if (msg->rep_type)
                 tipc_tlv_init(msg->rep, msg->rep_type);
 
-        if (cmd->header)
-                (*cmd->header)(msg);
+        if (cmd->header) {
+                err = (*cmd->header)(msg);
+                if (err) {
+                        kfree_skb(msg->rep);
+                        msg->rep = NULL;
+                        return err;
+                }
+        }
 
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
@@ -397,7 +403,12 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        len -= offsetof(struct tipc_bearer_config, name);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(b->name, len))
                 return -EINVAL;
 
@@ -766,7 +777,12 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         lc = (struct tipc_link_config *)TLV_DATA(msg->req);
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        len -= offsetof(struct tipc_link_config, name);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_LINK_NAME);
         if (!string_is_valid(lc->name, len))
                 return -EINVAL;
 
diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
index 3481e4906bd6..9df82a573aa7 100644
--- a/net/tipc/sysctl.c
+++ b/net/tipc/sysctl.c
@@ -38,6 +38,8 @@
 
 #include <linux/sysctl.h>
 
+static int zero;
+static int one = 1;
 static struct ctl_table_header *tipc_ctl_hdr;
 
 static struct ctl_table tipc_table[] = {
@@ -46,14 +48,16 @@ static struct ctl_table tipc_table[] = {
                 .data           = &sysctl_tipc_rmem,
                 .maxlen         = sizeof(sysctl_tipc_rmem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
         },
         {
                 .procname       = "named_timeout",
                 .data           = &sysctl_tipc_named_timeout,
                 .maxlen         = sizeof(sysctl_tipc_named_timeout),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
         {
                 .procname       = "sk_filter",
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 135a7ee9db03..cc0256939eb6 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -52,8 +52,11 @@ static DEFINE_SPINLOCK(tls_device_lock);
 
 static void tls_device_free_ctx(struct tls_context *ctx)
 {
-        if (ctx->tx_conf == TLS_HW)
+        if (ctx->tx_conf == TLS_HW) {
                 kfree(tls_offload_ctx_tx(ctx));
+                kfree(ctx->tx.rec_seq);
+                kfree(ctx->tx.iv);
+        }
 
         if (ctx->rx_conf == TLS_HW)
                 kfree(tls_offload_ctx_rx(ctx));
@@ -216,6 +219,13 @@ void tls_device_sk_destruct(struct sock *sk)
 }
 EXPORT_SYMBOL(tls_device_sk_destruct);
 
+void tls_device_free_resources_tx(struct sock *sk)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+
+        tls_free_partial_record(sk, tls_ctx);
+}
+
 static void tls_append_frag(struct tls_record_info *record,
                             struct page_frag *pfrag,
                             int size)
@@ -894,7 +904,9 @@ int tls_set_device_offload_rx(struct sock *sk, struct tls_context *ctx)
         goto release_netdev;
 
 free_sw_resources:
+        up_read(&device_offload_lock);
         tls_sw_free_resources_rx(sk);
+        down_read(&device_offload_lock);
 release_ctx:
         ctx->priv_ctx_rx = NULL;
 release_netdev:
@@ -929,8 +941,6 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
         }
 out:
         up_read(&device_offload_lock);
-        kfree(tls_ctx->rx.rec_seq);
-        kfree(tls_ctx->rx.iv);
         tls_sw_release_resources_rx(sk);
 }
 
diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
index 54c3a758f2a7..a3ebd4b02714 100644
--- a/net/tls/tls_device_fallback.c
+++ b/net/tls/tls_device_fallback.c
@@ -194,6 +194,9 @@ static void update_chksum(struct sk_buff *skb, int headln)
 
 static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
 {
+        struct sock *sk = skb->sk;
+        int delta;
+
         skb_copy_header(nskb, skb);
 
         skb_put(nskb, skb->len);
@@ -201,11 +204,15 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
         update_chksum(nskb, headln);
 
         nskb->destructor = skb->destructor;
-        nskb->sk = skb->sk;
+        nskb->sk = sk;
         skb->destructor = NULL;
         skb->sk = NULL;
-        refcount_add(nskb->truesize - skb->truesize,
-                     &nskb->sk->sk_wmem_alloc);
+
+        delta = nskb->truesize - skb->truesize;
+        if (likely(delta < 0))
+                WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
+        else if (delta)
+                refcount_add(delta, &sk->sk_wmem_alloc);
 }
 
 /* This function may be called after the user socket is already
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index df921a2904b9..478603f43964 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -208,6 +208,26 @@ int tls_push_partial_record(struct sock *sk, struct tls_context *ctx,
         return tls_push_sg(sk, ctx, sg, offset, flags);
 }
 
+bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx)
+{
+        struct scatterlist *sg;
+
+        sg = ctx->partially_sent_record;
+        if (!sg)
+                return false;
+
+        while (1) {
+                put_page(sg_page(sg));
+                sk_mem_uncharge(sk, sg->length);
+
+                if (sg_is_last(sg))
+                        break;
+                sg++;
+        }
+        ctx->partially_sent_record = NULL;
+        return true;
+}
+
 static void tls_write_space(struct sock *sk)
 {
         struct tls_context *ctx = tls_get_ctx(sk);
@@ -267,13 +287,14 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
                 kfree(ctx->tx.rec_seq);
                 kfree(ctx->tx.iv);
                 tls_sw_free_resources_tx(sk);
+#ifdef CONFIG_TLS_DEVICE
+        } else if (ctx->tx_conf == TLS_HW) {
+                tls_device_free_resources_tx(sk);
+#endif
         }
 
-        if (ctx->rx_conf == TLS_SW) {
-                kfree(ctx->rx.rec_seq);
-                kfree(ctx->rx.iv);
+        if (ctx->rx_conf == TLS_SW)
                 tls_sw_free_resources_rx(sk);
-        }
 
 #ifdef CONFIG_TLS_DEVICE
         if (ctx->rx_conf == TLS_HW)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 425351ac2a9b..29d6af43dd24 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1484,6 +1484,8 @@ static int decrypt_skb_update(struct sock *sk, struct sk_buff *skb,
 
                                 return err;
                         }
+                } else {
+                        *zc = false;
                 }
 
                 rxm->full_len -= padding_length(ctx, tls_ctx, skb);
@@ -2050,20 +2052,7 @@ void tls_sw_free_resources_tx(struct sock *sk)
         /* Free up un-sent records in tx_list. First, free
          * the partially sent record if any at head of tx_list.
          */
-        if (tls_ctx->partially_sent_record) {
-                struct scatterlist *sg = tls_ctx->partially_sent_record;
-
-                while (1) {
-                        put_page(sg_page(sg));
-                        sk_mem_uncharge(sk, sg->length);
-
-                        if (sg_is_last(sg))
-                                break;
-                        sg++;
-                }
-
-                tls_ctx->partially_sent_record = NULL;
-
+        if (tls_free_partial_record(sk, tls_ctx)) {
                 rec = list_first_entry(&ctx->tx_list,
                                        struct tls_rec, list);
                 list_del(&rec->list);
@@ -2089,6 +2078,9 @@ void tls_sw_release_resources_rx(struct sock *sk)
         struct tls_context *tls_ctx = tls_get_ctx(sk);
         struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
 
+        kfree(tls_ctx->rx.rec_seq);
+        kfree(tls_ctx->rx.iv);
+
         if (ctx->aead_recv) {
                 kfree_skb(ctx->recv_pkt);
                 ctx->recv_pkt = NULL;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 25a9e3b5c154..47e30a58566c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13650,7 +13650,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEAUTHENTICATE,
@@ -13701,7 +13702,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
@@ -13709,7 +13711,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DISCONNECT,
@@ -13738,7 +13741,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEL_PMKSA,
@@ -14090,7 +14094,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_SET_QOS_MAP,
@@ -14145,7 +14150,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_pmk,
                 .policy = nl80211_policy,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEL_PMK,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2f1bf91eb226..0ba778f371cb 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1309,6 +1309,16 @@ reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
         return dfs_region1;
 }
 
+static void reg_wmm_rules_intersect(const struct ieee80211_wmm_ac *wmm_ac1,
+                                    const struct ieee80211_wmm_ac *wmm_ac2,
+                                    struct ieee80211_wmm_ac *intersect)
+{
+        intersect->cw_min = max_t(u16, wmm_ac1->cw_min, wmm_ac2->cw_min);
+        intersect->cw_max = max_t(u16, wmm_ac1->cw_max, wmm_ac2->cw_max);
+        intersect->cot = min_t(u16, wmm_ac1->cot, wmm_ac2->cot);
+        intersect->aifsn = max_t(u8, wmm_ac1->aifsn, wmm_ac2->aifsn);
+}
+
 /*
  * Helper for regdom_intersect(), this does the real
  * mathematical intersection fun
@@ -1323,6 +1333,8 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         struct ieee80211_freq_range *freq_range;
         const struct ieee80211_power_rule *power_rule1, *power_rule2;
         struct ieee80211_power_rule *power_rule;
+        const struct ieee80211_wmm_rule *wmm_rule1, *wmm_rule2;
+        struct ieee80211_wmm_rule *wmm_rule;
         u32 freq_diff, max_bandwidth1, max_bandwidth2;
 
         freq_range1 = &rule1->freq_range;
@@ -1333,6 +1345,10 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         power_rule2 = &rule2->power_rule;
         power_rule = &intersected_rule->power_rule;
 
+        wmm_rule1 = &rule1->wmm_rule;
+        wmm_rule2 = &rule2->wmm_rule;
+        wmm_rule = &intersected_rule->wmm_rule;
+
         freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
                                          freq_range2->start_freq_khz);
         freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
@@ -1376,6 +1392,29 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
                                            rule2->dfs_cac_ms);
 
+        if (rule1->has_wmm && rule2->has_wmm) {
+                u8 ac;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        reg_wmm_rules_intersect(&wmm_rule1->client[ac],
+                                                &wmm_rule2->client[ac],
+                                                &wmm_rule->client[ac]);
+                        reg_wmm_rules_intersect(&wmm_rule1->ap[ac],
+                                                &wmm_rule2->ap[ac],
+                                                &wmm_rule->ap[ac]);
+                }
+
+                intersected_rule->has_wmm = true;
+        } else if (rule1->has_wmm) {
+                *wmm_rule = *wmm_rule1;
+                intersected_rule->has_wmm = true;
+        } else if (rule2->has_wmm) {
+                *wmm_rule = *wmm_rule2;
+                intersected_rule->has_wmm = true;
+        } else {
+                intersected_rule->has_wmm = false;
+        }
+
         if (!is_valid_reg_rule(intersected_rule))
                 return -EINVAL;
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 287518c6caa4..04d888628f29 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -190,10 +190,9 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
         /* copy subelement as we need to change its content to
          * mark an ie after it is processed.
          */
-        sub_copy = kmalloc(subie_len, gfp);
+        sub_copy = kmemdup(subelement, subie_len, gfp);
         if (!sub_copy)
                 return 0;
-        memcpy(sub_copy, subelement, subie_len);
 
         pos = &new_ie[0];
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index e4b8db5e81ec..75899b62bdc9 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1220,9 +1220,11 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
         else if (rate->bw == RATE_INFO_BW_HE_RU &&
                  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
                 result = rates_26[rate->he_gi];
-        else if (WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
-                      rate->bw, rate->he_ru_alloc))
+        else {
+                WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
+                     rate->bw, rate->he_ru_alloc);
                 return 0;
+        }
 
         /* now scale to the appropriate MCS */
         tmp = result;
diff --git a/scripts/atomic/gen-atomics.sh b/scripts/atomic/gen-atomics.sh
index 27400b0cd732..000dc6437893 100644
--- a/scripts/atomic/gen-atomics.sh
+++ b/scripts/atomic/gen-atomics.sh
@@ -13,7 +13,7 @@ gen-atomic-long.sh              asm-generic/atomic-long.h
 gen-atomic-fallback.sh          linux/atomic-fallback.h
 EOF
 while read script header; do
-        ${ATOMICDIR}/${script} ${ATOMICTBL} > ${LINUXDIR}/include/${header}
+        /bin/sh ${ATOMICDIR}/${script} ${ATOMICTBL} > ${LINUXDIR}/include/${header}
         HASH="$(sha1sum ${LINUXDIR}/include/${header})"
         HASH="${HASH%% *}"
         printf "// %s\n" "${HASH}" >> ${LINUXDIR}/include/${header}
diff --git a/scripts/coccinelle/api/stream_open.cocci b/scripts/coccinelle/api/stream_open.cocci
new file mode 100644
index 000000000000..350145da7669
--- /dev/null
+++ b/scripts/coccinelle/api/stream_open.cocci
@@ -0,0 +1,363 @@
+// SPDX-License-Identifier: GPL-2.0
+// Author: Kirill Smelkov (kirr@nexedi.com)
+//
+// Search for stream-like files that are using nonseekable_open and convert
+// them to stream_open. A stream-like file is a file that does not use ppos in
+// its read and write. Rationale for the conversion is to avoid deadlock in
+// between read and write.
+
+virtual report
+virtual patch
+virtual explain  // explain decisions in the patch (SPFLAGS="-D explain")
+
+// stream-like reader & writer - ones that do not depend on f_pos.
+@ stream_reader @
+identifier readstream, ppos;
+identifier f, buf, len;
+type loff_t;
+@@
+  ssize_t readstream(struct file *f, char *buf, size_t len, loff_t *ppos)
+  {
+    ... when != ppos
+  }
+
+@ stream_writer @
+identifier writestream, ppos;
+identifier f, buf, len;
+type loff_t;
+@@
+  ssize_t writestream(struct file *f, const char *buf, size_t len, loff_t *ppos)
+  {
+    ... when != ppos
+  }
+
+
+// a function that blocks
+@ blocks @
+identifier block_f;
+identifier wait_event =~ "^wait_event_.*";
+@@
+  block_f(...) {
+    ... when exists
+    wait_event(...)
+    ... when exists
+  }
+
+// stream_reader that can block inside.
+//
+// XXX wait_* can be called not directly from current function (e.g. func -> f -> g -> wait())
+// XXX currently reader_blocks supports only direct and 1-level indirect cases.
+@ reader_blocks_direct @
+identifier stream_reader.readstream;
+identifier wait_event =~ "^wait_event_.*";
+@@
+  readstream(...)
+  {
+    ... when exists
+    wait_event(...)
+    ... when exists
+  }
+
+@ reader_blocks_1 @
+identifier stream_reader.readstream;
+identifier blocks.block_f;
+@@
+  readstream(...)
+  {
+    ... when exists
+    block_f(...)
+    ... when exists
+  }
+
+@ reader_blocks depends on reader_blocks_direct || reader_blocks_1 @
+identifier stream_reader.readstream;
+@@
+  readstream(...) {
+    ...
+  }
+
+
+// file_operations + whether they have _any_ .read, .write, .llseek ... at all.
+//
+// XXX add support for file_operations xxx[N] = ...     (sound/core/pcm_native.c)
+@ fops0 @
+identifier fops;
+@@
+  struct file_operations fops = {
+    ...
+  };
+
+@ has_read @
+identifier fops0.fops;
+identifier read_f;
+@@
+  struct file_operations fops = {
+    .read = read_f,
+  };
+
+@ has_read_iter @
+identifier fops0.fops;
+identifier read_iter_f;
+@@
+  struct file_operations fops = {
+    .read_iter = read_iter_f,
+  };
+
+@ has_write @
+identifier fops0.fops;
+identifier write_f;
+@@
+  struct file_operations fops = {
+    .write = write_f,
+  };
+
+@ has_write_iter @
+identifier fops0.fops;
+identifier write_iter_f;
+@@
+  struct file_operations fops = {
+    .write_iter = write_iter_f,
+  };
+
+@ has_llseek @
+identifier fops0.fops;
+identifier llseek_f;
+@@
+  struct file_operations fops = {
+    .llseek = llseek_f,
+  };
+
+@ has_no_llseek @
+identifier fops0.fops;
+@@
+  struct file_operations fops = {
+    .llseek = no_llseek,
+  };
+
+@ has_mmap @
+identifier fops0.fops;
+identifier mmap_f;
+@@
+  struct file_operations fops = {
+    .mmap = mmap_f,
+  };
+
+@ has_copy_file_range @
+identifier fops0.fops;
+identifier copy_file_range_f;
+@@
+  struct file_operations fops = {
+    .copy_file_range = copy_file_range_f,
+  };
+
+@ has_remap_file_range @
+identifier fops0.fops;
+identifier remap_file_range_f;
+@@
+  struct file_operations fops = {
+    .remap_file_range = remap_file_range_f,
+  };
+
+@ has_splice_read @
+identifier fops0.fops;
+identifier splice_read_f;
+@@
+  struct file_operations fops = {
+    .splice_read = splice_read_f,
+  };
+
+@ has_splice_write @
+identifier fops0.fops;
+identifier splice_write_f;
+@@
+  struct file_operations fops = {
+    .splice_write = splice_write_f,
+  };
+
+
+// file_operations that is candidate for stream_open conversion - it does not
+// use mmap and other methods that assume @offset access to file.
+//
+// XXX for simplicity require no .{read/write}_iter and no .splice_{read/write} for now.
+// XXX maybe_steam.fops cannot be used in other rules - it gives "bad rule maybe_stream or bad variable fops".
+@ maybe_stream depends on (!has_llseek || has_no_llseek) && !has_mmap && !has_copy_file_range && !has_remap_file_range && !has_read_iter && !has_write_iter && !has_splice_read && !has_splice_write @
+identifier fops0.fops;
+@@
+  struct file_operations fops = {
+  };
+
+
+// ---- conversions ----
+
+// XXX .open = nonseekable_open -> .open = stream_open
+// XXX .open = func -> openfunc -> nonseekable_open
+
+// read & write
+//
+// if both are used in the same file_operations together with an opener -
+// under that conditions we can use stream_open instead of nonseekable_open.
+@ fops_rw depends on maybe_stream @
+identifier fops0.fops, openfunc;
+identifier stream_reader.readstream;
+identifier stream_writer.writestream;
+@@
+  struct file_operations fops = {
+      .open  = openfunc,
+      .read  = readstream,
+      .write = writestream,
+  };
+
+@ report_rw depends on report @
+identifier fops_rw.openfunc;
+position p1;
+@@
+  openfunc(...) {
+    <...
+     nonseekable_open@p1
+    ...>
+  }
+
+@ script:python depends on report && reader_blocks @
+fops << fops0.fops;
+p << report_rw.p1;
+@@
+coccilib.report.print_report(p[0],
+  "ERROR: %s: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix." % (fops,))
+
+@ script:python depends on report && !reader_blocks @
+fops << fops0.fops;
+p << report_rw.p1;
+@@
+coccilib.report.print_report(p[0],
+  "WARNING: %s: .read() and .write() have stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
+
+
+@ explain_rw_deadlocked depends on explain && reader_blocks @
+identifier fops_rw.openfunc;
+@@
+  openfunc(...) {
+    <...
+-    nonseekable_open
++    nonseekable_open /* read & write (was deadlock) */
+    ...>
+  }
+
+
+@ explain_rw_nodeadlock depends on explain && !reader_blocks @
+identifier fops_rw.openfunc;
+@@
+  openfunc(...) {
+    <...
+-    nonseekable_open
++    nonseekable_open /* read & write (no direct deadlock) */
+    ...>
+  }
+
+@ patch_rw depends on patch @
+identifier fops_rw.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   stream_open
+    ...>
+  }
+
+
+// read, but not write
+@ fops_r depends on maybe_stream && !has_write @
+identifier fops0.fops, openfunc;
+identifier stream_reader.readstream;
+@@
+  struct file_operations fops = {
+      .open  = openfunc,
+      .read  = readstream,
+  };
+
+@ report_r depends on report @
+identifier fops_r.openfunc;
+position p1;
+@@
+  openfunc(...) {
+    <...
+    nonseekable_open@p1
+    ...>
+  }
+
+@ script:python depends on report @
+fops << fops0.fops;
+p << report_r.p1;
+@@
+coccilib.report.print_report(p[0],
+  "WARNING: %s: .read() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
+
+@ explain_r depends on explain @
+identifier fops_r.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   nonseekable_open /* read only */
+    ...>
+  }
+
+@ patch_r depends on patch @
+identifier fops_r.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   stream_open
+    ...>
+  }
+
+
+// write, but not read
+@ fops_w depends on maybe_stream && !has_read @
+identifier fops0.fops, openfunc;
+identifier stream_writer.writestream;
+@@
+  struct file_operations fops = {
+      .open  = openfunc,
+      .write = writestream,
+  };
+
+@ report_w depends on report @
+identifier fops_w.openfunc;
+position p1;
+@@
+  openfunc(...) {
+    <...
+    nonseekable_open@p1
+    ...>
+  }
+
+@ script:python depends on report @
+fops << fops0.fops;
+p << report_w.p1;
+@@
+coccilib.report.print_report(p[0],
+  "WARNING: %s: .write() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
+
+@ explain_w depends on explain @
+identifier fops_w.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   nonseekable_open /* write only */
+    ...>
+  }
+
+@ patch_w depends on patch @
+identifier fops_w.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   stream_open
+    ...>
+  }
+
+
+// no read, no write - don't change anything
diff --git a/scripts/selinux/genheaders/genheaders.c b/scripts/selinux/genheaders/genheaders.c
index 1ceedea847dd..544ca126a8a8 100644
--- a/scripts/selinux/genheaders/genheaders.c
+++ b/scripts/selinux/genheaders/genheaders.c
@@ -9,7 +9,6 @@
 #include <string.h>
 #include <errno.h>
 #include <ctype.h>
-#include <sys/socket.h>
 
 struct security_class_mapping {
         const char *name;
diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c
index 073fe7537f6c..6d51b74bc679 100644
--- a/scripts/selinux/mdp/mdp.c
+++ b/scripts/selinux/mdp/mdp.c
@@ -32,7 +32,6 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <string.h>
-#include <sys/socket.h>
 
 static void usage(char *name)
 {
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 49d664ddff44..87500bde5a92 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1336,9 +1336,16 @@ module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
 bool aa_g_paranoid_load = true;
 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
 
+static int param_get_aaintbool(char *buffer, const struct kernel_param *kp);
+static int param_set_aaintbool(const char *val, const struct kernel_param *kp);
+#define param_check_aaintbool param_check_int
+static const struct kernel_param_ops param_ops_aaintbool = {
+        .set = param_set_aaintbool,
+        .get = param_get_aaintbool
+};
 /* Boot time disable flag */
 static int apparmor_enabled __lsm_ro_after_init = 1;
-module_param_named(enabled, apparmor_enabled, int, 0444);
+module_param_named(enabled, apparmor_enabled, aaintbool, 0444);
 
 static int __init apparmor_enabled_setup(char *str)
 {
@@ -1413,6 +1420,46 @@ static int param_get_aauint(char *buffer, const struct kernel_param *kp)
         return param_get_uint(buffer, kp);
 }
 
+/* Can only be set before AppArmor is initialized (i.e. on boot cmdline). */
+static int param_set_aaintbool(const char *val, const struct kernel_param *kp)
+{
+        struct kernel_param kp_local;
+        bool value;
+        int error;
+
+        if (apparmor_initialized)
+                return -EPERM;
+
+        /* Create local copy, with arg pointing to bool type. */
+        value = !!*((int *)kp->arg);
+        memcpy(&kp_local, kp, sizeof(kp_local));
+        kp_local.arg = &value;
+
+        error = param_set_bool(val, &kp_local);
+        if (!error)
+                *((int *)kp->arg) = *((bool *)kp_local.arg);
+        return error;
+}
+
+/*
+ * To avoid changing /sys/module/apparmor/parameters/enabled from Y/N to
+ * 1/0, this converts the "int that is actually bool" back to bool for
+ * display in the /sys filesystem, while keeping it "int" for the LSM
+ * infrastructure.
+ */
+static int param_get_aaintbool(char *buffer, const struct kernel_param *kp)
+{
+        struct kernel_param kp_local;
+        bool value;
+
+        /* Create local copy, with arg pointing to bool type. */
+        value = !!*((int *)kp->arg);
+        memcpy(&kp_local, kp, sizeof(kp_local));
+        kp_local.arg = &value;
+
+        return param_get_bool(buffer, &kp_local);
+}
+
 static int param_get_audit(char *buffer, const struct kernel_param *kp)
 {
         if (!apparmor_enabled)
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index cd97929fac66..dc28914fa72e 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -560,7 +560,7 @@ static int propagate_exception(struct dev_cgroup *devcg_root,
                     devcg->behavior == DEVCG_DEFAULT_ALLOW) {
                         rc = dev_exception_add(devcg, ex);
                         if (rc)
-                                break;
+                                return rc;
                 } else {
                         /*
                          * in the other possible cases:
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index bcc9c6ead7fd..efdbf17f3915 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -125,7 +125,7 @@ out:
  */
 int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                         unsigned int keylen, unsigned char *h1,
-                        unsigned char *h2, unsigned char h3, ...)
+                        unsigned char *h2, unsigned int h3, ...)
 {
         unsigned char paramdigest[SHA1_DIGEST_SIZE];
         struct sdesc *sdesc;
@@ -135,13 +135,16 @@ int TSS_authhmac(unsigned char *digest, const unsigned char *key,
         int ret;
         va_list argp;
 
+        if (!chip)
+                return -ENODEV;
+
         sdesc = init_sdesc(hashalg);
         if (IS_ERR(sdesc)) {
                 pr_info("trusted_key: can't alloc %s\n", hash_alg);
                 return PTR_ERR(sdesc);
         }
 
-        c = h3;
+        c = !!h3;
         ret = crypto_shash_init(&sdesc->shash);
         if (ret < 0)
                 goto out;
@@ -196,6 +199,9 @@ int TSS_checkhmac1(unsigned char *buffer,
         va_list argp;
         int ret;
 
+        if (!chip)
+                return -ENODEV;
+
         bufsize = LOAD32(buffer, TPM_SIZE_OFFSET);
         tag = LOAD16(buffer, 0);
         ordinal = command;
@@ -363,6 +369,9 @@ int trusted_tpm_send(unsigned char *cmd, size_t buflen)
 {
         int rc;
 
+        if (!chip)
+                return -ENODEV;
+
         dump_tpm_buf(cmd);
         rc = tpm_send(chip, cmd, buflen);
         dump_tpm_buf(cmd);
@@ -429,6 +438,9 @@ int oiap(struct tpm_buf *tb, uint32_t *handle, unsigned char *nonce)
 {
         int ret;
 
+        if (!chip)
+                return -ENODEV;
+
         INIT_BUF(tb);
         store16(tb, TPM_TAG_RQU_COMMAND);
         store32(tb, TPM_OIAP_SIZE);
@@ -1245,9 +1257,13 @@ static int __init init_trusted(void)
 {
         int ret;
 
+        /* encrypted_keys.ko depends on successful load of this module even if
+         * TPM is not used.
+         */
         chip = tpm_default_chip();
         if (!chip)
-                return -ENOENT;
+                return 0;
+
         ret = init_digests();
         if (ret < 0)
                 goto err_put;
@@ -1269,10 +1285,12 @@ err_put:
 
 static void __exit cleanup_trusted(void)
 {
-        put_device(&chip->dev);
-        kfree(digests);
-        trusted_shash_release();
-        unregister_key_type(&key_type_trusted);
+        if (chip) {
+                put_device(&chip->dev);
+                kfree(digests);
+                trusted_shash_release();
+                unregister_key_type(&key_type_trusted);
+        }
 }
 
 late_initcall(init_trusted);
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index bd5fe0d3204a..201f7e588a29 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 #include <linux/capability.h>
+#include <linux/socket.h>
 
 #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
     "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append", "map"
diff --git a/sound/core/info.c b/sound/core/info.c
index 96a074019c33..0eb169acc850 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -713,8 +713,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent,
         INIT_LIST_HEAD(&entry->list);
         entry->parent = parent;
         entry->module = module;
-        if (parent)
+        if (parent) {
+                mutex_lock(&parent->access);
                 list_add_tail(&entry->list, &parent->children);
+                mutex_unlock(&parent->access);
+        }
         return entry;
 }
 
@@ -792,7 +795,12 @@ void snd_info_free_entry(struct snd_info_entry * entry)
         list_for_each_entry_safe(p, n, &entry->children, list)
                 snd_info_free_entry(p);
 
-        list_del(&entry->list);
+        p = entry->parent;
+        if (p) {
+                mutex_lock(&p->access);
+                list_del(&entry->list);
+                mutex_unlock(&p->access);
+        }
         kfree(entry->name);
         if (entry->private_free)
                 entry->private_free(entry);
diff --git a/sound/core/init.c b/sound/core/init.c
index 0c4dc40376a7..079c12d64b0e 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -382,14 +382,7 @@ int snd_card_disconnect(struct snd_card *card)
         card->shutdown = 1;
         spin_unlock(&card->files_lock);
 
-        /* phase 1: disable fops (user space) operations for ALSA API */
-        mutex_lock(&snd_card_mutex);
-        snd_cards[card->number] = NULL;
-        clear_bit(card->number, snd_cards_lock);
-        mutex_unlock(&snd_card_mutex);
-        
-        /* phase 2: replace file->f_op with special dummy operations */
-        
+        /* replace file->f_op with special dummy operations */
         spin_lock(&card->files_lock);
         list_for_each_entry(mfile, &card->files_list, list) {
                 /* it's critical part, use endless loop */
@@ -405,7 +398,7 @@ int snd_card_disconnect(struct snd_card *card)
         }
         spin_unlock(&card->files_lock); 
 
-        /* phase 3: notify all connected devices about disconnection */
+        /* notify all connected devices about disconnection */
         /* at this point, they cannot respond to any calls except release() */
 
 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
@@ -421,6 +414,13 @@ int snd_card_disconnect(struct snd_card *card)
                 device_del(&card->card_dev);
                 card->registered = false;
         }
+
+        /* disable fops (user space) operations for ALSA API */
+        mutex_lock(&snd_card_mutex);
+        snd_cards[card->number] = NULL;
+        clear_bit(card->number, snd_cards_lock);
+        mutex_unlock(&snd_card_mutex);
+
 #ifdef CONFIG_PM
         wake_up(&card->power_sleep);
 #endif
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 7d4640d1fe9f..38e7deab6384 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client,
 
         /* fill the info fields */
         if (client_info->name[0])
-                strlcpy(client->name, client_info->name, sizeof(client->name));
+                strscpy(client->name, client_info->name, sizeof(client->name));
 
         client->filter = client_info->filter;
         client->event_lost = client_info->event_lost;
@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
         /* set queue name */
         if (!info->name[0])
                 snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
-        strlcpy(q->name, info->name, sizeof(q->name));
+        strscpy(q->name, info->name, sizeof(q->name));
         snd_use_lock_free(&q->use_lock);
 
         return 0;
@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client,
                 queuefree(q);
                 return -EPERM;
         }
-        strlcpy(q->name, info->name, sizeof(q->name));
+        strscpy(q->name, info->name, sizeof(q->name));
         queuefree(q);
 
         return 0;
diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c
index 9c37d9af3023..ec7715c6b0c0 100644
--- a/sound/hda/ext/hdac_ext_bus.c
+++ b/sound/hda/ext/hdac_ext_bus.c
@@ -107,7 +107,6 @@ int snd_hdac_ext_bus_init(struct hdac_bus *bus, struct device *dev,
         INIT_LIST_HEAD(&bus->hlink_list);
         bus->idx = idx++;
 
-        mutex_init(&bus->lock);
         bus->cmd_dma_state = true;
 
         return 0;
diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c
index 012305177f68..ad8eee08013f 100644
--- a/sound/hda/hdac_bus.c
+++ b/sound/hda/hdac_bus.c
@@ -38,6 +38,7 @@ int snd_hdac_bus_init(struct hdac_bus *bus, struct device *dev,
         INIT_WORK(&bus->unsol_work, snd_hdac_bus_process_unsol_events);
         spin_lock_init(&bus->reg_lock);
         mutex_init(&bus->cmd_mutex);
+        mutex_init(&bus->lock);
         bus->irq = -1;
         return 0;
 }
diff --git a/sound/hda/hdac_component.c b/sound/hda/hdac_component.c
index 5c95933e739a..1ea51e3b942a 100644
--- a/sound/hda/hdac_component.c
+++ b/sound/hda/hdac_component.c
@@ -69,13 +69,15 @@ void snd_hdac_display_power(struct hdac_bus *bus, unsigned int idx, bool enable)
 
         dev_dbg(bus->dev, "display power %s\n",
                 enable ? "enable" : "disable");
+
+        mutex_lock(&bus->lock);
         if (enable)
                 set_bit(idx, &bus->display_power_status);
         else
                 clear_bit(idx, &bus->display_power_status);
 
         if (!acomp || !acomp->ops)
-                return;
+                goto unlock;
 
         if (bus->display_power_status) {
                 if (!bus->display_power_active) {
@@ -92,6 +94,8 @@ void snd_hdac_display_power(struct hdac_bus *bus, unsigned int idx, bool enable)
                         bus->display_power_active = false;
                 }
         }
+ unlock:
+        mutex_unlock(&bus->lock);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_display_power);
 
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index ec0b8595eb4d..701a69d856f5 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -969,6 +969,7 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card,
 
         /* power-up all before initialization */
         hda_set_power_state(codec, AC_PWRST_D0);
+        codec->core.dev.power.power_state = PMSG_ON;
 
         snd_hda_codec_proc_new(codec);
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index ece256a3b48f..2ec91085fa3e 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2142,6 +2142,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0),
         /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */
         SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
+        /* https://bugs.launchpad.net/bugs/1821663 */
+        SND_PCI_QUIRK(0x8086, 0x2064, "Intel SDP 8086:2064", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
         SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0),
         /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
@@ -2150,6 +2152,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
         SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
+        /* https://bugs.launchpad.net/bugs/1821663 */
+        SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0),
         {}
 };
 #endif /* CONFIG_PM */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a3fb3d4c5730..f5b510f119ed 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1864,8 +1864,8 @@ enum {
         ALC887_FIXUP_BASS_CHMAP,
         ALC1220_FIXUP_GB_DUAL_CODECS,
         ALC1220_FIXUP_CLEVO_P950,
-        ALC1220_FIXUP_SYSTEM76_ORYP5,
-        ALC1220_FIXUP_SYSTEM76_ORYP5_PINS,
+        ALC1220_FIXUP_CLEVO_PB51ED,
+        ALC1220_FIXUP_CLEVO_PB51ED_PINS,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2070,7 +2070,7 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
 static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action);
 
-static void alc1220_fixup_system76_oryp5(struct hda_codec *codec,
+static void alc1220_fixup_clevo_pb51ed(struct hda_codec *codec,
                                      const struct hda_fixup *fix,
                                      int action)
 {
@@ -2322,18 +2322,18 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc1220_fixup_clevo_p950,
         },
-        [ALC1220_FIXUP_SYSTEM76_ORYP5] = {
+        [ALC1220_FIXUP_CLEVO_PB51ED] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc1220_fixup_system76_oryp5,
+                .v.func = alc1220_fixup_clevo_pb51ed,
         },
-        [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = {
+        [ALC1220_FIXUP_CLEVO_PB51ED_PINS] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
                         { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
                         {}
                 },
                 .chained = true,
-                .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5,
+                .chain_id = ALC1220_FIXUP_CLEVO_PB51ED,
         },
 };
 
@@ -2411,8 +2411,9 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
-        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
-        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
+        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+        SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
@@ -5491,7 +5492,7 @@ static void alc_headset_btn_callback(struct hda_codec *codec,
         jack->jack->button_state = report;
 }
 
-static void alc295_fixup_chromebook(struct hda_codec *codec,
+static void alc_fixup_headset_jack(struct hda_codec *codec,
                                     const struct hda_fixup *fix, int action)
 {
 
@@ -5501,16 +5502,6 @@ static void alc295_fixup_chromebook(struct hda_codec *codec,
                                                     alc_headset_btn_callback);
                 snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false,
                                       SND_JACK_HEADSET, alc_headset_btn_keymap);
-                switch (codec->core.vendor_id) {
-                case 0x10ec0295:
-                        alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
-                        alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
-                        break;
-                case 0x10ec0236:
-                        alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
-                        alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
-                        break;
-                }
                 break;
         case HDA_FIXUP_ACT_INIT:
                 switch (codec->core.vendor_id) {
@@ -5531,6 +5522,25 @@ static void alc295_fixup_chromebook(struct hda_codec *codec,
         }
 }
 
+static void alc295_fixup_chromebook(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        switch (action) {
+        case HDA_FIXUP_ACT_INIT:
+                switch (codec->core.vendor_id) {
+                case 0x10ec0295:
+                        alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
+                        alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
+                        break;
+                case 0x10ec0236:
+                        alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
+                        alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
+                        break;
+                }
+                break;
+        }
+}
+
 static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
                                   const struct hda_fixup *fix, int action)
 {
@@ -5663,6 +5673,7 @@ enum {
         ALC233_FIXUP_ASUS_MIC_NO_PRESENCE,
         ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
         ALC233_FIXUP_LENOVO_MULTI_CODECS,
+        ALC233_FIXUP_ACER_HEADSET_MIC,
         ALC294_FIXUP_LENOVO_MIC_LOCATION,
         ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
         ALC700_FIXUP_INTEL_REFERENCE,
@@ -5684,6 +5695,7 @@ enum {
         ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
         ALC255_FIXUP_ACER_HEADSET_MIC,
         ALC295_FIXUP_CHROME_BOOK,
+        ALC225_FIXUP_HEADSET_JACK,
         ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE,
         ALC225_FIXUP_WYSE_AUTO_MUTE,
         ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
@@ -6490,6 +6502,16 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc233_alc662_fixup_lenovo_dual_codecs,
         },
+        [ALC233_FIXUP_ACER_HEADSET_MIC] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
+                        { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC233_FIXUP_ASUS_MIC_NO_PRESENCE
+        },
         [ALC294_FIXUP_LENOVO_MIC_LOCATION] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -6635,6 +6657,12 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC295_FIXUP_CHROME_BOOK] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc295_fixup_chromebook,
+                .chained = true,
+                .chain_id = ALC225_FIXUP_HEADSET_JACK
+        },
+        [ALC225_FIXUP_HEADSET_JACK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_headset_jack,
         },
         [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
                 .type = HDA_FIXUP_PINS,
@@ -6737,6 +6765,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
@@ -7132,7 +7161,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC255_FIXUP_DUMMY_LINEOUT_VERB, .name = "alc255-dummy-lineout"},
         {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
         {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
-        {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"},
+        {.id = ALC225_FIXUP_HEADSET_JACK, .name = "alc-headset-jack"},
+        {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-chrome-book"},
         {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
         {}
 };
@@ -7236,6 +7266,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60140},
                 {0x14, 0x90170150},
                 {0x21, 0x02211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
                 {0x14, 0x90170110},
                 {0x21, 0x02211020}),
@@ -7346,6 +7378,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x21, 0x0221101f}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x14, 0x90170110},
+                {0x1b, 0x01011020},
+                {0x21, 0x0221101f}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
                 {0x14, 0x90170110},
                 {0x1b, 0x90a70130},
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 419114edfd57..667fc1d59e18 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -1151,6 +1151,7 @@ config SND_SOC_WCD9335
         tristate "WCD9335 Codec"
         depends on SLIMBUS
         select REGMAP_SLIMBUS
+        select REGMAP_IRQ
         help
           The WCD9335 is a standalone Hi-Fi audio CODEC IC, supports
           Qualcomm Technologies, Inc. (QTI) multimedia solutions,
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index 03bbbcd3b6c1..87616b126018 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -2129,6 +2129,7 @@ static int ab8500_codec_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
                 dev_err(dai->component->dev,
                         "%s: ERROR: The device is either a master or a slave.\n",
                         __func__);
+                /* fall through */
         default:
                 dev_err(dai->component->dev,
                         "%s: ERROR: Unsupporter master mask 0x%x\n",
diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
index 9f4a59871cee..c71696146c5e 100644
--- a/sound/soc/codecs/cs35l35.c
+++ b/sound/soc/codecs/cs35l35.c
@@ -1635,6 +1635,16 @@ err:
         return ret;
 }
 
+static int cs35l35_i2c_remove(struct i2c_client *i2c_client)
+{
+        struct cs35l35_private *cs35l35 = i2c_get_clientdata(i2c_client);
+
+        regulator_bulk_disable(cs35l35->num_supplies, cs35l35->supplies);
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
+
+        return 0;
+}
+
 static const struct of_device_id cs35l35_of_match[] = {
         {.compatible = "cirrus,cs35l35"},
         {},
@@ -1655,6 +1665,7 @@ static struct i2c_driver cs35l35_i2c_driver = {
         },
         .id_table = cs35l35_id,
         .probe = cs35l35_i2c_probe,
+        .remove = cs35l35_i2c_remove,
 };
 
 module_i2c_driver(cs35l35_i2c_driver);
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index 33d74f163bd7..793a14d58667 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
         .reg_defaults =         cs4270_reg_defaults,
         .num_reg_defaults =     ARRAY_SIZE(cs4270_reg_defaults),
         .cache_type =           REGCACHE_RBTREE,
+        .write_flag_mask =      CS4270_I2C_INCR,
 
         .readable_reg =         cs4270_reg_is_readable,
         .volatile_reg =         cs4270_reg_is_volatile,
diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index ffecdaaa8cf2..f889d94c8e3c 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -38,6 +38,9 @@ static void hdac_hda_dai_close(struct snd_pcm_substream *substream,
                                struct snd_soc_dai *dai);
 static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai);
+static int hdac_hda_dai_hw_params(struct snd_pcm_substream *substream,
+                                  struct snd_pcm_hw_params *params,
+                                  struct snd_soc_dai *dai);
 static int hdac_hda_dai_hw_free(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai);
 static int hdac_hda_dai_set_tdm_slot(struct snd_soc_dai *dai,
@@ -50,6 +53,7 @@ static const struct snd_soc_dai_ops hdac_hda_dai_ops = {
         .startup = hdac_hda_dai_open,
         .shutdown = hdac_hda_dai_close,
         .prepare = hdac_hda_dai_prepare,
+        .hw_params = hdac_hda_dai_hw_params,
         .hw_free = hdac_hda_dai_hw_free,
         .set_tdm_slot = hdac_hda_dai_set_tdm_slot,
 };
@@ -139,6 +143,39 @@ static int hdac_hda_dai_set_tdm_slot(struct snd_soc_dai *dai,
         return 0;
 }
 
+static int hdac_hda_dai_hw_params(struct snd_pcm_substream *substream,
+                                  struct snd_pcm_hw_params *params,
+                                  struct snd_soc_dai *dai)
+{
+        struct snd_soc_component *component = dai->component;
+        struct hdac_hda_priv *hda_pvt;
+        unsigned int format_val;
+        unsigned int maxbps;
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                maxbps = dai->driver->playback.sig_bits;
+        else
+                maxbps = dai->driver->capture.sig_bits;
+
+        hda_pvt = snd_soc_component_get_drvdata(component);
+        format_val = snd_hdac_calc_stream_format(params_rate(params),
+                                                 params_channels(params),
+                                                 params_format(params),
+                                                 maxbps,
+                                                 0);
+        if (!format_val) {
+                dev_err(dai->dev,
+                        "invalid format_val, rate=%d, ch=%d, format=%d, maxbps=%d\n",
+                        params_rate(params), params_channels(params),
+                        params_format(params), maxbps);
+
+                return -EINVAL;
+        }
+
+        hda_pvt->pcm[dai->id].format_val[substream->stream] = format_val;
+        return 0;
+}
+
 static int hdac_hda_dai_hw_free(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai)
 {
@@ -162,10 +199,9 @@ static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai)
 {
         struct snd_soc_component *component = dai->component;
+        struct hda_pcm_stream *hda_stream;
         struct hdac_hda_priv *hda_pvt;
-        struct snd_pcm_runtime *runtime = substream->runtime;
         struct hdac_device *hdev;
-        struct hda_pcm_stream *hda_stream;
         unsigned int format_val;
         struct hda_pcm *pcm;
         unsigned int stream;
@@ -179,19 +215,8 @@ static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,
 
         hda_stream = &pcm->stream[substream->stream];
 
-        format_val = snd_hdac_calc_stream_format(runtime->rate,
-                                                 runtime->channels,
-                                                 runtime->format,
-                                                 hda_stream->maxbps,
-                                                 0);
-        if (!format_val) {
-                dev_err(&hdev->dev,
-                        "invalid format_val, rate=%d, ch=%d, format=%d\n",
-                        runtime->rate, runtime->channels, runtime->format);
-                return -EINVAL;
-        }
-
         stream = hda_pvt->pcm[dai->id].stream_tag[substream->stream];
+        format_val = hda_pvt->pcm[dai->id].format_val[substream->stream];
 
         ret = snd_hda_codec_prepare(&hda_pvt->codec, hda_stream,
                                     stream, format_val, substream);
diff --git a/sound/soc/codecs/hdac_hda.h b/sound/soc/codecs/hdac_hda.h
index e444ef593360..6b1bd4f428e7 100644
--- a/sound/soc/codecs/hdac_hda.h
+++ b/sound/soc/codecs/hdac_hda.h
@@ -8,6 +8,7 @@
 
 struct hdac_hda_pcm {
         int stream_tag[2];
+        unsigned int format_val[2];
 };
 
 struct hdac_hda_priv {
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index e5b6769b9797..35df73e42cbc 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -484,9 +484,6 @@ static int hdmi_codec_hw_params(struct snd_pcm_substream *substream,
                 params_width(params), params_rate(params),
                 params_channels(params));
 
-        if (params_width(params) > 24)
-                params->msbits = 24;
-
         ret = snd_pcm_create_iec958_consumer_hw_params(params, hp.iec.status,
                                                        sizeof(hp.iec.status));
         if (ret < 0) {
@@ -529,73 +526,71 @@ static int hdmi_codec_set_fmt(struct snd_soc_dai *dai,
 {
         struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
         struct hdmi_codec_daifmt cf = { 0 };
-        int ret = 0;
 
         dev_dbg(dai->dev, "%s()\n", __func__);
 
-        if (dai->id == DAI_ID_SPDIF) {
-                cf.fmt = HDMI_SPDIF;
-        } else {
-                switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
-                case SND_SOC_DAIFMT_CBM_CFM:
-                        cf.bit_clk_master = 1;
-                        cf.frame_clk_master = 1;
-                        break;
-                case SND_SOC_DAIFMT_CBS_CFM:
-                        cf.frame_clk_master = 1;
-                        break;
-                case SND_SOC_DAIFMT_CBM_CFS:
-                        cf.bit_clk_master = 1;
-                        break;
-                case SND_SOC_DAIFMT_CBS_CFS:
-                        break;
-                default:
-                        return -EINVAL;
-                }
+        if (dai->id == DAI_ID_SPDIF)
+                return 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                cf.bit_clk_master = 1;
+                cf.frame_clk_master = 1;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFM:
+                cf.frame_clk_master = 1;
+                break;
+        case SND_SOC_DAIFMT_CBM_CFS:
+                cf.bit_clk_master = 1;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
 
-                switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-                case SND_SOC_DAIFMT_NB_NF:
-                        break;
-                case SND_SOC_DAIFMT_NB_IF:
-                        cf.frame_clk_inv = 1;
-                        break;
-                case SND_SOC_DAIFMT_IB_NF:
-                        cf.bit_clk_inv = 1;
-                        break;
-                case SND_SOC_DAIFMT_IB_IF:
-                        cf.frame_clk_inv = 1;
-                        cf.bit_clk_inv = 1;
-                        break;
-                }
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_NB_IF:
+                cf.frame_clk_inv = 1;
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                cf.bit_clk_inv = 1;
+                break;
+        case SND_SOC_DAIFMT_IB_IF:
+                cf.frame_clk_inv = 1;
+                cf.bit_clk_inv = 1;
+                break;
+        }
 
-                switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
-                case SND_SOC_DAIFMT_I2S:
-                        cf.fmt = HDMI_I2S;
-                        break;
-                case SND_SOC_DAIFMT_DSP_A:
-                        cf.fmt = HDMI_DSP_A;
-                        break;
-                case SND_SOC_DAIFMT_DSP_B:
-                        cf.fmt = HDMI_DSP_B;
-                        break;
-                case SND_SOC_DAIFMT_RIGHT_J:
-                        cf.fmt = HDMI_RIGHT_J;
-                        break;
-                case SND_SOC_DAIFMT_LEFT_J:
-                        cf.fmt = HDMI_LEFT_J;
-                        break;
-                case SND_SOC_DAIFMT_AC97:
-                        cf.fmt = HDMI_AC97;
-                        break;
-                default:
-                        dev_err(dai->dev, "Invalid DAI interface format\n");
-                        return -EINVAL;
-                }
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                cf.fmt = HDMI_I2S;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                cf.fmt = HDMI_DSP_A;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                cf.fmt = HDMI_DSP_B;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                cf.fmt = HDMI_RIGHT_J;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                cf.fmt = HDMI_LEFT_J;
+                break;
+        case SND_SOC_DAIFMT_AC97:
+                cf.fmt = HDMI_AC97;
+                break;
+        default:
+                dev_err(dai->dev, "Invalid DAI interface format\n");
+                return -EINVAL;
         }
 
         hcp->daifmt[dai->id] = cf;
 
-        return ret;
+        return 0;
 }
 
 static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
@@ -792,8 +787,10 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                 i++;
         }
 
-        if (hcd->spdif)
+        if (hcd->spdif) {
                 hcp->daidrv[i] = hdmi_spdif_dai;
+                hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
+        }
 
         dev_set_drvdata(dev, hcp);
 
diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
index bfd74b86c9d2..645aa0794123 100644
--- a/sound/soc/codecs/nau8810.c
+++ b/sound/soc/codecs/nau8810.c
@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
         SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
                 NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
                 ARRAY_SIZE(nau8810_mono_mixer_controls)),
-        SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
+        SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
                 NAU8810_DAC_EN_SFT, 0),
-        SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
+        SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
                 NAU8810_ADC_EN_SFT, 0),
         SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
                 NAU8810_NSPK_EN_SFT, 0, NULL, 0),
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
index 87ed3dc496dc..5ab05e75edea 100644
--- a/sound/soc/codecs/nau8824.c
+++ b/sound/soc/codecs/nau8824.c
@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
         SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
                 NAU8824_ADCR_EN_SFT, 0),
 
-        SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
-        SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
 
         SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
                 NAU8824_DACL_EN_SFT, 0),
@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
         }
 }
 
+static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
+{
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        const char *prefix = dapm->component->name_prefix;
+        char prefixed_pin[80];
+
+        if (prefix) {
+                snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
+                         prefix, pin);
+                snd_soc_dapm_disable_pin(dapm, prefixed_pin);
+        } else {
+                snd_soc_dapm_disable_pin(dapm, pin);
+        }
+}
+
+static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
+{
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        const char *prefix = dapm->component->name_prefix;
+        char prefixed_pin[80];
+
+        if (prefix) {
+                snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
+                         prefix, pin);
+                snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
+        } else {
+                snd_soc_dapm_force_enable_pin(dapm, pin);
+        }
+}
+
 static void nau8824_eject_jack(struct nau8824 *nau8824)
 {
         struct snd_soc_dapm_context *dapm = nau8824->dapm;
@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
         /* Clear all interruption status */
         nau8824_int_status_clear_all(regmap);
 
-        snd_soc_dapm_disable_pin(dapm, "SAR");
-        snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+        nau8824_dapm_disable_pin(nau8824, "SAR");
+        nau8824_dapm_disable_pin(nau8824, "MICBIAS");
         snd_soc_dapm_sync(dapm);
 
         /* Enable the insertion interruption, disable the ejection
@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
         struct regmap *regmap = nau8824->regmap;
         int adc_value, event = 0, event_mask = 0;
 
-        snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
-        snd_soc_dapm_force_enable_pin(dapm, "SAR");
+        nau8824_dapm_enable_pin(nau8824, "MICBIAS");
+        nau8824_dapm_enable_pin(nau8824, "SAR");
         snd_soc_dapm_sync(dapm);
 
         msleep(100);
@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
         if (adc_value < HEADSET_SARADC_THD) {
                 event |= SND_JACK_HEADPHONE;
 
-                snd_soc_dapm_disable_pin(dapm, "SAR");
-                snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+                nau8824_dapm_disable_pin(nau8824, "SAR");
+                nau8824_dapm_disable_pin(nau8824, "MICBIAS");
                 snd_soc_dapm_sync(dapm);
         } else {
                 event |= SND_JACK_HEADSET;
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 9d5acd2d04ab..86a7fa31c294 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -910,13 +910,21 @@ static int rt5682_headset_detect(struct snd_soc_component *component,
                 int jack_insert)
 {
         struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
-        struct snd_soc_dapm_context *dapm =
-                snd_soc_component_get_dapm(component);
         unsigned int val, count;
 
         if (jack_insert) {
-                snd_soc_dapm_force_enable_pin(dapm, "CBJ Power");
-                snd_soc_dapm_sync(dapm);
+
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_1,
+                        RT5682_PWR_VREF2 | RT5682_PWR_MB,
+                        RT5682_PWR_VREF2 | RT5682_PWR_MB);
+                snd_soc_component_update_bits(component,
+                                RT5682_PWR_ANLG_1, RT5682_PWR_FV2, 0);
+                usleep_range(15000, 20000);
+                snd_soc_component_update_bits(component,
+                                RT5682_PWR_ANLG_1, RT5682_PWR_FV2, RT5682_PWR_FV2);
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3,
+                        RT5682_PWR_CBJ, RT5682_PWR_CBJ);
+
                 snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
                         RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_HIGH);
 
@@ -944,8 +952,10 @@ static int rt5682_headset_detect(struct snd_soc_component *component,
                 rt5682_enable_push_button_irq(component, false);
                 snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
                         RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_LOW);
-                snd_soc_dapm_disable_pin(dapm, "CBJ Power");
-                snd_soc_dapm_sync(dapm);
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_1,
+                        RT5682_PWR_VREF2 | RT5682_PWR_MB, 0);
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3,
+                        RT5682_PWR_CBJ, 0);
 
                 rt5682->jack_type = 0;
         }
@@ -1198,7 +1208,7 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
         struct snd_soc_component *component =
                 snd_soc_dapm_to_component(w->dapm);
         struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
-        int ref, val, reg, sft, mask, idx = -EINVAL;
+        int ref, val, reg, idx = -EINVAL;
         static const int div_f[] = {1, 2, 3, 4, 6, 8, 12, 16, 24, 32, 48};
         static const int div_o[] = {1, 2, 4, 6, 8, 12, 16, 24, 32, 48};
 
@@ -1212,15 +1222,10 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
 
         idx = rt5682_div_sel(rt5682, ref, div_f, ARRAY_SIZE(div_f));
 
-        if (w->shift == RT5682_PWR_ADC_S1F_BIT) {
+        if (w->shift == RT5682_PWR_ADC_S1F_BIT)
                 reg = RT5682_PLL_TRACK_3;
-                sft = RT5682_ADC_OSR_SFT;
-                mask = RT5682_ADC_OSR_MASK;
-        } else {
+        else
                 reg = RT5682_PLL_TRACK_2;
-                sft = RT5682_DAC_OSR_SFT;
-                mask = RT5682_DAC_OSR_MASK;
-        }
 
         snd_soc_component_update_bits(component, reg,
                 RT5682_FILTER_CLK_DIV_MASK, idx << RT5682_FILTER_CLK_DIV_SFT);
@@ -1232,7 +1237,8 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
         }
 
         snd_soc_component_update_bits(component, RT5682_ADDA_CLK_1,
-                mask, idx << sft);
+                RT5682_ADC_OSR_MASK | RT5682_DAC_OSR_MASK,
+                (idx << RT5682_ADC_OSR_SFT) | (idx << RT5682_DAC_OSR_SFT));
 
         return 0;
 }
@@ -1591,8 +1597,6 @@ static const struct snd_soc_dapm_widget rt5682_dapm_widgets[] = {
                 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY("Vref1", RT5682_PWR_ANLG_1, RT5682_PWR_VREF1_BIT, 0,
                 rt5655_set_verf, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU),
-        SND_SOC_DAPM_SUPPLY("Vref2", RT5682_PWR_ANLG_1, RT5682_PWR_VREF2_BIT, 0,
-                rt5655_set_verf, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU),
 
         /* ASRC */
         SND_SOC_DAPM_SUPPLY_S("DAC STO1 ASRC", 1, RT5682_PLL_TRACK_1,
@@ -1627,9 +1631,6 @@ static const struct snd_soc_dapm_widget rt5682_dapm_widgets[] = {
         SND_SOC_DAPM_PGA("BST1 CBJ", SND_SOC_NOPM,
                 0, 0, NULL, 0),
 
-        SND_SOC_DAPM_SUPPLY("CBJ Power", RT5682_PWR_ANLG_3,
-                RT5682_PWR_CBJ_BIT, 0, NULL, 0),
-
         /* REC Mixer */
         SND_SOC_DAPM_MIXER("RECMIX1L", SND_SOC_NOPM, 0, 0, rt5682_rec1_l_mix,
                 ARRAY_SIZE(rt5682_rec1_l_mix)),
@@ -1792,17 +1793,13 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
 
         /*Vref*/
         {"MICBIAS1", NULL, "Vref1"},
-        {"MICBIAS1", NULL, "Vref2"},
         {"MICBIAS2", NULL, "Vref1"},
-        {"MICBIAS2", NULL, "Vref2"},
 
         {"CLKDET SYS", NULL, "CLKDET"},
 
         {"IN1P", NULL, "LDO2"},
 
         {"BST1 CBJ", NULL, "IN1P"},
-        {"BST1 CBJ", NULL, "CBJ Power"},
-        {"CBJ Power", NULL, "Vref2"},
 
         {"RECMIX1L", "CBJ Switch", "BST1 CBJ"},
         {"RECMIX1L", NULL, "RECMIX1L Power"},
@@ -1912,9 +1909,7 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
         {"HP Amp", NULL, "Capless"},
         {"HP Amp", NULL, "Charge Pump"},
         {"HP Amp", NULL, "CLKDET SYS"},
-        {"HP Amp", NULL, "CBJ Power"},
         {"HP Amp", NULL, "Vref1"},
-        {"HP Amp", NULL, "Vref2"},
         {"HPOL Playback", "Switch", "HP Amp"},
         {"HPOR Playback", "Switch", "HP Amp"},
         {"HPOL", NULL, "HPOL Playback"},
@@ -2303,16 +2298,13 @@ static int rt5682_set_bias_level(struct snd_soc_component *component,
         switch (level) {
         case SND_SOC_BIAS_PREPARE:
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_ANLG_1,
-                        RT5682_PWR_MB | RT5682_PWR_BG,
-                        RT5682_PWR_MB | RT5682_PWR_BG);
+                        RT5682_PWR_BG, RT5682_PWR_BG);
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_DIG_1,
                         RT5682_DIG_GATE_CTRL | RT5682_PWR_LDO,
                         RT5682_DIG_GATE_CTRL | RT5682_PWR_LDO);
                 break;
 
         case SND_SOC_BIAS_STANDBY:
-                regmap_update_bits(rt5682->regmap, RT5682_PWR_ANLG_1,
-                        RT5682_PWR_MB, RT5682_PWR_MB);
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_DIG_1,
                         RT5682_DIG_GATE_CTRL, RT5682_DIG_GATE_CTRL);
                 break;
@@ -2320,7 +2312,7 @@ static int rt5682_set_bias_level(struct snd_soc_component *component,
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_DIG_1,
                         RT5682_DIG_GATE_CTRL | RT5682_PWR_LDO, 0);
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_ANLG_1,
-                        RT5682_PWR_MB | RT5682_PWR_BG, 0);
+                        RT5682_PWR_BG, 0);
                 break;
 
         default:
@@ -2363,6 +2355,8 @@ static int rt5682_resume(struct snd_soc_component *component)
         regcache_cache_only(rt5682->regmap, false);
         regcache_sync(rt5682->regmap);
 
+        rt5682_irq(0, rt5682);
+
         return 0;
 }
 #else
diff --git a/sound/soc/codecs/tlv320aic32x4-i2c.c b/sound/soc/codecs/tlv320aic32x4-i2c.c
index 385fa2e9525a..22c3a6bc0b6c 100644
--- a/sound/soc/codecs/tlv320aic32x4-i2c.c
+++ b/sound/soc/codecs/tlv320aic32x4-i2c.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2011 NW Digital Radio
  *
- * Author: Jeremy McDermond <nh6z@nh6z.net>
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
@@ -72,5 +72,5 @@ static struct i2c_driver aic32x4_i2c_driver = {
 module_i2c_driver(aic32x4_i2c_driver);
 
 MODULE_DESCRIPTION("ASoC TLV320AIC32x4 codec driver I2C");
-MODULE_AUTHOR("Jeremy McDermond <nh6z@nh6z.net>");
+MODULE_AUTHOR("Annaliese McDermond <nh6z@nh6z.net>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/tlv320aic32x4-spi.c b/sound/soc/codecs/tlv320aic32x4-spi.c
index 07d78ae51e05..aa5b7ba0254b 100644
--- a/sound/soc/codecs/tlv320aic32x4-spi.c
+++ b/sound/soc/codecs/tlv320aic32x4-spi.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2011 NW Digital Radio
  *
- * Author: Jeremy McDermond <nh6z@nh6z.net>
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
@@ -74,5 +74,5 @@ static struct spi_driver aic32x4_spi_driver = {
 module_spi_driver(aic32x4_spi_driver);
 
 MODULE_DESCRIPTION("ASoC TLV320AIC32x4 codec driver SPI");
-MODULE_AUTHOR("Jeremy McDermond <nh6z@nh6z.net>");
+MODULE_AUTHOR("Annaliese McDermond <nh6z@nh6z.net>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 96f1526cb258..5520044929f4 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -490,6 +490,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
         SND_SOC_DAPM_INPUT("IN2_R"),
         SND_SOC_DAPM_INPUT("IN3_L"),
         SND_SOC_DAPM_INPUT("IN3_R"),
+        SND_SOC_DAPM_INPUT("CM_L"),
+        SND_SOC_DAPM_INPUT("CM_R"),
 };
 
 static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 283583d1db60..516d17cb2182 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1609,7 +1609,6 @@ static int aic3x_probe(struct snd_soc_component *component)
         struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
         int ret, i;
 
-        INIT_LIST_HEAD(&aic3x->list);
         aic3x->component = component;
 
         for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) {
@@ -1873,6 +1872,7 @@ static int aic3x_i2c_probe(struct i2c_client *i2c,
         if (ret != 0)
                 goto err_gpio;
 
+        INIT_LIST_HEAD(&aic3x->list);
         list_add(&aic3x->list, &reset_list);
 
         return 0;
@@ -1889,6 +1889,8 @@ static int aic3x_i2c_remove(struct i2c_client *client)
 {
         struct aic3x_priv *aic3x = i2c_get_clientdata(client);
 
+        list_del(&aic3x->list);
+
         if (gpio_is_valid(aic3x->gpio_reset) &&
             !aic3x_is_shared_reset(aic3x)) {
                 gpio_set_value(aic3x->gpio_reset, 0);
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index b93fdc8d2d6f..b0b48eb9c7c9 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -2905,6 +2905,8 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 if (wm_adsp_fw[dsp->fw].num_caps != 0)
                         wm_adsp_buffer_free(dsp);
 
+                dsp->fatal_error = false;
+
                 mutex_unlock(&dsp->pwr_lock);
 
                 adsp_dbg(dsp, "Execution stopped\n");
@@ -3000,6 +3002,9 @@ static int wm_adsp_compr_attach(struct wm_adsp_compr *compr)
 {
         struct wm_adsp_compr_buf *buf = NULL, *tmp;
 
+        if (compr->dsp->fatal_error)
+                return -EINVAL;
+
         list_for_each_entry(tmp, &compr->dsp->buffer_list, list) {
                 if (!tmp->name || !strcmp(compr->name, tmp->name)) {
                         buf = tmp;
@@ -3535,11 +3540,11 @@ static int wm_adsp_buffer_get_error(struct wm_adsp_compr_buf *buf)
 
         ret = wm_adsp_buffer_read(buf, HOST_BUFFER_FIELD(error), &buf->error);
         if (ret < 0) {
-                adsp_err(buf->dsp, "Failed to check buffer error: %d\n", ret);
+                compr_err(buf, "Failed to check buffer error: %d\n", ret);
                 return ret;
         }
         if (buf->error != 0) {
-                adsp_err(buf->dsp, "Buffer error occurred: %d\n", buf->error);
+                compr_err(buf, "Buffer error occurred: %d\n", buf->error);
                 return -EIO;
         }
 
@@ -3571,8 +3576,6 @@ int wm_adsp_compr_trigger(struct snd_compr_stream *stream, int cmd)
                 if (ret < 0)
                         break;
 
-                wm_adsp_buffer_clear(compr->buf);
-
                 /* Trigger the IRQ at one fragment of data */
                 ret = wm_adsp_buffer_write(compr->buf,
                                            HOST_BUFFER_FIELD(high_water_mark),
@@ -3584,6 +3587,8 @@ int wm_adsp_compr_trigger(struct snd_compr_stream *stream, int cmd)
                 }
                 break;
         case SNDRV_PCM_TRIGGER_STOP:
+                if (wm_adsp_compr_attached(compr))
+                        wm_adsp_buffer_clear(compr->buf);
                 break;
         default:
                 ret = -EINVAL;
@@ -3917,22 +3922,40 @@ int wm_adsp2_lock(struct wm_adsp *dsp, unsigned int lock_regions)
 }
 EXPORT_SYMBOL_GPL(wm_adsp2_lock);
 
+static void wm_adsp_fatal_error(struct wm_adsp *dsp)
+{
+        struct wm_adsp_compr *compr;
+
+        dsp->fatal_error = true;
+
+        list_for_each_entry(compr, &dsp->compr_list, list) {
+                if (compr->stream) {
+                        snd_compr_stop_error(compr->stream,
+                                             SNDRV_PCM_STATE_XRUN);
+                        snd_compr_fragment_elapsed(compr->stream);
+                }
+        }
+}
+
 irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
 {
         unsigned int val;
         struct regmap *regmap = dsp->regmap;
         int ret = 0;
 
+        mutex_lock(&dsp->pwr_lock);
+
         ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
         if (ret) {
                 adsp_err(dsp,
                         "Failed to read Region Lock Ctrl register: %d\n", ret);
-                return IRQ_HANDLED;
+                goto error;
         }
 
         if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
                 adsp_err(dsp, "watchdog timeout error\n");
                 wm_adsp_stop_watchdog(dsp);
+                wm_adsp_fatal_error(dsp);
         }
 
         if (val & (ADSP2_SLAVE_ERR_MASK | ADSP2_REGION_LOCK_ERR_MASK)) {
@@ -3946,7 +3969,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
                         adsp_err(dsp,
                                  "Failed to read Bus Err Addr register: %d\n",
                                  ret);
-                        return IRQ_HANDLED;
+                        goto error;
                 }
 
                 adsp_err(dsp, "bus error address = 0x%x\n",
@@ -3959,7 +3982,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
                         adsp_err(dsp,
                                  "Failed to read Pmem Xmem Err Addr register: %d\n",
                                  ret);
-                        return IRQ_HANDLED;
+                        goto error;
                 }
 
                 adsp_err(dsp, "xmem error address = 0x%x\n",
@@ -3972,6 +3995,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
         regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
                            ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
 
+error:
+        mutex_unlock(&dsp->pwr_lock);
+
         return IRQ_HANDLED;
 }
 EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
diff --git a/sound/soc/codecs/wm_adsp.h b/sound/soc/codecs/wm_adsp.h
index 59e07ad16329..8f09b4419a91 100644
--- a/sound/soc/codecs/wm_adsp.h
+++ b/sound/soc/codecs/wm_adsp.h
@@ -85,6 +85,7 @@ struct wm_adsp {
         bool preloaded;
         bool booted;
         bool running;
+        bool fatal_error;
 
         struct list_head ctl_list;
 
diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
index 528e8b108422..0b937924d2e4 100644
--- a/sound/soc/fsl/fsl_asrc.c
+++ b/sound/soc/fsl/fsl_asrc.c
@@ -445,6 +445,19 @@ struct dma_chan *fsl_asrc_get_dma_channel(struct fsl_asrc_pair *pair, bool dir)
 }
 EXPORT_SYMBOL_GPL(fsl_asrc_get_dma_channel);
 
+static int fsl_asrc_dai_startup(struct snd_pcm_substream *substream,
+                                struct snd_soc_dai *dai)
+{
+        struct fsl_asrc *asrc_priv = snd_soc_dai_get_drvdata(dai);
+
+        /* Odd channel number is not valid for older ASRC (channel_bits==3) */
+        if (asrc_priv->channel_bits == 3)
+                snd_pcm_hw_constraint_step(substream->runtime, 0,
+                                           SNDRV_PCM_HW_PARAM_CHANNELS, 2);
+
+        return 0;
+}
+
 static int fsl_asrc_dai_hw_params(struct snd_pcm_substream *substream,
                                   struct snd_pcm_hw_params *params,
                                   struct snd_soc_dai *dai)
@@ -539,6 +552,7 @@ static int fsl_asrc_dai_trigger(struct snd_pcm_substream *substream, int cmd,
 }
 
 static const struct snd_soc_dai_ops fsl_asrc_dai_ops = {
+        .startup      = fsl_asrc_dai_startup,
         .hw_params    = fsl_asrc_dai_hw_params,
         .hw_free      = fsl_asrc_dai_hw_free,
         .trigger      = fsl_asrc_dai_trigger,
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index afe67c865330..3623aa9a6f2e 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -54,6 +54,8 @@ struct fsl_esai {
         u32 fifo_depth;
         u32 slot_width;
         u32 slots;
+        u32 tx_mask;
+        u32 rx_mask;
         u32 hck_rate[2];
         u32 sck_rate[2];
         bool hck_dir[2];
@@ -361,21 +363,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
         regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
                            ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
 
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask));
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB,
-                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask));
-
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
                            ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
 
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask));
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB,
-                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask));
-
         esai_priv->slot_width = slot_width;
         esai_priv->slots = slots;
+        esai_priv->tx_mask = tx_mask;
+        esai_priv->rx_mask = rx_mask;
 
         return 0;
 }
@@ -596,6 +590,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
         bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
         u8 i, channels = substream->runtime->channels;
         u32 pins = DIV_ROUND_UP(channels, esai_priv->slots);
+        u32 mask;
 
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
@@ -608,15 +603,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
                 for (i = 0; tx && i < channels; i++)
                         regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0);
 
+                /*
+                 * When set the TE/RE in the end of enablement flow, there
+                 * will be channel swap issue for multi data line case.
+                 * In order to workaround this issue, we switch the bit
+                 * enablement sequence to below sequence
+                 * 1) clear the xSMB & xSMA: which is done in probe and
+                 *                           stop state.
+                 * 2) set TE/RE
+                 * 3) set xSMB
+                 * 4) set xSMA:  xSMA is the last one in this flow, which
+                 *               will trigger esai to start.
+                 */
                 regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
                                    tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK,
                                    tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins));
+                mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask;
+
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
+                                   ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask));
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
+                                   ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask));
+
                 break;
         case SNDRV_PCM_TRIGGER_SUSPEND:
         case SNDRV_PCM_TRIGGER_STOP:
         case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                 regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
                                    tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0);
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
+                                   ESAI_xSMA_xS_MASK, 0);
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
+                                   ESAI_xSMB_xS_MASK, 0);
 
                 /* Disable and reset FIFO */
                 regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx),
@@ -906,6 +924,15 @@ static int fsl_esai_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        esai_priv->tx_mask = 0xFFFFFFFF;
+        esai_priv->rx_mask = 0xFFFFFFFF;
+
+        /* Clear the TSMA, TSMB, RSMA, RSMB */
+        regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0);
+        regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0);
+        regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0);
+        regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0);
+
         ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component,
                                               &fsl_esai_dai, 1);
         if (ret) {
diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
index bb12351330e8..69bc4848d787 100644
--- a/sound/soc/generic/audio-graph-card.c
+++ b/sound/soc/generic/audio-graph-card.c
@@ -20,6 +20,8 @@
 #include <linux/string.h>
 #include <sound/simple_card_utils.h>
 
+#define DPCM_SELECTABLE 1
+
 struct graph_priv {
         struct snd_soc_card snd_card;
         struct graph_dai_props {
@@ -440,6 +442,7 @@ static int graph_for_each_link(struct graph_priv *priv,
         struct device_node *codec_port;
         struct device_node *codec_port_old = NULL;
         struct asoc_simple_card_data adata;
+        uintptr_t dpcm_selectable = (uintptr_t)of_device_get_match_data(dev);
         int rc, ret;
 
         /* loop for all listed CPU port */
@@ -470,8 +473,9 @@ static int graph_for_each_link(struct graph_priv *priv,
                          * if Codec port has many endpoints,
                          * or has convert-xxx property
                          */
-                        if ((of_get_child_count(codec_port) > 1) ||
-                            adata.convert_rate || adata.convert_channels)
+                        if (dpcm_selectable &&
+                            ((of_get_child_count(codec_port) > 1) ||
+                             adata.convert_rate || adata.convert_channels))
                                 ret = func_dpcm(priv, cpu_ep, codec_ep, li,
                                                 (codec_port_old == codec_port));
                         /* else normal sound */
@@ -732,7 +736,8 @@ static int graph_remove(struct platform_device *pdev)
 
 static const struct of_device_id graph_of_match[] = {
         { .compatible = "audio-graph-card", },
-        { .compatible = "audio-graph-scu-card", },
+        { .compatible = "audio-graph-scu-card",
+          .data = (void *)DPCM_SELECTABLE },
         {},
 };
 MODULE_DEVICE_TABLE(of, graph_of_match);
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 7147bba45a2a..34de32efc4c4 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -9,12 +9,15 @@
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/string.h>
 #include <sound/simple_card.h>
 #include <sound/soc-dai.h>
 #include <sound/soc.h>
 
+#define DPCM_SELECTABLE 1
+
 struct simple_priv {
         struct snd_soc_card snd_card;
         struct simple_dai_props {
@@ -441,6 +444,7 @@ static int simple_for_each_link(struct simple_priv *priv,
         struct device *dev = simple_priv_to_dev(priv);
         struct device_node *top = dev->of_node;
         struct device_node *node;
+        uintptr_t dpcm_selectable = (uintptr_t)of_device_get_match_data(dev);
         bool is_top = 0;
         int ret = 0;
 
@@ -480,8 +484,9 @@ static int simple_for_each_link(struct simple_priv *priv,
                          * if it has many CPUs,
                          * or has convert-xxx property
                          */
-                        if (num > 2 ||
-                            adata.convert_rate || adata.convert_channels)
+                        if (dpcm_selectable &&
+                            (num > 2 ||
+                             adata.convert_rate || adata.convert_channels))
                                 ret = func_dpcm(priv, np, codec, li, is_top);
                         /* else normal sound */
                         else
@@ -822,7 +827,8 @@ static int simple_remove(struct platform_device *pdev)
 
 static const struct of_device_id simple_of_match[] = {
         { .compatible = "simple-audio-card", },
-        { .compatible = "simple-scu-audio-card", },
+        { .compatible = "simple-scu-audio-card",
+          .data = (void *)DPCM_SELECTABLE },
         {},
 };
 MODULE_DEVICE_TABLE(of, simple_of_match);
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 08cea5b5cda9..0e8b1c5eec88 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -706,9 +706,17 @@ static int sst_soc_probe(struct snd_soc_component *component)
         return sst_dsp_init_v2_dpcm(component);
 }
 
+static void sst_soc_remove(struct snd_soc_component *component)
+{
+        struct sst_data *drv = dev_get_drvdata(component->dev);
+
+        drv->soc_card = NULL;
+}
+
 static const struct snd_soc_component_driver sst_soc_platform_drv  = {
         .name           = DRV_NAME,
         .probe          = sst_soc_probe,
+        .remove         = sst_soc_remove,
         .ops            = &sst_platform_ops,
         .compr_ops      = &sst_platform_compr_ops,
         .pcm_new        = sst_pcm_new,
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index 3263b0495853..c0e0844f75b9 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -43,6 +43,7 @@ struct cht_mc_private {
         struct clk *mclk;
         struct snd_soc_jack jack;
         bool ts3a227e_present;
+        int quirks;
 };
 
 static int platform_clock_control(struct snd_soc_dapm_widget *w,
@@ -54,6 +55,10 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
         struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
         int ret;
 
+        /* See the comment in snd_cht_mc_probe() */
+        if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
+                return 0;
+
         codec_dai = snd_soc_card_get_codec_dai(card, CHT_CODEC_DAI);
         if (!codec_dai) {
                 dev_err(card->dev, "Codec dai not found; Unable to set platform clock\n");
@@ -223,6 +228,10 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime)
                         "jack detection gpios not added, error %d\n", ret);
         }
 
+        /* See the comment in snd_cht_mc_probe() */
+        if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
+                return 0;
+
         /*
          * The firmware might enable the clock at
          * boot (this information may or may not
@@ -423,16 +432,15 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         const char *mclk_name;
         struct snd_soc_acpi_mach *mach;
         const char *platform_name;
-        int quirks = 0;
-
-        dmi_id = dmi_first_match(cht_max98090_quirk_table);
-        if (dmi_id)
-                quirks = (unsigned long)dmi_id->driver_data;
 
         drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
         if (!drv)
                 return -ENOMEM;
 
+        dmi_id = dmi_first_match(cht_max98090_quirk_table);
+        if (dmi_id)
+                drv->quirks = (unsigned long)dmi_id->driver_data;
+
         drv->ts3a227e_present = acpi_dev_found("104C227E");
         if (!drv->ts3a227e_present) {
                 /* no need probe TI jack detection chip */
@@ -458,7 +466,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         snd_soc_card_cht.dev = &pdev->dev;
         snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
 
-        if (quirks & QUIRK_PMC_PLT_CLK_0)
+        if (drv->quirks & QUIRK_PMC_PLT_CLK_0)
                 mclk_name = "pmc_plt_clk_0";
         else
                 mclk_name = "pmc_plt_clk_3";
@@ -471,6 +479,21 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
                 return PTR_ERR(drv->mclk);
         }
 
+        /*
+         * Boards which have the MAX98090's clk connected to clk_0 do not seem
+         * to like it if we muck with the clock. If we disable the clock when
+         * it is unused we get "max98090 i2c-193C9890:00: PLL unlocked" errors
+         * and the PLL never seems to lock again.
+         * So for these boards we enable it here once and leave it at that.
+         */
+        if (drv->quirks & QUIRK_PMC_PLT_CLK_0) {
+                ret_val = clk_prepare_enable(drv->mclk);
+                if (ret_val < 0) {
+                        dev_err(&pdev->dev, "MCLK enable error: %d\n", ret_val);
+                        return ret_val;
+                }
+        }
+
         ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht);
         if (ret_val) {
                 dev_err(&pdev->dev,
@@ -481,11 +504,23 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         return ret_val;
 }
 
+static int snd_cht_mc_remove(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
+
+        if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
+                clk_disable_unprepare(ctx->mclk);
+
+        return 0;
+}
+
 static struct platform_driver snd_cht_mc_driver = {
         .driver = {
                 .name = "cht-bsw-max98090",
         },
         .probe = snd_cht_mc_probe,
+        .remove = snd_cht_mc_remove,
 };
 
 module_platform_driver(snd_cht_mc_driver)
diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
index 7044d8c2b187..879f14257a3e 100644
--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -405,7 +405,7 @@ static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
 };
 
 static const unsigned int dmic_2ch[] = {
-        4,
+        2,
 };
 
 static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = {
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index 28c4806b196a..4bf70b4429f0 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -483,6 +483,7 @@ static void skl_set_base_module_format(struct skl_sst *ctx,
         base_cfg->audio_fmt.bit_depth = format->bit_depth;
         base_cfg->audio_fmt.valid_bit_depth = format->valid_bit_depth;
         base_cfg->audio_fmt.ch_cfg = format->ch_cfg;
+        base_cfg->audio_fmt.sample_type = format->sample_type;
 
         dev_dbg(ctx->dev, "bit_depth=%x valid_bd=%x ch_config=%x\n",
                         format->bit_depth, format->valid_bit_depth,
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 1ae83f4ccc36..9735e2412251 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -181,6 +181,7 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
         struct hdac_stream *hstream;
         struct hdac_ext_stream *stream;
         struct hdac_ext_link *link;
+        unsigned char stream_tag;
 
         hstream = snd_hdac_get_stream(bus, params->stream,
                                         params->link_dma_id + 1);
@@ -199,10 +200,13 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
 
         snd_hdac_ext_link_stream_setup(stream, format_val);
 
-        list_for_each_entry(link, &bus->hlink_list, list) {
-                if (link->index == params->link_index)
-                        snd_hdac_ext_link_set_stream_id(link,
-                                        hstream->stream_tag);
+        stream_tag = hstream->stream_tag;
+        if (stream->hstream.direction == SNDRV_PCM_STREAM_PLAYBACK) {
+                list_for_each_entry(link, &bus->hlink_list, list) {
+                        if (link->index == params->link_index)
+                                snd_hdac_ext_link_set_stream_id(link,
+                                                                stream_tag);
+                }
         }
 
         stream->link_prepared = 1;
@@ -645,6 +649,7 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
         struct hdac_ext_stream *link_dev =
                                 snd_soc_dai_get_dma_data(dai, substream);
         struct hdac_ext_link *link;
+        unsigned char stream_tag;
 
         dev_dbg(dai->dev, "%s: %s\n", __func__, dai->name);
 
@@ -654,7 +659,11 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
         if (!link)
                 return -EINVAL;
 
-        snd_hdac_ext_link_clear_stream_id(link, hdac_stream(link_dev)->stream_tag);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                stream_tag = hdac_stream(link_dev)->stream_tag;
+                snd_hdac_ext_link_clear_stream_id(link, stream_tag);
+        }
+
         snd_hdac_ext_stream_release(link_dev, HDAC_EXT_STREAM_TYPE_LINK);
         return 0;
 }
@@ -1453,13 +1462,20 @@ static int skl_platform_soc_probe(struct snd_soc_component *component)
         return 0;
 }
 
+static void skl_pcm_remove(struct snd_soc_component *component)
+{
+        /* remove topology */
+        snd_soc_tplg_component_remove(component, SND_SOC_TPLG_INDEX_ALL);
+}
+
 static const struct snd_soc_component_driver skl_component  = {
         .name           = "pcm",
         .probe          = skl_platform_soc_probe,
+        .remove         = skl_pcm_remove,
         .ops            = &skl_platform_ops,
         .pcm_new        = skl_pcm_new,
         .pcm_free       = skl_pcm_free,
-        .ignore_module_refcount = 1, /* do not increase the refcount in core */
+        .module_get_upon_open = 1, /* increment refcount when a pcm is opened */
 };
 
 int skl_platform_register(struct device *dev)
diff --git a/sound/soc/mediatek/common/mtk-btcvsd.c b/sound/soc/mediatek/common/mtk-btcvsd.c
index 1b8bcdaf02d1..9a163d7064d1 100644
--- a/sound/soc/mediatek/common/mtk-btcvsd.c
+++ b/sound/soc/mediatek/common/mtk-btcvsd.c
@@ -49,6 +49,7 @@ enum bt_sco_state {
         BT_SCO_STATE_IDLE,
         BT_SCO_STATE_RUNNING,
         BT_SCO_STATE_ENDING,
+        BT_SCO_STATE_LOOPBACK,
 };
 
 enum bt_sco_direct {
@@ -486,7 +487,8 @@ static irqreturn_t mtk_btcvsd_snd_irq_handler(int irq_id, void *dev)
         if (bt->rx->state != BT_SCO_STATE_RUNNING &&
             bt->rx->state != BT_SCO_STATE_ENDING &&
             bt->tx->state != BT_SCO_STATE_RUNNING &&
-            bt->tx->state != BT_SCO_STATE_ENDING) {
+            bt->tx->state != BT_SCO_STATE_ENDING &&
+            bt->tx->state != BT_SCO_STATE_LOOPBACK) {
                 dev_warn(bt->dev, "%s(), in idle state: rx->state: %d, tx->state: %d\n",
                          __func__, bt->rx->state, bt->tx->state);
                 goto irq_handler_exit;
@@ -512,6 +514,42 @@ static irqreturn_t mtk_btcvsd_snd_irq_handler(int irq_id, void *dev)
         buf_cnt_tx = btsco_packet_info[packet_type][2];
         buf_cnt_rx = btsco_packet_info[packet_type][3];
 
+        if (bt->tx->state == BT_SCO_STATE_LOOPBACK) {
+                u8 *src, *dst;
+                unsigned long connsys_addr_rx, ap_addr_rx;
+                unsigned long connsys_addr_tx, ap_addr_tx;
+
+                connsys_addr_rx = *bt->bt_reg_pkt_r;
+                ap_addr_rx = (unsigned long)bt->bt_sram_bank2_base +
+                             (connsys_addr_rx & 0xFFFF);
+
+                connsys_addr_tx = *bt->bt_reg_pkt_w;
+                ap_addr_tx = (unsigned long)bt->bt_sram_bank2_base +
+                             (connsys_addr_tx & 0xFFFF);
+
+                if (connsys_addr_tx == 0xdeadfeed ||
+                    connsys_addr_rx == 0xdeadfeed) {
+                        /* bt return 0xdeadfeed if read reg during bt sleep */
+                        dev_warn(bt->dev, "%s(), connsys_addr_tx == 0xdeadfeed\n",
+                                 __func__);
+                        goto irq_handler_exit;
+                }
+
+                src = (u8 *)ap_addr_rx;
+                dst = (u8 *)ap_addr_tx;
+
+                mtk_btcvsd_snd_data_transfer(BT_SCO_DIRECT_BT2ARM, src,
+                                             bt->tx->temp_packet_buf,
+                                             packet_length,
+                                             packet_num);
+                mtk_btcvsd_snd_data_transfer(BT_SCO_DIRECT_ARM2BT,
+                                             bt->tx->temp_packet_buf, dst,
+                                             packet_length,
+                                             packet_num);
+                bt->rx->rw_cnt++;
+                bt->tx->rw_cnt++;
+        }
+
         if (bt->rx->state == BT_SCO_STATE_RUNNING ||
             bt->rx->state == BT_SCO_STATE_ENDING) {
                 if (bt->rx->xrun) {
@@ -1067,6 +1105,33 @@ static int btcvsd_band_set(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+static int btcvsd_loopback_get(struct snd_kcontrol *kcontrol,
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_component *cmpnt = snd_soc_kcontrol_component(kcontrol);
+        struct mtk_btcvsd_snd *bt = snd_soc_component_get_drvdata(cmpnt);
+        bool lpbk_en = bt->tx->state == BT_SCO_STATE_LOOPBACK;
+
+        ucontrol->value.integer.value[0] = lpbk_en;
+        return 0;
+}
+
+static int btcvsd_loopback_set(struct snd_kcontrol *kcontrol,
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_component *cmpnt = snd_soc_kcontrol_component(kcontrol);
+        struct mtk_btcvsd_snd *bt = snd_soc_component_get_drvdata(cmpnt);
+
+        if (ucontrol->value.integer.value[0]) {
+                mtk_btcvsd_snd_set_state(bt, bt->tx, BT_SCO_STATE_LOOPBACK);
+                mtk_btcvsd_snd_set_state(bt, bt->rx, BT_SCO_STATE_LOOPBACK);
+        } else {
+                mtk_btcvsd_snd_set_state(bt, bt->tx, BT_SCO_STATE_RUNNING);
+                mtk_btcvsd_snd_set_state(bt, bt->rx, BT_SCO_STATE_RUNNING);
+        }
+        return 0;
+}
+
 static int btcvsd_tx_mute_get(struct snd_kcontrol *kcontrol,
                               struct snd_ctl_elem_value *ucontrol)
 {
@@ -1202,6 +1267,8 @@ static int btcvsd_tx_timestamp_get(struct snd_kcontrol *kcontrol,
 static const struct snd_kcontrol_new mtk_btcvsd_snd_controls[] = {
         SOC_ENUM_EXT("BTCVSD Band", btcvsd_enum[0],
                      btcvsd_band_get, btcvsd_band_set),
+        SOC_SINGLE_BOOL_EXT("BTCVSD Loopback Switch", 0,
+                            btcvsd_loopback_get, btcvsd_loopback_set),
         SOC_SINGLE_BOOL_EXT("BTCVSD Tx Mute Switch", 0,
                             btcvsd_tx_mute_get, btcvsd_tx_mute_set),
         SOC_SINGLE_BOOL_EXT("BTCVSD Tx Irq Received Switch", 0,
diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-clk.c b/sound/soc/mediatek/mt8183/mt8183-afe-clk.c
index f523ad103acc..48e81c5d52fc 100644
--- a/sound/soc/mediatek/mt8183/mt8183-afe-clk.c
+++ b/sound/soc/mediatek/mt8183/mt8183-afe-clk.c
@@ -605,6 +605,10 @@ void mt8183_mck_disable(struct mtk_base_afe *afe, int mck_id)
         int m_sel_id = mck_div[mck_id].m_sel_id;
         int div_clk_id = mck_div[mck_id].div_clk_id;
 
+        /* i2s5 mck not support */
+        if (mck_id == MT8183_I2S5_MCK)
+                return;
+
         clk_disable_unprepare(afe_priv->clk[div_clk_id]);
         if (m_sel_id >= 0)
                 clk_disable_unprepare(afe_priv->clk[m_sel_id]);
diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
index 400e29edb1c9..d0b403a0e27b 100644
--- a/sound/soc/rockchip/rockchip_pdm.c
+++ b/sound/soc/rockchip/rockchip_pdm.c
@@ -24,7 +24,7 @@
 
 #include "rockchip_pdm.h"
 
-#define PDM_DMA_BURST_SIZE      (16) /* size * width: 16*4 = 64 bytes */
+#define PDM_DMA_BURST_SIZE      (8) /* size * width: 8*4 = 32 bytes */
 
 struct rk_pdm_dev {
         struct device *dev;
@@ -208,7 +208,9 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
                 return -EINVAL;
         }
 
+        pm_runtime_get_sync(cpu_dai->dev);
         regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val);
+        pm_runtime_put(cpu_dai->dev);
 
         return 0;
 }
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index 4231001226f4..ab471d550d17 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -1130,11 +1130,11 @@ static const struct snd_soc_dapm_widget samsung_i2s_widgets[] = {
 };
 
 static const struct snd_soc_dapm_route samsung_i2s_dapm_routes[] = {
-        { "Playback Mixer", NULL, "Primary" },
-        { "Playback Mixer", NULL, "Secondary" },
+        { "Playback Mixer", NULL, "Primary Playback" },
+        { "Playback Mixer", NULL, "Secondary Playback" },
 
         { "Mixer DAI TX", NULL, "Playback Mixer" },
-        { "Playback Mixer", NULL, "Mixer DAI RX" },
+        { "Primary Capture", NULL, "Mixer DAI RX" },
 };
 
 static const struct snd_soc_component_driver samsung_i2s_component = {
@@ -1155,7 +1155,8 @@ static int i2s_alloc_dais(struct samsung_i2s_priv *priv,
                           int num_dais)
 {
         static const char *dai_names[] = { "samsung-i2s", "samsung-i2s-sec" };
-        static const char *stream_names[] = { "Primary", "Secondary" };
+        static const char *stream_names[] = { "Primary Playback",
+                                              "Secondary Playback" };
         struct snd_soc_dai_driver *dai_drv;
         struct i2s_dai *dai;
         int i;
@@ -1201,6 +1202,7 @@ static int i2s_alloc_dais(struct samsung_i2s_priv *priv,
         dai_drv->capture.channels_max = 2;
         dai_drv->capture.rates = i2s_dai_data->pcm_rates;
         dai_drv->capture.formats = SAMSUNG_I2S_FMTS;
+        dai_drv->capture.stream_name = "Primary Capture";
 
         return 0;
 }
diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
index 694512f980fd..1dc54c4206f0 100644
--- a/sound/soc/samsung/odroid.c
+++ b/sound/soc/samsung/odroid.c
@@ -91,11 +91,11 @@ static int odroid_card_be_hw_params(struct snd_pcm_substream *substream,
                 return ret;
 
         /*
-         *  We add 1 to the rclk_freq value in order to avoid too low clock
+         *  We add 2 to the rclk_freq value in order to avoid too low clock
          *  frequency values due to the EPLL output frequency not being exact
          *  multiple of the audio sampling rate.
          */
-        rclk_freq = params_rate(params) * rfs + 1;
+        rclk_freq = params_rate(params) * rfs + 2;
 
         ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
         if (ret < 0)
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 022996d2db13..4fe83e611c01 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -110,6 +110,8 @@ static const struct of_device_id rsnd_of_match[] = {
         { .compatible = "renesas,rcar_sound-gen1", .data = (void *)RSND_GEN1 },
         { .compatible = "renesas,rcar_sound-gen2", .data = (void *)RSND_GEN2 },
         { .compatible = "renesas,rcar_sound-gen3", .data = (void *)RSND_GEN3 },
+        /* Special Handling */
+        { .compatible = "renesas,rcar_sound-r8a77990", .data = (void *)(RSND_GEN3 | RSND_SOC_E) },
         {},
 };
 MODULE_DEVICE_TABLE(of, rsnd_of_match);
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 90625c57847b..0e6ef4e18400 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -607,6 +607,8 @@ struct rsnd_priv {
 #define RSND_GEN1       (1 << 0)
 #define RSND_GEN2       (2 << 0)
 #define RSND_GEN3       (3 << 0)
+#define RSND_SOC_MASK   (0xFF << 4)
+#define RSND_SOC_E      (1 << 4) /* E1/E2/E3 */
 
         /*
          * below value will be filled on rsnd_gen_probe()
@@ -679,6 +681,9 @@ struct rsnd_priv {
 #define rsnd_is_gen1(priv)      (((priv)->flags & RSND_GEN_MASK) == RSND_GEN1)
 #define rsnd_is_gen2(priv)      (((priv)->flags & RSND_GEN_MASK) == RSND_GEN2)
 #define rsnd_is_gen3(priv)      (((priv)->flags & RSND_GEN_MASK) == RSND_GEN3)
+#define rsnd_is_e3(priv)        (((priv)->flags & \
+                                        (RSND_GEN_MASK | RSND_SOC_MASK)) == \
+                                        (RSND_GEN3 | RSND_SOC_E))
 
 #define rsnd_flags_has(p, f) ((p)->flags & (f))
 #define rsnd_flags_set(p, f) ((p)->flags |= (f))
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index db81e066b92e..585ffba0244b 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -14,7 +14,6 @@
  */
 
 #include "rsnd.h"
-#include <linux/sys_soc.h>
 
 #define SRC_NAME "src"
 
@@ -135,7 +134,7 @@ unsigned int rsnd_src_get_rate(struct rsnd_priv *priv,
         return rate;
 }
 
-const static u32 bsdsr_table_pattern1[] = {
+static const u32 bsdsr_table_pattern1[] = {
         0x01800000, /* 6 - 1/6 */
         0x01000000, /* 6 - 1/4 */
         0x00c00000, /* 6 - 1/3 */
@@ -144,7 +143,7 @@ const static u32 bsdsr_table_pattern1[] = {
         0x00400000, /* 6 - 1   */
 };
 
-const static u32 bsdsr_table_pattern2[] = {
+static const u32 bsdsr_table_pattern2[] = {
         0x02400000, /* 6 - 1/6 */
         0x01800000, /* 6 - 1/4 */
         0x01200000, /* 6 - 1/3 */
@@ -153,7 +152,7 @@ const static u32 bsdsr_table_pattern2[] = {
         0x00600000, /* 6 - 1   */
 };
 
-const static u32 bsisr_table[] = {
+static const u32 bsisr_table[] = {
         0x00100060, /* 6 - 1/6 */
         0x00100040, /* 6 - 1/4 */
         0x00100030, /* 6 - 1/3 */
@@ -162,7 +161,7 @@ const static u32 bsisr_table[] = {
         0x00100020, /* 6 - 1   */
 };
 
-const static u32 chan288888[] = {
+static const u32 chan288888[] = {
         0x00000006, /* 1 to 2 */
         0x000001fe, /* 1 to 8 */
         0x000001fe, /* 1 to 8 */
@@ -171,7 +170,7 @@ const static u32 chan288888[] = {
         0x000001fe, /* 1 to 8 */
 };
 
-const static u32 chan244888[] = {
+static const u32 chan244888[] = {
         0x00000006, /* 1 to 2 */
         0x0000001e, /* 1 to 4 */
         0x0000001e, /* 1 to 4 */
@@ -180,7 +179,7 @@ const static u32 chan244888[] = {
         0x000001fe, /* 1 to 8 */
 };
 
-const static u32 chan222222[] = {
+static const u32 chan222222[] = {
         0x00000006, /* 1 to 2 */
         0x00000006, /* 1 to 2 */
         0x00000006, /* 1 to 2 */
@@ -189,18 +188,12 @@ const static u32 chan222222[] = {
         0x00000006, /* 1 to 2 */
 };
 
-static const struct soc_device_attribute ov_soc[] = {
-        { .soc_id = "r8a77990" }, /* E3 */
-        { /* sentinel */ }
-};
-
 static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
                                       struct rsnd_mod *mod)
 {
         struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
         struct device *dev = rsnd_priv_to_dev(priv);
         struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
-        const struct soc_device_attribute *soc = soc_device_match(ov_soc);
         int is_play = rsnd_io_is_play(io);
         int use_src = 0;
         u32 fin, fout;
@@ -307,7 +300,7 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         /*
          * E3 need to overwrite
          */
-        if (soc)
+        if (rsnd_is_e3(priv))
                 switch (rsnd_mod_id(mod)) {
                 case 0:
                 case 4:
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 93d316d5bf8e..46e3ab0fced4 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -947,7 +947,7 @@ static void soc_cleanup_component(struct snd_soc_component *component)
         snd_soc_dapm_free(snd_soc_component_get_dapm(component));
         soc_cleanup_component_debugfs(component);
         component->card = NULL;
-        if (!component->driver->ignore_module_refcount)
+        if (!component->driver->module_get_upon_open)
                 module_put(component->dev->driver->owner);
 }
 
@@ -1381,7 +1381,7 @@ static int soc_probe_component(struct snd_soc_card *card,
                 return 0;
         }
 
-        if (!component->driver->ignore_module_refcount &&
+        if (!component->driver->module_get_upon_open &&
             !try_module_get(component->dev->driver->owner))
                 return -ENODEV;
 
@@ -2797,6 +2797,7 @@ int snd_soc_register_card(struct snd_soc_card *card)
 
                 ret = soc_init_dai_link(card, link);
                 if (ret) {
+                        soc_cleanup_platform(card);
                         dev_err(card->dev, "ASoC: failed to init link %s\n",
                                 link->name);
                         mutex_unlock(&client_mutex);
@@ -2819,6 +2820,7 @@ int snd_soc_register_card(struct snd_soc_card *card)
         card->instantiated = 0;
         mutex_init(&card->mutex);
         mutex_init(&card->dapm_mutex);
+        spin_lock_init(&card->dpcm_lock);
 
         return snd_soc_bind_card(card);
 }
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1ec06ef6d161..0382a47b30bd 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3650,6 +3650,13 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
         case snd_soc_dapm_dac:
         case snd_soc_dapm_aif_in:
         case snd_soc_dapm_pga:
+        case snd_soc_dapm_buffer:
+        case snd_soc_dapm_scheduler:
+        case snd_soc_dapm_effect:
+        case snd_soc_dapm_src:
+        case snd_soc_dapm_asrc:
+        case snd_soc_dapm_encoder:
+        case snd_soc_dapm_decoder:
         case snd_soc_dapm_out_drv:
         case snd_soc_dapm_micbias:
         case snd_soc_dapm_line:
@@ -3957,6 +3964,10 @@ snd_soc_dapm_free_kcontrol(struct snd_soc_card *card,
         int count;
 
         devm_kfree(card->dev, (void *)*private_value);
+
+        if (!w_param_text)
+                return;
+
         for (count = 0 ; count < num_params; count++)
                 devm_kfree(card->dev, (void *)w_param_text[count]);
         devm_kfree(card->dev, w_param_text);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 0d5ec68a1e50..be80a12fba27 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -15,6 +15,7 @@
 #include <linux/delay.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/pm_runtime.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/export.h>
@@ -463,6 +464,9 @@ static int soc_pcm_components_close(struct snd_pcm_substream *substream,
                         continue;
 
                 component->driver->ops->close(substream);
+
+                if (component->driver->module_get_upon_open)
+                        module_put(component->dev->driver->owner);
         }
 
         return 0;
@@ -513,6 +517,12 @@ static int soc_pcm_open(struct snd_pcm_substream *substream)
                     !component->driver->ops->open)
                         continue;
 
+                if (component->driver->module_get_upon_open &&
+                    !try_module_get(component->dev->driver->owner)) {
+                        ret = -ENODEV;
+                        goto module_err;
+                }
+
                 ret = component->driver->ops->open(substream);
                 if (ret < 0) {
                         dev_err(component->dev,
@@ -628,7 +638,7 @@ codec_dai_err:
 
 component_err:
         soc_pcm_components_close(substream, component);
-
+module_err:
         if (cpu_dai->driver->ops->shutdown)
                 cpu_dai->driver->ops->shutdown(substream, cpu_dai);
 out:
@@ -954,10 +964,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
                 codec_params = *params;
 
                 /* fixup params based on TDM slot masks */
-                if (codec_dai->tx_mask)
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+                    codec_dai->tx_mask)
                         soc_pcm_codec_params_fixup(&codec_params,
                                                    codec_dai->tx_mask);
-                if (codec_dai->rx_mask)
+
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
+                    codec_dai->rx_mask)
                         soc_pcm_codec_params_fixup(&codec_params,
                                                    codec_dai->rx_mask);
 
@@ -1213,6 +1226,7 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
                 struct snd_soc_pcm_runtime *be, int stream)
 {
         struct snd_soc_dpcm *dpcm;
+        unsigned long flags;
 
         /* only add new dpcms */
         for_each_dpcm_be(fe, stream, dpcm) {
@@ -1228,8 +1242,10 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
         dpcm->fe = fe;
         be->dpcm[stream].runtime = fe->dpcm[stream].runtime;
         dpcm->state = SND_SOC_DPCM_LINK_STATE_NEW;
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         list_add(&dpcm->list_be, &fe->dpcm[stream].be_clients);
         list_add(&dpcm->list_fe, &be->dpcm[stream].fe_clients);
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         dev_dbg(fe->dev, "connected new DPCM %s path %s %s %s\n",
                         stream ? "capture" : "playback",  fe->dai_link->name,
@@ -1275,6 +1291,7 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe,
 void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
 {
         struct snd_soc_dpcm *dpcm, *d;
+        unsigned long flags;
 
         for_each_dpcm_be_safe(fe, stream, dpcm, d) {
                 dev_dbg(fe->dev, "ASoC: BE %s disconnect check for %s\n",
@@ -1294,8 +1311,10 @@ void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
 #ifdef CONFIG_DEBUG_FS
                 debugfs_remove(dpcm->debugfs_state);
 #endif
+                spin_lock_irqsave(&fe->card->dpcm_lock, flags);
                 list_del(&dpcm->list_be);
                 list_del(&dpcm->list_fe);
+                spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
                 kfree(dpcm);
         }
 }
@@ -1547,10 +1566,13 @@ int dpcm_process_paths(struct snd_soc_pcm_runtime *fe,
 void dpcm_clear_pending_state(struct snd_soc_pcm_runtime *fe, int stream)
 {
         struct snd_soc_dpcm *dpcm;
+        unsigned long flags;
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_be(fe, stream, dpcm)
                 dpcm->be->dpcm[stream].runtime_update =
                                                 SND_SOC_DPCM_UPDATE_NO;
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 }
 
 static void dpcm_be_dai_startup_unwind(struct snd_soc_pcm_runtime *fe,
@@ -1899,10 +1921,15 @@ static int dpcm_apply_symmetry(struct snd_pcm_substream *fe_substream,
                 struct snd_soc_pcm_runtime *be = dpcm->be;
                 struct snd_pcm_substream *be_substream =
                         snd_soc_dpcm_get_substream(be, stream);
-                struct snd_soc_pcm_runtime *rtd = be_substream->private_data;
+                struct snd_soc_pcm_runtime *rtd;
                 struct snd_soc_dai *codec_dai;
                 int i;
 
+                /* A backend may not have the requested substream */
+                if (!be_substream)
+                        continue;
+
+                rtd = be_substream->private_data;
                 if (rtd->dai_link->be_hw_params_fixup)
                         continue;
 
@@ -2571,6 +2598,7 @@ static int dpcm_run_update_startup(struct snd_soc_pcm_runtime *fe, int stream)
         struct snd_soc_dpcm *dpcm;
         enum snd_soc_dpcm_trigger trigger = fe->dai_link->trigger[stream];
         int ret;
+        unsigned long flags;
 
         dev_dbg(fe->dev, "ASoC: runtime %s open on FE %s\n",
                         stream ? "capture" : "playback", fe->dai_link->name);
@@ -2640,11 +2668,13 @@ close:
         dpcm_be_dai_shutdown(fe, stream);
 disconnect:
         /* disconnect any non started BEs */
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_be(fe, stream, dpcm) {
                 struct snd_soc_pcm_runtime *be = dpcm->be;
                 if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
                                 dpcm->state = SND_SOC_DPCM_LINK_STATE_FREE;
         }
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         return ret;
 }
@@ -3221,7 +3251,10 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,
 {
         struct snd_soc_dpcm *dpcm;
         int state;
+        int ret = 1;
+        unsigned long flags;
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_fe(be, stream, dpcm) {
 
                 if (dpcm->fe == fe)
@@ -3230,12 +3263,15 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,
                 state = dpcm->fe->dpcm[stream].state;
                 if (state == SND_SOC_DPCM_STATE_START ||
                         state == SND_SOC_DPCM_STATE_PAUSED ||
-                        state == SND_SOC_DPCM_STATE_SUSPEND)
-                        return 0;
+                        state == SND_SOC_DPCM_STATE_SUSPEND) {
+                        ret = 0;
+                        break;
+                }
         }
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         /* it's safe to free/stop this BE DAI */
-        return 1;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_free_stop);
 
@@ -3248,7 +3284,10 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,
 {
         struct snd_soc_dpcm *dpcm;
         int state;
+        int ret = 1;
+        unsigned long flags;
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_fe(be, stream, dpcm) {
 
                 if (dpcm->fe == fe)
@@ -3258,12 +3297,15 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,
                 if (state == SND_SOC_DPCM_STATE_START ||
                         state == SND_SOC_DPCM_STATE_PAUSED ||
                         state == SND_SOC_DPCM_STATE_SUSPEND ||
-                        state == SND_SOC_DPCM_STATE_PREPARE)
-                        return 0;
+                        state == SND_SOC_DPCM_STATE_PREPARE) {
+                        ret = 0;
+                        break;
+                }
         }
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         /* it's safe to change hw_params */
-        return 1;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_params);
 
@@ -3302,6 +3344,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
         struct snd_pcm_hw_params *params = &fe->dpcm[stream].hw_params;
         struct snd_soc_dpcm *dpcm;
         ssize_t offset = 0;
+        unsigned long flags;
 
         /* FE state */
         offset += snprintf(buf + offset, size - offset,
@@ -3329,6 +3372,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                 goto out;
         }
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_be(fe, stream, dpcm) {
                 struct snd_soc_pcm_runtime *be = dpcm->be;
                 params = &dpcm->hw_params;
@@ -3349,7 +3393,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                                 params_channels(params),
                                 params_rate(params));
         }
-
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 out:
         return offset;
 }
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 25fca7055464..96852d250619 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -482,10 +482,11 @@ static void remove_widget(struct snd_soc_component *comp,
 
                         snd_ctl_remove(card, kcontrol);
 
-                        kfree(dobj->control.dvalues);
+                        /* free enum kcontrol's dvalues and dtexts */
+                        kfree(se->dobj.control.dvalues);
                         for (j = 0; j < se->items; j++)
-                                kfree(dobj->control.dtexts[j]);
-                        kfree(dobj->control.dtexts);
+                                kfree(se->dobj.control.dtexts[j]);
+                        kfree(se->dobj.control.dtexts);
 
                         kfree(se);
                         kfree(w->kcontrol_news[i].name);
diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c
index 47901983a6ff..78bed9734713 100644
--- a/sound/soc/stm/stm32_adfsdm.c
+++ b/sound/soc/stm/stm32_adfsdm.c
@@ -9,6 +9,7 @@
 
 #include <linux/clk.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
@@ -37,6 +38,8 @@ struct stm32_adfsdm_priv {
         /* PCM buffer */
         unsigned char *pcm_buff;
         unsigned int pos;
+
+        struct mutex lock; /* protect against race condition on iio state */
 };
 
 static const struct snd_pcm_hardware stm32_adfsdm_pcm_hw = {
@@ -62,10 +65,12 @@ static void stm32_adfsdm_shutdown(struct snd_pcm_substream *substream,
 {
         struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
 
+        mutex_lock(&priv->lock);
         if (priv->iio_active) {
                 iio_channel_stop_all_cb(priv->iio_cb);
                 priv->iio_active = false;
         }
+        mutex_unlock(&priv->lock);
 }
 
 static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
@@ -74,13 +79,19 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
         struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
         int ret;
 
+        mutex_lock(&priv->lock);
+        if (priv->iio_active) {
+                iio_channel_stop_all_cb(priv->iio_cb);
+                priv->iio_active = false;
+        }
+
         ret = iio_write_channel_attribute(priv->iio_ch,
                                           substream->runtime->rate, 0,
                                           IIO_CHAN_INFO_SAMP_FREQ);
         if (ret < 0) {
                 dev_err(dai->dev, "%s: Failed to set %d sampling rate\n",
                         __func__, substream->runtime->rate);
-                return ret;
+                goto out;
         }
 
         if (!priv->iio_active) {
@@ -92,6 +103,9 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
                                 __func__, ret);
         }
 
+out:
+        mutex_unlock(&priv->lock);
+
         return ret;
 }
 
@@ -291,6 +305,7 @@ MODULE_DEVICE_TABLE(of, stm32_adfsdm_of_match);
 static int stm32_adfsdm_probe(struct platform_device *pdev)
 {
         struct stm32_adfsdm_priv *priv;
+        struct snd_soc_component *component;
         int ret;
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
@@ -299,6 +314,7 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
 
         priv->dev = &pdev->dev;
         priv->dai_drv = stm32_adfsdm_dai;
+        mutex_init(&priv->lock);
 
         dev_set_drvdata(&pdev->dev, priv);
 
@@ -317,9 +333,15 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
         if (IS_ERR(priv->iio_cb))
                 return PTR_ERR(priv->iio_cb);
 
-        ret = devm_snd_soc_register_component(&pdev->dev,
-                                              &stm32_adfsdm_soc_platform,
-                                              NULL, 0);
+        component = devm_kzalloc(&pdev->dev, sizeof(*component), GFP_KERNEL);
+        if (!component)
+                return -ENOMEM;
+#ifdef CONFIG_DEBUG_FS
+        component->debugfs_prefix = "pcm";
+#endif
+
+        ret = snd_soc_add_component(&pdev->dev, component,
+                                    &stm32_adfsdm_soc_platform, NULL, 0);
         if (ret < 0)
                 dev_err(&pdev->dev, "%s: Failed to register PCM platform\n",
                         __func__);
@@ -327,12 +349,20 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
         return ret;
 }
 
+static int stm32_adfsdm_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_component(&pdev->dev);
+
+        return 0;
+}
+
 static struct platform_driver stm32_adfsdm_driver = {
         .driver = {
                    .name = STM32_ADFSDM_DRV_NAME,
                    .of_match_table = stm32_adfsdm_of_match,
                    },
         .probe = stm32_adfsdm_probe,
+        .remove = stm32_adfsdm_remove,
 };
 
 module_platform_driver(stm32_adfsdm_driver);
diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c
index 47c334de6b09..8968458eec62 100644
--- a/sound/soc/stm/stm32_i2s.c
+++ b/sound/soc/stm/stm32_i2s.c
@@ -281,7 +281,6 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg)
         case STM32_I2S_CFG2_REG:
         case STM32_I2S_IER_REG:
         case STM32_I2S_SR_REG:
-        case STM32_I2S_TXDR_REG:
         case STM32_I2S_RXDR_REG:
         case STM32_I2S_CGFR_REG:
                 return true;
@@ -293,7 +292,7 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg)
 static bool stm32_i2s_volatile_reg(struct device *dev, unsigned int reg)
 {
         switch (reg) {
-        case STM32_I2S_TXDR_REG:
+        case STM32_I2S_SR_REG:
         case STM32_I2S_RXDR_REG:
                 return true;
         default:
diff --git a/sound/soc/stm/stm32_sai.c b/sound/soc/stm/stm32_sai.c
index 14c9591aae42..d68d62f12df5 100644
--- a/sound/soc/stm/stm32_sai.c
+++ b/sound/soc/stm/stm32_sai.c
@@ -105,6 +105,7 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
         if (!pdev) {
                 dev_err(&sai_client->pdev->dev,
                         "Device not found for node %pOFn\n", np_provider);
+                of_node_put(np_provider);
                 return -ENODEV;
         }
 
@@ -113,19 +114,20 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
                 dev_err(&sai_client->pdev->dev,
                         "SAI sync provider data not found\n");
                 ret = -EINVAL;
-                goto out_put_dev;
+                goto error;
         }
 
         /* Configure sync client */
         ret = stm32_sai_sync_conf_client(sai_client, synci);
         if (ret < 0)
-                goto out_put_dev;
+                goto error;
 
         /* Configure sync provider */
         ret = stm32_sai_sync_conf_provider(sai_provider, synco);
 
-out_put_dev:
+error:
         put_device(&pdev->dev);
+        of_node_put(np_provider);
         return ret;
 }
 
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index f9297228c41c..d7045aa520de 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -70,6 +70,7 @@
 #define SAI_IEC60958_STATUS_BYTES       24
 
 #define SAI_MCLK_NAME_LEN               32
+#define SAI_RATE_11K                    11025
 
 /**
  * struct stm32_sai_sub_data - private data of SAI sub block (block A or B)
@@ -100,8 +101,9 @@
  * @slot_mask: rx or tx active slots mask. set at init or at runtime
  * @data_size: PCM data width. corresponds to PCM substream width.
  * @spdif_frm_cnt: S/PDIF playback frame counter
- * @snd_aes_iec958: iec958 data
+ * @iec958: iec958 data
  * @ctrl_lock: control lock
+ * @irq_lock: prevent race condition with IRQ
  */
 struct stm32_sai_sub_data {
         struct platform_device *pdev;
@@ -133,6 +135,7 @@ struct stm32_sai_sub_data {
         unsigned int spdif_frm_cnt;
         struct snd_aes_iec958 iec958;
         struct mutex ctrl_lock; /* protect resources accessed by controls */
+        spinlock_t irq_lock; /* used to prevent race condition with IRQ */
 };
 
 enum stm32_sai_fifo_th {
@@ -307,6 +310,25 @@ static int stm32_sai_set_clk_div(struct stm32_sai_sub_data *sai,
         return ret;
 }
 
+static int stm32_sai_set_parent_clock(struct stm32_sai_sub_data *sai,
+                                      unsigned int rate)
+{
+        struct platform_device *pdev = sai->pdev;
+        struct clk *parent_clk = sai->pdata->clk_x8k;
+        int ret;
+
+        if (!(rate % SAI_RATE_11K))
+                parent_clk = sai->pdata->clk_x11k;
+
+        ret = clk_set_parent(sai->sai_ck, parent_clk);
+        if (ret)
+                dev_err(&pdev->dev, " Error %d setting sai_ck parent clock. %s",
+                        ret, ret == -EBUSY ?
+                        "Active stream rates conflict\n" : "\n");
+
+        return ret;
+}
+
 static long stm32_sai_mclk_round_rate(struct clk_hw *hw, unsigned long rate,
                                       unsigned long *prate)
 {
@@ -474,8 +496,10 @@ static irqreturn_t stm32_sai_isr(int irq, void *devid)
                 status = SNDRV_PCM_STATE_XRUN;
         }
 
-        if (status != SNDRV_PCM_STATE_RUNNING)
+        spin_lock(&sai->irq_lock);
+        if (status != SNDRV_PCM_STATE_RUNNING && sai->substream)
                 snd_pcm_stop_xrun(sai->substream);
+        spin_unlock(&sai->irq_lock);
 
         return IRQ_HANDLED;
 }
@@ -486,25 +510,29 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
         int ret;
 
-        if (dir == SND_SOC_CLOCK_OUT) {
+        if (dir == SND_SOC_CLOCK_OUT && sai->sai_mclk) {
                 ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
                                          SAI_XCR1_NODIV,
                                          (unsigned int)~SAI_XCR1_NODIV);
                 if (ret < 0)
                         return ret;
 
-                dev_dbg(cpu_dai->dev, "SAI MCLK frequency is %uHz\n", freq);
-                sai->mclk_rate = freq;
+                /* If master clock is used, set parent clock now */
+                ret = stm32_sai_set_parent_clock(sai, freq);
+                if (ret)
+                        return ret;
 
-                if (sai->sai_mclk) {
-                        ret = clk_set_rate_exclusive(sai->sai_mclk,
-                                                     sai->mclk_rate);
-                        if (ret) {
-                                dev_err(cpu_dai->dev,
-                                        "Could not set mclk rate\n");
-                                return ret;
-                        }
+                ret = clk_set_rate_exclusive(sai->sai_mclk, freq);
+                if (ret) {
+                        dev_err(cpu_dai->dev,
+                                ret == -EBUSY ?
+                                "Active streams have incompatible rates" :
+                                "Could not set mclk rate\n");
+                        return ret;
                 }
+
+                dev_dbg(cpu_dai->dev, "SAI MCLK frequency is %uHz\n", freq);
+                sai->mclk_rate = freq;
         }
 
         return 0;
@@ -679,8 +707,19 @@ static int stm32_sai_startup(struct snd_pcm_substream *substream,
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
         int imr, cr2, ret;
+        unsigned long flags;
 
+        spin_lock_irqsave(&sai->irq_lock, flags);
         sai->substream = substream;
+        spin_unlock_irqrestore(&sai->irq_lock, flags);
+
+        if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
+                snd_pcm_hw_constraint_mask64(substream->runtime,
+                                             SNDRV_PCM_HW_PARAM_FORMAT,
+                                             SNDRV_PCM_FMTBIT_S32_LE);
+                snd_pcm_hw_constraint_single(substream->runtime,
+                                             SNDRV_PCM_HW_PARAM_CHANNELS, 2);
+        }
 
         ret = clk_prepare_enable(sai->sai_ck);
         if (ret < 0) {
@@ -898,14 +937,16 @@ static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
                                      struct snd_pcm_hw_params *params)
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
-        int div = 0;
+        int div = 0, cr1 = 0;
         int sai_clk_rate, mclk_ratio, den;
         unsigned int rate = params_rate(params);
+        int ret;
 
-        if (!(rate % 11025))
-                clk_set_parent(sai->sai_ck, sai->pdata->clk_x11k);
-        else
-                clk_set_parent(sai->sai_ck, sai->pdata->clk_x8k);
+        if (!sai->sai_mclk) {
+                ret = stm32_sai_set_parent_clock(sai, rate);
+                if (ret)
+                        return ret;
+        }
         sai_clk_rate = clk_get_rate(sai->sai_ck);
 
         if (STM_SAI_IS_F4(sai->pdata)) {
@@ -943,13 +984,19 @@ static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
                 } else {
                         if (sai->mclk_rate) {
                                 mclk_ratio = sai->mclk_rate / rate;
-                                if ((mclk_ratio != 512) &&
-                                    (mclk_ratio != 256)) {
+                                if (mclk_ratio == 512) {
+                                        cr1 = SAI_XCR1_OSR;
+                                } else if (mclk_ratio != 256) {
                                         dev_err(cpu_dai->dev,
                                                 "Wrong mclk ratio %d\n",
                                                 mclk_ratio);
                                         return -EINVAL;
                                 }
+
+                                regmap_update_bits(sai->regmap,
+                                                   STM_SAI_CR1_REGX,
+                                                   SAI_XCR1_OSR, cr1);
+
                                 div = stm32_sai_get_clk_div(sai, sai_clk_rate,
                                                             sai->mclk_rate);
                                 if (div < 0)
@@ -1051,28 +1098,36 @@ static void stm32_sai_shutdown(struct snd_pcm_substream *substream,
                                struct snd_soc_dai *cpu_dai)
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        unsigned long flags;
 
         regmap_update_bits(sai->regmap, STM_SAI_IMR_REGX, SAI_XIMR_MASK, 0);
 
         regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, SAI_XCR1_NODIV,
                            SAI_XCR1_NODIV);
 
-        clk_disable_unprepare(sai->sai_ck);
+        /* Release mclk rate only if rate was actually set */
+        if (sai->mclk_rate) {
+                clk_rate_exclusive_put(sai->sai_mclk);
+                sai->mclk_rate = 0;
+        }
 
-        clk_rate_exclusive_put(sai->sai_mclk);
+        clk_disable_unprepare(sai->sai_ck);
 
+        spin_lock_irqsave(&sai->irq_lock, flags);
         sai->substream = NULL;
+        spin_unlock_irqrestore(&sai->irq_lock, flags);
 }
 
 static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd,
                              struct snd_soc_dai *cpu_dai)
 {
         struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
+        struct snd_kcontrol_new knew = iec958_ctls;
 
         if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
                 dev_dbg(&sai->pdev->dev, "%s: register iec controls", __func__);
-                return snd_ctl_add(rtd->pcm->card,
-                                   snd_ctl_new1(&iec958_ctls, sai));
+                knew.device = rtd->pcm->device;
+                return snd_ctl_add(rtd->pcm->card, snd_ctl_new1(&knew, sai));
         }
 
         return 0;
@@ -1081,7 +1136,7 @@ static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd,
 static int stm32_sai_dai_probe(struct snd_soc_dai *cpu_dai)
 {
         struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
-        int cr1 = 0, cr1_mask;
+        int cr1 = 0, cr1_mask, ret;
 
         sai->cpu_dai = cpu_dai;
 
@@ -1111,8 +1166,10 @@ static int stm32_sai_dai_probe(struct snd_soc_dai *cpu_dai)
         /* Configure synchronization */
         if (sai->sync == SAI_SYNC_EXTERNAL) {
                 /* Configure synchro client and provider */
-                sai->pdata->set_sync(sai->pdata, sai->np_sync_provider,
-                                     sai->synco, sai->synci);
+                ret = sai->pdata->set_sync(sai->pdata, sai->np_sync_provider,
+                                           sai->synco, sai->synci);
+                if (ret)
+                        return ret;
         }
 
         cr1_mask |= SAI_XCR1_SYNCEN_MASK;
@@ -1392,7 +1449,6 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
         if (!sai->cpu_dai_drv)
                 return -ENOMEM;
 
-        sai->cpu_dai_drv->name = dev_name(&pdev->dev);
         if (STM_SAI_IS_PLAYBACK(sai)) {
                 memcpy(sai->cpu_dai_drv, &stm32_sai_playback_dai,
                        sizeof(stm32_sai_playback_dai));
@@ -1402,6 +1458,7 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
                        sizeof(stm32_sai_capture_dai));
                 sai->cpu_dai_drv->capture.stream_name = sai->cpu_dai_drv->name;
         }
+        sai->cpu_dai_drv->name = dev_name(&pdev->dev);
 
         return 0;
 }
@@ -1424,6 +1481,7 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
 
         sai->pdev = pdev;
         mutex_init(&sai->ctrl_lock);
+        spin_lock_init(&sai->irq_lock);
         platform_set_drvdata(pdev, sai);
 
         sai->pdata = dev_get_drvdata(pdev->dev.parent);
diff --git a/sound/xen/xen_snd_front_alsa.c b/sound/xen/xen_snd_front_alsa.c
index a7f413cb704d..b14ab512c2ce 100644
--- a/sound/xen/xen_snd_front_alsa.c
+++ b/sound/xen/xen_snd_front_alsa.c
@@ -441,7 +441,7 @@ static int shbuf_setup_backstore(struct xen_snd_front_pcm_stream_info *stream,
 {
         int i;
 
-        stream->buffer = alloc_pages_exact(stream->buffer_sz, GFP_KERNEL);
+        stream->buffer = alloc_pages_exact(buffer_sz, GFP_KERNEL);
         if (!stream->buffer)
                 return -ENOMEM;
 
diff --git a/tools/include/uapi/sound/asound.h b/tools/include/uapi/sound/asound.h
index 404d4b9ffe76..df1153cea0b7 100644
--- a/tools/include/uapi/sound/asound.h
+++ b/tools/include/uapi/sound/asound.h
@@ -32,6 +32,7 @@
 
 #ifndef __KERNEL__
 #include <stdlib.h>
+#include <time.h>
 #endif
 
 /*
diff --git a/tools/io_uring/io_uring-bench.c b/tools/io_uring/io_uring-bench.c
index 512306a37531..0f257139b003 100644
--- a/tools/io_uring/io_uring-bench.c
+++ b/tools/io_uring/io_uring-bench.c
@@ -32,10 +32,6 @@
 #include "liburing.h"
 #include "barrier.h"
 
-#ifndef IOCQE_FLAG_CACHEHIT
-#define IOCQE_FLAG_CACHEHIT     (1U << 0)
-#endif
-
 #define min(a, b)               ((a < b) ? (a) : (b))
 
 struct io_sq_ring {
@@ -85,7 +81,6 @@ struct submitter {
         unsigned long reaps;
         unsigned long done;
         unsigned long calls;
-        unsigned long cachehit, cachemiss;
         volatile int finish;
 
         __s32 *fds;
@@ -270,10 +265,6 @@ static int reap_events(struct submitter *s)
                                 return -1;
                         }
                 }
-                if (cqe->flags & IOCQE_FLAG_CACHEHIT)
-                        s->cachehit++;
-                else
-                        s->cachemiss++;
                 reaped++;
                 head++;
         } while (1);
@@ -489,7 +480,7 @@ static void file_depths(char *buf)
 int main(int argc, char *argv[])
 {
         struct submitter *s = &submitters[0];
-        unsigned long done, calls, reap, cache_hit, cache_miss;
+        unsigned long done, calls, reap;
         int err, i, flags, fd;
         char *fdepths;
         void *ret;
@@ -569,44 +560,29 @@ int main(int argc, char *argv[])
         pthread_create(&s->thread, NULL, submitter_fn, s);
 
         fdepths = malloc(8 * s->nr_files);
-        cache_hit = cache_miss = reap = calls = done = 0;
+        reap = calls = done = 0;
         do {
                 unsigned long this_done = 0;
                 unsigned long this_reap = 0;
                 unsigned long this_call = 0;
-                unsigned long this_cache_hit = 0;
-                unsigned long this_cache_miss = 0;
                 unsigned long rpc = 0, ipc = 0;
-                double hit = 0.0;
 
                 sleep(1);
                 this_done += s->done;
                 this_call += s->calls;
                 this_reap += s->reaps;
-                this_cache_hit += s->cachehit;
-                this_cache_miss += s->cachemiss;
-                if (this_cache_hit && this_cache_miss) {
-                        unsigned long hits, total;
-
-                        hits = this_cache_hit - cache_hit;
-                        total = hits + this_cache_miss - cache_miss;
-                        hit = (double) hits / (double) total;
-                        hit *= 100.0;
-                }
                 if (this_call - calls) {
                         rpc = (this_done - done) / (this_call - calls);
                         ipc = (this_reap - reap) / (this_call - calls);
                 } else
                         rpc = ipc = -1;
                 file_depths(fdepths);
-                printf("IOPS=%lu, IOS/call=%ld/%ld, inflight=%u (%s), Cachehit=%0.2f%%\n",
+                printf("IOPS=%lu, IOS/call=%ld/%ld, inflight=%u (%s)\n",
                                 this_done - done, rpc, ipc, s->inflight,
-                                fdepths, hit);
+                                fdepths);
                 done = this_done;
                 calls = this_call;
                 reap = this_reap;
-                cache_hit = s->cachehit;
-                cache_miss = s->cachemiss;
         } while (!finish);
 
         pthread_join(s->thread, &ret);
diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index 5bf8e52c41fc..8e7c56e9590f 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -177,7 +177,7 @@ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION)
 
 $(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)
         $(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \
-                                    -Wl,--version-script=$(VERSION_SCRIPT) $^ -o $@
+                                    -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -o $@
         @ln -sf $(@F) $(OUTPUT)libbpf.so
         @ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)
 
@@ -220,8 +220,9 @@ install_lib: all_cmd
 install_headers:
         $(call QUIET_INSTALL, headers) \
                 $(call do_install,bpf.h,$(prefix)/include/bpf,644); \
-                $(call do_install,libbpf.h,$(prefix)/include/bpf,644);
-                $(call do_install,btf.h,$(prefix)/include/bpf,644);
+                $(call do_install,libbpf.h,$(prefix)/include/bpf,644); \
+                $(call do_install,btf.h,$(prefix)/include/bpf,644); \
+                $(call do_install,xsk.h,$(prefix)/include/bpf,644);
 
 install: install_lib
 
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 87e3020ac1bc..cf119c9b6f27 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2107,6 +2107,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
                 return fwd_kind == real_kind;
         }
 
+        if (cand_kind != canon_kind)
+                return 0;
+
         switch (cand_kind) {
         case BTF_KIND_INT:
                 return btf_equal_int(cand_type, canon_type);
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index 87494c7c619d..981c6ce2da2c 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2233,7 +2233,7 @@ eval_type_str(unsigned long long val, const char *type, int pointer)
                 return val & 0xffffffff;
 
         if (strcmp(type, "u64") == 0 ||
-            strcmp(type, "s64"))
+            strcmp(type, "s64") == 0)
                 return val;
 
         if (strcmp(type, "s8") == 0)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 5dde107083c6..479196aeb409 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -165,6 +165,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
                 "fortify_panic",
                 "usercopy_abort",
                 "machine_real_restart",
+                "rewind_stack_do_exit",
         };
 
         if (func->bind == STB_WEAK)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 49ee3c2033ec..c3625ec374e0 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1308,6 +1308,7 @@ static void init_features(struct perf_session *session)
         for (feat = HEADER_FIRST_FEATURE; feat < HEADER_LAST_FEATURE; feat++)
                 perf_header__set_feat(&session->header, feat);
 
+        perf_header__clear_feat(&session->header, HEADER_DIR_FORMAT);
         perf_header__clear_feat(&session->header, HEADER_BUILD_ID);
         perf_header__clear_feat(&session->header, HEADER_TRACING_DATA);
         perf_header__clear_feat(&session->header, HEADER_BRANCH_STACK);
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 1999d6533d12..fbbb0da43abb 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1377,6 +1377,7 @@ int cmd_top(int argc, const char **argv)
                          * */
                         .overwrite      = 0,
                         .sample_time    = true,
+                        .sample_time_set = true,
                 },
                 .max_stack           = sysctl__max_stack(),
                 .annotation_opts     = annotation__default_options,
diff --git a/tools/perf/scripts/python/export-to-sqlite.py b/tools/perf/scripts/python/export-to-sqlite.py
index 3b71902a5a21..bf271fbc3a88 100644
--- a/tools/perf/scripts/python/export-to-sqlite.py
+++ b/tools/perf/scripts/python/export-to-sqlite.py
@@ -331,7 +331,7 @@ if perf_db_export_calls:
                         'return_id,'
                         'CASE WHEN flags=0 THEN \'\' WHEN flags=1 THEN \'no call\' WHEN flags=2 THEN \'no return\' WHEN flags=3 THEN \'no call/return\' WHEN flags=6 THEN \'jump\' ELSE flags END AS flags,'
                         'parent_call_path_id,'
-                        'parent_id'
+                        'calls.parent_id'
                 ' FROM calls INNER JOIN call_paths ON call_paths.id = call_path_id')
 
 do_query(query, 'CREATE VIEW samples_view AS '
diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
index c6351b557bb0..9494f9dc61ec 100644
--- a/tools/perf/util/env.c
+++ b/tools/perf/util/env.c
@@ -57,9 +57,11 @@ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
                 else if (prog_id > node->info_linear->info.id)
                         n = n->rb_right;
                 else
-                        break;
+                        goto out;
         }
+        node = NULL;
 
+out:
         up_read(&env->bpf_progs.lock);
         return node;
 }
@@ -109,10 +111,12 @@ struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id)
                 else if (btf_id > node->id)
                         n = n->rb_right;
                 else
-                        break;
+                        goto out;
         }
+        node = NULL;
 
         up_read(&env->bpf_progs.lock);
+out:
         return node;
 }
 
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 6689378ee577..51ead577533f 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -1868,12 +1868,12 @@ static void *perf_evlist__poll_thread(void *arg)
 {
         struct perf_evlist *evlist = arg;
         bool draining = false;
-        int i;
+        int i, done = 0;
+
+        while (!done) {
+                bool got_data = false;
 
-        while (draining || !(evlist->thread.done)) {
-                if (draining)
-                        draining = false;
-                else if (evlist->thread.done)
+                if (evlist->thread.done)
                         draining = true;
 
                 if (!draining)
@@ -1894,9 +1894,13 @@ static void *perf_evlist__poll_thread(void *arg)
                                         pr_warning("cannot locate proper evsel for the side band event\n");
 
                                 perf_mmap__consume(map);
+                                got_data = true;
                         }
                         perf_mmap__read_done(map);
                 }
+
+                if (draining && !got_data)
+                        break;
         }
         return NULL;
 }
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 66d066f18b5b..966360844fff 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -2368,7 +2368,7 @@ int perf_evsel__parse_sample(struct perf_evsel *evsel, union perf_event *event,
                 if (data->user_regs.abi) {
                         u64 mask = evsel->attr.sample_regs_user;
 
-                        sz = hweight_long(mask) * sizeof(u64);
+                        sz = hweight64(mask) * sizeof(u64);
                         OVERFLOW_CHECK(array, sz, max_size);
                         data->user_regs.mask = mask;
                         data->user_regs.regs = (u64 *)array;
@@ -2424,7 +2424,7 @@ int perf_evsel__parse_sample(struct perf_evsel *evsel, union perf_event *event,
                 if (data->intr_regs.abi != PERF_SAMPLE_REGS_ABI_NONE) {
                         u64 mask = evsel->attr.sample_regs_intr;
 
-                        sz = hweight_long(mask) * sizeof(u64);
+                        sz = hweight64(mask) * sizeof(u64);
                         OVERFLOW_CHECK(array, sz, max_size);
                         data->intr_regs.mask = mask;
                         data->intr_regs.regs = (u64 *)array;
@@ -2552,7 +2552,7 @@ size_t perf_event__sample_event_size(const struct perf_sample *sample, u64 type,
         if (type & PERF_SAMPLE_REGS_USER) {
                 if (sample->user_regs.abi) {
                         result += sizeof(u64);
-                        sz = hweight_long(sample->user_regs.mask) * sizeof(u64);
+                        sz = hweight64(sample->user_regs.mask) * sizeof(u64);
                         result += sz;
                 } else {
                         result += sizeof(u64);
@@ -2580,7 +2580,7 @@ size_t perf_event__sample_event_size(const struct perf_sample *sample, u64 type,
         if (type & PERF_SAMPLE_REGS_INTR) {
                 if (sample->intr_regs.abi) {
                         result += sizeof(u64);
-                        sz = hweight_long(sample->intr_regs.mask) * sizeof(u64);
+                        sz = hweight64(sample->intr_regs.mask) * sizeof(u64);
                         result += sz;
                 } else {
                         result += sizeof(u64);
@@ -2710,7 +2710,7 @@ int perf_event__synthesize_sample(union perf_event *event, u64 type,
         if (type & PERF_SAMPLE_REGS_USER) {
                 if (sample->user_regs.abi) {
                         *array++ = sample->user_regs.abi;
-                        sz = hweight_long(sample->user_regs.mask) * sizeof(u64);
+                        sz = hweight64(sample->user_regs.mask) * sizeof(u64);
                         memcpy(array, sample->user_regs.regs, sz);
                         array = (void *)array + sz;
                 } else {
@@ -2746,7 +2746,7 @@ int perf_event__synthesize_sample(union perf_event *event, u64 type,
         if (type & PERF_SAMPLE_REGS_INTR) {
                 if (sample->intr_regs.abi) {
                         *array++ = sample->intr_regs.abi;
-                        sz = hweight_long(sample->intr_regs.mask) * sizeof(u64);
+                        sz = hweight64(sample->intr_regs.mask) * sizeof(u64);
                         memcpy(array, sample->intr_regs.regs, sz);
                         array = (void *)array + sz;
                 } else {
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index b9e693825873..2d2af2ac2b1e 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2606,6 +2606,7 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)
                 perf_env__insert_bpf_prog_info(env, info_node);
         }
 
+        up_write(&env->bpf_progs.lock);
         return 0;
 out:
         free(info_linear);
@@ -2623,7 +2624,9 @@ static int process_bpf_prog_info(struct feat_fd *ff __maybe_unused, void *data _
 static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)
 {
         struct perf_env *env = &ff->ph->env;
+        struct btf_node *node = NULL;
         u32 count, i;
+        int err = -1;
 
         if (ff->ph->needs_swap) {
                 pr_warning("interpreting btf from systems with endianity is not yet supported\n");
@@ -2636,31 +2639,32 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)
         down_write(&env->bpf_progs.lock);
 
         for (i = 0; i < count; ++i) {
-                struct btf_node *node;
                 u32 id, data_size;
 
                 if (do_read_u32(ff, &id))
-                        return -1;
+                        goto out;
                 if (do_read_u32(ff, &data_size))
-                        return -1;
+                        goto out;
 
                 node = malloc(sizeof(struct btf_node) + data_size);
                 if (!node)
-                        return -1;
+                        goto out;
 
                 node->id = id;
                 node->data_size = data_size;
 
-                if (__do_read(ff, node->data, data_size)) {
-                        free(node);
-                        return -1;
-                }
+                if (__do_read(ff, node->data, data_size))
+                        goto out;
 
                 perf_env__insert_btf(env, node);
+                node = NULL;
         }
 
+        err = 0;
+out:
         up_write(&env->bpf_progs.lock);
-        return 0;
+        free(node);
+        return err;
 }
 
 struct feature_ops {
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index e32628cd20a7..ee71efb9db62 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -261,6 +261,22 @@ bool __map__is_extra_kernel_map(const struct map *map)
         return kmap && kmap->name[0];
 }
 
+bool __map__is_bpf_prog(const struct map *map)
+{
+        const char *name;
+
+        if (map->dso->binary_type == DSO_BINARY_TYPE__BPF_PROG_INFO)
+                return true;
+
+        /*
+         * If PERF_RECORD_BPF_EVENT is not included, the dso will not have
+         * type of DSO_BINARY_TYPE__BPF_PROG_INFO. In such cases, we can
+         * guess the type based on name.
+         */
+        name = map->dso->short_name;
+        return name && (strstr(name, "bpf_prog_") == name);
+}
+
 bool map__has_symbols(const struct map *map)
 {
         return dso__has_symbols(map->dso);
@@ -910,10 +926,8 @@ static void __maps__insert_name(struct maps *maps, struct map *map)
                 rc = strcmp(m->dso->short_name, map->dso->short_name);
                 if (rc < 0)
                         p = &(*p)->rb_left;
-                else if (rc  > 0)
-                        p = &(*p)->rb_right;
                 else
-                        return;
+                        p = &(*p)->rb_right;
         }
         rb_link_node(&map->rb_node_name, parent, p);
         rb_insert_color(&map->rb_node_name, &maps->names);
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index 0e20749f2c55..dc93787c74f0 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -159,10 +159,12 @@ int map__set_kallsyms_ref_reloc_sym(struct map *map, const char *symbol_name,
 
 bool __map__is_kernel(const struct map *map);
 bool __map__is_extra_kernel_map(const struct map *map);
+bool __map__is_bpf_prog(const struct map *map);
 
 static inline bool __map__is_kmodule(const struct map *map)
 {
-        return !__map__is_kernel(map) && !__map__is_extra_kernel_map(map);
+        return !__map__is_kernel(map) && !__map__is_extra_kernel_map(map) &&
+               !__map__is_bpf_prog(map);
 }
 
 bool map__has_symbols(const struct map *map);
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index c3fad065c89c..c7727be9719f 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -44,6 +44,7 @@
 #include <cpuid.h>
 #include <linux/capability.h>
 #include <errno.h>
+#include <math.h>
 
 char *proc_stat = "/proc/stat";
 FILE *outf;
@@ -63,7 +64,6 @@ unsigned int dump_only;
 unsigned int do_snb_cstates;
 unsigned int do_knl_cstates;
 unsigned int do_slm_cstates;
-unsigned int do_cnl_cstates;
 unsigned int use_c1_residency_msr;
 unsigned int has_aperf;
 unsigned int has_epb;
@@ -141,9 +141,21 @@ unsigned int first_counter_read = 1;
 
 #define RAPL_CORES_ENERGY_STATUS        (1 << 9)
                                         /* 0x639 MSR_PP0_ENERGY_STATUS */
+#define RAPL_PER_CORE_ENERGY    (1 << 10)
+                                        /* Indicates cores energy collection is per-core,
+                                         * not per-package. */
+#define RAPL_AMD_F17H           (1 << 11)
+                                        /* 0xc0010299 MSR_RAPL_PWR_UNIT */
+                                        /* 0xc001029a MSR_CORE_ENERGY_STAT */
+                                        /* 0xc001029b MSR_PKG_ENERGY_STAT */
 #define RAPL_CORES (RAPL_CORES_ENERGY_STATUS | RAPL_CORES_POWER_LIMIT)
 #define TJMAX_DEFAULT   100
 
+/* MSRs that are not yet in the kernel-provided header. */
+#define MSR_RAPL_PWR_UNIT       0xc0010299
+#define MSR_CORE_ENERGY_STAT    0xc001029a
+#define MSR_PKG_ENERGY_STAT     0xc001029b
+
 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 
 /*
@@ -187,6 +199,7 @@ struct core_data {
         unsigned long long c7;
         unsigned long long mc6_us;      /* duplicate as per-core for now, even though per module */
         unsigned int core_temp_c;
+        unsigned int core_energy;       /* MSR_CORE_ENERGY_STAT */
         unsigned int core_id;
         unsigned long long counter[MAX_ADDED_COUNTERS];
 } *core_even, *core_odd;
@@ -273,6 +286,7 @@ struct system_summary {
 
 struct cpu_topology {
         int physical_package_id;
+        int die_id;
         int logical_cpu_id;
         int physical_node_id;
         int logical_node_id;    /* 0-based count within the package */
@@ -283,6 +297,7 @@ struct cpu_topology {
 
 struct topo_params {
         int num_packages;
+        int num_die;
         int num_cpus;
         int num_cores;
         int max_cpu_num;
@@ -314,9 +329,8 @@ int for_all_cpus(int (func)(struct thread_data *, struct core_data *, struct pkg
         int retval, pkg_no, core_no, thread_no, node_no;
 
         for (pkg_no = 0; pkg_no < topo.num_packages; ++pkg_no) {
-                for (core_no = 0; core_no < topo.cores_per_node; ++core_no) {
-                        for (node_no = 0; node_no < topo.nodes_per_pkg;
-                             node_no++) {
+                for (node_no = 0; node_no < topo.nodes_per_pkg; node_no++) {
+                        for (core_no = 0; core_no < topo.cores_per_node; ++core_no) {
                                 for (thread_no = 0; thread_no <
                                         topo.threads_per_core; ++thread_no) {
                                         struct thread_data *t;
@@ -442,6 +456,7 @@ struct msr_counter bic[] = {
         { 0x0, "CPU" },
         { 0x0, "APIC" },
         { 0x0, "X2APIC" },
+        { 0x0, "Die" },
 };
 
 #define MAX_BIC (sizeof(bic) / sizeof(struct msr_counter))
@@ -495,6 +510,7 @@ struct msr_counter bic[] = {
 #define BIC_CPU         (1ULL << 47)
 #define BIC_APIC        (1ULL << 48)
 #define BIC_X2APIC      (1ULL << 49)
+#define BIC_Die         (1ULL << 50)
 
 #define BIC_DISABLED_BY_DEFAULT (BIC_USEC | BIC_TOD | BIC_APIC | BIC_X2APIC)
 
@@ -621,6 +637,8 @@ void print_header(char *delim)
                 outp += sprintf(outp, "%sTime_Of_Day_Seconds", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Package))
                 outp += sprintf(outp, "%sPackage", (printed++ ? delim : ""));
+        if (DO_BIC(BIC_Die))
+                outp += sprintf(outp, "%sDie", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Node))
                 outp += sprintf(outp, "%sNode", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Core))
@@ -667,7 +685,7 @@ void print_header(char *delim)
 
         if (DO_BIC(BIC_CPU_c1))
                 outp += sprintf(outp, "%sCPU%%c1", (printed++ ? delim : ""));
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates)
+        if (DO_BIC(BIC_CPU_c3))
                 outp += sprintf(outp, "%sCPU%%c3", (printed++ ? delim : ""));
         if (DO_BIC(BIC_CPU_c6))
                 outp += sprintf(outp, "%sCPU%%c6", (printed++ ? delim : ""));
@@ -680,6 +698,14 @@ void print_header(char *delim)
         if (DO_BIC(BIC_CoreTmp))
                 outp += sprintf(outp, "%sCoreTmp", (printed++ ? delim : ""));
 
+        if (do_rapl && !rapl_joules) {
+                if (DO_BIC(BIC_CorWatt) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                        outp += sprintf(outp, "%sCorWatt", (printed++ ? delim : ""));
+        } else if (do_rapl && rapl_joules) {
+                if (DO_BIC(BIC_Cor_J) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                        outp += sprintf(outp, "%sCor_J", (printed++ ? delim : ""));
+        }
+
         for (mp = sys.cp; mp; mp = mp->next) {
                 if (mp->format == FORMAT_RAW) {
                         if (mp->width == 64)
@@ -734,7 +760,7 @@ void print_header(char *delim)
         if (do_rapl && !rapl_joules) {
                 if (DO_BIC(BIC_PkgWatt))
                         outp += sprintf(outp, "%sPkgWatt", (printed++ ? delim : ""));
-                if (DO_BIC(BIC_CorWatt))
+                if (DO_BIC(BIC_CorWatt) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                         outp += sprintf(outp, "%sCorWatt", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_GFXWatt))
                         outp += sprintf(outp, "%sGFXWatt", (printed++ ? delim : ""));
@@ -747,7 +773,7 @@ void print_header(char *delim)
         } else if (do_rapl && rapl_joules) {
                 if (DO_BIC(BIC_Pkg_J))
                         outp += sprintf(outp, "%sPkg_J", (printed++ ? delim : ""));
-                if (DO_BIC(BIC_Cor_J))
+                if (DO_BIC(BIC_Cor_J) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                         outp += sprintf(outp, "%sCor_J", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_GFX_J))
                         outp += sprintf(outp, "%sGFX_J", (printed++ ? delim : ""));
@@ -808,6 +834,7 @@ int dump_counters(struct thread_data *t, struct core_data *c,
                 outp += sprintf(outp, "c6: %016llX\n", c->c6);
                 outp += sprintf(outp, "c7: %016llX\n", c->c7);
                 outp += sprintf(outp, "DTS: %dC\n", c->core_temp_c);
+                outp += sprintf(outp, "Joules: %0X\n", c->core_energy);
 
                 for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                         outp += sprintf(outp, "cADDED [%d] msr0x%x: %08llX\n",
@@ -904,6 +931,8 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (t == &average.threads) {
                 if (DO_BIC(BIC_Package))
                         outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                if (DO_BIC(BIC_Die))
+                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_Node))
                         outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_Core))
@@ -921,6 +950,12 @@ int format_counters(struct thread_data *t, struct core_data *c,
                         else
                                 outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 }
+                if (DO_BIC(BIC_Die)) {
+                        if (c)
+                                outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), cpus[t->cpu_id].die_id);
+                        else
+                                outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                }
                 if (DO_BIC(BIC_Node)) {
                         if (t)
                                 outp += sprintf(outp, "%s%d",
@@ -1003,7 +1038,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates)
+        if (DO_BIC(BIC_CPU_c3))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * c->c3/tsc);
         if (DO_BIC(BIC_CPU_c6))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * c->c6/tsc);
@@ -1033,6 +1068,20 @@ int format_counters(struct thread_data *t, struct core_data *c,
                 }
         }
 
+        /*
+         * If measurement interval exceeds minimum RAPL Joule Counter range,
+         * indicate that results are suspect by printing "**" in fraction place.
+         */
+        if (interval_float < rapl_joule_counter_range)
+                fmt8 = "%s%.2f";
+        else
+                fmt8 = "%6.0f**";
+
+        if (DO_BIC(BIC_CorWatt) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                outp += sprintf(outp, fmt8, (printed++ ? delim : ""), c->core_energy * rapl_energy_units / interval_float);
+        if (DO_BIC(BIC_Cor_J) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                outp += sprintf(outp, fmt8, (printed++ ? delim : ""), c->core_energy * rapl_energy_units);
+
         /* print per-package data only for 1st core in package */
         if (!(t->flags & CPU_IS_FIRST_CORE_IN_PACKAGE))
                 goto done;
@@ -1085,18 +1134,9 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (DO_BIC(BIC_SYS_LPI))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * p->sys_lpi / 1000000.0 / interval_float);
 
-        /*
-         * If measurement interval exceeds minimum RAPL Joule Counter range,
-         * indicate that results are suspect by printing "**" in fraction place.
-         */
-        if (interval_float < rapl_joule_counter_range)
-                fmt8 = "%s%.2f";
-        else
-                fmt8 = "%6.0f**";
-
         if (DO_BIC(BIC_PkgWatt))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_pkg * rapl_energy_units / interval_float);
-        if (DO_BIC(BIC_CorWatt))
+        if (DO_BIC(BIC_CorWatt) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_cores * rapl_energy_units / interval_float);
         if (DO_BIC(BIC_GFXWatt))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_gfx * rapl_energy_units / interval_float);
@@ -1104,7 +1144,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_dram * rapl_dram_energy_units / interval_float);
         if (DO_BIC(BIC_Pkg_J))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_pkg * rapl_energy_units);
-        if (DO_BIC(BIC_Cor_J))
+        if (DO_BIC(BIC_Cor_J) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_cores * rapl_energy_units);
         if (DO_BIC(BIC_GFX_J))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_gfx * rapl_energy_units);
@@ -1249,6 +1289,8 @@ delta_core(struct core_data *new, struct core_data *old)
         old->core_temp_c = new->core_temp_c;
         old->mc6_us = new->mc6_us - old->mc6_us;
 
+        DELTA_WRAP32(new->core_energy, old->core_energy);
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (mp->format == FORMAT_RAW)
                         old->counter[i] = new->counter[i];
@@ -1391,6 +1433,7 @@ void clear_counters(struct thread_data *t, struct core_data *c, struct pkg_data
         c->c7 = 0;
         c->mc6_us = 0;
         c->core_temp_c = 0;
+        c->core_energy = 0;
 
         p->pkg_wtd_core_c0 = 0;
         p->pkg_any_core_c0 = 0;
@@ -1473,6 +1516,8 @@ int sum_counters(struct thread_data *t, struct core_data *c,
 
         average.cores.core_temp_c = MAX(average.cores.core_temp_c, c->core_temp_c);
 
+        average.cores.core_energy += c->core_energy;
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (mp->format == FORMAT_RAW)
                         continue;
@@ -1818,7 +1863,7 @@ retry:
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates) {
+        if (DO_BIC(BIC_CPU_c3)) {
                 if (get_msr(cpu, MSR_CORE_C3_RESIDENCY, &c->c3))
                         return -6;
         }
@@ -1845,6 +1890,12 @@ retry:
                 c->core_temp_c = tcc_activation_temp - ((msr >> 16) & 0x7F);
         }
 
+        if (do_rapl & RAPL_AMD_F17H) {
+                if (get_msr(cpu, MSR_CORE_ENERGY_STAT, &msr))
+                        return -14;
+                c->core_energy = msr & 0xFFFFFFFF;
+        }
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (get_mp(cpu, mp, &c->counter[i]))
                         return -10;
@@ -1934,6 +1985,11 @@ retry:
                         return -16;
                 p->rapl_dram_perf_status = msr & 0xFFFFFFFF;
         }
+        if (do_rapl & RAPL_AMD_F17H) {
+                if (get_msr(cpu, MSR_PKG_ENERGY_STAT, &msr))
+                        return -13;
+                p->energy_pkg = msr & 0xFFFFFFFF;
+        }
         if (DO_BIC(BIC_PkgTmp)) {
                 if (get_msr(cpu, MSR_IA32_PACKAGE_THERM_STATUS, &msr))
                         return -17;
@@ -2456,6 +2512,8 @@ void free_all_buffers(void)
 
 /*
  * Parse a file containing a single int.
+ * Return 0 if file can not be opened
+ * Exit if file can be opened, but can not be parsed
  */
 int parse_int_file(const char *fmt, ...)
 {
@@ -2467,7 +2525,9 @@ int parse_int_file(const char *fmt, ...)
         va_start(args, fmt);
         vsnprintf(path, sizeof(path), fmt, args);
         va_end(args);
-        filep = fopen_or_die(path, "r");
+        filep = fopen(path, "r");
+        if (!filep)
+                return 0;
         if (fscanf(filep, "%d", &value) != 1)
                 err(1, "%s: failed to parse number from file", path);
         fclose(filep);
@@ -2488,6 +2548,11 @@ int get_physical_package_id(int cpu)
         return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/physical_package_id", cpu);
 }
 
+int get_die_id(int cpu)
+{
+        return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/die_id", cpu);
+}
+
 int get_core_id(int cpu)
 {
         return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/core_id", cpu);
@@ -2578,7 +2643,8 @@ int get_thread_siblings(struct cpu_topology *thiscpu)
         filep = fopen_or_die(path, "r");
         do {
                 offset -= BITMASK_SIZE;
-                fscanf(filep, "%lx%c", &map, &character);
+                if (fscanf(filep, "%lx%c", &map, &character) != 2)
+                        err(1, "%s: failed to parse file", path);
                 for (shift = 0; shift < BITMASK_SIZE; shift++) {
                         if ((map >> shift) & 0x1) {
                                 so = shift + offset;
@@ -2855,8 +2921,11 @@ int snapshot_cpu_lpi_us(void)
         fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_cpu_residency_us", "r");
 
         retval = fscanf(fp, "%lld", &cpuidle_cur_cpu_lpi_us);
-        if (retval != 1)
-                err(1, "CPU LPI");
+        if (retval != 1) {
+                fprintf(stderr, "Disabling Low Power Idle CPU output\n");
+                BIC_NOT_PRESENT(BIC_CPU_LPI);
+                return -1;
+        }
 
         fclose(fp);
 
@@ -2878,9 +2947,11 @@ int snapshot_sys_lpi_us(void)
         fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us", "r");
 
         retval = fscanf(fp, "%lld", &cpuidle_cur_sys_lpi_us);
-        if (retval != 1)
-                err(1, "SYS LPI");
-
+        if (retval != 1) {
+                fprintf(stderr, "Disabling Low Power Idle System output\n");
+                BIC_NOT_PRESENT(BIC_SYS_LPI);
+                return -1;
+        }
         fclose(fp);
 
         return 0;
@@ -3410,14 +3481,14 @@ dump_sysfs_cstate_config(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
 
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
                 if (!sp)
                         sp = strchrnul(name_buf, '\n');
                 *sp = '\0';
-
                 fclose(input);
 
                 sprintf(path, "/sys/devices/system/cpu/cpu%d/cpuidle/state%d/desc",
@@ -3425,7 +3496,8 @@ dump_sysfs_cstate_config(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(desc, sizeof(desc), input);
+                if (!fgets(desc, sizeof(desc), input))
+                        err(1, "%s: failed to read file", path);
 
                 fprintf(outf, "cpu%d: %s: %s", base_cpu, name_buf, desc);
                 fclose(input);
@@ -3444,20 +3516,22 @@ dump_sysfs_pstate_config(void)
                         base_cpu);
         input = fopen(path, "r");
         if (input == NULL) {
-                fprintf(stderr, "NSFOD %s\n", path);
+                fprintf(outf, "NSFOD %s\n", path);
                 return;
         }
-        fgets(driver_buf, sizeof(driver_buf), input);
+        if (!fgets(driver_buf, sizeof(driver_buf), input))
+                err(1, "%s: failed to read file", path);
         fclose(input);
 
         sprintf(path, "/sys/devices/system/cpu/cpu%d/cpufreq/scaling_governor",
                         base_cpu);
         input = fopen(path, "r");
         if (input == NULL) {
-                fprintf(stderr, "NSFOD %s\n", path);
+                fprintf(outf, "NSFOD %s\n", path);
                 return;
         }
-        fgets(governor_buf, sizeof(governor_buf), input);
+        if (!fgets(governor_buf, sizeof(governor_buf), input))
+                err(1, "%s: failed to read file", path);
         fclose(input);
 
         fprintf(outf, "cpu%d: cpufreq driver: %s", base_cpu, driver_buf);
@@ -3466,7 +3540,8 @@ dump_sysfs_pstate_config(void)
         sprintf(path, "/sys/devices/system/cpu/cpufreq/boost");
         input = fopen(path, "r");
         if (input != NULL) {
-                fscanf(input, "%d", &turbo);
+                if (fscanf(input, "%d", &turbo) != 1)
+                        err(1, "%s: failed to parse number from file", path);
                 fprintf(outf, "cpufreq boost: %d\n", turbo);
                 fclose(input);
         }
@@ -3474,7 +3549,8 @@ dump_sysfs_pstate_config(void)
         sprintf(path, "/sys/devices/system/cpu/intel_pstate/no_turbo");
         input = fopen(path, "r");
         if (input != NULL) {
-                fscanf(input, "%d", &turbo);
+                if (fscanf(input, "%d", &turbo) != 1)
+                        err(1, "%s: failed to parse number from file", path);
                 fprintf(outf, "cpufreq intel_pstate no_turbo: %d\n", turbo);
                 fclose(input);
         }
@@ -3718,7 +3794,7 @@ int print_perf_limit(struct thread_data *t, struct core_data *c, struct pkg_data
 #define RAPL_POWER_GRANULARITY  0x7FFF  /* 15 bit power granularity */
 #define RAPL_TIME_GRANULARITY   0x3F /* 6 bit time granularity */
 
-double get_tdp(unsigned int model)
+double get_tdp_intel(unsigned int model)
 {
         unsigned long long msr;
 
@@ -3735,6 +3811,16 @@ double get_tdp(unsigned int model)
         }
 }
 
+double get_tdp_amd(unsigned int family)
+{
+        switch (family) {
+        case 0x17:
+        default:
+                /* This is the max stock TDP of HEDT/Server Fam17h chips */
+                return 250.0;
+        }
+}
+
 /*
  * rapl_dram_energy_units_probe()
  * Energy units are either hard-coded, or come from RAPL Energy Unit MSR.
@@ -3754,21 +3840,12 @@ rapl_dram_energy_units_probe(int  model, double rapl_energy_units)
         }
 }
 
-
-/*
- * rapl_probe()
- *
- * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
- */
-void rapl_probe(unsigned int family, unsigned int model)
+void rapl_probe_intel(unsigned int family, unsigned int model)
 {
         unsigned long long msr;
         unsigned int time_unit;
         double tdp;
 
-        if (!genuine_intel)
-                return;
-
         if (family != 6)
                 return;
 
@@ -3892,13 +3969,69 @@ void rapl_probe(unsigned int family, unsigned int model)
 
         rapl_time_units = 1.0 / (1 << (time_unit));
 
-        tdp = get_tdp(model);
+        tdp = get_tdp_intel(model);
 
         rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
         if (!quiet)
                 fprintf(outf, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
+}
 
-        return;
+void rapl_probe_amd(unsigned int family, unsigned int model)
+{
+        unsigned long long msr;
+        unsigned int eax, ebx, ecx, edx;
+        unsigned int has_rapl = 0;
+        double tdp;
+
+        if (max_extended_level >= 0x80000007) {
+                __cpuid(0x80000007, eax, ebx, ecx, edx);
+                /* RAPL (Fam 17h) */
+                has_rapl = edx & (1 << 14);
+        }
+
+        if (!has_rapl)
+                return;
+
+        switch (family) {
+        case 0x17: /* Zen, Zen+ */
+                do_rapl = RAPL_AMD_F17H | RAPL_PER_CORE_ENERGY;
+                if (rapl_joules) {
+                        BIC_PRESENT(BIC_Pkg_J);
+                        BIC_PRESENT(BIC_Cor_J);
+                } else {
+                        BIC_PRESENT(BIC_PkgWatt);
+                        BIC_PRESENT(BIC_CorWatt);
+                }
+                break;
+        default:
+                return;
+        }
+
+        if (get_msr(base_cpu, MSR_RAPL_PWR_UNIT, &msr))
+                return;
+
+        rapl_time_units = ldexp(1.0, -(msr >> 16 & 0xf));
+        rapl_energy_units = ldexp(1.0, -(msr >> 8 & 0x1f));
+        rapl_power_units = ldexp(1.0, -(msr & 0xf));
+
+        tdp = get_tdp_amd(model);
+
+        rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
+        if (!quiet)
+                fprintf(outf, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
+}
+
+/*
+ * rapl_probe()
+ *
+ * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
+ */
+void rapl_probe(unsigned int family, unsigned int model)
+{
+        if (genuine_intel)
+                rapl_probe_intel(family, model);
+        if (authentic_amd)
+                rapl_probe_amd(family, model);
 }
 
 void perf_limit_reasons_probe(unsigned int family, unsigned int model)
@@ -4003,6 +4136,7 @@ void print_power_limit_msr(int cpu, unsigned long long msr, char *label)
 int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
         unsigned long long msr;
+        const char *msr_name;
         int cpu;
 
         if (!do_rapl)
@@ -4018,10 +4152,17 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return -1;
         }
 
-        if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
-                return -1;
+        if (do_rapl & RAPL_AMD_F17H) {
+                msr_name = "MSR_RAPL_PWR_UNIT";
+                if (get_msr(cpu, MSR_RAPL_PWR_UNIT, &msr))
+                        return -1;
+        } else {
+                msr_name = "MSR_RAPL_POWER_UNIT";
+                if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
+                        return -1;
+        }
 
-        fprintf(outf, "cpu%d: MSR_RAPL_POWER_UNIT: 0x%08llx (%f Watts, %f Joules, %f sec.)\n", cpu, msr,
+        fprintf(outf, "cpu%d: %s: 0x%08llx (%f Watts, %f Joules, %f sec.)\n", cpu, msr_name, msr,
                 rapl_power_units, rapl_energy_units, rapl_time_units);
 
         if (do_rapl & RAPL_PKG_POWER_INFO) {
@@ -4451,6 +4592,9 @@ unsigned int intel_model_duplicates(unsigned int model)
         case INTEL_FAM6_KABYLAKE_MOBILE:
         case INTEL_FAM6_KABYLAKE_DESKTOP:
                 return INTEL_FAM6_SKYLAKE_MOBILE;
+
+        case INTEL_FAM6_ICELAKE_MOBILE:
+                return INTEL_FAM6_CANNONLAKE_MOBILE;
         }
         return model;
 }
@@ -4702,7 +4846,9 @@ void process_cpuid()
         }
         do_slm_cstates = is_slm(family, model);
         do_knl_cstates  = is_knl(family, model);
-        do_cnl_cstates = is_cnl(family, model);
+
+        if (do_slm_cstates || do_knl_cstates || is_cnl(family, model))
+                BIC_NOT_PRESENT(BIC_CPU_c3);
 
         if (!quiet)
                 decode_misc_pwr_mgmt_msr();
@@ -4769,6 +4915,7 @@ void topology_probe()
         int i;
         int max_core_id = 0;
         int max_package_id = 0;
+        int max_die_id = 0;
         int max_siblings = 0;
 
         /* Initialize num_cpus, max_cpu_num */
@@ -4835,6 +4982,11 @@ void topology_probe()
                 if (cpus[i].physical_package_id > max_package_id)
                         max_package_id = cpus[i].physical_package_id;
 
+                /* get die information */
+                cpus[i].die_id = get_die_id(i);
+                if (cpus[i].die_id > max_die_id)
+                        max_die_id = cpus[i].die_id;
+
                 /* get numa node information */
                 cpus[i].physical_node_id = get_physical_node_id(&cpus[i]);
                 if (cpus[i].physical_node_id > topo.max_node_num)
@@ -4860,6 +5012,13 @@ void topology_probe()
         if (!summary_only && topo.cores_per_node > 1)
                 BIC_PRESENT(BIC_Core);
 
+        topo.num_die = max_die_id + 1;
+        if (debug > 1)
+                fprintf(outf, "max_die_id %d, sizing for %d die\n",
+                                max_die_id, topo.num_die);
+        if (!summary_only && topo.num_die > 1)
+                BIC_PRESENT(BIC_Die);
+
         topo.num_packages = max_package_id + 1;
         if (debug > 1)
                 fprintf(outf, "max_package_id %d, sizing for %d packages\n",
@@ -4884,8 +5043,8 @@ void topology_probe()
                 if (cpu_is_not_present(i))
                         continue;
                 fprintf(outf,
-                        "cpu %d pkg %d node %d lnode %d core %d thread %d\n",
-                        i, cpus[i].physical_package_id,
+                        "cpu %d pkg %d die %d node %d lnode %d core %d thread %d\n",
+                        i, cpus[i].physical_package_id, cpus[i].die_id,
                         cpus[i].physical_node_id,
                         cpus[i].logical_node_id,
                         cpus[i].physical_core_id,
@@ -5122,7 +5281,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 18.07.27"
+        fprintf(outf, "turbostat version 19.03.20"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
@@ -5319,7 +5478,8 @@ void probe_sysfs(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
 
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
@@ -5346,7 +5506,8 @@ void probe_sysfs(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
                 if (!sp)
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index b579f962451d..85ffdcfa596b 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -146,6 +146,7 @@ static int dimm_fail_cmd_code[ARRAY_SIZE(handle)];
 struct nfit_test_sec {
         u8 state;
         u8 ext_state;
+        u8 old_state;
         u8 passphrase[32];
         u8 master_passphrase[32];
         u64 overwrite_end_time;
@@ -225,6 +226,8 @@ static struct workqueue_struct *nfit_wq;
 
 static struct gen_pool *nfit_pool;
 
+static const char zero_key[NVDIMM_PASSPHRASE_LEN];
+
 static struct nfit_test *to_nfit_test(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -1059,8 +1062,7 @@ static int nd_intel_test_cmd_secure_erase(struct nfit_test *t,
         struct device *dev = &t->pdev.dev;
         struct nfit_test_sec *sec = &dimm_sec_info[dimm];
 
-        if (!(sec->state & ND_INTEL_SEC_STATE_ENABLED) ||
-                        (sec->state & ND_INTEL_SEC_STATE_FROZEN)) {
+        if (sec->state & ND_INTEL_SEC_STATE_FROZEN) {
                 nd_cmd->status = ND_INTEL_STATUS_INVALID_STATE;
                 dev_dbg(dev, "secure erase: wrong security state\n");
         } else if (memcmp(nd_cmd->passphrase, sec->passphrase,
@@ -1068,6 +1070,12 @@ static int nd_intel_test_cmd_secure_erase(struct nfit_test *t,
                 nd_cmd->status = ND_INTEL_STATUS_INVALID_PASS;
                 dev_dbg(dev, "secure erase: wrong passphrase\n");
         } else {
+                if (!(sec->state & ND_INTEL_SEC_STATE_ENABLED)
+                                && (memcmp(nd_cmd->passphrase, zero_key,
+                                        ND_INTEL_PASSPHRASE_SIZE) != 0)) {
+                        dev_dbg(dev, "invalid zero key\n");
+                        return 0;
+                }
                 memset(sec->passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
                 memset(sec->master_passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
                 sec->state = 0;
@@ -1093,7 +1101,7 @@ static int nd_intel_test_cmd_overwrite(struct nfit_test *t,
                 return 0;
         }
 
-        memset(sec->passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
+        sec->old_state = sec->state;
         sec->state = ND_INTEL_SEC_STATE_OVERWRITE;
         dev_dbg(dev, "overwrite progressing.\n");
         sec->overwrite_end_time = get_jiffies_64() + 5 * HZ;
@@ -1115,7 +1123,8 @@ static int nd_intel_test_cmd_query_overwrite(struct nfit_test *t,
 
         if (time_is_before_jiffies64(sec->overwrite_end_time)) {
                 sec->overwrite_end_time = 0;
-                sec->state = 0;
+                sec->state = sec->old_state;
+                sec->old_state = 0;
                 sec->ext_state = ND_INTEL_SEC_ESTATE_ENABLED;
                 dev_dbg(dev, "overwrite is complete\n");
         } else
diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
index bcbd928c96ab..fc818bc1d729 100644
--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
@@ -39,6 +39,58 @@ static struct bpf_flow_keys pkt_v6_flow_keys = {
         .n_proto = __bpf_constant_htons(ETH_P_IPV6),
 };
 
+#define VLAN_HLEN       4
+
+static struct {
+        struct ethhdr eth;
+        __u16 vlan_tci;
+        __u16 vlan_proto;
+        struct iphdr iph;
+        struct tcphdr tcp;
+} __packed pkt_vlan_v4 = {
+        .eth.h_proto = __bpf_constant_htons(ETH_P_8021Q),
+        .vlan_proto = __bpf_constant_htons(ETH_P_IP),
+        .iph.ihl = 5,
+        .iph.protocol = IPPROTO_TCP,
+        .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
+        .tcp.urg_ptr = 123,
+        .tcp.doff = 5,
+};
+
+static struct bpf_flow_keys pkt_vlan_v4_flow_keys = {
+        .nhoff = VLAN_HLEN,
+        .thoff = VLAN_HLEN + sizeof(struct iphdr),
+        .addr_proto = ETH_P_IP,
+        .ip_proto = IPPROTO_TCP,
+        .n_proto = __bpf_constant_htons(ETH_P_IP),
+};
+
+static struct {
+        struct ethhdr eth;
+        __u16 vlan_tci;
+        __u16 vlan_proto;
+        __u16 vlan_tci2;
+        __u16 vlan_proto2;
+        struct ipv6hdr iph;
+        struct tcphdr tcp;
+} __packed pkt_vlan_v6 = {
+        .eth.h_proto = __bpf_constant_htons(ETH_P_8021AD),
+        .vlan_proto = __bpf_constant_htons(ETH_P_8021Q),
+        .vlan_proto2 = __bpf_constant_htons(ETH_P_IPV6),
+        .iph.nexthdr = IPPROTO_TCP,
+        .iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
+        .tcp.urg_ptr = 123,
+        .tcp.doff = 5,
+};
+
+static struct bpf_flow_keys pkt_vlan_v6_flow_keys = {
+        .nhoff = VLAN_HLEN * 2,
+        .thoff = VLAN_HLEN * 2 + sizeof(struct ipv6hdr),
+        .addr_proto = ETH_P_IPV6,
+        .ip_proto = IPPROTO_TCP,
+        .n_proto = __bpf_constant_htons(ETH_P_IPV6),
+};
+
 void test_flow_dissector(void)
 {
         struct bpf_flow_keys flow_keys;
@@ -68,5 +120,21 @@ void test_flow_dissector(void)
               err, errno, retval, duration, size, sizeof(flow_keys));
         CHECK_FLOW_KEYS("ipv6_flow_keys", flow_keys, pkt_v6_flow_keys);
 
+        err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v4, sizeof(pkt_vlan_v4),
+                                &flow_keys, &size, &retval, &duration);
+        CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv4",
+              "err %d errno %d retval %d duration %d size %u/%lu\n",
+              err, errno, retval, duration, size, sizeof(flow_keys));
+        CHECK_FLOW_KEYS("vlan_ipv4_flow_keys", flow_keys,
+                        pkt_vlan_v4_flow_keys);
+
+        err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v6, sizeof(pkt_vlan_v6),
+                                &flow_keys, &size, &retval, &duration);
+        CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv6",
+              "err %d errno %d retval %d duration %d size %u/%lu\n",
+              err, errno, retval, duration, size, sizeof(flow_keys));
+        CHECK_FLOW_KEYS("vlan_ipv6_flow_keys", flow_keys,
+                        pkt_vlan_v6_flow_keys);
+
         bpf_object__close(obj);
 }
diff --git a/tools/testing/selftests/bpf/progs/bpf_flow.c b/tools/testing/selftests/bpf/progs/bpf_flow.c
index 284660f5aa95..75b17cada539 100644
--- a/tools/testing/selftests/bpf/progs/bpf_flow.c
+++ b/tools/testing/selftests/bpf/progs/bpf_flow.c
@@ -92,7 +92,6 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 {
         struct bpf_flow_keys *keys = skb->flow_keys;
 
-        keys->n_proto = proto;
         switch (proto) {
         case bpf_htons(ETH_P_IP):
                 bpf_tail_call(skb, &jmp_table, IP);
@@ -119,10 +118,9 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 SEC("flow_dissector")
 int _dissect(struct __sk_buff *skb)
 {
-        if (!skb->vlan_present)
-                return parse_eth_proto(skb, skb->protocol);
-        else
-                return parse_eth_proto(skb, skb->vlan_proto);
+        struct bpf_flow_keys *keys = skb->flow_keys;
+
+        return parse_eth_proto(skb, keys->n_proto);
 }
 
 /* Parses on IPPROTO_* */
@@ -336,15 +334,9 @@ PROG(VLAN)(struct __sk_buff *skb)
 {
         struct bpf_flow_keys *keys = skb->flow_keys;
         struct vlan_hdr *vlan, _vlan;
-        __be16 proto;
-
-        /* Peek back to see if single or double-tagging */
-        if (bpf_skb_load_bytes(skb, keys->thoff - sizeof(proto), &proto,
-                               sizeof(proto)))
-                return BPF_DROP;
 
         /* Account for double-tagging */
-        if (proto == bpf_htons(ETH_P_8021AD)) {
+        if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
                 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
                 if (!vlan)
                         return BPF_DROP;
@@ -352,6 +344,7 @@ PROG(VLAN)(struct __sk_buff *skb)
                 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
                         return BPF_DROP;
 
+                keys->nhoff += sizeof(*vlan);
                 keys->thoff += sizeof(*vlan);
         }
 
@@ -359,12 +352,14 @@ PROG(VLAN)(struct __sk_buff *skb)
         if (!vlan)
                 return BPF_DROP;
 
+        keys->nhoff += sizeof(*vlan);
         keys->thoff += sizeof(*vlan);
         /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
         if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
             vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
                 return BPF_DROP;
 
+        keys->n_proto = vlan->h_vlan_encapsulated_proto;
         return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
 }
 
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 23e3b314ca60..ec5794e4205b 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -5777,6 +5777,53 @@ const struct btf_dedup_test dedup_tests[] = {
         },
 },
 {
+        .descr = "dedup: void equiv check",
+        /*
+         * // CU 1:
+         * struct s {
+         *      struct {} *x;
+         * };
+         * // CU 2:
+         * struct s {
+         *      int *x;
+         * };
+         */
+        .input = {
+                .raw_types = {
+                        /* CU 1 */
+                        BTF_STRUCT_ENC(0, 0, 1),                                /* [1] struct {}  */
+                        BTF_PTR_ENC(1),                                         /* [2] ptr -> [1] */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [3] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
+                        /* CU 2 */
+                        BTF_PTR_ENC(0),                                         /* [4] ptr -> void */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [5] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0s\0x"),
+        },
+        .expect = {
+                .raw_types = {
+                        /* CU 1 */
+                        BTF_STRUCT_ENC(0, 0, 1),                                /* [1] struct {}  */
+                        BTF_PTR_ENC(1),                                         /* [2] ptr -> [1] */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [3] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
+                        /* CU 2 */
+                        BTF_PTR_ENC(0),                                         /* [4] ptr -> void */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [5] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0s\0x"),
+        },
+        .opts = {
+                .dont_resolve_fwds = false,
+                .dedup_table_size = 1, /* force hash collisions */
+        },
+},
+{
         .descr = "dedup: all possible kinds (no duplicates)",
         .input = {
                 .raw_types = {
diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
index f2ccae39ee66..fb11240b758b 100644
--- a/tools/testing/selftests/bpf/verifier/calls.c
+++ b/tools/testing/selftests/bpf/verifier/calls.c
@@ -908,6 +908,44 @@
         .result = REJECT,
 },
 {
+        "calls: stack depth check in dead code",
+        .insns = {
+        /* main */
+        BPF_MOV64_IMM(BPF_REG_1, 0),
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
+        BPF_EXIT_INSN(),
+        /* A */
+        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        /* B */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
+        BPF_EXIT_INSN(),
+        /* C */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
+        BPF_EXIT_INSN(),
+        /* D */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
+        BPF_EXIT_INSN(),
+        /* E */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
+        BPF_EXIT_INSN(),
+        /* F */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
+        BPF_EXIT_INSN(),
+        /* G */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
+        BPF_EXIT_INSN(),
+        /* H */
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_XDP,
+        .errstr = "call stack",
+        .result = REJECT,
+},
+{
         "calls: spill into caller stack frame",
         .insns = {
         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
diff --git a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
index c4cf6e6d800e..a6c196c8534c 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
@@ -11,6 +11,7 @@ lib_dir=$(dirname $0)/../../../net/forwarding
 
 ALL_TESTS="
         rif_set_addr_test
+        rif_vrf_set_addr_test
         rif_inherit_bridge_addr_test
         rif_non_inherit_bridge_addr_test
         vlan_interface_deletion_test
@@ -98,6 +99,25 @@ rif_set_addr_test()
         ip link set dev $swp1 addr $swp1_mac
 }
 
+rif_vrf_set_addr_test()
+{
+        # Test that it is possible to set an IP address on a VRF upper despite
+        # its random MAC address.
+        RET=0
+
+        ip link add name vrf-test type vrf table 10
+        ip link set dev $swp1 master vrf-test
+
+        ip -4 address add 192.0.2.1/24 dev vrf-test
+        check_err $? "failed to set IPv4 address on VRF"
+        ip -6 address add 2001:db8:1::1/64 dev vrf-test
+        check_err $? "failed to set IPv6 address on VRF"
+
+        log_test "RIF - setting IP address on VRF"
+
+        ip link del dev vrf-test
+}
+
 rif_inherit_bridge_addr_test()
 {
         RET=0
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 7514fcea91a7..f8588cca2bef 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -1,3 +1,5 @@
+include ../../../../scripts/Kbuild.include
+
 all:
 
 top_srcdir = ../../../..
@@ -17,6 +19,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/state_test
 TEST_GEN_PROGS_x86_64 += x86_64/evmcs_test
 TEST_GEN_PROGS_x86_64 += x86_64/hyperv_cpuid
 TEST_GEN_PROGS_x86_64 += x86_64/vmx_close_while_nested_test
+TEST_GEN_PROGS_x86_64 += x86_64/smm_test
 TEST_GEN_PROGS_x86_64 += dirty_log_test
 TEST_GEN_PROGS_x86_64 += clear_dirty_log_test
 
@@ -30,7 +33,11 @@ INSTALL_HDR_PATH = $(top_srcdir)/usr
 LINUX_HDR_PATH = $(INSTALL_HDR_PATH)/include/
 LINUX_TOOL_INCLUDE = $(top_srcdir)/tools/include
 CFLAGS += -O2 -g -std=gnu99 -fno-stack-protector -fno-PIE -I$(LINUX_TOOL_INCLUDE) -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I..
-LDFLAGS += -pthread -no-pie
+
+no-pie-option := $(call try-run, echo 'int main() { return 0; }' | \
+        $(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -no-pie -x c - -o "$$TMP", -no-pie)
+
+LDFLAGS += -pthread $(no-pie-option)
 
 # After inclusion, $(OUTPUT) is defined and
 # $(TEST_GEN_PROGS) starts with $(OUTPUT)/
diff --git a/tools/testing/selftests/kvm/include/x86_64/processor.h b/tools/testing/selftests/kvm/include/x86_64/processor.h
index e2884c2b81ff..6063d5b2f356 100644
--- a/tools/testing/selftests/kvm/include/x86_64/processor.h
+++ b/tools/testing/selftests/kvm/include/x86_64/processor.h
@@ -778,6 +778,33 @@ void vcpu_set_msr(struct kvm_vm *vm, uint32_t vcpuid, uint64_t msr_index,
 #define MSR_IA32_APICBASE_ENABLE        (1<<11)
 #define MSR_IA32_APICBASE_BASE          (0xfffff<<12)
 
+#define APIC_BASE_MSR   0x800
+#define X2APIC_ENABLE   (1UL << 10)
+#define APIC_ICR        0x300
+#define         APIC_DEST_SELF          0x40000
+#define         APIC_DEST_ALLINC        0x80000
+#define         APIC_DEST_ALLBUT        0xC0000
+#define         APIC_ICR_RR_MASK        0x30000
+#define         APIC_ICR_RR_INVALID     0x00000
+#define         APIC_ICR_RR_INPROG      0x10000
+#define         APIC_ICR_RR_VALID       0x20000
+#define         APIC_INT_LEVELTRIG      0x08000
+#define         APIC_INT_ASSERT         0x04000
+#define         APIC_ICR_BUSY           0x01000
+#define         APIC_DEST_LOGICAL       0x00800
+#define         APIC_DEST_PHYSICAL      0x00000
+#define         APIC_DM_FIXED           0x00000
+#define         APIC_DM_FIXED_MASK      0x00700
+#define         APIC_DM_LOWEST          0x00100
+#define         APIC_DM_SMI             0x00200
+#define         APIC_DM_REMRD           0x00300
+#define         APIC_DM_NMI             0x00400
+#define         APIC_DM_INIT            0x00500
+#define         APIC_DM_STARTUP         0x00600
+#define         APIC_DM_EXTINT          0x00700
+#define         APIC_VECTOR_MASK        0x000FF
+#define APIC_ICR2       0x310
+
 #define MSR_IA32_TSCDEADLINE            0x000006e0
 
 #define MSR_IA32_UCODE_WRITE            0x00000079
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index efa0aad8b3c6..4ca96b228e46 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -91,6 +91,11 @@ static void vm_open(struct kvm_vm *vm, int perm, unsigned long type)
         if (vm->kvm_fd < 0)
                 exit(KSFT_SKIP);
 
+        if (!kvm_check_cap(KVM_CAP_IMMEDIATE_EXIT)) {
+                fprintf(stderr, "immediate_exit not available, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+
         vm->fd = ioctl(vm->kvm_fd, KVM_CREATE_VM, type);
         TEST_ASSERT(vm->fd >= 0, "KVM_CREATE_VM ioctl failed, "
                 "rc: %i errno: %i", vm->fd, errno);
diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c
index f28127f4a3af..dc7fae9fa424 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/processor.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c
@@ -1030,6 +1030,14 @@ struct kvm_x86_state *vcpu_save_state(struct kvm_vm *vm, uint32_t vcpuid)
                             nested_size, sizeof(state->nested_));
         }
 
+        /*
+         * When KVM exits to userspace with KVM_EXIT_IO, KVM guarantees
+         * guest state is consistent only after userspace re-enters the
+         * kernel with KVM_RUN.  Complete IO prior to migrating state
+         * to a new VM.
+         */
+        vcpu_run_complete_io(vm, vcpuid);
+
         nmsrs = kvm_get_num_msrs(vm);
         list = malloc(sizeof(*list) + nmsrs * sizeof(list->indices[0]));
         list->nmsrs = nmsrs;
@@ -1093,12 +1101,6 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
         struct vcpu *vcpu = vcpu_find(vm, vcpuid);
         int r;
 
-        if (state->nested.size) {
-                r = ioctl(vcpu->fd, KVM_SET_NESTED_STATE, &state->nested);
-                TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_NESTED_STATE, r: %i",
-                        r);
-        }
-
         r = ioctl(vcpu->fd, KVM_SET_XSAVE, &state->xsave);
         TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XSAVE, r: %i",
                 r);
@@ -1130,4 +1132,10 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
         r = ioctl(vcpu->fd, KVM_SET_REGS, &state->regs);
         TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_REGS, r: %i",
                 r);
+
+        if (state->nested.size) {
+                r = ioctl(vcpu->fd, KVM_SET_NESTED_STATE, &state->nested);
+                TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_NESTED_STATE, r: %i",
+                        r);
+        }
 }
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index c49c2a28b0eb..36669684eca5 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -123,8 +123,6 @@ int main(int argc, char *argv[])
                             stage, run->exit_reason,
                             exit_reason_str(run->exit_reason));
 
-                memset(&regs1, 0, sizeof(regs1));
-                vcpu_regs_get(vm, VCPU_ID, &regs1);
                 switch (get_ucall(vm, VCPU_ID, &uc)) {
                 case UCALL_ABORT:
                         TEST_ASSERT(false, "%s at %s:%d", (const char *)uc.args[0],
@@ -144,6 +142,9 @@ int main(int argc, char *argv[])
                             stage, (ulong)uc.args[1]);
 
                 state = vcpu_save_state(vm, VCPU_ID);
+                memset(&regs1, 0, sizeof(regs1));
+                vcpu_regs_get(vm, VCPU_ID, &regs1);
+
                 kvm_vm_release(vm);
 
                 /* Restore state in a new VM.  */
diff --git a/tools/testing/selftests/kvm/x86_64/smm_test.c b/tools/testing/selftests/kvm/x86_64/smm_test.c
new file mode 100644
index 000000000000..fb8086964d83
--- /dev/null
+++ b/tools/testing/selftests/kvm/x86_64/smm_test.c
@@ -0,0 +1,157 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2018, Red Hat, Inc.
+ *
+ * Tests for SMM.
+ */
+#define _GNU_SOURCE /* for program_invocation_short_name */
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+
+#include "kvm_util.h"
+
+#include "vmx.h"
+
+#define VCPU_ID       1
+
+#define PAGE_SIZE  4096
+
+#define SMRAM_SIZE 65536
+#define SMRAM_MEMSLOT ((1 << 16) | 1)
+#define SMRAM_PAGES (SMRAM_SIZE / PAGE_SIZE)
+#define SMRAM_GPA 0x1000000
+#define SMRAM_STAGE 0xfe
+
+#define STR(x) #x
+#define XSTR(s) STR(s)
+
+#define SYNC_PORT 0xe
+#define DONE 0xff
+
+/*
+ * This is compiled as normal 64-bit code, however, SMI handler is executed
+ * in real-address mode. To stay simple we're limiting ourselves to a mode
+ * independent subset of asm here.
+ * SMI handler always report back fixed stage SMRAM_STAGE.
+ */
+uint8_t smi_handler[] = {
+        0xb0, SMRAM_STAGE,    /* mov $SMRAM_STAGE, %al */
+        0xe4, SYNC_PORT,      /* in $SYNC_PORT, %al */
+        0x0f, 0xaa,           /* rsm */
+};
+
+void sync_with_host(uint64_t phase)
+{
+        asm volatile("in $" XSTR(SYNC_PORT)", %%al \n"
+                     : : "a" (phase));
+}
+
+void self_smi(void)
+{
+        wrmsr(APIC_BASE_MSR + (APIC_ICR >> 4),
+              APIC_DEST_SELF | APIC_INT_ASSERT | APIC_DM_SMI);
+}
+
+void guest_code(struct vmx_pages *vmx_pages)
+{
+        uint64_t apicbase = rdmsr(MSR_IA32_APICBASE);
+
+        sync_with_host(1);
+
+        wrmsr(MSR_IA32_APICBASE, apicbase | X2APIC_ENABLE);
+
+        sync_with_host(2);
+
+        self_smi();
+
+        sync_with_host(4);
+
+        if (vmx_pages) {
+                GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
+
+                sync_with_host(5);
+
+                self_smi();
+
+                sync_with_host(7);
+        }
+
+        sync_with_host(DONE);
+}
+
+int main(int argc, char *argv[])
+{
+        struct vmx_pages *vmx_pages = NULL;
+        vm_vaddr_t vmx_pages_gva = 0;
+
+        struct kvm_regs regs;
+        struct kvm_vm *vm;
+        struct kvm_run *run;
+        struct kvm_x86_state *state;
+        int stage, stage_reported;
+
+        /* Create VM */
+        vm = vm_create_default(VCPU_ID, 0, guest_code);
+
+        vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+
+        run = vcpu_state(vm, VCPU_ID);
+
+        vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, SMRAM_GPA,
+                                    SMRAM_MEMSLOT, SMRAM_PAGES, 0);
+        TEST_ASSERT(vm_phy_pages_alloc(vm, SMRAM_PAGES, SMRAM_GPA, SMRAM_MEMSLOT)
+                    == SMRAM_GPA, "could not allocate guest physical addresses?");
+
+        memset(addr_gpa2hva(vm, SMRAM_GPA), 0x0, SMRAM_SIZE);
+        memcpy(addr_gpa2hva(vm, SMRAM_GPA) + 0x8000, smi_handler,
+               sizeof(smi_handler));
+
+        vcpu_set_msr(vm, VCPU_ID, MSR_IA32_SMBASE, SMRAM_GPA);
+
+        if (kvm_check_cap(KVM_CAP_NESTED_STATE)) {
+                vmx_pages = vcpu_alloc_vmx(vm, &vmx_pages_gva);
+                vcpu_args_set(vm, VCPU_ID, 1, vmx_pages_gva);
+        } else {
+                printf("will skip SMM test with VMX enabled\n");
+                vcpu_args_set(vm, VCPU_ID, 1, 0);
+        }
+
+        for (stage = 1;; stage++) {
+                _vcpu_run(vm, VCPU_ID);
+                TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                            "Stage %d: unexpected exit reason: %u (%s),\n",
+                            stage, run->exit_reason,
+                            exit_reason_str(run->exit_reason));
+
+                memset(&regs, 0, sizeof(regs));
+                vcpu_regs_get(vm, VCPU_ID, &regs);
+
+                stage_reported = regs.rax & 0xff;
+
+                if (stage_reported == DONE)
+                        goto done;
+
+                TEST_ASSERT(stage_reported == stage ||
+                            stage_reported == SMRAM_STAGE,
+                            "Unexpected stage: #%x, got %x",
+                            stage, stage_reported);
+
+                state = vcpu_save_state(vm, VCPU_ID);
+                kvm_vm_release(vm);
+                kvm_vm_restart(vm, O_RDWR);
+                vm_vcpu_add(vm, VCPU_ID, 0, 0);
+                vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+                vcpu_load_state(vm, VCPU_ID, state);
+                run = vcpu_state(vm, VCPU_ID);
+                free(state);
+        }
+
+done:
+        kvm_vm_free(vm);
+}
diff --git a/tools/testing/selftests/kvm/x86_64/state_test.c b/tools/testing/selftests/kvm/x86_64/state_test.c
index 30f75856cf39..e0a3c0204b7c 100644
--- a/tools/testing/selftests/kvm/x86_64/state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/state_test.c
@@ -134,11 +134,6 @@ int main(int argc, char *argv[])
 
         struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
 
-        if (!kvm_check_cap(KVM_CAP_IMMEDIATE_EXIT)) {
-                fprintf(stderr, "immediate_exit not available, skipping test\n");
-                exit(KSFT_SKIP);
-        }
-
         /* Create VM */
         vm = vm_create_default(VCPU_ID, 0, guest_code);
         vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
@@ -179,18 +174,10 @@ int main(int argc, char *argv[])
                             uc.args[1] == stage, "Unexpected register values vmexit #%lx, got %lx",
                             stage, (ulong)uc.args[1]);
 
-                /*
-                 * When KVM exits to userspace with KVM_EXIT_IO, KVM guarantees
-                 * guest state is consistent only after userspace re-enters the
-                 * kernel with KVM_RUN.  Complete IO prior to migrating state
-                 * to a new VM.
-                 */
-                vcpu_run_complete_io(vm, VCPU_ID);
-
+                state = vcpu_save_state(vm, VCPU_ID);
                 memset(&regs1, 0, sizeof(regs1));
                 vcpu_regs_get(vm, VCPU_ID, &regs1);
 
-                state = vcpu_save_state(vm, VCPU_ID);
                 kvm_vm_release(vm);
 
                 /* Restore state in a new VM.  */
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 1080ff55a788..0d2a5f4f1e63 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -605,6 +605,39 @@ run_cmd()
         return $rc
 }
 
+check_expected()
+{
+        local out="$1"
+        local expected="$2"
+        local rc=0
+
+        [ "${out}" = "${expected}" ] && return 0
+
+        if [ -z "${out}" ]; then
+                if [ "$VERBOSE" = "1" ]; then
+                        printf "\nNo route entry found\n"
+                        printf "Expected:\n"
+                        printf "    ${expected}\n"
+                fi
+                return 1
+        fi
+
+        # tricky way to convert output to 1-line without ip's
+        # messy '\'; this drops all extra white space
+        out=$(echo ${out})
+        if [ "${out}" != "${expected}" ]; then
+                rc=1
+                if [ "${VERBOSE}" = "1" ]; then
+                        printf "    Unexpected route entry. Have:\n"
+                        printf "        ${out}\n"
+                        printf "    Expected:\n"
+                        printf "        ${expected}\n\n"
+                fi
+        fi
+
+        return $rc
+}
+
 # add route for a prefix, flushing any existing routes first
 # expected to be the first step of a test
 add_route6()
@@ -652,31 +685,7 @@ check_route6()
         pfx=$1
 
         out=$($IP -6 ro ls match ${pfx} | sed -e 's/ pref medium//')
-        [ "${out}" = "${expected}" ] && return 0
-
-        if [ -z "${out}" ]; then
-                if [ "$VERBOSE" = "1" ]; then
-                        printf "\nNo route entry found\n"
-                        printf "Expected:\n"
-                        printf "    ${expected}\n"
-                fi
-                return 1
-        fi
-
-        # tricky way to convert output to 1-line without ip's
-        # messy '\'; this drops all extra white space
-        out=$(echo ${out})
-        if [ "${out}" != "${expected}" ]; then
-                rc=1
-                if [ "${VERBOSE}" = "1" ]; then
-                        printf "    Unexpected route entry. Have:\n"
-                        printf "        ${out}\n"
-                        printf "    Expected:\n"
-                        printf "        ${expected}\n\n"
-                fi
-        fi
-
-        return $rc
+        check_expected "${out}" "${expected}"
 }
 
 route_cleanup()
@@ -725,7 +734,7 @@ route_setup()
         ip -netns ns2 addr add 172.16.103.2/24 dev veth4
         ip -netns ns2 addr add 172.16.104.1/24 dev dummy1
 
-        set +ex
+        set +e
 }
 
 # assumption is that basic add of a single path route works
@@ -960,7 +969,8 @@ ipv6_addr_metric_test()
         run_cmd "$IP li set dev dummy2 down"
         rc=$?
         if [ $rc -eq 0 ]; then
-                check_route6 ""
+                out=$($IP -6 ro ls match 2001:db8:104::/64)
+                check_expected "${out}" ""
                 rc=$?
         fi
         log_test $rc 0 "Prefix route removed on link down"
@@ -1091,38 +1101,13 @@ check_route()
         local pfx
         local expected="$1"
         local out
-        local rc=0
 
         set -- $expected
         pfx=$1
         [ "${pfx}" = "unreachable" ] && pfx=$2
 
         out=$($IP ro ls match ${pfx})
-        [ "${out}" = "${expected}" ] && return 0
-
-        if [ -z "${out}" ]; then
-                if [ "$VERBOSE" = "1" ]; then
-                        printf "\nNo route entry found\n"
-                        printf "Expected:\n"
-                        printf "    ${expected}\n"
-                fi
-                return 1
-        fi
-
-        # tricky way to convert output to 1-line without ip's
-        # messy '\'; this drops all extra white space
-        out=$(echo ${out})
-        if [ "${out}" != "${expected}" ]; then
-                rc=1
-                if [ "${VERBOSE}" = "1" ]; then
-                        printf "    Unexpected route entry. Have:\n"
-                        printf "        ${out}\n"
-                        printf "    Expected:\n"
-                        printf "        ${expected}\n\n"
-                fi
-        fi
-
-        return $rc
+        check_expected "${out}" "${expected}"
 }
 
 # assumption is that basic add of a single path route works
@@ -1387,7 +1372,8 @@ ipv4_addr_metric_test()
         run_cmd "$IP li set dev dummy2 down"
         rc=$?
         if [ $rc -eq 0 ]; then
-                check_route ""
+                out=$($IP ro ls match 172.16.104.0/24)
+                check_expected "${out}" ""
                 rc=$?
         fi
         log_test $rc 0 "Prefix route removed on link down"
diff --git a/tools/testing/selftests/net/run_afpackettests b/tools/testing/selftests/net/run_afpackettests
index 2dc95fda7ef7..ea5938ec009a 100755
--- a/tools/testing/selftests/net/run_afpackettests
+++ b/tools/testing/selftests/net/run_afpackettests
@@ -6,12 +6,14 @@ if [ $(id -u) != 0 ]; then
         exit 0
 fi
 
+ret=0
 echo "--------------------"
 echo "running psock_fanout test"
 echo "--------------------"
 ./in_netns.sh ./psock_fanout
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
+        ret=1
 else
         echo "[PASS]"
 fi
@@ -22,6 +24,7 @@ echo "--------------------"
 ./in_netns.sh ./psock_tpacket
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
+        ret=1
 else
         echo "[PASS]"
 fi
@@ -32,6 +35,8 @@ echo "--------------------"
 ./in_netns.sh ./txring_overwrite
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
+        ret=1
 else
         echo "[PASS]"
 fi
+exit $ret
diff --git a/tools/testing/selftests/net/run_netsocktests b/tools/testing/selftests/net/run_netsocktests
index b093f39c298c..14e41faf2c57 100755
--- a/tools/testing/selftests/net/run_netsocktests
+++ b/tools/testing/selftests/net/run_netsocktests
@@ -7,7 +7,7 @@ echo "--------------------"
 ./socket
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
+        exit 1
 else
         echo "[PASS]"
 fi
-
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
index c9ff2b47bd1c..a37cb1192c6a 100644
--- a/tools/testing/selftests/netfilter/Makefile
+++ b/tools/testing/selftests/netfilter/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for netfilter selftests
 
-TEST_PROGS := nft_trans_stress.sh nft_nat.sh
+TEST_PROGS := nft_trans_stress.sh nft_nat.sh conntrack_icmp_related.sh
 
 include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
new file mode 100755
index 000000000000..b48e1833bc89
--- /dev/null
+++ b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
@@ -0,0 +1,283 @@
+#!/bin/bash
+#
+# check that ICMP df-needed/pkttoobig icmp are set are set as related
+# state
+#
+# Setup is:
+#
+# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
+# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
+# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
+# 'fragmentation needed' icmp packet.
+#
+# In addition, nsrouter1 will perform IP masquerading, i.e. also
+# check the icmp errors are propagated to the correct host as per
+# nat of "established" icmp-echo "connection".
+
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+ret=0
+
+nft --version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without nft tool"
+        exit $ksft_skip
+fi
+
+ip -Version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without ip tool"
+        exit $ksft_skip
+fi
+
+cleanup() {
+        for i in 1 2;do ip netns del nsclient$i;done
+        for i in 1 2;do ip netns del nsrouter$i;done
+}
+
+ipv4() {
+    echo -n 192.168.$1.2
+}
+
+ipv6 () {
+    echo -n dead:$1::2
+}
+
+check_counter()
+{
+        ns=$1
+        name=$2
+        expect=$3
+        local lret=0
+
+        cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
+                ip netns exec $ns nft list counter inet filter "$name" 1>&2
+                lret=1
+        fi
+
+        return $lret
+}
+
+check_unknown()
+{
+        expect="packets 0 bytes 0"
+        for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
+                check_counter $n "unknown" "$expect"
+                if [ $? -ne 0 ] ;then
+                        return 1
+                fi
+        done
+
+        return 0
+}
+
+for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
+  ip netns add $n
+  ip -net $n link set lo up
+done
+
+DEV=veth0
+ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
+DEV=veth0
+ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
+
+DEV=veth0
+ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
+
+DEV=veth0
+for i in 1 2; do
+    ip -net nsclient$i link set $DEV up
+    ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
+    ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
+done
+
+ip -net nsrouter1 link set eth1 up
+ip -net nsrouter1 link set veth0 up
+
+ip -net nsrouter2 link set eth1 up
+ip -net nsrouter2 link set eth2 up
+
+ip -net nsclient1 route add default via 192.168.1.1
+ip -net nsclient1 -6 route add default via dead:1::1
+
+ip -net nsclient2 route add default via 192.168.2.1
+ip -net nsclient2 route add default via dead:2::1
+
+i=3
+ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
+ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
+ip -net nsrouter1 addr add dead:1::1/64 dev eth1
+ip -net nsrouter1 addr add dead:3::1/64 dev veth0
+ip -net nsrouter1 route add default via 192.168.3.10
+ip -net nsrouter1 -6 route add default via dead:3::10
+
+ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
+ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
+ip -net nsrouter2 addr add dead:2::1/64 dev eth1
+ip -net nsrouter2 addr add dead:3::10/64 dev eth2
+ip -net nsrouter2 route add default via 192.168.3.1
+ip -net nsrouter2 route add default via dead:3::1
+
+sleep 2
+for i in 4 6; do
+        ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
+        ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
+done
+
+for netns in nsrouter1 nsrouter2; do
+ip netns exec $netns nft -f - <<EOF
+table inet filter {
+        counter unknown { }
+        counter related { }
+        chain forward {
+                type filter hook forward priority 0; policy accept;
+                meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
+                meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
+                meta l4proto { icmp, icmpv6 } ct state new,established accept
+                counter name "unknown" drop
+        }
+}
+EOF
+done
+
+ip netns exec nsclient1 nft -f - <<EOF
+table inet filter {
+        counter unknown { }
+        counter related { }
+        chain input {
+                type filter hook input priority 0; policy accept;
+                meta l4proto { icmp, icmpv6 } ct state established,untracked accept
+
+                meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
+                counter name "unknown" drop
+        }
+}
+EOF
+
+ip netns exec nsclient2 nft -f - <<EOF
+table inet filter {
+        counter unknown { }
+        counter new { }
+        counter established { }
+
+        chain input {
+                type filter hook input priority 0; policy accept;
+                meta l4proto { icmp, icmpv6 } ct state established,untracked accept
+
+                meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
+                meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
+                counter name "unknown" drop
+        }
+        chain output {
+                type filter hook output priority 0; policy accept;
+                meta l4proto { icmp, icmpv6 } ct state established,untracked accept
+
+                meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
+                meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
+                counter name "unknown" drop
+        }
+}
+EOF
+
+
+# make sure NAT core rewrites adress of icmp error if nat is used according to
+# conntrack nat information (icmp error will be directed at nsrouter1 address,
+# but it needs to be routed to nsclient1 address).
+ip netns exec nsrouter1 nft -f - <<EOF
+table ip nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                ip protocol icmp oifname "veth0" counter masquerade
+        }
+}
+table ip6 nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
+        }
+}
+EOF
+
+ip netns exec nsrouter2 ip link set eth1  mtu 1280
+ip netns exec nsclient2 ip link set veth0 mtu 1280
+sleep 1
+
+ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
+if [ $? -ne 0 ]; then
+        echo "ERROR: netns ip routing/connectivity broken" 1>&2
+        cleanup
+        exit 1
+fi
+ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
+if [ $? -ne 0 ]; then
+        echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
+        cleanup
+        exit 1
+fi
+
+check_unknown
+if [ $? -ne 0 ]; then
+        ret=1
+fi
+
+expect="packets 0 bytes 0"
+for netns in nsrouter1 nsrouter2 nsclient1;do
+        check_counter "$netns" "related" "$expect"
+        if [ $? -ne 0 ]; then
+                ret=1
+        fi
+done
+
+expect="packets 2 bytes 2076"
+check_counter nsclient2 "new" "$expect"
+if [ $? -ne 0 ]; then
+        ret=1
+fi
+
+ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
+if [ $? -eq 0 ]; then
+        echo "ERROR: ping should have failed with PMTU too big error" 1>&2
+        ret=1
+fi
+
+# nsrouter2 should have generated the icmp error, so
+# related counter should be 0 (its in forward).
+expect="packets 0 bytes 0"
+check_counter "nsrouter2" "related" "$expect"
+if [ $? -ne 0 ]; then
+        ret=1
+fi
+
+# but nsrouter1 should have seen it, same for nsclient1.
+expect="packets 1 bytes 576"
+for netns in nsrouter1 nsclient1;do
+        check_counter "$netns" "related" "$expect"
+        if [ $? -ne 0 ]; then
+                ret=1
+        fi
+done
+
+ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
+if [ $? -eq 0 ]; then
+        echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
+        ret=1
+fi
+
+expect="packets 2 bytes 1856"
+for netns in nsrouter1 nsclient1;do
+        check_counter "$netns" "related" "$expect"
+        if [ $? -ne 0 ]; then
+                ret=1
+        fi
+done
+
+if [ $ret -eq 0 ];then
+        echo "PASS: icmp mtu error had RELATED state"
+else
+        echo "ERROR: icmp error RELATED state test has failed"
+fi
+
+cleanup
+exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
index 8ec76681605c..3194007cf8d1 100755
--- a/tools/testing/selftests/netfilter/nft_nat.sh
+++ b/tools/testing/selftests/netfilter/nft_nat.sh
@@ -321,6 +321,7 @@ EOF
 
 test_masquerade6()
 {
+        local natflags=$1
         local lret=0
 
         ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
@@ -354,13 +355,13 @@ ip netns exec ns0 nft -f - <<EOF
 table ip6 nat {
         chain postrouting {
                 type nat hook postrouting priority 0; policy accept;
-                meta oif veth0 masquerade
+                meta oif veth0 masquerade $natflags
         }
 }
 EOF
         ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
         if [ $? -ne 0 ] ; then
-                echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading"
+                echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags"
                 lret=1
         fi
 
@@ -397,19 +398,26 @@ EOF
                 fi
         done
 
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)"
+                lret=1
+        fi
+
         ip netns exec ns0 nft flush chain ip6 nat postrouting
         if [ $? -ne 0 ]; then
                 echo "ERROR: Could not flush ip6 nat postrouting" 1>&2
                 lret=1
         fi
 
-        test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2"
+        test $lret -eq 0 && echo "PASS: IPv6 masquerade $natflags for ns2"
 
         return $lret
 }
 
 test_masquerade()
 {
+        local natflags=$1
         local lret=0
 
         ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
@@ -417,7 +425,7 @@ test_masquerade()
 
         ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
         if [ $? -ne 0 ] ; then
-                echo "ERROR: canot ping ns1 from ns2"
+                echo "ERROR: cannot ping ns1 from ns2 $natflags"
                 lret=1
         fi
 
@@ -443,13 +451,13 @@ ip netns exec ns0 nft -f - <<EOF
 table ip nat {
         chain postrouting {
                 type nat hook postrouting priority 0; policy accept;
-                meta oif veth0 masquerade
+                meta oif veth0 masquerade $natflags
         }
 }
 EOF
         ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
         if [ $? -ne 0 ] ; then
-                echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading"
+                echo "ERROR: cannot ping ns1 from ns2 with active ip masquere $natflags"
                 lret=1
         fi
 
@@ -485,13 +493,19 @@ EOF
                 fi
         done
 
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)"
+                lret=1
+        fi
+
         ip netns exec ns0 nft flush chain ip nat postrouting
         if [ $? -ne 0 ]; then
                 echo "ERROR: Could not flush nat postrouting" 1>&2
                 lret=1
         fi
 
-        test $lret -eq 0 && echo "PASS: IP masquerade for ns2"
+        test $lret -eq 0 && echo "PASS: IP masquerade $natflags for ns2"
 
         return $lret
 }
@@ -750,8 +764,12 @@ test_local_dnat
 test_local_dnat6
 
 reset_counters
-test_masquerade
-test_masquerade6
+test_masquerade ""
+test_masquerade6 ""
+
+reset_counters
+test_masquerade "fully-random"
+test_masquerade6 "fully-random"
 
 reset_counters
 test_redirect
diff --git a/tools/testing/selftests/proc/proc-pid-vm.c b/tools/testing/selftests/proc/proc-pid-vm.c
index 7202bbac976e..853aa164a401 100644
--- a/tools/testing/selftests/proc/proc-pid-vm.c
+++ b/tools/testing/selftests/proc/proc-pid-vm.c
@@ -187,8 +187,8 @@ static int make_exe(const uint8_t *payload, size_t len)
         ph.p_offset = 0;
         ph.p_vaddr = VADDR;
         ph.p_paddr = 0;
-        ph.p_filesz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + sizeof(payload);
-        ph.p_memsz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + sizeof(payload);
+        ph.p_filesz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len;
+        ph.p_memsz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len;
         ph.p_align = 4096;
 
         fd = openat(AT_FDCWD, "/tmp", O_WRONLY|O_EXCL|O_TMPFILE, 0700);
diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c
index 762cb01f2ca7..47b7473dedef 100644
--- a/tools/testing/selftests/proc/proc-self-map-files-002.c
+++ b/tools/testing/selftests/proc/proc-self-map-files-002.c
@@ -46,12 +46,9 @@ static void fail(const char *fmt, unsigned long a, unsigned long b)
 
 int main(void)
 {
-        const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
-#ifdef __arm__
-        unsigned long va = 2 * PAGE_SIZE;
-#else
-        unsigned long va = 0;
-#endif
+        const int PAGE_SIZE = sysconf(_SC_PAGESIZE);
+        const unsigned long va_max = 1UL << 32;
+        unsigned long va;
         void *p;
         int fd;
         unsigned long a, b;
@@ -60,10 +57,13 @@ int main(void)
         if (fd == -1)
                 return 1;
 
-        p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
-        if (p == MAP_FAILED) {
-                if (errno == EPERM)
-                        return 4;
+        for (va = 0; va < va_max; va += PAGE_SIZE) {
+                p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
+                if (p == (void *)va)
+                        break;
+        }
+        if (va == va_max) {
+                fprintf(stderr, "error: mmap doesn't like you\n");
                 return 1;
         }
 
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index f69d2ee29742..5019cdae5d0b 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -2166,11 +2166,14 @@ TEST(detect_seccomp_filter_flags)
                                  SECCOMP_FILTER_FLAG_LOG,
                                  SECCOMP_FILTER_FLAG_SPEC_ALLOW,
                                  SECCOMP_FILTER_FLAG_NEW_LISTENER };
-        unsigned int flag, all_flags;
+        unsigned int exclusive[] = {
+                                SECCOMP_FILTER_FLAG_TSYNC,
+                                SECCOMP_FILTER_FLAG_NEW_LISTENER };
+        unsigned int flag, all_flags, exclusive_mask;
         int i;
         long ret;
 
-        /* Test detection of known-good filter flags */
+        /* Test detection of individual known-good filter flags */
         for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
                 int bits = 0;
 
@@ -2197,16 +2200,29 @@ TEST(detect_seccomp_filter_flags)
                 all_flags |= flag;
         }
 
-        /* Test detection of all known-good filter flags */
-        ret = seccomp(SECCOMP_SET_MODE_FILTER, all_flags, NULL);
-        EXPECT_EQ(-1, ret);
-        EXPECT_EQ(EFAULT, errno) {
-                TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
-                       all_flags);
+        /*
+         * Test detection of all known-good filter flags combined. But
+         * for the exclusive flags we need to mask them out and try them
+         * individually for the "all flags" testing.
+         */
+        exclusive_mask = 0;
+        for (i = 0; i < ARRAY_SIZE(exclusive); i++)
+                exclusive_mask |= exclusive[i];
+        for (i = 0; i < ARRAY_SIZE(exclusive); i++) {
+                flag = all_flags & ~exclusive_mask;
+                flag |= exclusive[i];
+
+                ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
+                EXPECT_EQ(-1, ret);
+                EXPECT_EQ(EFAULT, errno) {
+                        TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
+                               flag);
+                }
         }
 
-        /* Test detection of an unknown filter flag */
+        /* Test detection of an unknown filter flags, without exclusives. */
         flag = -1;
+        flag &= ~exclusive_mask;
         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
         EXPECT_EQ(-1, ret);
         EXPECT_EQ(EINVAL, errno) {
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
index 27f0acaed880..ddabb160a11b 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
@@ -144,6 +144,30 @@
         ]
     },
     {
+        "id": "7571",
+        "name": "Add sample action with invalid rate",
+        "category": [
+            "actions",
+            "sample"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action sample",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action sample rate 0 group 1 index 2",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions get action sample index 2",
+        "matchPattern": "action order [0-9]+: sample rate 1/0 group 1.*index 2 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action sample"
+        ]
+    },
+    {
         "id": "b6d4",
         "name": "Add sample action with mandatory arguments and invalid control action",
         "category": [
diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
index 99a5ffca1088..2d096b2abf2c 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
@@ -19,6 +19,26 @@
         ]
     },
     {
+        "id": "2638",
+        "name": "Add matchall and try to get it",
+        "category": [
+            "filter",
+            "matchall"
+        ],
+        "setup": [
+            "$TC qdisc add dev $DEV1 clsact",
+            "$TC filter add dev $DEV1 protocol all pref 1 ingress handle 0x1234 matchall action ok"
+        ],
+        "cmdUnderTest": "$TC filter get dev $DEV1 protocol all pref 1 ingress handle 0x1234 matchall",
+        "expExitCode": "0",
+        "verifyCmd": "$TC filter show dev $DEV1 ingress",
+        "matchPattern": "filter protocol all pref 1 matchall chain 0 handle 0x1234",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DEV1 clsact"
+        ]
+    },
+    {
         "id": "d052",
         "name": "Add 1M filters with the same action",
         "category": [
diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py
index 40ea95ce2ead..828c18584624 100644
--- a/tools/testing/selftests/tpm2/tpm2.py
+++ b/tools/testing/selftests/tpm2/tpm2.py
@@ -22,6 +22,7 @@ TPM2_CC_UNSEAL = 0x015E
 TPM2_CC_FLUSH_CONTEXT = 0x0165
 TPM2_CC_START_AUTH_SESSION = 0x0176
 TPM2_CC_GET_CAPABILITY  = 0x017A
+TPM2_CC_GET_RANDOM = 0x017B
 TPM2_CC_PCR_READ = 0x017E
 TPM2_CC_POLICY_PCR = 0x017F
 TPM2_CC_PCR_EXTEND = 0x0182
@@ -357,9 +358,9 @@ class Client:
         self.flags = flags
 
         if (self.flags & Client.FLAG_SPACE) == 0:
-            self.tpm = open('/dev/tpm0', 'r+b')
+            self.tpm = open('/dev/tpm0', 'r+b', buffering=0)
         else:
-            self.tpm = open('/dev/tpmrm0', 'r+b')
+            self.tpm = open('/dev/tpmrm0', 'r+b', buffering=0)
 
     def close(self):
         self.tpm.close()
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index 3bb066fea4a0..d4973be53493 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -158,6 +158,69 @@ class SmokeTest(unittest.TestCase):
             pass
         self.assertEqual(rejected, True)
 
+    def test_read_partial_resp(self):
+        try:
+            fmt = '>HIIH'
+            cmd = struct.pack(fmt,
+                              tpm2.TPM2_ST_NO_SESSIONS,
+                              struct.calcsize(fmt),
+                              tpm2.TPM2_CC_GET_RANDOM,
+                              0x20)
+            self.client.tpm.write(cmd)
+            hdr = self.client.tpm.read(10)
+            sz = struct.unpack('>I', hdr[2:6])[0]
+            rsp = self.client.tpm.read()
+        except:
+            pass
+        self.assertEqual(sz, 10 + 2 + 32)
+        self.assertEqual(len(rsp), 2 + 32)
+
+    def test_read_partial_overwrite(self):
+        try:
+            fmt = '>HIIH'
+            cmd = struct.pack(fmt,
+                              tpm2.TPM2_ST_NO_SESSIONS,
+                              struct.calcsize(fmt),
+                              tpm2.TPM2_CC_GET_RANDOM,
+                              0x20)
+            self.client.tpm.write(cmd)
+            # Read part of the respone
+            rsp1 = self.client.tpm.read(15)
+
+            # Send a new cmd
+            self.client.tpm.write(cmd)
+
+            # Read the whole respone
+            rsp2 = self.client.tpm.read()
+        except:
+            pass
+        self.assertEqual(len(rsp1), 15)
+        self.assertEqual(len(rsp2), 10 + 2 + 32)
+
+    def test_send_two_cmds(self):
+        rejected = False
+        try:
+            fmt = '>HIIH'
+            cmd = struct.pack(fmt,
+                              tpm2.TPM2_ST_NO_SESSIONS,
+                              struct.calcsize(fmt),
+                              tpm2.TPM2_CC_GET_RANDOM,
+                              0x20)
+            self.client.tpm.write(cmd)
+
+            # expect the second one to raise -EBUSY error
+            self.client.tpm.write(cmd)
+            rsp = self.client.tpm.read()
+
+        except IOError, e:
+            # read the response
+            rsp = self.client.tpm.read()
+            rejected = True
+            pass
+        except:
+            pass
+        self.assertEqual(rejected, True)
+
 class SpaceTest(unittest.TestCase):
     def setUp(self):
         logging.basicConfig(filename='SpaceTest.log', level=logging.DEBUG)
diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
index 3547b0d8c91e..79e59e4fa3dc 100644
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -144,18 +144,19 @@ static int setup_routing_entry(struct kvm *kvm,
 {
         struct kvm_kernel_irq_routing_entry *ei;
         int r;
+        u32 gsi = array_index_nospec(ue->gsi, KVM_MAX_IRQ_ROUTES);
 
         /*
          * Do not allow GSI to be mapped to the same irqchip more than once.
          * Allow only one to one mapping between GSI and non-irqchip routing.
          */
-        hlist_for_each_entry(ei, &rt->map[ue->gsi], link)
+        hlist_for_each_entry(ei, &rt->map[gsi], link)
                 if (ei->type != KVM_IRQ_ROUTING_IRQCHIP ||
                     ue->type != KVM_IRQ_ROUTING_IRQCHIP ||
                     ue->u.irqchip.irqchip == ei->irqchip.irqchip)
                         return -EINVAL;
 
-        e->gsi = ue->gsi;
+        e->gsi = gsi;
         e->type = ue->type;
         r = kvm_set_routing_entry(kvm, e, ue);
         if (r)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 55fe8e20d8fd..dc8edc97ba85 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2977,12 +2977,14 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         struct kvm_device_ops *ops = NULL;
         struct kvm_device *dev;
         bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
+        int type;
         int ret;
 
         if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
                 return -ENODEV;
 
-        ops = kvm_device_ops_table[cd->type];
+        type = array_index_nospec(cd->type, ARRAY_SIZE(kvm_device_ops_table));
+        ops = kvm_device_ops_table[type];
         if (ops == NULL)
                 return -ENODEV;
 
@@ -2997,7 +2999,7 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         dev->kvm = kvm;
 
         mutex_lock(&kvm->lock);
-        ret = ops->create(dev, cd->type);
+        ret = ops->create(dev, type);
         if (ret < 0) {
                 mutex_unlock(&kvm->lock);
                 kfree(dev);