1124 files changed, 13115 insertions, 6773 deletions

diff --git a/.mailmap b/.mailmap
index a76be45fef6c..28fecafa6506 100644
--- a/.mailmap
+++ b/.mailmap
@@ -159,6 +159,7 @@ Peter Oruba <peter@oruba.de>
 Peter Oruba <peter.oruba@amd.com>
 Pratyush Anand <pratyush.anand@gmail.com> <pratyush.anand@st.com>
 Praveen BP <praveenbp@ti.com>
+Punit Agrawal <punitagrawal@gmail.com> <punit.agrawal@arm.com>
 Qais Yousef <qsyousef@gmail.com> <qais.yousef@imgtec.com>
 Oleksij Rempel <linux@rempel-privat.de> <bug-track@fisher-privat.net>
 Oleksij Rempel <linux@rempel-privat.de> <external.Oleksij.Rempel@de.bosch.com>
diff --git a/CREDITS b/CREDITS
index 5befd2d714d0..c9273393fe14 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2138,6 +2138,10 @@ E: paul@laufernet.com
 D: Soundblaster driver fixes, ISAPnP quirk
 S: California, USA
 
+N: Jarkko Lavinen
+E: jarkko.lavinen@nokia.com
+D: OMAP MMC support
+
 N: Jonathan Layes
 D: ARPD support
 
@@ -2200,6 +2204,10 @@ S: Post Office Box 371
 S: North Little Rock, Arkansas 72115
 S: USA
 
+N: Christopher Li
+E: sparse@chrisli.org
+D: Sparse maintainer 2009 - 2018
+
 N: Stephan Linz
 E: linz@mazet.de
 E: Stephan.Linz@gmx.de
diff --git a/Documentation/ABI/testing/sysfs-class-led-trigger-pattern b/Documentation/ABI/testing/sysfs-class-led-trigger-pattern
index fb3d1e03b881..1e5d172e0646 100644
--- a/Documentation/ABI/testing/sysfs-class-led-trigger-pattern
+++ b/Documentation/ABI/testing/sysfs-class-led-trigger-pattern
@@ -37,8 +37,8 @@ Description:
                   0-|   /             \/             \/
                     +---0----1----2----3----4----5----6------------> time (s)
 
-                2. To make the LED go instantly from one brigntess value to another,
-                we should use use zero-time lengths (the brightness must be same as
+                2. To make the LED go instantly from one brightness value to another,
+                we should use zero-time lengths (the brightness must be same as
                 the previous tuple's). So the format should be:
                 "brightness_1 duration_1 brightness_1 0 brightness_2 duration_2
                 brightness_2 0 ...". For example:
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 81d1d5a74728..aefd358a5ca3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -856,7 +856,8 @@
                         causing system reset or hang due to sending
                         INIT from AP to BSP.
 
-        disable_counter_freezing [HW]
+        perf_v4_pmi=    [X86,INTEL]
+                        Format: <bool>
                         Disable Intel PMU counter freezing feature.
                         The feature only exists starting from
                         Arch Perfmon v4 (Skylake and newer).
@@ -3504,6 +3505,10 @@
                         before loading.
                         See Documentation/blockdev/ramdisk.txt.
 
+        psi=            [KNL] Enable or disable pressure stall information
+                        tracking.
+                        Format: <bool>
+
         psmouse.proto=  [HW,MOUSE] Highest PS2 mouse protocol extension to
                         probe for; one of (bare|imps|exps|lifebook|any).
         psmouse.rate=   [HW,MOUSE] Set desired mouse report rate, in reports
@@ -4194,9 +4199,13 @@
 
         spectre_v2=     [X86] Control mitigation of Spectre variant 2
                         (indirect branch speculation) vulnerability.
+                        The default operation protects the kernel from
+                        user space attacks.
 
-                        on   - unconditionally enable
-                        off  - unconditionally disable
+                        on   - unconditionally enable, implies
+                               spectre_v2_user=on
+                        off  - unconditionally disable, implies
+                               spectre_v2_user=off
                         auto - kernel detects whether your CPU model is
                                vulnerable
 
@@ -4206,6 +4215,12 @@
                         CONFIG_RETPOLINE configuration option, and the
                         compiler with which the kernel was built.
 
+                        Selecting 'on' will also enable the mitigation
+                        against user space to user space task attacks.
+
+                        Selecting 'off' will disable both the kernel and
+                        the user space protections.
+
                         Specific mitigations can also be selected manually:
 
                         retpoline         - replace indirect branches
@@ -4215,6 +4230,48 @@
                         Not specifying this option is equivalent to
                         spectre_v2=auto.
 
+        spectre_v2_user=
+                        [X86] Control mitigation of Spectre variant 2
+                        (indirect branch speculation) vulnerability between
+                        user space tasks
+
+                        on      - Unconditionally enable mitigations. Is
+                                  enforced by spectre_v2=on
+
+                        off     - Unconditionally disable mitigations. Is
+                                  enforced by spectre_v2=off
+
+                        prctl   - Indirect branch speculation is enabled,
+                                  but mitigation can be enabled via prctl
+                                  per thread.  The mitigation control state
+                                  is inherited on fork.
+
+                        prctl,ibpb
+                                - Like "prctl" above, but only STIBP is
+                                  controlled per thread. IBPB is issued
+                                  always when switching between different user
+                                  space processes.
+
+                        seccomp
+                                - Same as "prctl" above, but all seccomp
+                                  threads will enable the mitigation unless
+                                  they explicitly opt out.
+
+                        seccomp,ibpb
+                                - Like "seccomp" above, but only STIBP is
+                                  controlled per thread. IBPB is issued
+                                  always when switching between different
+                                  user space processes.
+
+                        auto    - Kernel selects the mitigation depending on
+                                  the available CPU features and vulnerability.
+
+                        Default mitigation:
+                        If CONFIG_SECCOMP=y then "seccomp", otherwise "prctl"
+
+                        Not specifying this option is equivalent to
+                        spectre_v2_user=auto.
+
         spec_store_bypass_disable=
                         [HW] Control Speculative Store Bypass (SSB) Disable mitigation
                         (Speculative Store Bypass vulnerability)
@@ -4713,6 +4770,8 @@
                                         prevent spurious wakeup);
                                 n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a
                                         pause after every control message);
+                                o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra
+                                        delay after resetting its port);
                         Example: quirks=0781:5580:bk,0a5c:5834:gij
 
         usbhid.mousepoll=
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 47153e64dfb5..7eca9026a9ed 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -150,7 +150,7 @@ data structures necessary to handle the given policy and, possibly, to add
 a governor ``sysfs`` interface to it.  Next, the governor is started by
 invoking its ``->start()`` callback.
 
-That callback it expected to register per-CPU utilization update callbacks for
+That callback is expected to register per-CPU utilization update callbacks for
 all of the online CPUs belonging to the given policy with the CPU scheduler.
 The utilization update callbacks will be invoked by the CPU scheduler on
 important events, like task enqueue and dequeue, on every iteration of the
diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
index 164bf71149fd..30187d49dc2c 100644
--- a/Documentation/admin-guide/security-bugs.rst
+++ b/Documentation/admin-guide/security-bugs.rst
@@ -32,16 +32,17 @@ Disclosure and embargoed information
 The security list is not a disclosure channel.  For that, see Coordination
 below.
 
-Once a robust fix has been developed, our preference is to release the
-fix in a timely fashion, treating it no differently than any of the other
-thousands of changes and fixes the Linux kernel project releases every
-month.
-
-However, at the request of the reporter, we will postpone releasing the
-fix for up to 5 business days after the date of the report or after the
-embargo has lifted; whichever comes first.  The only exception to that
-rule is if the bug is publicly known, in which case the preference is to
-release the fix as soon as it's available.
+Once a robust fix has been developed, the release process starts.  Fixes
+for publicly known bugs are released immediately.
+
+Although our preference is to release fixes for publicly undisclosed bugs
+as soon as they become available, this may be postponed at the request of
+the reporter or an affected party for up to 7 calendar days from the start
+of the release process, with an exceptional extension to 14 calendar days
+if it is agreed that the criticality of the bug requires more time.  The
+only valid reason for deferring the publication of a fix is to accommodate
+the logistics of QA and large scale rollouts which require release
+coordination.
 
 Whilst embargoed information may be shared with trusted individuals in
 order to develop a fix, such information will not be published alongside
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index 76ccded8b74c..8f9577621144 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -57,6 +57,7 @@ stable kernels.
 | ARM            | Cortex-A73      | #858921         | ARM64_ERRATUM_858921        |
 | ARM            | Cortex-A55      | #1024718        | ARM64_ERRATUM_1024718       |
 | ARM            | Cortex-A76      | #1188873        | ARM64_ERRATUM_1188873       |
+| ARM            | Cortex-A76      | #1286807        | ARM64_ERRATUM_1286807       |
 | ARM            | MMU-500         | #841119,#826419 | N/A                         |
 |                |                 |                 |                             |
 | Cavium         | ThunderX ITS    | #22375, #24313  | CAVIUM_ERRATUM_22375        |
diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index a4e705108f42..dbe96cb5558e 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -74,7 +74,8 @@ using :c:func:`xa_load`.  xa_store will overwrite any entry with the
 new entry and return the previous entry stored at that index.  You can
 use :c:func:`xa_erase` instead of calling :c:func:`xa_store` with a
 ``NULL`` entry.  There is no difference between an entry that has never
-been stored to and one that has most recently had ``NULL`` stored to it.
+been stored to, one that has been erased and one that has most recently
+had ``NULL`` stored to it.
 
 You can conditionally replace an entry at an index by using
 :c:func:`xa_cmpxchg`.  Like :c:func:`cmpxchg`, it will only succeed if
@@ -105,23 +106,44 @@ may result in the entry being marked at some, but not all of the other
 indices.  Storing into one index may result in the entry retrieved by
 some, but not all of the other indices changing.
 
+Sometimes you need to ensure that a subsequent call to :c:func:`xa_store`
+will not need to allocate memory.  The :c:func:`xa_reserve` function
+will store a reserved entry at the indicated index.  Users of the normal
+API will see this entry as containing ``NULL``.  If you do not need to
+use the reserved entry, you can call :c:func:`xa_release` to remove the
+unused entry.  If another user has stored to the entry in the meantime,
+:c:func:`xa_release` will do nothing; if instead you want the entry to
+become ``NULL``, you should use :c:func:`xa_erase`.
+
+If all entries in the array are ``NULL``, the :c:func:`xa_empty` function
+will return ``true``.
+
 Finally, you can remove all entries from an XArray by calling
 :c:func:`xa_destroy`.  If the XArray entries are pointers, you may wish
 to free the entries first.  You can do this by iterating over all present
 entries in the XArray using the :c:func:`xa_for_each` iterator.
 
-ID assignment
--------------
+Allocating XArrays
+------------------
+
+If you use :c:func:`DEFINE_XARRAY_ALLOC` to define the XArray, or
+initialise it by passing ``XA_FLAGS_ALLOC`` to :c:func:`xa_init_flags`,
+the XArray changes to track whether entries are in use or not.
 
 You can call :c:func:`xa_alloc` to store the entry at any unused index
 in the XArray.  If you need to modify the array from interrupt context,
 you can use :c:func:`xa_alloc_bh` or :c:func:`xa_alloc_irq` to disable
-interrupts while allocating the ID.  Unlike :c:func:`xa_store`, allocating
-a ``NULL`` pointer does not delete an entry.  Instead it reserves an
-entry like :c:func:`xa_reserve` and you can release it using either
-:c:func:`xa_erase` or :c:func:`xa_release`.  To use ID assignment, the
-XArray must be defined with :c:func:`DEFINE_XARRAY_ALLOC`, or initialised
-by passing ``XA_FLAGS_ALLOC`` to :c:func:`xa_init_flags`,
+interrupts while allocating the ID.
+
+Using :c:func:`xa_store`, :c:func:`xa_cmpxchg` or :c:func:`xa_insert`
+will mark the entry as being allocated.  Unlike a normal XArray, storing
+``NULL`` will mark the entry as being in use, like :c:func:`xa_reserve`.
+To free an entry, use :c:func:`xa_erase` (or :c:func:`xa_release` if
+you only want to free the entry if it's ``NULL``).
+
+You cannot use ``XA_MARK_0`` with an allocating XArray as this mark
+is used to track whether an entry is free or not.  The other marks are
+available for your use.
 
 Memory allocation
 -----------------
@@ -158,6 +180,8 @@ Takes RCU read lock:
 
 Takes xa_lock internally:
  * :c:func:`xa_store`
+ * :c:func:`xa_store_bh`
+ * :c:func:`xa_store_irq`
  * :c:func:`xa_insert`
  * :c:func:`xa_erase`
  * :c:func:`xa_erase_bh`
@@ -167,6 +191,9 @@ Takes xa_lock internally:
  * :c:func:`xa_alloc`
  * :c:func:`xa_alloc_bh`
  * :c:func:`xa_alloc_irq`
+ * :c:func:`xa_reserve`
+ * :c:func:`xa_reserve_bh`
+ * :c:func:`xa_reserve_irq`
  * :c:func:`xa_destroy`
  * :c:func:`xa_set_mark`
  * :c:func:`xa_clear_mark`
@@ -177,6 +204,7 @@ Assumes xa_lock held on entry:
  * :c:func:`__xa_erase`
  * :c:func:`__xa_cmpxchg`
  * :c:func:`__xa_alloc`
+ * :c:func:`__xa_reserve`
  * :c:func:`__xa_set_mark`
  * :c:func:`__xa_clear_mark`
 
@@ -234,7 +262,8 @@ Sharing the XArray with interrupt context is also possible, either
 using :c:func:`xa_lock_irqsave` in both the interrupt handler and process
 context, or :c:func:`xa_lock_irq` in process context and :c:func:`xa_lock`
 in the interrupt handler.  Some of the more common patterns have helper
-functions such as :c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
+functions such as :c:func:`xa_store_bh`, :c:func:`xa_store_irq`,
+:c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
 
 Sometimes you need to protect access to the XArray with a mutex because
 that lock sits above another mutex in the locking hierarchy.  That does
@@ -322,7 +351,8 @@ to :c:func:`xas_retry`, and retry the operation if it returns ``true``.
      - :c:func:`xa_is_zero`
      - Zero entries appear as ``NULL`` through the Normal API, but occupy
        an entry in the XArray which can be used to reserve the index for
-       future use.
+       future use.  This is used by allocating XArrays for allocated entries
+       which are ``NULL``.
 
 Other internal entries may be added in the future.  As far as possible, they
 will be handled by :c:func:`xas_retry`.
diff --git a/Documentation/cpu-freq/cpufreq-stats.txt b/Documentation/cpu-freq/cpufreq-stats.txt
index a873855c811d..14378cecb172 100644
--- a/Documentation/cpu-freq/cpufreq-stats.txt
+++ b/Documentation/cpu-freq/cpufreq-stats.txt
@@ -86,9 +86,11 @@ transitions.
 This will give a fine grained information about all the CPU frequency
 transitions. The cat output here is a two dimensional matrix, where an entry
 <i,j> (row i, column j) represents the count of number of transitions from 
-Freq_i to Freq_j. Freq_i is in descending order with increasing rows and 
-Freq_j is in descending order with increasing columns. The output here also 
-contains the actual freq values for each row and column for better readability.
+Freq_i to Freq_j. Freq_i rows and Freq_j columns follow the sorting order in
+which the driver has provided the frequency table initially to the cpufreq core
+and so can be sorted (ascending or descending) or unsorted.  The output here
+also contains the actual freq values for each row and column for better
+readability.
 
 If the transition table is bigger than PAGE_SIZE, reading this will
 return an -EFBIG error.
diff --git a/Documentation/devicetree/bindings/arm/shmobile.txt b/Documentation/devicetree/bindings/arm/shmobile.txt
index f5e0f82fd503..58c4256d37a3 100644
--- a/Documentation/devicetree/bindings/arm/shmobile.txt
+++ b/Documentation/devicetree/bindings/arm/shmobile.txt
@@ -27,7 +27,7 @@ SoCs:
     compatible = "renesas,r8a77470"
   - RZ/G2M (R8A774A1)
     compatible = "renesas,r8a774a1"
-  - RZ/G2E (RA8774C0)
+  - RZ/G2E (R8A774C0)
     compatible = "renesas,r8a774c0"
   - R-Car M1A (R8A77781)
     compatible = "renesas,r8a7778"
diff --git a/Documentation/devicetree/bindings/cpufreq/arm_big_little_dt.txt b/Documentation/devicetree/bindings/cpufreq/arm_big_little_dt.txt
deleted file mode 100644
index 2aa06ac0fac5..000000000000
--- a/Documentation/devicetree/bindings/cpufreq/arm_big_little_dt.txt
+++ /dev/null
@@ -1,65 +0,0 @@
-Generic ARM big LITTLE cpufreq driver's DT glue
------------------------------------------------
-
-This is DT specific glue layer for generic cpufreq driver for big LITTLE
-systems.
-
-Both required and optional properties listed below must be defined
-under node /cpus/cpu@x. Where x is the first cpu inside a cluster.
-
-FIXME: Cpus should boot in the order specified in DT and all cpus for a cluster
-must be present contiguously. Generic DT driver will check only node 'x' for
-cpu:x.
-
-Required properties:
-- operating-points: Refer to Documentation/devicetree/bindings/opp/opp.txt
-  for details
-
-Optional properties:
-- clock-latency: Specify the possible maximum transition latency for clock,
-  in unit of nanoseconds.
-
-Examples:
-
-cpus {
-        #address-cells = <1>;
-        #size-cells = <0>;
-
-        cpu@0 {
-                compatible = "arm,cortex-a15";
-                reg = <0>;
-                next-level-cache = <&L2>;
-                operating-points = <
-                        /* kHz    uV */
-                        792000  1100000
-                        396000  950000
-                        198000  850000
-                >;
-                clock-latency = <61036>; /* two CLK32 periods */
-        };
-
-        cpu@1 {
-                compatible = "arm,cortex-a15";
-                reg = <1>;
-                next-level-cache = <&L2>;
-        };
-
-        cpu@100 {
-                compatible = "arm,cortex-a7";
-                reg = <100>;
-                next-level-cache = <&L2>;
-                operating-points = <
-                        /* kHz    uV */
-                        792000  950000
-                        396000  750000
-                        198000  450000
-                >;
-                clock-latency = <61036>; /* two CLK32 periods */
-        };
-
-        cpu@101 {
-                compatible = "arm,cortex-a7";
-                reg = <101>;
-                next-level-cache = <&L2>;
-        };
-};
diff --git a/Documentation/devicetree/bindings/i2c/i2c-omap.txt b/Documentation/devicetree/bindings/i2c/i2c-omap.txt
index 7e49839d4124..4b90ba9f31b7 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-omap.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-omap.txt
@@ -1,8 +1,12 @@
 I2C for OMAP platforms
 
 Required properties :
-- compatible : Must be "ti,omap2420-i2c", "ti,omap2430-i2c", "ti,omap3-i2c"
-  or "ti,omap4-i2c"
+- compatible : Must be
+        "ti,omap2420-i2c" for OMAP2420 SoCs
+        "ti,omap2430-i2c" for OMAP2430 SoCs
+        "ti,omap3-i2c" for OMAP3 SoCs
+        "ti,omap4-i2c" for OMAP4+ SoCs
+        "ti,am654-i2c", "ti,omap4-i2c" for AM654 SoCs
 - ti,hwmods : Must be "i2c<n>", n being the instance number (1-based)
 - #address-cells = <1>;
 - #size-cells = <0>;
diff --git a/Documentation/devicetree/bindings/input/input-reset.txt b/Documentation/devicetree/bindings/input/input-reset.txt
index 2bb2626fdb78..1ca6cc5ebf8e 100644
--- a/Documentation/devicetree/bindings/input/input-reset.txt
+++ b/Documentation/devicetree/bindings/input/input-reset.txt
@@ -12,7 +12,7 @@ The /chosen node should contain a 'linux,sysrq-reset-seq' child node to define
 a set of keys.
 
 Required property:
-sysrq-reset-seq: array of Linux keycodes, one keycode per cell.
+keyset: array of Linux keycodes, one keycode per cell.
 
 Optional property:
 timeout-ms: duration keys must be pressed together in milliseconds before
diff --git a/Documentation/devicetree/bindings/media/rockchip-vpu.txt b/Documentation/devicetree/bindings/media/rockchip-vpu.txt
deleted file mode 100644
index 35dc464ad7c8..000000000000
--- a/Documentation/devicetree/bindings/media/rockchip-vpu.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-device-tree bindings for rockchip VPU codec
-
-Rockchip (Video Processing Unit) present in various Rockchip platforms,
-such as RK3288 and RK3399.
-
-Required properties:
-- compatible: value should be one of the following
-                "rockchip,rk3288-vpu";
-                "rockchip,rk3399-vpu";
-- interrupts: encoding and decoding interrupt specifiers
-- interrupt-names: should be "vepu" and "vdpu"
-- clocks: phandle to VPU aclk, hclk clocks
-- clock-names: should be "aclk" and "hclk"
-- power-domains: phandle to power domain node
-- iommus: phandle to a iommu node
-
-Example:
-SoC-specific DT entry:
-        vpu: video-codec@ff9a0000 {
-                compatible = "rockchip,rk3288-vpu";
-                reg = <0x0 0xff9a0000 0x0 0x800>;
-                interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
-                             <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
-                interrupt-names = "vepu", "vdpu";
-                clocks = <&cru ACLK_VCODEC>, <&cru HCLK_VCODEC>;
-                clock-names = "aclk", "hclk";
-                power-domains = <&power RK3288_PD_VIDEO>;
-                iommus = <&vpu_mmu>;
-        };
diff --git a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
index 903a78da65be..3a9926f99937 100644
--- a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+++ b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
@@ -17,7 +17,7 @@ Example:
                 reg = <1>;
                 clocks = <&clk32m>;
                 interrupt-parent = <&gpio4>;
-                interrupts = <13 IRQ_TYPE_EDGE_RISING>;
+                interrupts = <13 IRQ_TYPE_LEVEL_HIGH>;
                 vdd-supply = <&reg5v0>;
                 xceiver-supply = <&reg5v0>;
         };
diff --git a/Documentation/devicetree/bindings/net/can/rcar_can.txt b/Documentation/devicetree/bindings/net/can/rcar_can.txt
index cc4372842bf3..9936b9ee67c3 100644
--- a/Documentation/devicetree/bindings/net/can/rcar_can.txt
+++ b/Documentation/devicetree/bindings/net/can/rcar_can.txt
@@ -5,6 +5,7 @@ Required properties:
 - compatible: "renesas,can-r8a7743" if CAN controller is a part of R8A7743 SoC.
               "renesas,can-r8a7744" if CAN controller is a part of R8A7744 SoC.
               "renesas,can-r8a7745" if CAN controller is a part of R8A7745 SoC.
+              "renesas,can-r8a774a1" if CAN controller is a part of R8A774A1 SoC.
               "renesas,can-r8a7778" if CAN controller is a part of R8A7778 SoC.
               "renesas,can-r8a7779" if CAN controller is a part of R8A7779 SoC.
               "renesas,can-r8a7790" if CAN controller is a part of R8A7790 SoC.
@@ -14,26 +15,32 @@ Required properties:
               "renesas,can-r8a7794" if CAN controller is a part of R8A7794 SoC.
               "renesas,can-r8a7795" if CAN controller is a part of R8A7795 SoC.
               "renesas,can-r8a7796" if CAN controller is a part of R8A7796 SoC.
+              "renesas,can-r8a77965" if CAN controller is a part of R8A77965 SoC.
               "renesas,rcar-gen1-can" for a generic R-Car Gen1 compatible device.
               "renesas,rcar-gen2-can" for a generic R-Car Gen2 or RZ/G1
               compatible device.
-              "renesas,rcar-gen3-can" for a generic R-Car Gen3 compatible device.
+              "renesas,rcar-gen3-can" for a generic R-Car Gen3 or RZ/G2
+              compatible device.
               When compatible with the generic version, nodes must list the
               SoC-specific version corresponding to the platform first
               followed by the generic version.
 
 - reg: physical base address and size of the R-Car CAN register map.
 - interrupts: interrupt specifier for the sole interrupt.
-- clocks: phandles and clock specifiers for 3 CAN clock inputs.
-- clock-names: 3 clock input name strings: "clkp1", "clkp2", "can_clk".
+- clocks: phandles and clock specifiers for 2 CAN clock inputs for RZ/G2
+          devices.
+          phandles and clock specifiers for 3 CAN clock inputs for every other
+          SoC.
+- clock-names: 2 clock input name strings for RZ/G2: "clkp1", "can_clk".
+               3 clock input name strings for every other SoC: "clkp1", "clkp2",
+               "can_clk".
 - pinctrl-0: pin control group to be used for this controller.
 - pinctrl-names: must be "default".
 
-Required properties for "renesas,can-r8a7795" and "renesas,can-r8a7796"
-compatible:
-In R8A7795 and R8A7796 SoCs, "clkp2" can be CANFD clock. This is a div6 clock
-and can be used by both CAN and CAN FD controller at the same time. It needs to
-be scaled to maximum frequency if any of these controllers use it. This is done
+Required properties for R8A7795, R8A7796 and R8A77965:
+For the denoted SoCs, "clkp2" can be CANFD clock. This is a div6 clock and can
+be used by both CAN and CAN FD controller at the same time. It needs to be
+scaled to maximum frequency if any of these controllers use it. This is done
 using the below properties:
 
 - assigned-clocks: phandle of clkp2(CANFD) clock.
@@ -42,8 +49,9 @@ using the below properties:
 Optional properties:
 - renesas,can-clock-select: R-Car CAN Clock Source Select. Valid values are:
                             <0x0> (default) : Peripheral clock (clkp1)
-                            <0x1> : Peripheral clock (clkp2)
-                            <0x3> : Externally input clock
+                            <0x1> : Peripheral clock (clkp2) (not supported by
+                                    RZ/G2 devices)
+                            <0x3> : External input clock
 
 Example
 -------
diff --git a/Documentation/devicetree/bindings/net/dsa/dsa.txt b/Documentation/devicetree/bindings/net/dsa/dsa.txt
index 3ceeb8de1196..35694c0c376b 100644
--- a/Documentation/devicetree/bindings/net/dsa/dsa.txt
+++ b/Documentation/devicetree/bindings/net/dsa/dsa.txt
@@ -7,7 +7,7 @@ limitations.
 Current Binding
 ---------------
 
-Switches are true Linux devices and can be probes by any means. Once
+Switches are true Linux devices and can be probed by any means. Once
 probed, they register to the DSA framework, passing a node
 pointer. This node is expected to fulfil the following binding, and
 may contain additional properties as required by the device it is
diff --git a/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt b/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt
index adf20b2bdf71..fbc198d5dd39 100644
--- a/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt
+++ b/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt
@@ -40,24 +40,36 @@ Required properties:
                 "ref" for 19.2 MHz ref clk,
                 "com_aux" for phy common block aux clock,
                 "ref_aux" for phy reference aux clock,
+
+                For "qcom,ipq8074-qmp-pcie-phy": no clocks are listed.
                 For "qcom,msm8996-qmp-pcie-phy" must contain:
                         "aux", "cfg_ahb", "ref".
                 For "qcom,msm8996-qmp-usb3-phy" must contain:
                         "aux", "cfg_ahb", "ref".
-                For "qcom,qmp-v3-usb3-phy" must contain:
+                For "qcom,sdm845-qmp-usb3-phy" must contain:
+                        "aux", "cfg_ahb", "ref", "com_aux".
+                For "qcom,sdm845-qmp-usb3-uni-phy" must contain:
                         "aux", "cfg_ahb", "ref", "com_aux".
+                For "qcom,sdm845-qmp-ufs-phy" must contain:
+                        "ref", "ref_aux".
 
  - resets: a list of phandles and reset controller specifier pairs,
            one for each entry in reset-names.
  - reset-names: "phy" for reset of phy block,
                 "common" for phy common block reset,
-                "cfg" for phy's ahb cfg block reset (Optional).
+                "cfg" for phy's ahb cfg block reset.
+
+                For "qcom,ipq8074-qmp-pcie-phy" must contain:
+                        "phy", "common".
                 For "qcom,msm8996-qmp-pcie-phy" must contain:
-                 "phy", "common", "cfg".
+                        "phy", "common", "cfg".
                 For "qcom,msm8996-qmp-usb3-phy" must contain
-                 "phy", "common".
-                For "qcom,ipq8074-qmp-pcie-phy" must contain:
-                 "phy", "common".
+                        "phy", "common".
+                For "qcom,sdm845-qmp-usb3-phy" must contain:
+                        "phy", "common".
+                For "qcom,sdm845-qmp-usb3-uni-phy" must contain:
+                        "phy", "common".
+                For "qcom,sdm845-qmp-ufs-phy": no resets are listed.
 
  - vdda-phy-supply: Phandle to a regulator supply to PHY core block.
  - vdda-pll-supply: Phandle to 1.8V regulator supply to PHY refclk pll block.
@@ -79,9 +91,10 @@ Required properties for child node:
 
  - #phy-cells: must be 0
 
+Required properties child node of pcie and usb3 qmp phys:
  - clocks: a list of phandles and clock-specifier pairs,
            one for each entry in clock-names.
- - clock-names: Must contain following for pcie and usb qmp phys:
+ - clock-names: Must contain following:
                  "pipe<lane-number>" for pipe clock specific to each lane.
  - clock-output-names: Name of the PHY clock that will be the parent for
                        the above pipe clock.
@@ -91,9 +104,11 @@ Required properties for child node:
                         (or)
                   "pcie20_phy1_pipe_clk"
 
+Required properties for child node of PHYs with lane reset, AKA:
+        "qcom,msm8996-qmp-pcie-phy"
  - resets: a list of phandles and reset controller specifier pairs,
            one for each entry in reset-names.
- - reset-names: Must contain following for pcie qmp phys:
+ - reset-names: Must contain following:
                  "lane<lane-number>" for reset specific to each lane.
 
 Example:
diff --git a/Documentation/devicetree/bindings/spi/spi-uniphier.txt b/Documentation/devicetree/bindings/spi/spi-uniphier.txt
index 504a4ecfc7b1..b04e66a52de5 100644
--- a/Documentation/devicetree/bindings/spi/spi-uniphier.txt
+++ b/Documentation/devicetree/bindings/spi/spi-uniphier.txt
@@ -5,18 +5,20 @@ UniPhier SoCs have SCSSI which supports SPI single channel.
 Required properties:
  - compatible: should be "socionext,uniphier-scssi"
  - reg: address and length of the spi master registers
- - #address-cells: must be <1>, see spi-bus.txt
- - #size-cells: must be <0>, see spi-bus.txt
- - clocks: A phandle to the clock for the device.
- - resets: A phandle to the reset control for the device.
+ - interrupts: a single interrupt specifier
+ - pinctrl-names: should be "default"
+ - pinctrl-0: pin control state for the default mode
+ - clocks: a phandle to the clock for the device
+ - resets: a phandle to the reset control for the device
 
 Example:
 
 spi0: spi@54006000 {
         compatible = "socionext,uniphier-scssi";
         reg = <0x54006000 0x100>;
-        #address-cells = <1>;
-        #size-cells = <0>;
+        interrupts = <0 39 4>;
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_spi0>;
         clocks = <&peri_clk 11>;
         resets = <&peri_rst 11>;
 };
diff --git a/Documentation/i2c/busses/i2c-nvidia-gpu b/Documentation/i2c/busses/i2c-nvidia-gpu
new file mode 100644
index 000000000000..31884d2b2eb5
--- /dev/null
+++ b/Documentation/i2c/busses/i2c-nvidia-gpu
@@ -0,0 +1,18 @@
+Kernel driver i2c-nvidia-gpu
+
+Datasheet: not publicly available.
+
+Authors:
+        Ajay Gupta <ajayg@nvidia.com>
+
+Description
+-----------
+
+i2c-nvidia-gpu is a driver for I2C controller included in NVIDIA Turing
+and later GPUs and it is used to communicate with Type-C controller on GPUs.
+
+If your 'lspci -v' listing shows something like the following,
+
+01:00.3 Serial bus controller [0c80]: NVIDIA Corporation Device 1ad9 (rev a1)
+
+then this driver should support the I2C controller of your GPU.
diff --git a/Documentation/input/event-codes.rst b/Documentation/input/event-codes.rst
index cef220c176a4..a8c0873beb95 100644
--- a/Documentation/input/event-codes.rst
+++ b/Documentation/input/event-codes.rst
@@ -190,16 +190,7 @@ A few EV_REL codes have special meanings:
 * REL_WHEEL, REL_HWHEEL:
 
   - These codes are used for vertical and horizontal scroll wheels,
-    respectively. The value is the number of "notches" moved on the wheel, the
-    physical size of which varies by device. For high-resolution wheels (which
-    report multiple events for each notch of movement, or do not have notches)
-    this may be an approximation based on the high-resolution scroll events.
-
-* REL_WHEEL_HI_RES:
-
-  - If a vertical scroll wheel supports high-resolution scrolling, this code
-    will be emitted in addition to REL_WHEEL. The value is the (approximate)
-    distance travelled by the user's finger, in microns.
+    respectively.
 
 EV_ABS
 ------
diff --git a/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst b/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst
index 0f8b31874002..de131f00c249 100644
--- a/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst
+++ b/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media_ioc_request_alloc:
 
diff --git a/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst b/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst
index 6dd2d7fea714..5d2604345e19 100644
--- a/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst
+++ b/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media_request_ioc_queue:
 
diff --git a/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst b/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst
index febe888494c8..ec61960c81ce 100644
--- a/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst
+++ b/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media_request_ioc_reinit:
 
diff --git a/Documentation/media/uapi/mediactl/request-api.rst b/Documentation/media/uapi/mediactl/request-api.rst
index 5f4a23029c48..945113dcb218 100644
--- a/Documentation/media/uapi/mediactl/request-api.rst
+++ b/Documentation/media/uapi/mediactl/request-api.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media-request-api:
 
diff --git a/Documentation/media/uapi/mediactl/request-func-close.rst b/Documentation/media/uapi/mediactl/request-func-close.rst
index 098d7f2b9548..dcf3f35bcf17 100644
--- a/Documentation/media/uapi/mediactl/request-func-close.rst
+++ b/Documentation/media/uapi/mediactl/request-func-close.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _request-func-close:
 
diff --git a/Documentation/media/uapi/mediactl/request-func-ioctl.rst b/Documentation/media/uapi/mediactl/request-func-ioctl.rst
index ff7b072a6999..11a22f887843 100644
--- a/Documentation/media/uapi/mediactl/request-func-ioctl.rst
+++ b/Documentation/media/uapi/mediactl/request-func-ioctl.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _request-func-ioctl:
 
diff --git a/Documentation/media/uapi/mediactl/request-func-poll.rst b/Documentation/media/uapi/mediactl/request-func-poll.rst
index 85191254f381..2609fd54d519 100644
--- a/Documentation/media/uapi/mediactl/request-func-poll.rst
+++ b/Documentation/media/uapi/mediactl/request-func-poll.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _request-func-poll:
 
diff --git a/Documentation/media/uapi/v4l/dev-meta.rst b/Documentation/media/uapi/v4l/dev-meta.rst
index f7ac8d0d3af1..b65dc078abeb 100644
--- a/Documentation/media/uapi/v4l/dev-meta.rst
+++ b/Documentation/media/uapi/v4l/dev-meta.rst
@@ -40,7 +40,7 @@ To use the :ref:`format` ioctls applications set the ``type`` field of the
 the desired operation. Both drivers and applications must set the remainder of
 the :c:type:`v4l2_format` structure to 0.
 
-.. _v4l2-meta-format:
+.. c:type:: v4l2_meta_format
 
 .. tabularcolumns:: |p{1.4cm}|p{2.2cm}|p{13.9cm}|
 
diff --git a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
index 3ead350e099f..9ea494a8faca 100644
--- a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
+++ b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
@@ -133,6 +133,11 @@ The format as returned by :ref:`VIDIOC_TRY_FMT <VIDIOC_G_FMT>` must be identical
       - Definition of a data format, see :ref:`pixfmt`, used by SDR
         capture and output devices.
     * -
+      - struct :c:type:`v4l2_meta_format`
+      - ``meta``
+      - Definition of a metadata format, see :ref:`meta-formats`, used by
+        metadata capture devices.
+    * -
       - __u8
       - ``raw_data``\ [200]
       - Place holder for future extensions.
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 605e00cdd6be..89f1302d593a 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -1056,18 +1056,23 @@ The kernel interface functions are as follows:
 
         u32 rxrpc_kernel_check_life(struct socket *sock,
                                     struct rxrpc_call *call);
+        void rxrpc_kernel_probe_life(struct socket *sock,
+                                     struct rxrpc_call *call);
 
-     This returns a number that is updated when ACKs are received from the peer
-     (notably including PING RESPONSE ACKs which we can elicit by sending PING
-     ACKs to see if the call still exists on the server).  The caller should
-     compare the numbers of two calls to see if the call is still alive after
-     waiting for a suitable interval.
+     The first function returns a number that is updated when ACKs are received
+     from the peer (notably including PING RESPONSE ACKs which we can elicit by
+     sending PING ACKs to see if the call still exists on the server).  The
+     caller should compare the numbers of two calls to see if the call is still
+     alive after waiting for a suitable interval.
 
      This allows the caller to work out if the server is still contactable and
      if the call is still alive on the server whilst waiting for the server to
      process a client operation.
 
-     This function may transmit a PING ACK.
+     The second function causes a ping ACK to be transmitted to try to provoke
+     the peer into responding, which would then cause the value returned by the
+     first function to change.  Note that this must be called in TASK_RUNNING
+     state.
 
  (*) Get reply timestamp.
 
diff --git a/Documentation/userspace-api/spec_ctrl.rst b/Documentation/userspace-api/spec_ctrl.rst
index 32f3d55c54b7..c4dbe6f7cdae 100644
--- a/Documentation/userspace-api/spec_ctrl.rst
+++ b/Documentation/userspace-api/spec_ctrl.rst
@@ -92,3 +92,12 @@ Speculation misfeature controls
    * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0);
    * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
    * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0);
+
+- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes
+                        (Mitigate Spectre V2 style attacks against user processes)
+
+  Invocations:
+   * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0);
+   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0);
+   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0);
+   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index 7727db8f94bc..5e9b826b5f62 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -61,18 +61,6 @@ Protocol 2.12:	(Kernel 3.8) Added the xloadflags field and extension fields
                 to struct boot_params for loading bzImage and ramdisk
                 above 4G in 64bit.
 
-Protocol 2.13:  (Kernel 3.14) Support 32- and 64-bit flags being set in
-                xloadflags to support booting a 64-bit kernel from 32-bit
-                EFI
-
-Protocol 2.14:  (Kernel 4.20) Added acpi_rsdp_addr holding the physical
-                address of the ACPI RSDP table.
-                The bootloader updates version with:
-                0x8000 | min(kernel-version, bootloader-version)
-                kernel-version being the protocol version supported by
-                the kernel and bootloader-version the protocol version
-                supported by the bootloader.
-
 **** MEMORY LAYOUT
 
 The traditional memory map for the kernel loader, used for Image or
@@ -209,7 +197,6 @@ Offset	Proto	Name		Meaning
 0258/8  2.10+   pref_address    Preferred loading address
 0260/4  2.10+   init_size       Linear memory required during initialization
 0264/4  2.11+   handover_offset Offset of handover entry point
-0268/8  2.14+   acpi_rsdp_addr  Physical address of RSDP table
 
 (1) For backwards compatibility, if the setup_sects field contains 0, the
     real value is 4.
@@ -322,7 +309,7 @@ Protocol:	2.00+
   Contains the magic number "HdrS" (0x53726448).
 
 Field name:     version
-Type:           modify
+Type:           read
 Offset/size:    0x206/2
 Protocol:       2.00+
 
@@ -330,12 +317,6 @@ Protocol:	2.00+
   e.g. 0x0204 for version 2.04, and 0x0a11 for a hypothetical version
   10.17.
 
-  Up to protocol version 2.13 this information is only read by the
-  bootloader. From protocol version 2.14 onwards the bootloader will
-  write the used protocol version or-ed with 0x8000 to the field. The
-  used protocol version will be the minimum of the supported protocol
-  versions of the bootloader and the kernel.
-
 Field name:     realmode_swtch
 Type:           modify (optional)
 Offset/size:    0x208/4
@@ -763,17 +744,6 @@ Offset/size:	0x264/4
 
   See EFI HANDOVER PROTOCOL below for more details.
 
-Field name:     acpi_rsdp_addr
-Type:           write
-Offset/size:    0x268/8
-Protocol:       2.14+
-
-  This field can be set by the boot loader to tell the kernel the
-  physical address of the ACPI RSDP table.
-
-  A value of 0 indicates the kernel should fall back to the standard
-  methods to locate the RSDP.
-
 
 **** THE IMAGE CHECKSUM
 
diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
index 73aaaa3da436..804f9426ed17 100644
--- a/Documentation/x86/x86_64/mm.txt
+++ b/Documentation/x86/x86_64/mm.txt
@@ -34,23 +34,24 @@ __________________|____________|__________________|_________|___________________
 ____________________________________________________________|___________________________________________________________
                   |            |                  |         |
  ffff800000000000 | -128    TB | ffff87ffffffffff |    8 TB | ... guard hole, also reserved for hypervisor
- ffff880000000000 | -120    TB | ffffc7ffffffffff |   64 TB | direct mapping of all physical memory (page_offset_base)
- ffffc80000000000 |  -56    TB | ffffc8ffffffffff |    1 TB | ... unused hole
+ ffff880000000000 | -120    TB | ffff887fffffffff |  0.5 TB | LDT remap for PTI
+ ffff888000000000 | -119.5  TB | ffffc87fffffffff |   64 TB | direct mapping of all physical memory (page_offset_base)
+ ffffc88000000000 |  -55.5  TB | ffffc8ffffffffff |  0.5 TB | ... unused hole
  ffffc90000000000 |  -55    TB | ffffe8ffffffffff |   32 TB | vmalloc/ioremap space (vmalloc_base)
  ffffe90000000000 |  -23    TB | ffffe9ffffffffff |    1 TB | ... unused hole
  ffffea0000000000 |  -22    TB | ffffeaffffffffff |    1 TB | virtual memory map (vmemmap_base)
  ffffeb0000000000 |  -21    TB | ffffebffffffffff |    1 TB | ... unused hole
  ffffec0000000000 |  -20    TB | fffffbffffffffff |   16 TB | KASAN shadow memory
- fffffc0000000000 |   -4    TB | fffffdffffffffff |    2 TB | ... unused hole
-                  |            |                  |         | vaddr_end for KASLR
- fffffe0000000000 |   -2    TB | fffffe7fffffffff |  0.5 TB | cpu_entry_area mapping
- fffffe8000000000 |   -1.5  TB | fffffeffffffffff |  0.5 TB | LDT remap for PTI
- ffffff0000000000 |   -1    TB | ffffff7fffffffff |  0.5 TB | %esp fixup stacks
 __________________|____________|__________________|_________|____________________________________________________________
                                                             |
-                                                            | Identical layout to the 47-bit one from here on:
+                                                            | Identical layout to the 56-bit one from here on:
 ____________________________________________________________|____________________________________________________________
                   |            |                  |         |
+ fffffc0000000000 |   -4    TB | fffffdffffffffff |    2 TB | ... unused hole
+                  |            |                  |         | vaddr_end for KASLR
+ fffffe0000000000 |   -2    TB | fffffe7fffffffff |  0.5 TB | cpu_entry_area mapping
+ fffffe8000000000 |   -1.5  TB | fffffeffffffffff |  0.5 TB | ... unused hole
+ ffffff0000000000 |   -1    TB | ffffff7fffffffff |  0.5 TB | %esp fixup stacks
  ffffff8000000000 | -512    GB | ffffffeeffffffff |  444 GB | ... unused hole
  ffffffef00000000 |  -68    GB | fffffffeffffffff |   64 GB | EFI region mapping space
  ffffffff00000000 |   -4    GB | ffffffff7fffffff |    2 GB | ... unused hole
@@ -83,7 +84,7 @@ Notes:
 __________________|____________|__________________|_________|___________________________________________________________
                   |            |                  |         |
  0000800000000000 |  +64    PB | ffff7fffffffffff | ~16K PB | ... huge, still almost 64 bits wide hole of non-canonical
-                  |            |                  |         |     virtual memory addresses up to the -128 TB
+                  |            |                  |         |     virtual memory addresses up to the -64 PB
                   |            |                  |         |     starting offset of kernel mappings.
 __________________|____________|__________________|_________|___________________________________________________________
                                                             |
@@ -91,23 +92,24 @@ __________________|____________|__________________|_________|___________________
 ____________________________________________________________|___________________________________________________________
                   |            |                  |         |
  ff00000000000000 |  -64    PB | ff0fffffffffffff |    4 PB | ... guard hole, also reserved for hypervisor
- ff10000000000000 |  -60    PB | ff8fffffffffffff |   32 PB | direct mapping of all physical memory (page_offset_base)
- ff90000000000000 |  -28    PB | ff9fffffffffffff |    4 PB | LDT remap for PTI
+ ff10000000000000 |  -60    PB | ff10ffffffffffff | 0.25 PB | LDT remap for PTI
+ ff11000000000000 |  -59.75 PB | ff90ffffffffffff |   32 PB | direct mapping of all physical memory (page_offset_base)
+ ff91000000000000 |  -27.75 PB | ff9fffffffffffff | 3.75 PB | ... unused hole
  ffa0000000000000 |  -24    PB | ffd1ffffffffffff | 12.5 PB | vmalloc/ioremap space (vmalloc_base)
  ffd2000000000000 |  -11.5  PB | ffd3ffffffffffff |  0.5 PB | ... unused hole
  ffd4000000000000 |  -11    PB | ffd5ffffffffffff |  0.5 PB | virtual memory map (vmemmap_base)
  ffd6000000000000 |  -10.5  PB | ffdeffffffffffff | 2.25 PB | ... unused hole
  ffdf000000000000 |   -8.25 PB | fffffdffffffffff |   ~8 PB | KASAN shadow memory
- fffffc0000000000 |   -4    TB | fffffdffffffffff |    2 TB | ... unused hole
-                  |            |                  |         | vaddr_end for KASLR
- fffffe0000000000 |   -2    TB | fffffe7fffffffff |  0.5 TB | cpu_entry_area mapping
- fffffe8000000000 |   -1.5  TB | fffffeffffffffff |  0.5 TB | ... unused hole
- ffffff0000000000 |   -1    TB | ffffff7fffffffff |  0.5 TB | %esp fixup stacks
 __________________|____________|__________________|_________|____________________________________________________________
                                                             |
                                                             | Identical layout to the 47-bit one from here on:
 ____________________________________________________________|____________________________________________________________
                   |            |                  |         |
+ fffffc0000000000 |   -4    TB | fffffdffffffffff |    2 TB | ... unused hole
+                  |            |                  |         | vaddr_end for KASLR
+ fffffe0000000000 |   -2    TB | fffffe7fffffffff |  0.5 TB | cpu_entry_area mapping
+ fffffe8000000000 |   -1.5  TB | fffffeffffffffff |  0.5 TB | ... unused hole
+ ffffff0000000000 |   -1    TB | ffffff7fffffffff |  0.5 TB | %esp fixup stacks
  ffffff8000000000 | -512    GB | ffffffeeffffffff |  444 GB | ... unused hole
  ffffffef00000000 |  -68    GB | fffffffeffffffff |   64 GB | EFI region mapping space
  ffffffff00000000 |   -4    GB | ffffffff7fffffff |    2 GB | ... unused hole
diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
index 97b7adbceda4..68aed077f7b6 100644
--- a/Documentation/x86/zero-page.txt
+++ b/Documentation/x86/zero-page.txt
@@ -25,7 +25,7 @@ Offset	Proto	Name		Meaning
 0C8/004 ALL     ext_cmd_line_ptr  cmd_line_ptr high 32bits
 140/080 ALL     edid_info       Video mode setup (struct edid_info)
 1C0/020 ALL     efi_info        EFI 32 information (struct efi_info)
-1E0/004 ALL     alk_mem_k       Alternative mem check, in KB
+1E0/004 ALL     alt_mem_k       Alternative mem check, in KB
 1E4/004 ALL     scratch         Scratch field for the kernel setup code
 1E8/001 ALL     e820_entries    Number of entries in e820_table (below)
 1E9/001 ALL     eddbuf_entries  Number of entries in eddbuf (below)
diff --git a/MAINTAINERS b/MAINTAINERS
index f4855974f325..6682420421c1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -180,6 +180,7 @@ F:	drivers/net/hamradio/6pack.c
 
 8169 10/100/1000 GIGABIT ETHERNET DRIVER
 M:      Realtek linux nic maintainers <nic_swsd@realtek.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/realtek/r8169.c
@@ -717,7 +718,7 @@ F:	include/linux/mfd/altera-a10sr.h
 F:      include/dt-bindings/reset/altr,rst-mgr-a10sr.h
 
 ALTERA TRIPLE SPEED ETHERNET DRIVER
-M:      Vince Bridgers <vbridger@opensource.altera.com>
+M:      Thor Thayer <thor.thayer@linux.intel.com>
 L:      netdev@vger.kernel.org
 L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
 S:      Maintained
@@ -1922,7 +1923,6 @@ ARM/QUALCOMM SUPPORT
 M:      Andy Gross <andy.gross@linaro.org>
 M:      David Brown <david.brown@linaro.org>
 L:      linux-arm-msm@vger.kernel.org
-L:      linux-soc@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/soc/qcom/
 F:      arch/arm/boot/dts/qcom-*.dts
@@ -2490,7 +2490,7 @@ F:	drivers/net/wireless/ath/*
 ATHEROS ATH5K WIRELESS DRIVER
 M:      Jiri Slaby <jirislaby@gmail.com>
 M:      Nick Kossifidis <mickflemm@gmail.com>
-M:      "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath5k
 S:      Maintained
@@ -2800,7 +2800,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
 Q:      https://patchwork.ozlabs.org/project/netdev/list/?delegate=77147
 S:      Supported
-F:      arch/x86/net/bpf_jit*
+F:      arch/*/net/*
 F:      Documentation/networking/filter.txt
 F:      Documentation/bpf/
 F:      include/linux/bpf*
@@ -2820,6 +2820,67 @@ F:	tools/bpf/
 F:      tools/lib/bpf/
 F:      tools/testing/selftests/bpf/
 
+BPF JIT for ARM
+M:      Shubham Bansal <illusionist.neo@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/arm/net/
+
+BPF JIT for ARM64
+M:      Daniel Borkmann <daniel@iogearbox.net>
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Zi Shen Lim <zlim.lnx@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      arch/arm64/net/
+
+BPF JIT for MIPS (32-BIT AND 64-BIT)
+M:      Paul Burton <paul.burton@mips.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/mips/net/
+
+BPF JIT for NFP NICs
+M:      Jakub Kicinski <jakub.kicinski@netronome.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/ethernet/netronome/nfp/bpf/
+
+BPF JIT for POWERPC (32-BIT AND 64-BIT)
+M:      Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+M:      Sandipan Das <sandipan@linux.ibm.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/powerpc/net/
+
+BPF JIT for S390
+M:      Martin Schwidefsky <schwidefsky@de.ibm.com>
+M:      Heiko Carstens <heiko.carstens@de.ibm.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/s390/net/
+X:      arch/s390/net/pnet.c
+
+BPF JIT for SPARC (32-BIT AND 64-BIT)
+M:      David S. Miller <davem@davemloft.net>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/sparc/net/
+
+BPF JIT for X86 32-BIT
+M:      Wang YanQing <udknight@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/x86/net/bpf_jit_comp32.c
+
+BPF JIT for X86 64-BIT
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      arch/x86/net/
+X:      arch/x86/net/bpf_jit_comp32.c
+
 BROADCOM B44 10/100 ETHERNET DRIVER
 M:      Michael Chan <michael.chan@broadcom.com>
 L:      netdev@vger.kernel.org
@@ -2860,7 +2921,7 @@ F:	drivers/staging/vc04_services
 BROADCOM BCM47XX MIPS ARCHITECTURE
 M:      Hauke Mehrtens <hauke@hauke-m.de>
 M:      Rafał Miłecki <zajec5@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/mips/brcm/
 F:      arch/mips/bcm47xx/*
@@ -2869,7 +2930,6 @@ F:	arch/mips/include/asm/mach-bcm47xx/*
 BROADCOM BCM5301X ARM ARCHITECTURE
 M:      Hauke Mehrtens <hauke@hauke-m.de>
 M:      Rafał Miłecki <zajec5@gmail.com>
-M:      Jon Mason <jonmason@broadcom.com>
 M:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
@@ -2924,7 +2984,7 @@ F:	drivers/cpufreq/bmips-cpufreq.c
 BROADCOM BMIPS MIPS ARCHITECTURE
 M:      Kevin Cernekee <cernekee@gmail.com>
 M:      Florian Fainelli <f.fainelli@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 T:      git git://github.com/broadcom/stblinux.git
 S:      Maintained
 F:      arch/mips/bmips/*
@@ -3015,7 +3075,6 @@ F:	drivers/net/ethernet/broadcom/genet/
 BROADCOM IPROC ARM ARCHITECTURE
 M:      Ray Jui <rjui@broadcom.com>
 M:      Scott Branden <sbranden@broadcom.com>
-M:      Jon Mason <jonmason@broadcom.com>
 M:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 T:      git git://github.com/broadcom/cygnus-linux.git
@@ -3062,7 +3121,7 @@ F:	include/uapi/rdma/bnxt_re-abi.h
 
 BROADCOM NVRAM DRIVER
 M:      Rafał Miłecki <zajec5@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      drivers/firmware/broadcom/*
 
@@ -3276,6 +3335,12 @@ F:	include/uapi/linux/caif/
 F:      include/net/caif/
 F:      net/caif/
 
+CAKE QDISC
+M:      Toke Høiland-Jørgensen <toke@toke.dk>
+L:      cake@lists.bufferbloat.net (moderated for non-subscribers)
+S:      Maintained
+F:      net/sched/sch_cake.c
+
 CALGARY x86-64 IOMMU
 M:      Muli Ben-Yehuda <mulix@mulix.org>
 M:      Jon Mason <jdmason@kudzu.us>
@@ -4158,7 +4223,7 @@ F:	net/decnet/
 
 DECSTATION PLATFORM SUPPORT
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 W:      http://www.linux-mips.org/wiki/DECstation
 S:      Maintained
 F:      arch/mips/dec/
@@ -5249,7 +5314,7 @@ EDAC-CAVIUM OCTEON
 M:      Ralf Baechle <ralf@linux-mips.org>
 M:      David Daney <david.daney@cavium.com>
 L:      linux-edac@vger.kernel.org
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      drivers/edac/octeon_edac*
 
@@ -5528,6 +5593,7 @@ F:	net/bridge/
 ETHERNET PHY LIBRARY
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Florian Fainelli <f.fainelli@gmail.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
@@ -5766,7 +5832,7 @@ F:	include/uapi/linux/firewire*.h
 F:      tools/firewire/
 
 FIRMWARE LOADER (request_firmware)
-M:      Luis R. Rodriguez <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      Documentation/firmware_class/
@@ -6299,6 +6365,7 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
+M:      Bartosz Golaszewski <bgolaszewski@baylibre.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -6607,9 +6674,9 @@ F:	arch/*/include/asm/suspend*.h
 
 HID CORE LAYER
 M:      Jiri Kosina <jikos@kernel.org>
-R:      Benjamin Tissoires <benjamin.tissoires@redhat.com>
+M:      Benjamin Tissoires <benjamin.tissoires@redhat.com>
 L:      linux-input@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git
 S:      Maintained
 F:      drivers/hid/
 F:      include/linux/hid*
@@ -6861,6 +6928,13 @@ L:	linux-acpi@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/i2c-core-acpi.c
 
+I2C CONTROLLER DRIVER FOR NVIDIA GPU
+M:      Ajay Gupta <ajayg@nvidia.com>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      Documentation/i2c/busses/i2c-nvidia-gpu
+F:      drivers/i2c/busses/i2c-nvidia-gpu.c
+
 I2C MUXES
 M:      Peter Rosin <peda@axentia.se>
 L:      linux-i2c@vger.kernel.org
@@ -7429,6 +7503,20 @@ S:	Maintained
 F:      Documentation/fb/intelfb.txt
 F:      drivers/video/fbdev/intelfb/
 
+INTEL GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-ich.c
+F:      drivers/gpio/gpio-intel-mid.c
+F:      drivers/gpio/gpio-lynxpoint.c
+F:      drivers/gpio/gpio-merrifield.c
+F:      drivers/gpio/gpio-ml-ioh.c
+F:      drivers/gpio/gpio-pch.c
+F:      drivers/gpio/gpio-sch.c
+F:      drivers/gpio/gpio-sodaville.c
+
 INTEL GVT-g DRIVERS (Intel GPU Virtualization)
 M:      Zhenyu Wang <zhenyuw@linux.intel.com>
 M:      Zhi Wang <zhi.a.wang@intel.com>
@@ -7439,12 +7527,6 @@ T:	git https://github.com/intel/gvt-linux.git
 S:      Supported
 F:      drivers/gpu/drm/i915/gvt/
 
-INTEL PMIC GPIO DRIVER
-R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-S:      Maintained
-F:      drivers/gpio/gpio-*cove.c
-F:      drivers/gpio/gpio-msic.c
-
 INTEL HID EVENT DRIVER
 M:      Alex Hung <alex.hung@canonical.com>
 L:      platform-driver-x86@vger.kernel.org
@@ -7532,12 +7614,6 @@ W:	https://01.org/linux-acpi
 S:      Supported
 F:      drivers/platform/x86/intel_menlow.c
 
-INTEL MERRIFIELD GPIO DRIVER
-M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-L:      linux-gpio@vger.kernel.org
-S:      Maintained
-F:      drivers/gpio/gpio-merrifield.c
-
 INTEL MIC DRIVERS (mic)
 M:      Sudeep Dutt <sudeep.dutt@intel.com>
 M:      Ashutosh Dixit <ashutosh.dixit@intel.com>
@@ -7570,6 +7646,13 @@ F:	drivers/platform/x86/intel_punit_ipc.c
 F:      arch/x86/include/asm/intel_pmc_ipc.h
 F:      arch/x86/include/asm/intel_punit_ipc.h
 
+INTEL PMIC GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-*cove.c
+F:      drivers/gpio/gpio-msic.c
+
 INTEL MULTIFUNCTION PMIC DEVICE DRIVERS
 R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 S:      Maintained
@@ -7678,7 +7761,7 @@ F:	Documentation/devicetree/bindings/iio/gyroscope/invensense,mpu3050.txt
 
 IOC3 ETHERNET DRIVER
 M:      Ralf Baechle <ralf@linux-mips.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/sgi/ioc3-eth.c
 
@@ -8049,7 +8132,7 @@ F:	tools/testing/selftests/
 F:      Documentation/dev-tools/kselftest*
 
 KERNEL USERMODE HELPER
-M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      kernel/umh.c
@@ -8106,7 +8189,7 @@ F:	arch/arm64/kvm/
 
 KERNEL VIRTUAL MACHINE FOR MIPS (KVM/mips)
 M:      James Hogan <jhogan@kernel.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      arch/mips/include/uapi/asm/kvm*
 F:      arch/mips/include/asm/kvm*
@@ -8225,7 +8308,7 @@ F:	mm/kmemleak.c
 F:      mm/kmemleak-test.c
 
 KMOD KERNEL MODULE LOADER - USERMODE HELPER
-M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      kernel/kmod.c
@@ -8279,7 +8362,7 @@ F:	drivers/net/dsa/lantiq_gswip.c
 
 LANTIQ MIPS ARCHITECTURE
 M:      John Crispin <john@phrozen.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/lantiq
 F:      drivers/soc/lantiq
@@ -8367,7 +8450,7 @@ F:	drivers/media/dvb-frontends/lgdt3305.*
 LIBATA PATA ARASAN COMPACT FLASH CONTROLLER
 M:      Viresh Kumar <vireshk@kernel.org>
 L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
 S:      Maintained
 F:      include/linux/pata_arasan_cf_data.h
 F:      drivers/ata/pata_arasan_cf.c
@@ -8384,7 +8467,7 @@ F:	drivers/ata/ata_generic.c
 LIBATA PATA FARADAY FTIDE010 AND GEMINI SATA BRIDGE DRIVERS
 M:      Linus Walleij <linus.walleij@linaro.org>
 L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
 S:      Maintained
 F:      drivers/ata/pata_ftide010.c
 F:      drivers/ata/sata_gemini.c
@@ -8403,7 +8486,7 @@ F:	include/linux/ahci_platform.h
 LIBATA SATA PROMISE TX2/TX4 CONTROLLER DRIVER
 M:      Mikael Pettersson <mikpelinux@gmail.com>
 L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
 S:      Maintained
 F:      drivers/ata/sata_promise.*
 
@@ -8842,7 +8925,7 @@ S:	Maintained
 
 MARDUK (CREATOR CI40) DEVICE TREE SUPPORT
 M:      Rahul Bedarkar <rahulbedarkar89@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/boot/dts/img/pistachio_marduk.dts
 
@@ -9801,7 +9884,7 @@ F:	drivers/dma/at_xdmac.c
 
 MICROSEMI MIPS SOCS
 M:      Alexandre Belloni <alexandre.belloni@bootlin.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/generic/board-ocelot.c
 F:      arch/mips/configs/generic/board-ocelot.config
@@ -9841,7 +9924,7 @@ MIPS
 M:      Ralf Baechle <ralf@linux-mips.org>
 M:      Paul Burton <paul.burton@mips.com>
 M:      James Hogan <jhogan@kernel.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 W:      http://www.linux-mips.org/
 T:      git git://git.linux-mips.org/pub/scm/ralf/linux.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git
@@ -9854,7 +9937,7 @@ F:	drivers/platform/mips/
 
 MIPS BOSTON DEVELOPMENT BOARD
 M:      Paul Burton <paul.burton@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/clock/img,boston-clock.txt
 F:      arch/mips/boot/dts/img/boston.dts
@@ -9864,7 +9947,7 @@ F:	include/dt-bindings/clock/boston-clock.h
 
 MIPS GENERIC PLATFORM
 M:      Paul Burton <paul.burton@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      Documentation/devicetree/bindings/power/mti,mips-cpc.txt
 F:      arch/mips/generic/
@@ -9872,7 +9955,7 @@ F:	arch/mips/tools/generic-board-config.sh
 
 MIPS/LOONGSON1 ARCHITECTURE
 M:      Keguang Zhang <keguang.zhang@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/loongson32/
 F:      arch/mips/include/asm/mach-loongson32/
@@ -9881,7 +9964,7 @@ F:	drivers/*/*/*loongson1*
 
 MIPS/LOONGSON2 ARCHITECTURE
 M:      Jiaxun Yang <jiaxun.yang@flygoat.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/loongson64/fuloong-2e/
 F:      arch/mips/loongson64/lemote-2f/
@@ -9891,7 +9974,7 @@ F:	drivers/*/*/*loongson2*
 
 MIPS/LOONGSON3 ARCHITECTURE
 M:      Huacai Chen <chenhc@lemote.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/loongson64/
 F:      arch/mips/include/asm/mach-loongson64/
@@ -9901,7 +9984,7 @@ F:	drivers/*/*/*loongson3*
 
 MIPS RINT INSTRUCTION EMULATION
 M:      Aleksandar Markovic <aleksandar.markovic@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      arch/mips/math-emu/sp_rint.c
 F:      arch/mips/math-emu/dp_rint.c
@@ -10784,6 +10867,14 @@ L:	linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/mach-omap2/omap_hwmod.*
 
+OMAP I2C DRIVER
+M:      Vignesh R <vigneshr@ti.com>
+L:      linux-omap@vger.kernel.org
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/i2c/i2c-omap.txt
+F:      drivers/i2c/busses/i2c-omap.c
+
 OMAP IMAGING SUBSYSTEM (OMAP3 ISP and OMAP4 ISS)
 M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 L:      linux-media@vger.kernel.org
@@ -10793,9 +10884,9 @@ F:	drivers/media/platform/omap3isp/
 F:      drivers/staging/media/omap4iss/
 
 OMAP MMC SUPPORT
-M:      Jarkko Lavinen <jarkko.lavinen@nokia.com>
+M:      Aaro Koskinen <aaro.koskinen@iki.fi>
 L:      linux-omap@vger.kernel.org
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/mmc/host/omap.c
 
 OMAP POWER MANAGEMENT SUPPORT
@@ -10878,7 +10969,7 @@ F:	include/linux/platform_data/i2c-omap.h
 
 ONION OMEGA2+ BOARD
 M:      Harvey Hunt <harveyhuntnexus@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/boot/dts/ralink/omega2p.dts
 
@@ -11730,6 +11821,7 @@ F:	Documentation/devicetree/bindings/pinctrl/fsl,*
 PIN CONTROLLER - INTEL
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
 M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel.git
 S:      Maintained
 F:      drivers/pinctrl/intel/
 
@@ -11786,7 +11878,7 @@ F:	drivers/pinctrl/spear/
 
 PISTACHIO SOC SUPPORT
 M:      James Hartley <james.hartley@sondrel.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Odd Fixes
 F:      arch/mips/pistachio/
 F:      arch/mips/include/asm/mach-pistachio/
@@ -11966,7 +12058,7 @@ F:	kernel/printk/
 F:      include/linux/printk.h
 
 PRISM54 WIRELESS DRIVER
-M:      "Luis R. Rodriguez" <mcgrof@gmail.com>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/p54
 S:      Obsolete
@@ -11980,9 +12072,10 @@ S:	Maintained
 F:      fs/proc/
 F:      include/linux/proc_fs.h
 F:      tools/testing/selftests/proc/
+F:      Documentation/filesystems/proc.txt
 
 PROC SYSCTL
-M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 M:      Kees Cook <keescook@chromium.org>
 L:      linux-kernel@vger.kernel.org
 L:      linux-fsdevel@vger.kernel.org
@@ -12445,7 +12538,7 @@ F:	drivers/media/usb/rainshadow-cec/*
 
 RALINK MIPS ARCHITECTURE
 M:      John Crispin <john@phrozen.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/ralink
 
@@ -12465,7 +12558,7 @@ F:	drivers/block/brd.c
 
 RANCHU VIRTUAL BOARD FOR MIPS
 M:      Miodrag Dinic <miodrag.dinic@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      arch/mips/generic/board-ranchu.c
 F:      arch/mips/configs/generic/board-ranchu.config
@@ -13915,6 +14008,7 @@ S:	Supported
 F:      Documentation/devicetree/bindings/sound/
 F:      Documentation/sound/soc/
 F:      sound/soc/
+F:      include/dt-bindings/sound/
 F:      include/sound/soc*
 
 SOUNDWIRE SUBSYSTEM
@@ -13962,11 +14056,10 @@ F:	drivers/tty/serial/sunzilog.h
 F:      drivers/tty/vcc.c
 
 SPARSE CHECKER
-M:      "Christopher Li" <sparse@chrisli.org>
+M:      "Luc Van Oostenryck" <luc.vanoostenryck@gmail.com>
 L:      linux-sparse@vger.kernel.org
 W:      https://sparse.wiki.kernel.org/
 T:      git git://git.kernel.org/pub/scm/devel/sparse/sparse.git
-T:      git git://git.kernel.org/pub/scm/devel/sparse/chrisl/sparse.git
 S:      Maintained
 F:      include/linux/compiler.h
 
@@ -14063,6 +14156,7 @@ F:	Documentation/devicetree/bindings/iio/proximity/vl53l0x.txt
 
 STABLE BRANCH
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Sasha Levin <sashal@kernel.org>
 L:      stable@vger.kernel.org
 S:      Supported
 F:      Documentation/process/stable-kernel-rules.rst
@@ -15200,7 +15294,7 @@ F:	arch/um/os-Linux/drivers/
 TURBOCHANNEL SUBSYSTEM
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
 M:      Ralf Baechle <ralf@linux-mips.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 Q:      http://patchwork.linux-mips.org/project/linux-mips/list/
 S:      Maintained
 F:      drivers/tc/
@@ -15436,9 +15530,9 @@ F:	include/linux/usb/gadget*
 
 USB HID/HIDBP DRIVERS (USB KEYBOARDS, MICE, REMOTE CONTROLS, ...)
 M:      Jiri Kosina <jikos@kernel.org>
-R:      Benjamin Tissoires <benjamin.tissoires@redhat.com>
+M:      Benjamin Tissoires <benjamin.tissoires@redhat.com>
 L:      linux-usb@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git
 S:      Maintained
 F:      Documentation/hid/hiddev.txt
 F:      drivers/hid/usbhid/
@@ -16021,7 +16115,7 @@ F:	drivers/net/vmxnet3/
 
 VOCORE VOCORE2 BOARD
 M:      Harvey Hunt <harveyhuntnexus@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/boot/dts/ralink/vocore2.dts
 
diff --git a/Makefile b/Makefile
index 9fce8b91c15f..e9fd22c8445e 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,8 @@
 VERSION = 4
 PATCHLEVEL = 20
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
-NAME = "People's Front"
+EXTRAVERSION = -rc5
+NAME = Shy Crocodile
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h
index 6a8c53dec57e..b7c77bb1bfd2 100644
--- a/arch/alpha/include/asm/termios.h
+++ b/arch/alpha/include/asm/termios.h
@@ -73,9 +73,15 @@
 })
 
 #define user_termios_to_kernel_termios(k, u) \
-        copy_from_user(k, u, sizeof(struct termios))
+        copy_from_user(k, u, sizeof(struct termios2))
 
 #define kernel_termios_to_user_termios(u, k) \
+        copy_to_user(u, k, sizeof(struct termios2))
+
+#define user_termios_to_kernel_termios_1(k, u) \
+        copy_from_user(k, u, sizeof(struct termios))
+
+#define kernel_termios_to_user_termios_1(u, k) \
         copy_to_user(u, k, sizeof(struct termios))
 
 #endif  /* _ALPHA_TERMIOS_H */
diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
index 1e9121c9b3c7..971311605288 100644
--- a/arch/alpha/include/uapi/asm/ioctls.h
+++ b/arch/alpha/include/uapi/asm/ioctls.h
@@ -32,6 +32,11 @@
 #define TCXONC          _IO('t', 30)
 #define TCFLSH          _IO('t', 31)
 
+#define TCGETS2         _IOR('T', 42, struct termios2)
+#define TCSETS2         _IOW('T', 43, struct termios2)
+#define TCSETSW2        _IOW('T', 44, struct termios2)
+#define TCSETSF2        _IOW('T', 45, struct termios2)
+
 #define TIOCSWINSZ      _IOW('t', 103, struct winsize)
 #define TIOCGWINSZ      _IOR('t', 104, struct winsize)
 #define TIOCSTART       _IO('t', 110)           /* start output, like ^Q */
diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h
index de6c8360fbe3..4575ba34a0ea 100644
--- a/arch/alpha/include/uapi/asm/termbits.h
+++ b/arch/alpha/include/uapi/asm/termbits.h
@@ -26,6 +26,19 @@ struct termios {
         speed_t c_ospeed;               /* output speed */
 };
 
+/* Alpha has identical termios and termios2 */
+
+struct termios2 {
+        tcflag_t c_iflag;               /* input mode flags */
+        tcflag_t c_oflag;               /* output mode flags */
+        tcflag_t c_cflag;               /* control mode flags */
+        tcflag_t c_lflag;               /* local mode flags */
+        cc_t c_cc[NCCS];                /* control characters */
+        cc_t c_line;                    /* line discipline (== c_cc[19]) */
+        speed_t c_ispeed;               /* input speed */
+        speed_t c_ospeed;               /* output speed */
+};
+
 /* Alpha has matching termios and ktermios */
 
 struct ktermios {
@@ -152,6 +165,7 @@ struct ktermios {
 #define B3000000  00034
 #define B3500000  00035
 #define B4000000  00036
+#define BOTHER    00037
 
 #define CSIZE   00001400
 #define   CS5   00000000
@@ -169,6 +183,9 @@ struct ktermios {
 #define CMSPAR    010000000000          /* mark or space (stick) parity */
 #define CRTSCTS   020000000000          /* flow control */
 
+#define CIBAUD  07600000
+#define IBSHIFT 16
+
 /* c_lflag bits */
 #define ISIG    0x00000080
 #define ICANON  0x00000100
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index c9e2a1323536..6dd783557330 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -109,7 +109,7 @@ endmenu
 
 choice
         prompt "ARC Instruction Set"
-        default ISA_ARCOMPACT
+        default ISA_ARCV2
 
 config ISA_ARCOMPACT
         bool "ARCompact ISA"
@@ -176,13 +176,11 @@ endchoice
 
 config CPU_BIG_ENDIAN
         bool "Enable Big Endian Mode"
-        default n
         help
           Build kernel for Big Endian Mode of ARC CPU
 
 config SMP
         bool "Symmetric Multi-Processing"
-        default n
         select ARC_MCIP if ISA_ARCV2
         help
           This enables support for systems with more than one CPU.
@@ -254,7 +252,6 @@ config ARC_CACHE_PAGES
 config ARC_CACHE_VIPT_ALIASING
         bool "Support VIPT Aliasing D$"
         depends on ARC_HAS_DCACHE && ISA_ARCOMPACT
-        default n
 
 endif   #ARC_CACHE
 
@@ -262,7 +259,6 @@ config ARC_HAS_ICCM
         bool "Use ICCM"
         help
           Single Cycle RAMS to store Fast Path Code
-        default n
 
 config ARC_ICCM_SZ
         int "ICCM Size in KB"
@@ -273,7 +269,6 @@ config ARC_HAS_DCCM
         bool "Use DCCM"
         help
           Single Cycle RAMS to store Fast Path Data
-        default n
 
 config ARC_DCCM_SZ
         int "DCCM Size in KB"
@@ -366,13 +361,11 @@ if ISA_ARCOMPACT
 
 config ARC_COMPACT_IRQ_LEVELS
         bool "Setup Timer IRQ as high Priority"
-        default n
         # if SMP, LV2 enabled ONLY if ARC implementation has LV2 re-entrancy
         depends on !SMP
 
 config ARC_FPU_SAVE_RESTORE
         bool "Enable FPU state persistence across context switch"
-        default n
         help
           Double Precision Floating Point unit had dedicated regs which
           need to be saved/restored across context-switch.
@@ -453,7 +446,6 @@ config HIGHMEM
 
 config ARC_HAS_PAE40
         bool "Support for the 40-bit Physical Address Extension"
-        default n
         depends on ISA_ARCV2
         select HIGHMEM
         select PHYS_ADDR_T_64BIT
@@ -496,7 +488,6 @@ config HZ
 
 config ARC_METAWARE_HLINK
         bool "Support for Metaware debugger assisted Host access"
-        default n
         help
           This options allows a Linux userland apps to directly access
           host file system (open/creat/read/write etc) with help from
@@ -524,13 +515,11 @@ config ARC_DW2_UNWIND
 
 config ARC_DBG_TLB_PARANOIA
         bool "Paranoia Checks in Low Level TLB Handlers"
-        default n
 
 endif
 
 config ARC_UBOOT_SUPPORT
         bool "Support uboot arg Handling"
-        default n
         help
           ARC Linux by default checks for uboot provided args as pointers to
           external cmdline or DTB. This however breaks in absence of uboot,
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index c64c505d966c..df00578c279d 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -6,7 +6,7 @@
 # published by the Free Software Foundation.
 #
 
-KBUILD_DEFCONFIG := nsim_700_defconfig
+KBUILD_DEFCONFIG := nsim_hs_defconfig
 
 cflags-y        += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
 cflags-$(CONFIG_ISA_ARCOMPACT)  += -mA7
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index ef149f59929a..43f17b51ee89 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -222,6 +222,21 @@
                         bus-width = <4>;
                         dma-coherent;
                 };
+
+                gpio: gpio@3000 {
+                        compatible = "snps,dw-apb-gpio";
+                        reg = <0x3000 0x20>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        gpio_port_a: gpio-controller@0 {
+                                compatible = "snps,dw-apb-gpio-port";
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                snps,nr-gpios = <24>;
+                                reg = <0>;
+                        };
+                };
         };
 
         memory@80000000 {
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index 41bc08be6a3b..020d4493edfd 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -14,6 +14,7 @@ CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
 CONFIG_MODULE_UNLOAD=y
@@ -95,6 +96,7 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index 1e1c4a8011b5..666314fffc60 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -94,6 +94,7 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index 6b0c0cfd5c30..429832b8560b 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -97,6 +97,7 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 1dec2b4bc5e6..87b23b7fb781 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -45,6 +45,9 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
 CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HW_RANDOM is not set
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_DWAPB=y
 # CONFIG_HWMON is not set
 CONFIG_DRM=y
 # CONFIG_DRM_FBDEV_EMULATION is not set
@@ -65,6 +68,7 @@ CONFIG_EXT3_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index 31ba224bbfb4..6e84060e7c90 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -15,6 +15,7 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
@@ -73,6 +74,7 @@ CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_ROOT_NFS=y
 CONFIG_DEBUG_INFO=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index 8e0b8b134cd9..219c2a65294b 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -15,6 +15,7 @@ CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 # CONFIG_LBDAF is not set
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index f14eeff7d308..35dfc6491a09 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -15,6 +15,7 @@ CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 # CONFIG_LBDAF is not set
@@ -66,5 +67,6 @@ CONFIG_EXT2_FS_XATTR=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index 025298a48305..1638e5bc9672 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -65,5 +65,6 @@ CONFIG_EXT2_FS_XATTR=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index df7b77b13b82..11cfbdb0f441 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -76,6 +76,7 @@ CONFIG_EXT2_FS_XATTR=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_FTRACE=y
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index a7f65313f84a..e71ade3cf9c8 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y
 # CONFIG_AIO is not set
 CONFIG_EMBEDDED=y
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index db47c3541f15..1e59a2e9c602 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -85,6 +85,7 @@ CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index a8ac5e917d9a..b5c3f6c54b03 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -90,6 +90,7 @@ CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index ff7d3232764a..f393b663413e 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -113,7 +113,9 @@ extern unsigned long perip_base, perip_end;
 
 /* IO coherency related Auxiliary registers */
 #define ARC_REG_IO_COH_ENABLE   0x500
+#define ARC_IO_COH_ENABLE_BIT   BIT(0)
 #define ARC_REG_IO_COH_PARTIAL  0x501
+#define ARC_IO_COH_PARTIAL_BIT  BIT(0)
 #define ARC_REG_IO_COH_AP0_BASE 0x508
 #define ARC_REG_IO_COH_AP0_SIZE 0x509
 
diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
index c22b181e8206..2f39d9b3886e 100644
--- a/arch/arc/include/asm/io.h
+++ b/arch/arc/include/asm/io.h
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
 #include <asm/page.h>
+#include <asm/unaligned.h>
 
 #ifdef CONFIG_ISA_ARCV2
 #include <asm/barrier.h>
@@ -94,6 +95,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
         return w;
 }
 
+/*
+ * {read,write}s{b,w,l}() repeatedly access the same IO address in
+ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory,
+ * @count times
+ */
+#define __raw_readsx(t,f) \
+static inline void __raw_reads##f(const volatile void __iomem *addr,    \
+                                  void *ptr, unsigned int count)        \
+{                                                                       \
+        bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0;        \
+        u##t *buf = ptr;                                                \
+                                                                        \
+        if (!count)                                                     \
+                return;                                                 \
+                                                                        \
+        /* Some ARC CPU's don't support unaligned accesses */           \
+        if (is_aligned) {                                               \
+                do {                                                    \
+                        u##t x = __raw_read##f(addr);                   \
+                        *buf++ = x;                                     \
+                } while (--count);                                      \
+        } else {                                                        \
+                do {                                                    \
+                        u##t x = __raw_read##f(addr);                   \
+                        put_unaligned(x, buf++);                        \
+                } while (--count);                                      \
+        }                                                               \
+}
+
+#define __raw_readsb __raw_readsb
+__raw_readsx(8, b)
+#define __raw_readsw __raw_readsw
+__raw_readsx(16, w)
+#define __raw_readsl __raw_readsl
+__raw_readsx(32, l)
+
 #define __raw_writeb __raw_writeb
 static inline void __raw_writeb(u8 b, volatile void __iomem *addr)
 {
@@ -126,6 +163,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
 
 }
 
+#define __raw_writesx(t,f)                                              \
+static inline void __raw_writes##f(volatile void __iomem *addr,         \
+                                   const void *ptr, unsigned int count) \
+{                                                                       \
+        bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0;        \
+        const u##t *buf = ptr;                                          \
+                                                                        \
+        if (!count)                                                     \
+                return;                                                 \
+                                                                        \
+        /* Some ARC CPU's don't support unaligned accesses */           \
+        if (is_aligned) {                                               \
+                do {                                                    \
+                        __raw_write##f(*buf++, addr);                   \
+                } while (--count);                                      \
+        } else {                                                        \
+                do {                                                    \
+                        __raw_write##f(get_unaligned(buf++), addr);     \
+                } while (--count);                                      \
+        }                                                               \
+}
+
+#define __raw_writesb __raw_writesb
+__raw_writesx(8, b)
+#define __raw_writesw __raw_writesw
+__raw_writesx(16, w)
+#define __raw_writesl __raw_writesl
+__raw_writesx(32, l)
+
 /*
  * MMIO can also get buffered/optimized in micro-arch, so barriers needed
  * Based on ARM model for the typical use case
@@ -141,10 +207,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
 #define readb(c)                ({ u8  __v = readb_relaxed(c); __iormb(); __v; })
 #define readw(c)                ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
 #define readl(c)                ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
+#define readsb(p,d,l)           ({ __raw_readsb(p,d,l); __iormb(); })
+#define readsw(p,d,l)           ({ __raw_readsw(p,d,l); __iormb(); })
+#define readsl(p,d,l)           ({ __raw_readsl(p,d,l); __iormb(); })
 
 #define writeb(v,c)             ({ __iowmb(); writeb_relaxed(v,c); })
 #define writew(v,c)             ({ __iowmb(); writew_relaxed(v,c); })
 #define writel(v,c)             ({ __iowmb(); writel_relaxed(v,c); })
+#define writesb(p,d,l)          ({ __iowmb(); __raw_writesb(p,d,l); })
+#define writesw(p,d,l)          ({ __iowmb(); __raw_writesw(p,d,l); })
+#define writesl(p,d,l)          ({ __iowmb(); __raw_writesl(p,d,l); })
 
 /*
  * Relaxed API for drivers which can handle barrier ordering themselves
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index b2cae79a25d7..eea8c5ce6335 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -243,7 +243,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 {
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[cpu_id];
         struct bcr_identity *core = &cpu->core;
-        int i, n = 0;
+        int i, n = 0, ua = 0;
 
         FIX_PTR(cpu);
 
@@ -263,10 +263,13 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        IS_AVAIL2(cpu->extn.rtc, "RTC [UP 64-bit] ", CONFIG_ARC_TIMERS_64BIT),
                        IS_AVAIL2(cpu->extn.gfrc, "GFRC [SMP 64-bit] ", CONFIG_ARC_TIMERS_64BIT));
 
-        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s",
+#ifdef __ARC_UNALIGNED__
+        ua = 1;
+#endif
+        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s%s",
                            IS_AVAIL2(cpu->isa.atomic, "atomic ", CONFIG_ARC_HAS_LLSC),
                            IS_AVAIL2(cpu->isa.ldd, "ll64 ", CONFIG_ARC_HAS_LL64),
-                           IS_AVAIL1(cpu->isa.unalign, "unalign (not used)"));
+                           IS_AVAIL1(cpu->isa.unalign, "unalign "), IS_USED_RUN(ua));
 
         if (i)
                 n += scnprintf(buf + n, len - n, "\n\t\t: ");
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index f2701c13a66b..cf9619d4efb4 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -1145,6 +1145,20 @@ noinline void __init arc_ioc_setup(void)
         unsigned int ioc_base, mem_sz;
 
         /*
+         * If IOC was already enabled (due to bootloader) it technically needs to
+         * be reconfigured with aperture base,size corresponding to Linux memory map
+         * which will certainly be different than uboot's. But disabling and
+         * reenabling IOC when DMA might be potentially active is tricky business.
+         * To avoid random memory issues later, just panic here and ask user to
+         * upgrade bootloader to one which doesn't enable IOC
+         */
+        if (read_aux_reg(ARC_REG_IO_COH_ENABLE) & ARC_IO_COH_ENABLE_BIT)
+                panic("IOC already enabled, please upgrade bootloader!\n");
+
+        if (!ioc_enable)
+                return;
+
+        /*
          * As for today we don't support both IOC and ZONE_HIGHMEM enabled
          * simultaneously. This happens because as of today IOC aperture covers
          * only ZONE_NORMAL (low mem) and any dma transactions outside this
@@ -1187,8 +1201,8 @@ noinline void __init arc_ioc_setup(void)
                 panic("IOC Aperture start must be aligned to the size of the aperture");
 
         write_aux_reg(ARC_REG_IO_COH_AP0_BASE, ioc_base >> 12);
-        write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1);
-        write_aux_reg(ARC_REG_IO_COH_ENABLE, 1);
+        write_aux_reg(ARC_REG_IO_COH_PARTIAL, ARC_IO_COH_PARTIAL_BIT);
+        write_aux_reg(ARC_REG_IO_COH_ENABLE, ARC_IO_COH_ENABLE_BIT);
 
         /* Re-enable L1 dcache */
         __dc_enable();
@@ -1265,7 +1279,7 @@ void __init arc_cache_init_master(void)
         if (is_isa_arcv2() && l2_line_sz && !slc_enable)
                 arc_slc_disable();
 
-        if (is_isa_arcv2() && ioc_enable)
+        if (is_isa_arcv2() && ioc_exists)
                 arc_ioc_setup();
 
         if (is_isa_arcv2() && l2_line_sz && slc_enable) {
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index c9da6102eb4f..e2d9fc3fea01 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -66,7 +66,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
         struct vm_area_struct *vma = NULL;
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->mm;
-        int si_code;
+        int si_code = 0;
         int ret;
         vm_fault_t fault;
         int write = regs->ecr_cause & ECR_C_PROTV_STORE;  /* ST/EX */
diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts
index d4d33cd7adad..1e2bb68231ad 100644
--- a/arch/arm/boot/dts/am3517-evm.dts
+++ b/arch/arm/boot/dts/am3517-evm.dts
@@ -228,7 +228,7 @@
         vmmc-supply = <&vmmc_fixed>;
         bus-width = <4>;
         wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>; /* gpio_126 */
-        cd-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>; /* gpio_127 */
+        cd-gpios = <&gpio4 31 GPIO_ACTIVE_LOW>; /* gpio_127 */
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/am3517-som.dtsi b/arch/arm/boot/dts/am3517-som.dtsi
index dae6e458e59f..b1c988eed87c 100644
--- a/arch/arm/boot/dts/am3517-som.dtsi
+++ b/arch/arm/boot/dts/am3517-som.dtsi
@@ -163,7 +163,7 @@
                 compatible = "ti,wl1271";
                 reg = <2>;
                 interrupt-parent = <&gpio6>;
-                interrupts = <10 IRQ_TYPE_LEVEL_HIGH>; /* gpio_170 */
+                interrupts = <10 IRQ_TYPE_EDGE_RISING>; /* gpio_170 */
                 ref-clock-frequency = <26000000>;
                 tcxo-clock-frequency = <26000000>;
         };
diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
index e45a15ceb94b..69d753cac89a 100644
--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
+++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
@@ -492,12 +492,6 @@
         pinctrl-0 = <&pinctrl_i2c2>;
         status = "okay";
 
-        eeprom@50 {
-                compatible = "atmel,24c04";
-                pagesize = <16>;
-                reg = <0x50>;
-        };
-
         hpa1: amp@60 {
                 compatible = "ti,tpa6130a2";
                 reg = <0x60>;
diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
index b560ff88459b..5ff9a179c83c 100644
--- a/arch/arm/boot/dts/imx53-ppd.dts
+++ b/arch/arm/boot/dts/imx53-ppd.dts
@@ -55,7 +55,7 @@
         };
 
         chosen {
-                stdout-path = "&uart1:115200n8";
+                stdout-path = "serial0:115200n8";
         };
 
         memory@70000000 {
diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
index ed9a980bce85..beefa1b2049d 100644
--- a/arch/arm/boot/dts/imx6sll.dtsi
+++ b/arch/arm/boot/dts/imx6sll.dtsi
@@ -740,7 +740,7 @@
                         i2c1: i2c@21a0000 {
                                 #address-cells = <1>;
                                 #size-cells = <0>;
-                                compatible = "fs,imx6sll-i2c", "fsl,imx21-i2c";
+                                compatible = "fsl,imx6sll-i2c", "fsl,imx21-i2c";
                                 reg = <0x021a0000 0x4000>;
                                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6SLL_CLK_I2C1>;
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
index 53b3408b5fab..7d7d679945d2 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
+++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
@@ -117,7 +117,9 @@
                 regulator-name = "enet_3v3";
                 regulator-min-microvolt = <3300000>;
                 regulator-max-microvolt = <3300000>;
-                gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
+                gpio = <&gpio2 6 GPIO_ACTIVE_LOW>;
+                regulator-boot-on;
+                regulator-always-on;
         };
 
         reg_pcie_gpio: regulator-pcie-gpio {
@@ -180,6 +182,7 @@
         phy-supply = <&reg_enet_3v3>;
         phy-mode = "rgmii";
         phy-handle = <&ethphy1>;
+        phy-reset-gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
         status = "okay";
 
         mdio {
@@ -373,6 +376,8 @@
                                 MX6SX_PAD_RGMII1_RD3__ENET1_RX_DATA_3   0x3081
                                 MX6SX_PAD_RGMII1_RX_CTL__ENET1_RX_EN    0x3081
                                 MX6SX_PAD_ENET2_RX_CLK__ENET2_REF_CLK_25M       0x91
+                                /* phy reset */
+                                MX6SX_PAD_ENET2_CRS__GPIO2_IO_7         0x10b0
                         >;
                 };
 
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index ac343330d0c8..98b682a8080c 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -129,7 +129,7 @@
 };
 
 &mmc3 {
-        interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+        interrupts-extended = <&intc 94 &omap3_pmx_core 0x136>;
         pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
         pinctrl-names = "default";
         vmmc-supply = <&wl12xx_vmmc>;
diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
index 9d5d53fbe9c0..c39cf2ca54da 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
@@ -35,7 +35,7 @@
  * jumpering combinations for the long run.
  */
 &mmc3 {
-        interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+        interrupts-extended = <&intc 94 &omap3_pmx_core 0x136>;
         pinctrl-0 = <&mmc3_pins &mmc3_core2_pins>;
         pinctrl-names = "default";
         vmmc-supply = <&wl12xx_vmmc>;
diff --git a/arch/arm/boot/dts/rk3288-veyron.dtsi b/arch/arm/boot/dts/rk3288-veyron.dtsi
index 2075120cfc4d..d8bf939a3aff 100644
--- a/arch/arm/boot/dts/rk3288-veyron.dtsi
+++ b/arch/arm/boot/dts/rk3288-veyron.dtsi
@@ -10,7 +10,11 @@
 #include "rk3288.dtsi"
 
 / {
-        memory@0 {
+        /*
+         * The default coreboot on veyron devices ignores memory@0 nodes
+         * and would instead create another memory node.
+         */
+        memory {
                 device_type = "memory";
                 reg = <0x0 0x0 0x0 0x80000000>;
         };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 843052f14f1c..dd0dda6ed44b 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -314,7 +314,7 @@
                                   0x1 0x0 0x60000000 0x10000000
                                   0x2 0x0 0x70000000 0x10000000
                                   0x3 0x0 0x80000000 0x10000000>;
-                        clocks = <&mck>;
+                        clocks = <&h32ck>;
                         status = "disabled";
 
                         nand_controller: nand-controller {
diff --git a/arch/arm/boot/dts/vf610m4-colibri.dts b/arch/arm/boot/dts/vf610m4-colibri.dts
index 41ec66a96990..ca6249558760 100644
--- a/arch/arm/boot/dts/vf610m4-colibri.dts
+++ b/arch/arm/boot/dts/vf610m4-colibri.dts
@@ -50,8 +50,8 @@
         compatible = "fsl,vf610m4";
 
         chosen {
-                bootargs = "console=ttyLP2,115200 clk_ignore_unused init=/linuxrc rw";
-                stdout-path = "&uart2";
+                bootargs = "clk_ignore_unused init=/linuxrc rw";
+                stdout-path = "serial2:115200";
         };
 
         memory@8c000000 {
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 1c7616815a86..63af6234c1b6 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -1,7 +1,6 @@
 CONFIG_SYSVIPC=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
-CONFIG_PREEMPT=y
 CONFIG_CGROUPS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EMBEDDED=y
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 0d289240b6ca..775cac3c02bb 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -111,6 +111,7 @@
 #include <linux/kernel.h>
 
 extern unsigned int processor_id;
+struct proc_info_list *lookup_processor(u32 midr);
 
 #ifdef CONFIG_CPU_CP15
 #define read_cpuid(reg)                                                 \
diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
index 92fd2c8a9af0..12659ce5c1f3 100644
--- a/arch/arm/include/asm/pgtable-2level.h
+++ b/arch/arm/include/asm/pgtable-2level.h
@@ -10,7 +10,7 @@
 #ifndef _ASM_PGTABLE_2LEVEL_H
 #define _ASM_PGTABLE_2LEVEL_H
 
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 
 /*
  * Hardware-wise, we have a two level page table structure, where the first
diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
index e25f4392e1b2..e1b6f280ab08 100644
--- a/arch/arm/include/asm/proc-fns.h
+++ b/arch/arm/include/asm/proc-fns.h
@@ -23,7 +23,7 @@ struct mm_struct;
 /*
  * Don't change this structure - ASM code relies on it.
  */
-extern struct processor {
+struct processor {
         /* MISC
          * get data abort address/flags
          */
@@ -79,9 +79,13 @@ extern struct processor {
         unsigned int suspend_size;
         void (*do_suspend)(void *);
         void (*do_resume)(void *);
-} processor;
+};
 
 #ifndef MULTI_CPU
+static inline void init_proc_vtable(const struct processor *p)
+{
+}
+
 extern void cpu_proc_init(void);
 extern void cpu_proc_fin(void);
 extern int cpu_do_idle(void);
@@ -98,17 +102,50 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn));
 extern void cpu_do_suspend(void *);
 extern void cpu_do_resume(void *);
 #else
-#define cpu_proc_init                   processor._proc_init
-#define cpu_proc_fin                    processor._proc_fin
-#define cpu_reset                       processor.reset
-#define cpu_do_idle                     processor._do_idle
-#define cpu_dcache_clean_area           processor.dcache_clean_area
-#define cpu_set_pte_ext                 processor.set_pte_ext
-#define cpu_do_switch_mm                processor.switch_mm
 
-/* These three are private to arch/arm/kernel/suspend.c */
-#define cpu_do_suspend                  processor.do_suspend
-#define cpu_do_resume                   processor.do_resume
+extern struct processor processor;
+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+#include <linux/smp.h>
+/*
+ * This can't be a per-cpu variable because we need to access it before
+ * per-cpu has been initialised.  We have a couple of functions that are
+ * called in a pre-emptible context, and so can't use smp_processor_id()
+ * there, hence PROC_TABLE().  We insist in init_proc_vtable() that the
+ * function pointers for these are identical across all CPUs.
+ */
+extern struct processor *cpu_vtable[];
+#define PROC_VTABLE(f)                  cpu_vtable[smp_processor_id()]->f
+#define PROC_TABLE(f)                   cpu_vtable[0]->f
+static inline void init_proc_vtable(const struct processor *p)
+{
+        unsigned int cpu = smp_processor_id();
+        *cpu_vtable[cpu] = *p;
+        WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area !=
+                     cpu_vtable[0]->dcache_clean_area);
+        WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext !=
+                     cpu_vtable[0]->set_pte_ext);
+}
+#else
+#define PROC_VTABLE(f)                  processor.f
+#define PROC_TABLE(f)                   processor.f
+static inline void init_proc_vtable(const struct processor *p)
+{
+        processor = *p;
+}
+#endif
+
+#define cpu_proc_init                   PROC_VTABLE(_proc_init)
+#define cpu_check_bugs                  PROC_VTABLE(check_bugs)
+#define cpu_proc_fin                    PROC_VTABLE(_proc_fin)
+#define cpu_reset                       PROC_VTABLE(reset)
+#define cpu_do_idle                     PROC_VTABLE(_do_idle)
+#define cpu_dcache_clean_area           PROC_TABLE(dcache_clean_area)
+#define cpu_set_pte_ext                 PROC_TABLE(set_pte_ext)
+#define cpu_do_switch_mm                PROC_VTABLE(switch_mm)
+
+/* These two are private to arch/arm/kernel/suspend.c */
+#define cpu_do_suspend                  PROC_VTABLE(do_suspend)
+#define cpu_do_resume                   PROC_VTABLE(do_resume)
 #endif
 
 extern void cpu_resume(void);
diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c
index 7be511310191..d41d3598e5e5 100644
--- a/arch/arm/kernel/bugs.c
+++ b/arch/arm/kernel/bugs.c
@@ -6,8 +6,8 @@
 void check_other_bugs(void)
 {
 #ifdef MULTI_CPU
-        if (processor.check_bugs)
-                processor.check_bugs();
+        if (cpu_check_bugs)
+                cpu_check_bugs();
 #endif
 }
 
diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
index 0142fcfcc3d3..bda949fd84e8 100644
--- a/arch/arm/kernel/ftrace.c
+++ b/arch/arm/kernel/ftrace.c
@@ -183,9 +183,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
                            unsigned long frame_pointer)
 {
         unsigned long return_hooker = (unsigned long) &return_to_handler;
-        struct ftrace_graph_ent trace;
         unsigned long old;
-        int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
@@ -193,21 +191,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
         old = *parent;
         *parent = return_hooker;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
+        if (function_graph_enter(old, self_addr, frame_pointer, NULL))
                 *parent = old;
-                return;
-        }
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, NULL);
-        if (err == -EBUSY) {
-                *parent = old;
-                return;
-        }
 }
 
 #ifdef CONFIG_DYNAMIC_FTRACE
diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
index 6e0375e7db05..997b02302c31 100644
--- a/arch/arm/kernel/head-common.S
+++ b/arch/arm/kernel/head-common.S
@@ -145,6 +145,9 @@ __mmap_switched_data:
 #endif
         .size   __mmap_switched_data, . - __mmap_switched_data
 
+        __FINIT
+        .text
+
 /*
  * This provides a C-API version of __lookup_processor_type
  */
@@ -156,9 +159,6 @@ ENTRY(lookup_processor_type)
         ldmfd   sp!, {r4 - r6, r9, pc}
 ENDPROC(lookup_processor_type)
 
-        __FINIT
-        .text
-
 /*
  * Read processor ID register (CP#15, CR0), and look up in the linker-built
  * supported processor list.  Note that we can't use the absolute addresses
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index ac7e08886863..375b13f7e780 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -114,6 +114,11 @@ EXPORT_SYMBOL(elf_hwcap2);
 
 #ifdef MULTI_CPU
 struct processor processor __ro_after_init;
+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+struct processor *cpu_vtable[NR_CPUS] = {
+        [0] = &processor,
+};
+#endif
 #endif
 #ifdef MULTI_TLB
 struct cpu_tlb_fns cpu_tlb __ro_after_init;
@@ -666,28 +671,33 @@ static void __init smp_build_mpidr_hash(void)
 }
 #endif
 
-static void __init setup_processor(void)
+/*
+ * locate processor in the list of supported processor types.  The linker
+ * builds this table for us from the entries in arch/arm/mm/proc-*.S
+ */
+struct proc_info_list *lookup_processor(u32 midr)
 {
-        struct proc_info_list *list;
+        struct proc_info_list *list = lookup_processor_type(midr);
 
-        /*
-         * locate processor in the list of supported processor
-         * types.  The linker builds this table for us from the
-         * entries in arch/arm/mm/proc-*.S
-         */
-        list = lookup_processor_type(read_cpuid_id());
         if (!list) {
-                pr_err("CPU configuration botched (ID %08x), unable to continue.\n",
-                       read_cpuid_id());
-                while (1);
+                pr_err("CPU%u: configuration botched (ID %08x), CPU halted\n",
+                       smp_processor_id(), midr);
+                while (1)
+                /* can't use cpu_relax() here as it may require MMU setup */;
         }
 
+        return list;
+}
+
+static void __init setup_processor(void)
+{
+        unsigned int midr = read_cpuid_id();
+        struct proc_info_list *list = lookup_processor(midr);
+
         cpu_name = list->cpu_name;
         __cpu_architecture = __get_cpu_architecture();
 
-#ifdef MULTI_CPU
-        processor = *list->proc;
-#endif
+        init_proc_vtable(list->proc);
 #ifdef MULTI_TLB
         cpu_tlb = *list->tlb;
 #endif
@@ -699,7 +709,7 @@ static void __init setup_processor(void)
 #endif
 
         pr_info("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n",
-                cpu_name, read_cpuid_id(), read_cpuid_id() & 15,
+                list->cpu_name, midr, midr & 15,
                 proc_arch[cpu_architecture()], get_cr());
 
         snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 0978282d5fc2..12a6172263c0 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -42,6 +42,7 @@
 #include <asm/mmu_context.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
+#include <asm/procinfo.h>
 #include <asm/processor.h>
 #include <asm/sections.h>
 #include <asm/tlbflush.h>
@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)
 #endif
 }
 
+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+static int secondary_biglittle_prepare(unsigned int cpu)
+{
+        if (!cpu_vtable[cpu])
+                cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL);
+
+        return cpu_vtable[cpu] ? 0 : -ENOMEM;
+}
+
+static void secondary_biglittle_init(void)
+{
+        init_proc_vtable(lookup_processor(read_cpuid_id())->proc);
+}
+#else
+static int secondary_biglittle_prepare(unsigned int cpu)
+{
+        return 0;
+}
+
+static void secondary_biglittle_init(void)
+{
+}
+#endif
+
 int __cpu_up(unsigned int cpu, struct task_struct *idle)
 {
         int ret;
@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
         if (!smp_ops.smp_boot_secondary)
                 return -ENOSYS;
 
+        ret = secondary_biglittle_prepare(cpu);
+        if (ret)
+                return ret;
+
         /*
          * We need to tell the secondary core where to find
          * its stack and the page tables.
@@ -359,6 +388,8 @@ asmlinkage void secondary_start_kernel(void)
         struct mm_struct *mm = &init_mm;
         unsigned int cpu;
 
+        secondary_biglittle_init();
+
         /*
          * The identity mapping is uncached (strongly ordered), so
          * switch away from it before attempting any exclusive accesses.
diff --git a/arch/arm/mach-davinci/da830.c b/arch/arm/mach-davinci/da830.c
index 0bc5bd2665df..2cc9fe4c3a91 100644
--- a/arch/arm/mach-davinci/da830.c
+++ b/arch/arm/mach-davinci/da830.c
@@ -759,7 +759,9 @@ static struct davinci_id da830_ids[] = {
 };
 
 static struct davinci_gpio_platform_data da830_gpio_platform_data = {
-        .ngpio = 128,
+        .no_auto_base   = true,
+        .base           = 0,
+        .ngpio          = 128,
 };
 
 int __init da830_register_gpio(void)
diff --git a/arch/arm/mach-davinci/da850.c b/arch/arm/mach-davinci/da850.c
index 4528bbf0c861..e7b78df2bfef 100644
--- a/arch/arm/mach-davinci/da850.c
+++ b/arch/arm/mach-davinci/da850.c
@@ -719,7 +719,9 @@ int __init da850_register_vpif_capture(struct vpif_capture_config
 }
 
 static struct davinci_gpio_platform_data da850_gpio_platform_data = {
-        .ngpio = 144,
+        .no_auto_base   = true,
+        .base           = 0,
+        .ngpio          = 144,
 };
 
 int __init da850_register_gpio(void)
diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
index 1fd3619f6a09..cf78da5ab054 100644
--- a/arch/arm/mach-davinci/devices-da8xx.c
+++ b/arch/arm/mach-davinci/devices-da8xx.c
@@ -701,6 +701,46 @@ static struct resource da8xx_gpio_resources[] = {
         },
         { /* interrupt */
                 .start  = IRQ_DA8XX_GPIO0,
+                .end    = IRQ_DA8XX_GPIO0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO1,
+                .end    = IRQ_DA8XX_GPIO1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO2,
+                .end    = IRQ_DA8XX_GPIO2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO3,
+                .end    = IRQ_DA8XX_GPIO3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO4,
+                .end    = IRQ_DA8XX_GPIO4,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO5,
+                .end    = IRQ_DA8XX_GPIO5,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO6,
+                .end    = IRQ_DA8XX_GPIO6,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO7,
+                .end    = IRQ_DA8XX_GPIO7,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO8,
                 .end    = IRQ_DA8XX_GPIO8,
                 .flags  = IORESOURCE_IRQ,
         },
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index 9f7d38d12c88..4c6e0bef4509 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -548,12 +548,44 @@ static struct resource dm355_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_DM355_GPIOBNK0,
+                .end    = IRQ_DM355_GPIOBNK0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK1,
+                .end    = IRQ_DM355_GPIOBNK1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK2,
+                .end    = IRQ_DM355_GPIOBNK2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK3,
+                .end    = IRQ_DM355_GPIOBNK3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK4,
+                .end    = IRQ_DM355_GPIOBNK4,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK5,
+                .end    = IRQ_DM355_GPIOBNK5,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK6,
                 .end    = IRQ_DM355_GPIOBNK6,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm355_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 104,
 };
 
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index abcf2a5ed89b..01fb2b0c82de 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -267,12 +267,49 @@ static struct resource dm365_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_DM365_GPIO0,
+                .end    = IRQ_DM365_GPIO0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO1,
+                .end    = IRQ_DM365_GPIO1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO2,
+                .end    = IRQ_DM365_GPIO2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO3,
+                .end    = IRQ_DM365_GPIO3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO4,
+                .end    = IRQ_DM365_GPIO4,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO5,
+                .end    = IRQ_DM365_GPIO5,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO6,
+                .end    = IRQ_DM365_GPIO6,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO7,
                 .end    = IRQ_DM365_GPIO7,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm365_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 104,
         .gpio_unbanked  = 8,
 };
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 0720da7809a6..38f92b7d413e 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -492,12 +492,34 @@ static struct resource dm644_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_GPIOBNK0,
+                .end    = IRQ_GPIOBNK0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK1,
+                .end    = IRQ_GPIOBNK1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK2,
+                .end    = IRQ_GPIOBNK2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK3,
+                .end    = IRQ_GPIOBNK3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK4,
                 .end    = IRQ_GPIOBNK4,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm644_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 71,
 };
 
diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
index 6bd2ed069d0d..7dc54b2a610f 100644
--- a/arch/arm/mach-davinci/dm646x.c
+++ b/arch/arm/mach-davinci/dm646x.c
@@ -442,12 +442,24 @@ static struct resource dm646x_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_DM646X_GPIOBNK0,
+                .end    = IRQ_DM646X_GPIOBNK0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM646X_GPIOBNK1,
+                .end    = IRQ_DM646X_GPIOBNK1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM646X_GPIOBNK2,
                 .end    = IRQ_DM646X_GPIOBNK2,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm646x_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 43,
 };
 
diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
index 3d191fd52910..17886744dbe6 100644
--- a/arch/arm/mach-omap1/board-ams-delta.c
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -750,6 +750,9 @@ static void modem_pm(struct uart_port *port, unsigned int state, unsigned old)
         struct modem_private_data *priv = port->private_data;
         int ret;
 
+        if (!priv)
+                return;
+
         if (IS_ERR(priv->regulator))
                 return;
 
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 9500b6e27380..f86b72d1d59e 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -209,11 +209,61 @@ static int __init omapdss_init_fbdev(void)
 
         return 0;
 }
-#else
-static inline int omapdss_init_fbdev(void)
+
+static const char * const omapdss_compat_names[] __initconst = {
+        "ti,omap2-dss",
+        "ti,omap3-dss",
+        "ti,omap4-dss",
+        "ti,omap5-dss",
+        "ti,dra7-dss",
+};
+
+static struct device_node * __init omapdss_find_dss_of_node(void)
 {
-        return 0;
+        struct device_node *node;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(omapdss_compat_names); ++i) {
+                node = of_find_compatible_node(NULL, NULL,
+                        omapdss_compat_names[i]);
+                if (node)
+                        return node;
+        }
+
+        return NULL;
 }
+
+static int __init omapdss_init_of(void)
+{
+        int r;
+        struct device_node *node;
+        struct platform_device *pdev;
+
+        /* only create dss helper devices if dss is enabled in the .dts */
+
+        node = omapdss_find_dss_of_node();
+        if (!node)
+                return 0;
+
+        if (!of_device_is_available(node))
+                return 0;
+
+        pdev = of_find_device_by_node(node);
+
+        if (!pdev) {
+                pr_err("Unable to find DSS platform device\n");
+                return -ENODEV;
+        }
+
+        r = of_platform_populate(node, NULL, NULL, &pdev->dev);
+        if (r) {
+                pr_err("Unable to populate DSS submodule devices\n");
+                return r;
+        }
+
+        return omapdss_init_fbdev();
+}
+omap_device_initcall(omapdss_init_of);
 #endif /* CONFIG_FB_OMAP2 */
 
 static void dispc_disable_outputs(void)
@@ -361,58 +411,3 @@ int omap_dss_reset(struct omap_hwmod *oh)
 
         return r;
 }
-
-static const char * const omapdss_compat_names[] __initconst = {
-        "ti,omap2-dss",
-        "ti,omap3-dss",
-        "ti,omap4-dss",
-        "ti,omap5-dss",
-        "ti,dra7-dss",
-};
-
-static struct device_node * __init omapdss_find_dss_of_node(void)
-{
-        struct device_node *node;
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(omapdss_compat_names); ++i) {
-                node = of_find_compatible_node(NULL, NULL,
-                        omapdss_compat_names[i]);
-                if (node)
-                        return node;
-        }
-
-        return NULL;
-}
-
-static int __init omapdss_init_of(void)
-{
-        int r;
-        struct device_node *node;
-        struct platform_device *pdev;
-
-        /* only create dss helper devices if dss is enabled in the .dts */
-
-        node = omapdss_find_dss_of_node();
-        if (!node)
-                return 0;
-
-        if (!of_device_is_available(node))
-                return 0;
-
-        pdev = of_find_device_by_node(node);
-
-        if (!pdev) {
-                pr_err("Unable to find DSS platform device\n");
-                return -ENODEV;
-        }
-
-        r = of_platform_populate(node, NULL, NULL, &pdev->dev);
-        if (r) {
-                pr_err("Unable to populate DSS submodule devices\n");
-                return r;
-        }
-
-        return omapdss_init_fbdev();
-}
-omap_device_initcall(omapdss_init_of);
diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
index 7b95729e8359..38a1be6c3694 100644
--- a/arch/arm/mach-omap2/prm44xx.c
+++ b/arch/arm/mach-omap2/prm44xx.c
@@ -351,7 +351,7 @@ static void omap44xx_prm_reconfigure_io_chain(void)
  * to occur, WAKEUPENABLE bits must be set in the pad mux registers, and
  * omap44xx_prm_reconfigure_io_chain() must be called.  No return value.
  */
-static void __init omap44xx_prm_enable_io_wakeup(void)
+static void omap44xx_prm_enable_io_wakeup(void)
 {
         s32 inst = omap4_prmst_get_prm_dev_inst();
 
diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
index 5544b82a2e7a..9a07916af8dd 100644
--- a/arch/arm/mm/proc-v7-bugs.c
+++ b/arch/arm/mm/proc-v7-bugs.c
@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)
         case ARM_CPU_PART_CORTEX_A17:
         case ARM_CPU_PART_CORTEX_A73:
         case ARM_CPU_PART_CORTEX_A75:
-                if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
-                        goto bl_error;
                 per_cpu(harden_branch_predictor_fn, cpu) =
                         harden_branch_predictor_bpiall;
                 spectre_v2_method = "BPIALL";
@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)
 
         case ARM_CPU_PART_CORTEX_A15:
         case ARM_CPU_PART_BRAHMA_B15:
-                if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
-                        goto bl_error;
                 per_cpu(harden_branch_predictor_fn, cpu) =
                         harden_branch_predictor_iciallu;
                 spectre_v2_method = "ICIALLU";
@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void)
                                           ARM_SMCCC_ARCH_WORKAROUND_1, &res);
                         if ((int)res.a0 != 0)
                                 break;
-                        if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
-                                goto bl_error;
                         per_cpu(harden_branch_predictor_fn, cpu) =
                                 call_hvc_arch_workaround_1;
-                        processor.switch_mm = cpu_v7_hvc_switch_mm;
+                        cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
                         spectre_v2_method = "hypervisor";
                         break;
 
@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void)
                                           ARM_SMCCC_ARCH_WORKAROUND_1, &res);
                         if ((int)res.a0 != 0)
                                 break;
-                        if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
-                                goto bl_error;
                         per_cpu(harden_branch_predictor_fn, cpu) =
                                 call_smc_arch_workaround_1;
-                        processor.switch_mm = cpu_v7_smc_switch_mm;
+                        cpu_do_switch_mm = cpu_v7_smc_switch_mm;
                         spectre_v2_method = "firmware";
                         break;
 
@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)
         if (spectre_v2_method)
                 pr_info("CPU%u: Spectre v2: using %s workaround\n",
                         smp_processor_id(), spectre_v2_method);
-        return;
-
-bl_error:
-        pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
-                cpu);
 }
 #else
 static void cpu_v7_spectre_init(void)
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 6fe52819e014..339eb17c9808 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm)
         hvc     #0
         ldmfd   sp!, {r0 - r3}
         b       cpu_v7_switch_mm
-ENDPROC(cpu_v7_smc_switch_mm)
+ENDPROC(cpu_v7_hvc_switch_mm)
 #endif
 ENTRY(cpu_v7_iciallu_switch_mm)
         mov     r3, #0
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index aff6e6eadc70..ee7b07938dd5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -573,7 +573,7 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp,
          */
         ufp_exc->fpexc = hwstate->fpexc;
         ufp_exc->fpinst = hwstate->fpinst;
-        ufp_exc->fpinst2 = ufp_exc->fpinst2;
+        ufp_exc->fpinst2 = hwstate->fpinst2;
 
         /* Ensure that VFP is disabled. */
         vfp_flush_hwstate(thread);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 787d7850e064..ea2ab0330e3a 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -497,6 +497,24 @@ config ARM64_ERRATUM_1188873
 
           If unsure, say Y.
 
+config ARM64_ERRATUM_1286807
+        bool "Cortex-A76: Modification of the translation table for a virtual address might lead to read-after-read ordering violation"
+        default y
+        select ARM64_WORKAROUND_REPEAT_TLBI
+        help
+          This option adds workaround for ARM Cortex-A76 erratum 1286807
+
+          On the affected Cortex-A76 cores (r0p0 to r3p0), if a virtual
+          address for a cacheable mapping of a location is being
+          accessed by a core while another core is remapping the virtual
+          address to a new physical page using the recommended
+          break-before-make sequence, then under very rare circumstances
+          TLBI+DSB completes before a read using the translation being
+          invalidated has been observed by other observers. The
+          workaround repeats the TLBI+DSB operation.
+
+          If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
         bool "Cavium erratum 22375, 24313"
         default y
@@ -566,9 +584,16 @@ config QCOM_FALKOR_ERRATUM_1003
           is unchanged. Work around the erratum by invalidating the walk cache
           entries for the trampoline before entering the kernel proper.
 
+config ARM64_WORKAROUND_REPEAT_TLBI
+        bool
+        help
+          Enable the repeat TLBI workaround for Falkor erratum 1009 and
+          Cortex-A76 erratum 1286807.
+
 config QCOM_FALKOR_ERRATUM_1009
         bool "Falkor E1009: Prematurely complete a DSB after a TLBI"
         default y
+        select ARM64_WORKAROUND_REPEAT_TLBI
         help
           On Falkor v1, the CPU may prematurely complete a DSB following a
           TLBI xxIS invalidate maintenance operation. Repeat the TLBI operation
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 8253a1a9e985..fef7351e9f67 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -139,6 +139,7 @@
                         clock-names = "stmmaceth";
                         tx-fifo-depth = <16384>;
                         rx-fifo-depth = <16384>;
+                        snps,multicast-filter-bins = <256>;
                         status = "disabled";
                 };
 
@@ -154,6 +155,7 @@
                         clock-names = "stmmaceth";
                         tx-fifo-depth = <16384>;
                         rx-fifo-depth = <16384>;
+                        snps,multicast-filter-bins = <256>;
                         status = "disabled";
                 };
 
@@ -169,6 +171,7 @@
                         clock-names = "stmmaceth";
                         tx-fifo-depth = <16384>;
                         rx-fifo-depth = <16384>;
+                        snps,multicast-filter-bins = <256>;
                         status = "disabled";
                 };
 
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
index b4276da1fb0d..11fd1fe8bdb5 100644
--- a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
@@ -241,3 +241,7 @@
                 };
         };
 };
+
+&tlmm {
+        gpio-reserved-ranges = <0 4>, <81 4>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
index eedfaf8922e2..d667eee4e6d0 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
@@ -352,6 +352,10 @@
         status = "okay";
 };
 
+&tlmm {
+        gpio-reserved-ranges = <0 4>, <81 4>;
+};
+
 &uart9 {
         status = "okay";
 };
diff --git a/arch/arm64/boot/dts/renesas/r8a7795.dtsi b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
index b5f2273caca4..a79c8d369e0b 100644
--- a/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
@@ -652,7 +652,7 @@
                         clock-names = "fck", "brg_int", "scif_clk";
                         dmas = <&dmac1 0x35>, <&dmac1 0x34>,
                                <&dmac2 0x35>, <&dmac2 0x34>;
-                        dma-names = "tx", "rx";
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
                         resets = <&cpg 518>;
                         status = "disabled";
diff --git a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
index fe2e2c051cc9..5a7012be0d6a 100644
--- a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+++ b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
@@ -15,7 +15,7 @@
 
         aliases {
                 serial0 = &scif0;
-                ethernet0 = &avb;
+                ethernet0 = &gether;
         };
 
         chosen {
@@ -97,23 +97,6 @@
         };
 };
 
-&avb {
-        pinctrl-0 = <&avb_pins>;
-        pinctrl-names = "default";
-
-        phy-mode = "rgmii-id";
-        phy-handle = <&phy0>;
-        renesas,no-ether-link;
-        status = "okay";
-
-        phy0: ethernet-phy@0 {
-                rxc-skew-ps = <1500>;
-                reg = <0>;
-                interrupt-parent = <&gpio1>;
-                interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
-        };
-};
-
 &canfd {
         pinctrl-0 = <&canfd0_pins>;
         pinctrl-names = "default";
@@ -139,6 +122,23 @@
         clock-frequency = <32768>;
 };
 
+&gether {
+        pinctrl-0 = <&gether_pins>;
+        pinctrl-names = "default";
+
+        phy-mode = "rgmii-id";
+        phy-handle = <&phy0>;
+        renesas,no-ether-link;
+        status = "okay";
+
+        phy0: ethernet-phy@0 {
+                rxc-skew-ps = <1500>;
+                reg = <0>;
+                interrupt-parent = <&gpio4>;
+                interrupts = <23 IRQ_TYPE_LEVEL_LOW>;
+        };
+};
+
 &i2c0 {
         pinctrl-0 = <&i2c0_pins>;
         pinctrl-names = "default";
@@ -236,16 +236,17 @@
 };
 
 &pfc {
-        avb_pins: avb {
-                groups = "avb_mdio", "avb_rgmii";
-                function = "avb";
-        };
-
         canfd0_pins: canfd0 {
                 groups = "canfd0_data_a";
                 function = "canfd0";
         };
 
+        gether_pins: gether {
+                groups = "gether_mdio_a", "gether_rgmii",
+                         "gether_txcrefclk", "gether_txcrefclk_mega";
+                function = "gether";
+        };
+
         i2c0_pins: i2c0 {
                 groups = "i2c0";
                 function = "i2c0";
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
index 2dceeea29b83..1e6a71066c16 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
@@ -153,7 +153,7 @@
 };
 
 &pcie0 {
-        ep-gpios = <&gpio4 RK_PC6 GPIO_ACTIVE_LOW>;
+        ep-gpios = <&gpio4 RK_PC6 GPIO_ACTIVE_HIGH>;
         num-lanes = <4>;
         pinctrl-names = "default";
         pinctrl-0 = <&pcie_clkreqn_cpm>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
index 6c8c4ab044aa..56abbb08c133 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
@@ -57,18 +57,6 @@
                 regulator-always-on;
                 vin-supply = <&vcc_sys>;
         };
-
-        vdd_log: vdd-log {
-                compatible = "pwm-regulator";
-                pwms = <&pwm2 0 25000 0>;
-                regulator-name = "vdd_log";
-                regulator-min-microvolt = <800000>;
-                regulator-max-microvolt = <1400000>;
-                regulator-always-on;
-                regulator-boot-on;
-                vin-supply = <&vcc_sys>;
-        };
-
 };
 
 &cpu_l0 {
diff --git a/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi
index affc3c309353..8d7b47f9dfbf 100644
--- a/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi
@@ -36,7 +36,7 @@
 
         wkup_uart0: serial@42300000 {
                 compatible = "ti,am654-uart";
-                reg = <0x00 0x42300000 0x00 0x100>;
+                reg = <0x42300000 0x100>;
                 reg-shift = <2>;
                 reg-io-width = <4>;
                 interrupts = <GIC_SPI 697 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h
index caa955f10e19..fac54fb050d0 100644
--- a/arch/arm64/include/asm/ftrace.h
+++ b/arch/arm64/include/asm/ftrace.h
@@ -56,6 +56,19 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
 {
         return is_compat_task();
 }
+
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+
+static inline bool arch_syscall_match_sym_name(const char *sym,
+                                               const char *name)
+{
+        /*
+         * Since all syscall functions have __arm64_ prefix, we must skip it.
+         * However, as we described above, we decided to ignore compat
+         * syscalls, so we don't care about __arm64_compat_ prefix here.
+         */
+        return !strcmp(sym + 8, name);
+}
 #endif /* ifndef __ASSEMBLY__ */
 
 #endif /* __ASM_FTRACE_H */
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 3e2091708b8e..6b0d4dff5012 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -24,6 +24,14 @@
 #define KERNEL_DS       UL(-1)
 #define USER_DS         (TASK_SIZE_64 - 1)
 
+/*
+ * On arm64 systems, unaligned accesses by the CPU are cheap, and so there is
+ * no point in shifting all network buffers by 2 bytes just to make some IP
+ * header fields appear aligned in memory, potentially sacrificing some DMA
+ * performance on some platforms.
+ */
+#define NET_IP_ALIGN    0
+
 #ifndef __ASSEMBLY__
 #ifdef __KERNEL__
 
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 0c909c4a932f..842fb9572661 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -468,7 +468,7 @@
                          SCTLR_ELx_SA     | SCTLR_ELx_I    | SCTLR_ELx_WXN | \
                          SCTLR_ELx_DSSBS | ENDIAN_CLEAR_EL2 | SCTLR_EL2_RES0)
 
-#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL2 set/clear bits"
 #endif
 
@@ -509,7 +509,7 @@
                          SCTLR_EL1_UMA | SCTLR_ELx_WXN     | ENDIAN_CLEAR_EL1 |\
                          SCTLR_ELx_DSSBS | SCTLR_EL1_NTWI  | SCTLR_EL1_RES0)
 
-#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL1 set/clear bits"
 #endif
 
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index c3c0387aee18..5dfd23897dea 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -41,14 +41,14 @@
                    ALTERNATIVE("nop\n                   nop",                  \
                                "dsb ish\n               tlbi " #op,            \
                                ARM64_WORKAROUND_REPEAT_TLBI,                   \
-                               CONFIG_QCOM_FALKOR_ERRATUM_1009)                \
+                               CONFIG_ARM64_WORKAROUND_REPEAT_TLBI)            \
                             : : )
 
 #define __TLBI_1(op, arg) asm ("tlbi " #op ", %0\n"                            \
                    ALTERNATIVE("nop\n                   nop",                  \
                                "dsb ish\n               tlbi " #op ", %0",     \
                                ARM64_WORKAROUND_REPEAT_TLBI,                   \
-                               CONFIG_QCOM_FALKOR_ERRATUM_1009)                \
+                               CONFIG_ARM64_WORKAROUND_REPEAT_TLBI)            \
                             : : "r" (arg))
 
 #define __TLBI_N(op, arg, n, ...) __TLBI_##n(op, arg)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index a509e35132d2..6ad715d67df8 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -570,6 +570,20 @@ static const struct midr_range arm64_harden_el2_vectors[] = {
 
 #endif
 
+#ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
+
+static const struct midr_range arm64_repeat_tlbi_cpus[] = {
+#ifdef CONFIG_QCOM_FALKOR_ERRATUM_1009
+        MIDR_RANGE(MIDR_QCOM_FALKOR_V1, 0, 0, 0, 0),
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_1286807
+        MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0),
+#endif
+        {},
+};
+
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #if     defined(CONFIG_ARM64_ERRATUM_826319) || \
         defined(CONFIG_ARM64_ERRATUM_827319) || \
@@ -695,11 +709,11 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                 .matches = is_kryo_midr,
         },
 #endif
-#ifdef CONFIG_QCOM_FALKOR_ERRATUM_1009
+#ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
         {
-                .desc = "Qualcomm Technologies Falkor erratum 1009",
+                .desc = "Qualcomm erratum 1009, ARM erratum 1286807",
                 .capability = ARM64_WORKAROUND_REPEAT_TLBI,
-                ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0),
+                ERRATA_MIDR_RANGE_LIST(arm64_repeat_tlbi_cpus),
         },
 #endif
 #ifdef CONFIG_ARM64_ERRATUM_858921
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index af50064dea51..aec5ecb85737 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1333,7 +1333,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .cpu_enable = cpu_enable_hw_dbm,
         },
 #endif
-#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "CRC32 instructions",
                 .capability = ARM64_HAS_CRC32,
@@ -1343,6 +1342,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .field_pos = ID_AA64ISAR0_CRC32_SHIFT,
                 .min_field_value = 1,
         },
+#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "Speculative Store Bypassing Safe (SSBS)",
                 .capability = ARM64_SSBS,
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 50986e388d2b..57e962290df3 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -216,8 +216,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
 {
         unsigned long return_hooker = (unsigned long)&return_to_handler;
         unsigned long old;
-        struct ftrace_graph_ent trace;
-        int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
@@ -229,18 +227,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
          */
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, NULL);
-        if (err == -EBUSY)
-                return;
-        else
+        if (!function_graph_enter(old, self_addr, frame_pointer, NULL))
                 *parent = return_hooker;
 }
 
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 953e316521fc..f4fc1e0544b7 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -313,6 +313,7 @@ void __init setup_arch(char **cmdline_p)
         arm64_memblock_init();
 
         paging_init();
+        efi_apply_persistent_mem_reservations();
 
         acpi_table_upgrade();
 
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 9d9582cac6c4..9b432d9fcada 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -483,8 +483,6 @@ void __init arm64_memblock_init(void)
         high_memory = __va(memblock_end_of_DRAM() - 1) + 1;
 
         dma_contiguous_reserve(arm64_dma_phys_limit);
-
-        memblock_allow_resize();
 }
 
 void __init bootmem_init(void)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 394b8d554def..d1d6601b385d 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -659,6 +659,8 @@ void __init paging_init(void)
 
         memblock_free(__pa_symbol(init_pg_dir),
                       __pa_symbol(init_pg_end) - __pa_symbol(init_pg_dir));
+
+        memblock_allow_resize();
 }
 
 /*
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index a6fdaea07c63..89198017e8e6 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -351,7 +351,8 @@ static void build_epilogue(struct jit_ctx *ctx)
  * >0 - successfully JITed a 16-byte eBPF instruction.
  * <0 - failed to JIT.
  */
-static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
+                      bool extra_pass)
 {
         const u8 code = insn->code;
         const u8 dst = bpf2a64[insn->dst_reg];
@@ -625,12 +626,19 @@ emit_cond_jmp:
         case BPF_JMP | BPF_CALL:
         {
                 const u8 r0 = bpf2a64[BPF_REG_0];
-                const u64 func = (u64)__bpf_call_base + imm;
+                bool func_addr_fixed;
+                u64 func_addr;
+                int ret;
 
-                if (ctx->prog->is_func)
-                        emit_addr_mov_i64(tmp, func, ctx);
+                ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass,
+                                            &func_addr, &func_addr_fixed);
+                if (ret < 0)
+                        return ret;
+                if (func_addr_fixed)
+                        /* We can use optimized emission here. */
+                        emit_a64_mov_i64(tmp, func_addr, ctx);
                 else
-                        emit_a64_mov_i64(tmp, func, ctx);
+                        emit_addr_mov_i64(tmp, func_addr, ctx);
                 emit(A64_BLR(tmp), ctx);
                 emit(A64_MOV(1, r0, A64_R(0)), ctx);
                 break;
@@ -753,7 +761,7 @@ emit_cond_jmp:
         return 0;
 }
 
-static int build_body(struct jit_ctx *ctx)
+static int build_body(struct jit_ctx *ctx, bool extra_pass)
 {
         const struct bpf_prog *prog = ctx->prog;
         int i;
@@ -762,7 +770,7 @@ static int build_body(struct jit_ctx *ctx)
                 const struct bpf_insn *insn = &prog->insnsi[i];
                 int ret;
 
-                ret = build_insn(insn, ctx);
+                ret = build_insn(insn, ctx, extra_pass);
                 if (ret > 0) {
                         i++;
                         if (ctx->image == NULL)
@@ -858,7 +866,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
         /* 1. Initial fake pass to compute ctx->idx. */
 
         /* Fake pass to fill in ctx->offset. */
-        if (build_body(&ctx)) {
+        if (build_body(&ctx, extra_pass)) {
                 prog = orig_prog;
                 goto out_off;
         }
@@ -888,7 +896,7 @@ skip_init_ctx:
 
         build_prologue(&ctx, was_classic);
 
-        if (build_body(&ctx)) {
+        if (build_body(&ctx, extra_pass)) {
                 bpf_jit_binary_free(header);
                 prog = orig_prog;
                 goto out_off;
diff --git a/arch/ia64/include/asm/numa.h b/arch/ia64/include/asm/numa.h
index ebef7f40aabb..c5c253cb9bd6 100644
--- a/arch/ia64/include/asm/numa.h
+++ b/arch/ia64/include/asm/numa.h
@@ -59,7 +59,9 @@ extern struct node_cpuid_s node_cpuid[NR_CPUS];
  */
 
 extern u8 numa_slit[MAX_NUMNODES * MAX_NUMNODES];
-#define node_distance(from,to) (numa_slit[(from) * MAX_NUMNODES + (to)])
+#define slit_distance(from,to) (numa_slit[(from) * MAX_NUMNODES + (to)])
+extern int __node_distance(int from, int to);
+#define node_distance(from,to) __node_distance(from, to)
 
 extern int paddr_to_nid(unsigned long paddr);
 
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 1dacbf5e9e09..41eb281709da 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -578,8 +578,8 @@ void __init acpi_numa_fixup(void)
         if (!slit_table) {
                 for (i = 0; i < MAX_NUMNODES; i++)
                         for (j = 0; j < MAX_NUMNODES; j++)
-                                node_distance(i, j) = i == j ? LOCAL_DISTANCE :
-                                                        REMOTE_DISTANCE;
+                                slit_distance(i, j) = i == j ?
+                                        LOCAL_DISTANCE : REMOTE_DISTANCE;
                 return;
         }
 
@@ -592,7 +592,7 @@ void __init acpi_numa_fixup(void)
                         if (!pxm_bit_test(j))
                                 continue;
                         node_to = pxm_to_node(j);
-                        node_distance(node_from, node_to) =
+                        slit_distance(node_from, node_to) =
                             slit_table->entry[i * slit_table->locality_count + j];
                 }
         }
diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c
index 3861d6e32d5f..a03803506b0c 100644
--- a/arch/ia64/mm/numa.c
+++ b/arch/ia64/mm/numa.c
@@ -36,6 +36,12 @@ struct node_cpuid_s node_cpuid[NR_CPUS] =
  */
 u8 numa_slit[MAX_NUMNODES * MAX_NUMNODES];
 
+int __node_distance(int from, int to)
+{
+        return slit_distance(from, to);
+}
+EXPORT_SYMBOL(__node_distance);
+
 /* Identify which cnode a physical address resides on */
 int
 paddr_to_nid(unsigned long paddr)
diff --git a/arch/m68k/include/asm/pgtable_mm.h b/arch/m68k/include/asm/pgtable_mm.h
index 6181e4134483..fe3ddd73a0cc 100644
--- a/arch/m68k/include/asm/pgtable_mm.h
+++ b/arch/m68k/include/asm/pgtable_mm.h
@@ -55,12 +55,12 @@
  */
 #ifdef CONFIG_SUN3
 #define PTRS_PER_PTE   16
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 #define PTRS_PER_PMD   1
 #define PTRS_PER_PGD   2048
 #elif defined(CONFIG_COLDFIRE)
 #define PTRS_PER_PTE    512
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 #define PTRS_PER_PMD    1
 #define PTRS_PER_PGD    1024
 #else
diff --git a/arch/microblaze/include/asm/pgtable.h b/arch/microblaze/include/asm/pgtable.h
index f64ebb9c9a41..e14b6621c933 100644
--- a/arch/microblaze/include/asm/pgtable.h
+++ b/arch/microblaze/include/asm/pgtable.h
@@ -63,7 +63,7 @@ extern int mem_init_done;
 
 #include <asm-generic/4level-fixup.h>
 
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
diff --git a/arch/microblaze/kernel/ftrace.c b/arch/microblaze/kernel/ftrace.c
index d57563c58a26..224eea40e1ee 100644
--- a/arch/microblaze/kernel/ftrace.c
+++ b/arch/microblaze/kernel/ftrace.c
@@ -22,8 +22,7 @@
 void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
 {
         unsigned long old;
-        int faulted, err;
-        struct ftrace_graph_ent trace;
+        int faulted;
         unsigned long return_hooker = (unsigned long)
                                 &return_to_handler;
 
@@ -63,18 +62,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
                 return;
         }
 
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth, 0, NULL);
-        if (err == -EBUSY) {
+        if (function_graph_enter(old, self_addr, 0, NULL))
                 *parent = old;
-                return;
-        }
-
-        trace.func = self_addr;
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
-                *parent = old;
-        }
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
index 75108ec669eb..6c79e8a16a26 100644
--- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
+++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
@@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port,
 void (*cvmx_override_ipd_port_setup) (int ipd_port);
 
 /* Port count per interface */
-static int interface_port_count[5];
+static int interface_port_count[9];
 
 /**
  * Return the number of interfaces the chip has. Each interface
diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig
index 490b12af103c..c52d0efacd14 100644
--- a/arch/mips/configs/cavium_octeon_defconfig
+++ b/arch/mips/configs/cavium_octeon_defconfig
@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_STAGING=y
 CONFIG_OCTEON_ETHERNET=y
+CONFIG_OCTEON_USB=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_RAS=y
 CONFIG_EXT4_FS=y
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 0170602a1e4e..6cf8ffb5367e 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -73,7 +73,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
 #ifdef CONFIG_64BIT
         case 4: case 5: case 6: case 7:
 #ifdef CONFIG_MIPS32_O32
-                if (test_thread_flag(TIF_32BIT_REGS))
+                if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
                         return get_user(*arg, (int *)usp + n);
                 else
 #endif
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 7f3dfdbc3657..b122cbb4aad1 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -322,7 +322,6 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
                            unsigned long fp)
 {
         unsigned long old_parent_ra;
-        struct ftrace_graph_ent trace;
         unsigned long return_hooker = (unsigned long)
             &return_to_handler;
         int faulted, insns;
@@ -369,12 +368,6 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
         if (unlikely(faulted))
                 goto out;
 
-        if (ftrace_push_return_trace(old_parent_ra, self_ra, &trace.depth, fp,
-                                     NULL) == -EBUSY) {
-                *parent_ra_addr = old_parent_ra;
-                return;
-        }
-
         /*
          * Get the recorded ip of the current mcount calling site in the
          * __mcount_loc section, which will be used to filter the function
@@ -382,13 +375,10 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
          */
 
         insns = core_kernel_text(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
-        trace.func = self_ra - (MCOUNT_INSN_SIZE * insns);
+        self_ra -= (MCOUNT_INSN_SIZE * insns);
 
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
+        if (function_graph_enter(old_parent_ra, self_ra, fp, NULL))
                 *parent_ra_addr = old_parent_ra;
-        }
         return;
 out:
         ftrace_graph_stop();
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index ea09ed6a80a9..8c6c48ed786a 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -794,6 +794,7 @@ static void __init arch_mem_init(char **cmdline_p)
 
         /* call board setup routine */
         plat_mem_setup();
+        memblock_set_bottom_up(true);
 
         /*
          * Make sure all kernel memory is in the maps.  The "UP" and
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 0f852e1b5891..15e103c6d799 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2260,10 +2260,8 @@ void __init trap_init(void)
                 unsigned long size = 0x200 + VECTORSPACING*64;
                 phys_addr_t ebase_pa;
 
-                memblock_set_bottom_up(true);
                 ebase = (unsigned long)
                         memblock_alloc_from(size, 1 << fls(size), 0);
-                memblock_set_bottom_up(false);
 
                 /*
                  * Try to ensure ebase resides in KSeg0 if possible.
@@ -2307,6 +2305,7 @@ void __init trap_init(void)
         if (board_ebase_setup)
                 board_ebase_setup();
         per_cpu_trap_init(true);
+        memblock_set_bottom_up(false);
 
         /*
          * Copy the generic exception handlers to their final destination.
diff --git a/arch/mips/loongson64/loongson-3/numa.c b/arch/mips/loongson64/loongson-3/numa.c
index 622761878cd1..60bf0a1cb757 100644
--- a/arch/mips/loongson64/loongson-3/numa.c
+++ b/arch/mips/loongson64/loongson-3/numa.c
@@ -231,6 +231,8 @@ static __init void prom_meminit(void)
                         cpumask_clear(&__node_data[(node)]->cpumask);
                 }
         }
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
+
         for (cpu = 0; cpu < loongson_sysconf.nr_cpus; cpu++) {
                 node = cpu / loongson_sysconf.cores_per_node;
                 if (node >= num_online_nodes())
@@ -248,19 +250,9 @@ static __init void prom_meminit(void)
 
 void __init paging_init(void)
 {
-        unsigned node;
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long  start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
 #ifdef CONFIG_ZONE_DMA32
         zones_size[ZONE_DMA32] = MAX_DMA32_PFN;
 #endif
diff --git a/arch/mips/mm/dma-noncoherent.c b/arch/mips/mm/dma-noncoherent.c
index e6c9485cadcf..cb38461391cb 100644
--- a/arch/mips/mm/dma-noncoherent.c
+++ b/arch/mips/mm/dma-noncoherent.c
@@ -50,7 +50,7 @@ void *arch_dma_alloc(struct device *dev, size_t size,
         void *ret;
 
         ret = dma_direct_alloc_pages(dev, size, dma_handle, gfp, attrs);
-        if (!ret && !(attrs & DMA_ATTR_NON_CONSISTENT)) {
+        if (ret && !(attrs & DMA_ATTR_NON_CONSISTENT)) {
                 dma_cache_wback_inv((unsigned long) ret, size);
                 ret = (void *)UNCAC_ADDR(ret);
         }
diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
index 41b71c4352c2..c1ce6f43642b 100644
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -84,7 +84,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = {
 };
 static struct rt2880_pmx_func nd_sd_grp[] = {
         FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15),
-        FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15)
+        FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13)
 };
 
 static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index d8b8444d6795..813d13f92957 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -435,6 +435,7 @@ void __init prom_meminit(void)
 
         mlreset();
         szmem();
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
 
         for (node = 0; node < MAX_COMPACT_NODES; node++) {
                 if (node_online(node)) {
@@ -455,18 +456,8 @@ extern void setup_zero_pages(void);
 void __init paging_init(void)
 {
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
-        unsigned node;
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
         zones_size[ZONE_NORMAL] = max_low_pfn;
         free_area_init_nodes(zones_size);
 }
diff --git a/arch/nds32/include/asm/pgtable.h b/arch/nds32/include/asm/pgtable.h
index d3e19a55cf53..9f52db930c00 100644
--- a/arch/nds32/include/asm/pgtable.h
+++ b/arch/nds32/include/asm/pgtable.h
@@ -4,7 +4,7 @@
 #ifndef _ASMNDS32_PGTABLE_H
 #define _ASMNDS32_PGTABLE_H
 
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 #include <asm-generic/4level-fixup.h>
 #include <asm-generic/sizes.h>
 
diff --git a/arch/nds32/kernel/ftrace.c b/arch/nds32/kernel/ftrace.c
index a0a9679ad5de..8a41372551ff 100644
--- a/arch/nds32/kernel/ftrace.c
+++ b/arch/nds32/kernel/ftrace.c
@@ -211,29 +211,15 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
                            unsigned long frame_pointer)
 {
         unsigned long return_hooker = (unsigned long)&return_to_handler;
-        struct ftrace_graph_ent trace;
         unsigned long old;
-        int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
 
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, NULL);
-
-        if (err == -EBUSY)
-                return;
-
-        *parent = return_hooker;
+        if (!function_graph_enter(old, self_addr, frame_pointer, NULL))
+                *parent = return_hooker;
 }
 
 noinline void ftrace_graph_caller(void)
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index d047a09d660f..1085385e1f06 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -71,6 +71,13 @@ ifdef CONFIG_MLONGCALLS
 KBUILD_CFLAGS_KERNEL += -mlong-calls
 endif
 
+# Without this, "ld -r" results in .text sections that are too big (> 0x40000)
+# for branches to reach stubs. And multiple .text sections trigger a warning
+# when creating the sysfs module information section.
+ifndef CONFIG_64BIT
+KBUILD_CFLAGS_MODULE += -ffunction-sections
+endif
+
 # select which processor to optimise for
 cflags-$(CONFIG_PA7000)         += -march=1.1 -mschedule=7100
 cflags-$(CONFIG_PA7200)         += -march=1.1 -mschedule=7200
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index b941ac7d4e70..c7bb74e22436 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -111,7 +111,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #if CONFIG_PGTABLE_LEVELS == 3
 #define BITS_PER_PMD    (PAGE_SHIFT + PMD_ORDER - BITS_PER_PMD_ENTRY)
 #else
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 #define BITS_PER_PMD    0
 #endif
 #define PTRS_PER_PMD    (1UL << BITS_PER_PMD)
diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
index 16aec9ba2580..8a63515f03bf 100644
--- a/arch/parisc/include/asm/spinlock.h
+++ b/arch/parisc/include/asm/spinlock.h
@@ -37,8 +37,8 @@ static inline void arch_spin_unlock(arch_spinlock_t *x)
         volatile unsigned int *a;
 
         a = __ldcw_align(x);
-        /* Release with ordered store. */
-        __asm__ __volatile__("stw,ma %0,0(%1)" : : "r"(1), "r"(a) : "memory");
+        mb();
+        *a = 1;
 }
 
 static inline int arch_spin_trylock(arch_spinlock_t *x)
diff --git a/arch/parisc/kernel/ftrace.c b/arch/parisc/kernel/ftrace.c
index 6fa8535d3cce..e46a4157a894 100644
--- a/arch/parisc/kernel/ftrace.c
+++ b/arch/parisc/kernel/ftrace.c
@@ -30,7 +30,6 @@ static void __hot prepare_ftrace_return(unsigned long *parent,
                                         unsigned long self_addr)
 {
         unsigned long old;
-        struct ftrace_graph_ent trace;
         extern int parisc_return_to_handler;
 
         if (unlikely(ftrace_graph_is_dead()))
@@ -41,19 +40,9 @@ static void __hot prepare_ftrace_return(unsigned long *parent,
 
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        if (ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                     0, NULL) == -EBUSY)
-                return;
-
-        /* activate parisc_return_to_handler() as return point */
-        *parent = (unsigned long) &parisc_return_to_handler;
+        if (!function_graph_enter(old, self_addr, 0, NULL))
+                /* activate parisc_return_to_handler() as return point */
+                *parent = (unsigned long) &parisc_return_to_handler;
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 9505c317818d..a9bc90dc4ae7 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -640,7 +640,8 @@ cas_action:
         sub,<>  %r28, %r25, %r0
 2:      stw     %r24, 0(%r26)
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
         /* Clear thread register indicator */
         stw     %r0, 4(%sr2,%r20)
@@ -654,7 +655,8 @@ cas_action:
 3:              
         /* Error occurred on load or store */
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
         stw     %r0, 4(%sr2,%r20)
 #endif
@@ -855,7 +857,8 @@ cas2_action:
 
 cas2_end:
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
         /* Enable interrupts */
         ssm     PSW_SM_I, %r0
         /* Return to userspace, set no error */
@@ -865,7 +868,8 @@ cas2_end:
 22:
         /* Error occurred on load or store */
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
         ssm     PSW_SM_I, %r0
         ldo     1(%r0),%r28
         b       lws_exit
diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
index 3ef40b703c4a..e746becd9d6f 100644
--- a/arch/powerpc/include/asm/io.h
+++ b/arch/powerpc/include/asm/io.h
@@ -268,19 +268,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
  * their hooks, a bitfield is reserved for use by the platform near the
  * top of MMIO addresses (not PIO, those have to cope the hard way).
  *
- * This bit field is 12 bits and is at the top of the IO virtual
- * addresses PCI_IO_INDIRECT_TOKEN_MASK.
+ * The highest address in the kernel virtual space are:
  *
- * The kernel virtual space is thus:
+ *  d0003fffffffffff    # with Hash MMU
+ *  c00fffffffffffff    # with Radix MMU
  *
- *  0xD000000000000000          : vmalloc
- *  0xD000080000000000          : PCI PHB IO space
- *  0xD000080080000000          : ioremap
- *  0xD0000fffffffffff          : end of ioremap region
- *
- * Since the top 4 bits are reserved as the region ID, we use thus
- * the next 12 bits and keep 4 bits available for the future if the
- * virtual address space is ever to be extended.
+ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits
+ * that can be used for the field.
  *
  * The direct IO mapping operations will then mask off those bits
  * before doing the actual access, though that only happen when
@@ -292,8 +286,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
  */
 
 #ifdef CONFIG_PPC_INDIRECT_MMIO
-#define PCI_IO_IND_TOKEN_MASK   0x0fff000000000000ul
-#define PCI_IO_IND_TOKEN_SHIFT  48
+#define PCI_IO_IND_TOKEN_SHIFT  52
+#define PCI_IO_IND_TOKEN_MASK   (0xfful << PCI_IO_IND_TOKEN_SHIFT)
 #define PCI_FIX_ADDR(addr)                                              \
         ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK))
 #define PCI_GET_ADDR_TOKEN(addr)                                        \
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index 6093bc8f74e5..a6e9e314c707 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -493,6 +493,8 @@
                                         __PPC_RS(t) | __PPC_RA0(a) | __PPC_RB(b))
 #define PPC_SLBFEE_DOT(t, b)    stringify_in_c(.long PPC_INST_SLBFEE | \
                                         __PPC_RT(t) | __PPC_RB(b))
+#define __PPC_SLBFEE_DOT(t, b)  stringify_in_c(.long PPC_INST_SLBFEE |  \
+                                               ___PPC_RT(t) | ___PPC_RB(b))
 #define PPC_ICBT(c,a,b)         stringify_in_c(.long PPC_INST_ICBT | \
                                        __PPC_CT(c) | __PPC_RA0(a) | __PPC_RB(b))
 /* PASemi instructions */
diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
index f73886a1a7f5..0b8a735b6d85 100644
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -54,6 +54,7 @@ struct pt_regs
 
 #ifdef CONFIG_PPC64
         unsigned long ppr;
+        unsigned long __pad;    /* Maintain 16 byte interrupt stack alignment */
 #endif
 };
 #endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 2a51e4cc8246..236c1151a3a7 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -636,6 +636,8 @@ static void *__init alloc_stack(unsigned long limit, int cpu)
 {
         unsigned long pa;
 
+        BUILD_BUG_ON(STACK_INT_FRAME_SIZE % 16);
+
         pa = memblock_alloc_base_nid(THREAD_SIZE, THREAD_SIZE, limit,
                                         early_cpu_to_node(cpu), MEMBLOCK_NONE);
         if (!pa) {
diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
index 4bf051d3e21e..b65c8a34ad6e 100644
--- a/arch/powerpc/kernel/trace/ftrace.c
+++ b/arch/powerpc/kernel/trace/ftrace.c
@@ -950,7 +950,6 @@ int ftrace_disable_ftrace_graph_caller(void)
  */
 unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 {
-        struct ftrace_graph_ent trace;
         unsigned long return_hooker;
 
         if (unlikely(ftrace_graph_is_dead()))
@@ -961,18 +960,8 @@ unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 
         return_hooker = ppc_function_entry(return_to_handler);
 
-        trace.func = ip;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                goto out;
-
-        if (ftrace_push_return_trace(parent, ip, &trace.depth, 0,
-                                     NULL) == -EBUSY)
-                goto out;
-
-        parent = return_hooker;
+        if (!function_graph_enter(parent, ip, 0, NULL))
+                parent = return_hooker;
 out:
         return parent;
 }
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index d65b961661fb..a56f8413758a 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -983,6 +983,7 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
                 ret = kvmhv_enter_nested_guest(vcpu);
                 if (ret == H_INTERRUPT) {
                         kvmppc_set_gpr(vcpu, 3, 0);
+                        vcpu->arch.hcall_needed = 0;
                         return -EINTR;
                 }
                 break;
diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h
index 491b0f715d6b..ea1d7c808319 100644
--- a/arch/powerpc/kvm/trace.h
+++ b/arch/powerpc/kvm/trace.h
@@ -6,8 +6,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace
 
 /*
  * Tracepoint for guest mode entry.
@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests,
 #endif /* _TRACE_KVM_H */
 
 /* This part must be outside protection */
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h
index ac640e81fdc5..3837842986aa 100644
--- a/arch/powerpc/kvm/trace_booke.h
+++ b/arch/powerpc/kvm/trace_booke.h
@@ -6,8 +6,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm_booke
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace_booke
 
 #define kvm_trace_symbol_exit \
         {0, "CRITICAL"}, \
@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio,
 #endif
 
 /* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_booke
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h
index bcfe8a987f6a..8a1e3b0047f1 100644
--- a/arch/powerpc/kvm/trace_hv.h
+++ b/arch/powerpc/kvm/trace_hv.h
@@ -9,8 +9,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm_hv
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace_hv
 
 #define kvm_trace_symbol_hcall \
         {H_REMOVE,                      "H_REMOVE"}, \
@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit,
 #endif /* _TRACE_KVM_HV_H */
 
 /* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_hv
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h
index 2f9a8829552b..46a46d328fbf 100644
--- a/arch/powerpc/kvm/trace_pr.h
+++ b/arch/powerpc/kvm/trace_pr.h
@@ -8,8 +8,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm_pr
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace_pr
 
 TRACE_EVENT(kvm_book3s_reenter,
         TP_PROTO(int r, struct kvm_vcpu *vcpu),
@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit,
 #endif /* _TRACE_KVM_H */
 
 /* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_pr
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 3a048e98a132..ce28ae5ca080 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1178,7 +1178,7 @@ static long vphn_get_associativity(unsigned long cpu,
 
         switch (rc) {
         case H_FUNCTION:
-                printk(KERN_INFO
+                printk_once(KERN_INFO
                         "VPHN is not supported. Disabling polling...\n");
                 stop_topology_update();
                 break;
diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
index c3fdf2969d9f..bc3914d54e26 100644
--- a/arch/powerpc/mm/slb.c
+++ b/arch/powerpc/mm/slb.c
@@ -19,6 +19,7 @@
 #include <asm/mmu.h>
 #include <asm/mmu_context.h>
 #include <asm/paca.h>
+#include <asm/ppc-opcode.h>
 #include <asm/cputable.h>
 #include <asm/cacheflush.h>
 #include <asm/smp.h>
@@ -58,27 +59,19 @@ static inline unsigned long mk_vsid_data(unsigned long ea, int ssize,
         return __mk_vsid_data(get_kernel_vsid(ea, ssize), ssize, flags);
 }
 
-static void assert_slb_exists(unsigned long ea)
+static void assert_slb_presence(bool present, unsigned long ea)
 {
 #ifdef CONFIG_DEBUG_VM
         unsigned long tmp;
 
         WARN_ON_ONCE(mfmsr() & MSR_EE);
 
-        asm volatile("slbfee. %0, %1" : "=r"(tmp) : "r"(ea) : "cr0");
-        WARN_ON(tmp == 0);
-#endif
-}
-
-static void assert_slb_notexists(unsigned long ea)
-{
-#ifdef CONFIG_DEBUG_VM
-        unsigned long tmp;
+        if (!cpu_has_feature(CPU_FTR_ARCH_206))
+                return;
 
-        WARN_ON_ONCE(mfmsr() & MSR_EE);
+        asm volatile(__PPC_SLBFEE_DOT(%0, %1) : "=r"(tmp) : "r"(ea) : "cr0");
 
-        asm volatile("slbfee. %0, %1" : "=r"(tmp) : "r"(ea) : "cr0");
-        WARN_ON(tmp != 0);
+        WARN_ON(present == (tmp == 0));
 #endif
 }
 
@@ -114,7 +107,7 @@ static inline void create_shadowed_slbe(unsigned long ea, int ssize,
          */
         slb_shadow_update(ea, ssize, flags, index);
 
-        assert_slb_notexists(ea);
+        assert_slb_presence(false, ea);
         asm volatile("slbmte  %0,%1" :
                      : "r" (mk_vsid_data(ea, ssize, flags)),
                        "r" (mk_esid_data(ea, ssize, index))
@@ -137,7 +130,7 @@ void __slb_restore_bolted_realmode(void)
                        "r" (be64_to_cpu(p->save_area[index].esid)));
         }
 
-        assert_slb_exists(local_paca->kstack);
+        assert_slb_presence(true, local_paca->kstack);
 }
 
 /*
@@ -185,7 +178,7 @@ void slb_flush_and_restore_bolted(void)
                      :: "r" (be64_to_cpu(p->save_area[KSTACK_INDEX].vsid)),
                         "r" (be64_to_cpu(p->save_area[KSTACK_INDEX].esid))
                      : "memory");
-        assert_slb_exists(get_paca()->kstack);
+        assert_slb_presence(true, get_paca()->kstack);
 
         get_paca()->slb_cache_ptr = 0;
 
@@ -443,9 +436,9 @@ void switch_slb(struct task_struct *tsk, struct mm_struct *mm)
                                 ea = (unsigned long)
                                         get_paca()->slb_cache[i] << SID_SHIFT;
                                 /*
-                                 * Could assert_slb_exists here, but hypervisor
-                                 * or machine check could have come in and
-                                 * removed the entry at this point.
+                                 * Could assert_slb_presence(true) here, but
+                                 * hypervisor or machine check could have come
+                                 * in and removed the entry at this point.
                                  */
 
                                 slbie_data = ea;
@@ -676,7 +669,7 @@ static long slb_insert_entry(unsigned long ea, unsigned long context,
          * User preloads should add isync afterwards in case the kernel
          * accesses user memory before it returns to userspace with rfid.
          */
-        assert_slb_notexists(ea);
+        assert_slb_presence(false, ea);
         asm volatile("slbmte %0, %1" : : "r" (vsid_data), "r" (esid_data));
 
         barrier();
@@ -715,7 +708,7 @@ static long slb_allocate_kernel(unsigned long ea, unsigned long id)
                         return -EFAULT;
 
                 if (ea < H_VMALLOC_END)
-                        flags = get_paca()->vmalloc_sllp;
+                        flags = local_paca->vmalloc_sllp;
                 else
                         flags = SLB_VSID_KERNEL | mmu_psize_defs[mmu_io_psize].sllp;
         } else {
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 50b129785aee..17482f5de3e2 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -166,7 +166,33 @@ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
         PPC_BLR();
 }
 
-static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func)
+static void bpf_jit_emit_func_call_hlp(u32 *image, struct codegen_context *ctx,
+                                       u64 func)
+{
+#ifdef PPC64_ELF_ABI_v1
+        /* func points to the function descriptor */
+        PPC_LI64(b2p[TMP_REG_2], func);
+        /* Load actual entry point from function descriptor */
+        PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0);
+        /* ... and move it to LR */
+        PPC_MTLR(b2p[TMP_REG_1]);
+        /*
+         * Load TOC from function descriptor at offset 8.
+         * We can clobber r2 since we get called through a
+         * function pointer (so caller will save/restore r2)
+         * and since we don't use a TOC ourself.
+         */
+        PPC_BPF_LL(2, b2p[TMP_REG_2], 8);
+#else
+        /* We can clobber r12 */
+        PPC_FUNC_ADDR(12, func);
+        PPC_MTLR(12);
+#endif
+        PPC_BLRL();
+}
+
+static void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx,
+                                       u64 func)
 {
         unsigned int i, ctx_idx = ctx->idx;
 
@@ -273,7 +299,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 {
         const struct bpf_insn *insn = fp->insnsi;
         int flen = fp->len;
-        int i;
+        int i, ret;
 
         /* Start of epilogue code - will only be valid 2nd pass onwards */
         u32 exit_addr = addrs[flen];
@@ -284,8 +310,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
                 u32 src_reg = b2p[insn[i].src_reg];
                 s16 off = insn[i].off;
                 s32 imm = insn[i].imm;
+                bool func_addr_fixed;
+                u64 func_addr;
                 u64 imm64;
-                u8 *func;
                 u32 true_cond;
                 u32 tmp_idx;
 
@@ -711,23 +738,15 @@ emit_clear:
                 case BPF_JMP | BPF_CALL:
                         ctx->seen |= SEEN_FUNC;
 
-                        /* bpf function call */
-                        if (insn[i].src_reg == BPF_PSEUDO_CALL)
-                                if (!extra_pass)
-                                        func = NULL;
-                                else if (fp->aux->func && off < fp->aux->func_cnt)
-                                        /* use the subprog id from the off
-                                         * field to lookup the callee address
-                                         */
-                                        func = (u8 *) fp->aux->func[off]->bpf_func;
-                                else
-                                        return -EINVAL;
-                        /* kernel helper call */
-                        else
-                                func = (u8 *) __bpf_call_base + imm;
-
-                        bpf_jit_emit_func_call(image, ctx, (u64)func);
+                        ret = bpf_jit_get_func_addr(fp, &insn[i], extra_pass,
+                                                    &func_addr, &func_addr_fixed);
+                        if (ret < 0)
+                                return ret;
 
+                        if (func_addr_fixed)
+                                bpf_jit_emit_func_call_hlp(image, ctx, func_addr);
+                        else
+                                bpf_jit_emit_func_call_rel(image, ctx, func_addr);
                         /* move return value from r3 to BPF_REG_0 */
                         PPC_MR(b2p[BPF_REG_0], 3);
                         break;
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 6f60e0931922..75b935252981 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -102,63 +102,6 @@ struct pci_dev *pnv_pci_get_npu_dev(struct pci_dev *gpdev, int index)
 }
 EXPORT_SYMBOL(pnv_pci_get_npu_dev);
 
-#define NPU_DMA_OP_UNSUPPORTED()                                        \
-        dev_err_once(dev, "%s operation unsupported for NVLink devices\n", \
-                __func__)
-
-static void *dma_npu_alloc(struct device *dev, size_t size,
-                           dma_addr_t *dma_handle, gfp_t flag,
-                           unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return NULL;
-}
-
-static void dma_npu_free(struct device *dev, size_t size,
-                         void *vaddr, dma_addr_t dma_handle,
-                         unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-}
-
-static dma_addr_t dma_npu_map_page(struct device *dev, struct page *page,
-                                   unsigned long offset, size_t size,
-                                   enum dma_data_direction direction,
-                                   unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static int dma_npu_map_sg(struct device *dev, struct scatterlist *sglist,
-                          int nelems, enum dma_data_direction direction,
-                          unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static int dma_npu_dma_supported(struct device *dev, u64 mask)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static u64 dma_npu_get_required_mask(struct device *dev)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static const struct dma_map_ops dma_npu_ops = {
-        .map_page               = dma_npu_map_page,
-        .map_sg                 = dma_npu_map_sg,
-        .alloc                  = dma_npu_alloc,
-        .free                   = dma_npu_free,
-        .dma_supported          = dma_npu_dma_supported,
-        .get_required_mask      = dma_npu_get_required_mask,
-};
-
 /*
  * Returns the PE assoicated with the PCI device of the given
  * NPU. Returns the linked pci device if pci_dev != NULL.
@@ -270,10 +213,11 @@ static void pnv_npu_dma_set_32(struct pnv_ioda_pe *npe)
         rc = pnv_npu_set_window(npe, 0, gpe->table_group.tables[0]);
 
         /*
-         * We don't initialise npu_pe->tce32_table as we always use
-         * dma_npu_ops which are nops.
+         * NVLink devices use the same TCE table configuration as
+         * their parent device so drivers shouldn't be doing DMA
+         * operations directly on these devices.
          */
-        set_dma_ops(&npe->pdev->dev, &dma_npu_ops);
+        set_dma_ops(&npe->pdev->dev, NULL);
 }
 
 /*
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index d10146197533..4b594f2e4f7e 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -71,10 +71,27 @@ KBUILD_CFLAGS += $(call cc-option,-mstrict-align)
 # arch specific predefines for sparse
 CHECKFLAGS += -D__riscv -D__riscv_xlen=$(BITS)
 
+# Default target when executing plain make
+boot            := arch/riscv/boot
+KBUILD_IMAGE    := $(boot)/Image.gz
+
 head-y := arch/riscv/kernel/head.o
 
 core-y += arch/riscv/kernel/ arch/riscv/mm/
 
 libs-y += arch/riscv/lib/
 
-all: vmlinux
+PHONY += vdso_install
+vdso_install:
+        $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
+
+all: Image.gz
+
+Image: vmlinux
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+Image.%: Image
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+zinstall install:
+        $(Q)$(MAKE) $(build)=$(boot) $@
diff --git a/arch/riscv/boot/.gitignore b/arch/riscv/boot/.gitignore
new file mode 100644
index 000000000000..8dab0bb6ae66
--- /dev/null
+++ b/arch/riscv/boot/.gitignore
@@ -0,0 +1,2 @@
+Image
+Image.gz
diff --git a/arch/riscv/boot/Makefile b/arch/riscv/boot/Makefile
new file mode 100644
index 000000000000..0990a9fdbe5d
--- /dev/null
+++ b/arch/riscv/boot/Makefile
@@ -0,0 +1,33 @@
+#
+# arch/riscv/boot/Makefile
+#
+# This file is included by the global makefile so that you can add your own
+# architecture-specific flags and dependencies.
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 2018, Anup Patel.
+# Author: Anup Patel <anup@brainfault.org>
+#
+# Based on the ia64 and arm64 boot/Makefile.
+#
+
+OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S
+
+targets := Image
+
+$(obj)/Image: vmlinux FORCE
+        $(call if_changed,objcopy)
+
+$(obj)/Image.gz: $(obj)/Image FORCE
+        $(call if_changed,gzip)
+
+install:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image System.map "$(INSTALL_PATH)"
+
+zinstall:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image.gz System.map "$(INSTALL_PATH)"
diff --git a/arch/riscv/boot/install.sh b/arch/riscv/boot/install.sh
new file mode 100644
index 000000000000..18c39159c0ff
--- /dev/null
+++ b/arch/riscv/boot/install.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+#
+# arch/riscv/boot/install.sh
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 1995 by Linus Torvalds
+#
+# Adapted from code in arch/i386/boot/Makefile by H. Peter Anvin
+# Adapted from code in arch/i386/boot/install.sh by Russell King
+#
+# "make install" script for the RISC-V Linux port
+#
+# Arguments:
+#   $1 - kernel version
+#   $2 - kernel image file
+#   $3 - kernel map file
+#   $4 - default install path (blank if root directory)
+#
+
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
+
+# User may have a custom install script
+if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
+if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
+
+if [ "$(basename $2)" = "Image.gz" ]; then
+# Compressed install
+  echo "Installing compressed kernel"
+  base=vmlinuz
+else
+# Normal install
+  echo "Installing normal kernel"
+  base=vmlinux
+fi
+
+if [ -f $4/$base-$1 ]; then
+  mv $4/$base-$1 $4/$base-$1.old
+fi
+cat $2 > $4/$base-$1
+
+# Install system map file
+if [ -f $4/System.map-$1 ]; then
+  mv $4/System.map-$1 $4/System.map-$1.old
+fi
+cp $3 $4/System.map-$1
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index 07fa9ea75fea..ef4f15df9adf 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -76,4 +76,5 @@ CONFIG_NFS_V4_1=y
 CONFIG_NFS_V4_2=y
 CONFIG_ROOT_NFS=y
 CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_PRINTK_TIME=y
 # CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/module.h b/arch/riscv/include/asm/module.h
index 349df33808c4..cd2af4b013e3 100644
--- a/arch/riscv/include/asm/module.h
+++ b/arch/riscv/include/asm/module.h
@@ -8,6 +8,7 @@
 
 #define MODULE_ARCH_VERMAGIC    "riscv"
 
+struct module;
 u64 module_emit_got_entry(struct module *mod, u64 val);
 u64 module_emit_plt_entry(struct module *mod, u64 val);
 
diff --git a/arch/riscv/include/asm/ptrace.h b/arch/riscv/include/asm/ptrace.h
index 2c5df945d43c..bbe1862e8f80 100644
--- a/arch/riscv/include/asm/ptrace.h
+++ b/arch/riscv/include/asm/ptrace.h
@@ -56,8 +56,8 @@ struct pt_regs {
         unsigned long sstatus;
         unsigned long sbadaddr;
         unsigned long scause;
-        /* a0 value before the syscall */
-        unsigned long orig_a0;
+        /* a0 value before the syscall */
+        unsigned long orig_a0;
 };
 
 #ifdef CONFIG_64BIT
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index 473cfc84e412..8c3e3e3c8be1 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to,
 static inline unsigned long
 raw_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        return __asm_copy_to_user(to, from, n);
+        return __asm_copy_from_user(to, from, n);
 }
 
 static inline unsigned long
 raw_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        return __asm_copy_from_user(to, from, n);
+        return __asm_copy_to_user(to, from, n);
 }
 
 extern long strncpy_from_user(char *dest, const char __user *src, long count);
diff --git a/arch/riscv/include/asm/unistd.h b/arch/riscv/include/asm/unistd.h
index eff7aa9aa163..fef96f117b4d 100644
--- a/arch/riscv/include/asm/unistd.h
+++ b/arch/riscv/include/asm/unistd.h
@@ -13,10 +13,9 @@
 
 /*
  * There is explicitly no include guard here because this file is expected to
- * be included multiple times.  See uapi/asm/syscalls.h for more info.
+ * be included multiple times.
  */
 
-#define __ARCH_WANT_NEW_STAT
 #define __ARCH_WANT_SYS_CLONE
+
 #include <uapi/asm/unistd.h>
-#include <uapi/asm/syscalls.h>
diff --git a/arch/riscv/include/uapi/asm/syscalls.h b/arch/riscv/include/uapi/asm/unistd.h
index 206dc4b0f6ea..1f3bd3ebbb0d 100644
--- a/arch/riscv/include/uapi/asm/syscalls.h
+++ b/arch/riscv/include/uapi/asm/unistd.h
@@ -1,13 +1,25 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /*
- * Copyright (C) 2017-2018 SiFive
+ * Copyright (C) 2018 David Abdurachmanov <david.abdurachmanov@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * There is explicitly no include guard here because this file is expected to
- * be included multiple times in order to define the syscall macros via
- * __SYSCALL.
- */
+#ifdef __LP64__
+#define __ARCH_WANT_NEW_STAT
+#endif /* __LP64__ */
+
+#include <asm-generic/unistd.h>
 
 /*
  * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
index 3a5a2ee31547..b4a7d4427fbb 100644
--- a/arch/riscv/kernel/cpu.c
+++ b/arch/riscv/kernel/cpu.c
@@ -64,7 +64,7 @@ int riscv_of_processor_hartid(struct device_node *node)
 
 static void print_isa(struct seq_file *f, const char *orig_isa)
 {
-        static const char *ext = "mafdc";
+        static const char *ext = "mafdcsu";
         const char *isa = orig_isa;
         const char *e;
 
@@ -88,11 +88,14 @@ static void print_isa(struct seq_file *f, const char *orig_isa)
         /*
          * Check the rest of the ISA string for valid extensions, printing those
          * we find.  RISC-V ISA strings define an order, so we only print the
-         * extension bits when they're in order.
+         * extension bits when they're in order. Hide the supervisor (S)
+         * extension from userspace as it's not accessible from there.
          */
         for (e = ext; *e != '\0'; ++e) {
                 if (isa[0] == e[0]) {
-                        seq_write(f, isa, 1);
+                        if (isa[0] != 's')
+                                seq_write(f, isa, 1);
+
                         isa++;
                 }
         }
diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
index 1157b6b52d25..c433f6d3dd64 100644
--- a/arch/riscv/kernel/ftrace.c
+++ b/arch/riscv/kernel/ftrace.c
@@ -132,7 +132,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
 {
         unsigned long return_hooker = (unsigned long)&return_to_handler;
         unsigned long old;
-        struct ftrace_graph_ent trace;
         int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
@@ -144,17 +143,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
          */
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, parent);
-        if (err == -EBUSY)
-                return;
-        *parent = return_hooker;
+        if (function_graph_enter(old, self_addr, frame_pointer, parent))
+                *parent = return_hooker;
 }
 
 #ifdef CONFIG_DYNAMIC_FTRACE
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 711190d473d4..fe884cd69abd 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -44,6 +44,16 @@ ENTRY(_start)
         amoadd.w a3, a2, (a3)
         bnez a3, .Lsecondary_start
 
+        /* Clear BSS for flat non-ELF images */
+        la a3, __bss_start
+        la a4, __bss_stop
+        ble a4, a3, clear_bss_done
+clear_bss:
+        REG_S zero, (a3)
+        add a3, a3, RISCV_SZPTR
+        blt a3, a4, clear_bss
+clear_bss_done:
+
         /* Save hart ID and DTB physical address */
         mv s0, a0
         mv s1, a1
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 3303ed2cd419..7dd308129b40 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
 {
         if (v != (u32)v) {
                 pr_err("%s: value %016llx out of range for 32-bit field\n",
-                       me->name, v);
+                       me->name, (long long)v);
                 return -EINVAL;
         }
         *location = v;
@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location,
         if (offset != (s32)offset) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
         if (IS_ENABLED(CMODEL_MEDLOW)) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location,
         } else {
                 pr_err(
                   "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location,
                 } else {
                         pr_err(
                           "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                          me->name, v, location);
+                          me->name, (long long)v, location);
                         return -EINVAL;
                 }
         }
@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location,
         if (offset != fill_v) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index ece84991609c..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -74,7 +74,7 @@ SECTIONS
                 *(.sbss*)
         }
 
-        BSS_SECTION(0, 0, 0)
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
 
         EXCEPTION_TABLE(0x10)
         NOTES
diff --git a/arch/riscv/lib/Makefile b/arch/riscv/lib/Makefile
index 5739bd05d289..4e2e600f7d53 100644
--- a/arch/riscv/lib/Makefile
+++ b/arch/riscv/lib/Makefile
@@ -3,6 +3,6 @@ lib-y	+= memcpy.o
 lib-y   += memset.o
 lib-y   += uaccess.o
 
-lib-(CONFIG_64BIT) += tishift.o
+lib-$(CONFIG_64BIT) += tishift.o
 
 lib-$(CONFIG_32BIT) += udivdi3.o
diff --git a/arch/s390/Makefile b/arch/s390/Makefile
index 0b33577932c3..e21053e5e0da 100644
--- a/arch/s390/Makefile
+++ b/arch/s390/Makefile
@@ -27,7 +27,7 @@ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-option,-ffreestanding)
 KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g)
 KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,))
 UTS_MACHINE     := s390x
-STACK_SIZE      := $(if $(CONFIG_KASAN),32768,16384)
+STACK_SIZE      := $(if $(CONFIG_KASAN),65536,16384)
 CHECKFLAGS      += -D__s390__ -D__s390x__
 
 export LD_BFD
diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
index 593039620487..b1bdd15e3429 100644
--- a/arch/s390/boot/compressed/Makefile
+++ b/arch/s390/boot/compressed/Makefile
@@ -22,10 +22,10 @@ OBJCOPYFLAGS :=
 OBJECTS := $(addprefix $(obj)/,$(obj-y))
 
 LDFLAGS_vmlinux := --oformat $(LD_BFD) -e startup -T
-$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS)
+$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) FORCE
         $(call if_changed,ld)
 
-OBJCOPYFLAGS_info.bin := -O binary --only-section=.vmlinux.info
+OBJCOPYFLAGS_info.bin := -O binary --only-section=.vmlinux.info --set-section-flags .vmlinux.info=load
 $(obj)/info.bin: vmlinux FORCE
         $(call if_changed,objcopy)
 
@@ -46,17 +46,17 @@ suffix-$(CONFIG_KERNEL_LZMA)  := .lzma
 suffix-$(CONFIG_KERNEL_LZO)  := .lzo
 suffix-$(CONFIG_KERNEL_XZ)  := .xz
 
-$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y)
+$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,gzip)
-$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y)
+$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,bzip2)
-$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y)
+$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,lz4)
-$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y)
+$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,lzma)
-$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y)
+$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,lzo)
-$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y)
+$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,xzkern)
 
 OBJCOPYFLAGS_piggy.o := -I binary -O elf64-s390 -B s390:64-bit --rename-section .data=.vmlinux.bin.compressed
diff --git a/arch/s390/configs/debug_defconfig b/arch/s390/configs/debug_defconfig
index 259d1698ac50..c69cb04b7a59 100644
--- a/arch/s390/configs/debug_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -64,6 +64,8 @@ CONFIG_NUMA=y
 CONFIG_PREEMPT=y
 CONFIG_HZ_100=y
 CONFIG_KEXEC_FILE=y
+CONFIG_EXPOLINE=y
+CONFIG_EXPOLINE_AUTO=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
@@ -84,9 +86,11 @@ CONFIG_PCI_DEBUG=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_S390=y
 CONFIG_CHSC_SCH=y
+CONFIG_VFIO_AP=m
 CONFIG_CRASH_DUMP=y
 CONFIG_BINFMT_MISC=m
 CONFIG_HIBERNATION=y
+CONFIG_PM_DEBUG=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_PACKET_DIAG=m
@@ -161,8 +165,6 @@ CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_CT_NETLINK=m
 CONFIG_NF_CT_NETLINK_TIMEOUT=m
 CONFIG_NF_TABLES=m
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
@@ -365,6 +367,8 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_OPENVSWITCH=m
+CONFIG_VSOCKETS=m
+CONFIG_VIRTIO_VSOCKETS=m
 CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
@@ -461,6 +465,7 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
+CONFIG_ISM=m
 CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
@@ -486,9 +491,12 @@ CONFIG_MLX4_INFINIBAND=m
 CONFIG_MLX5_INFINIBAND=m
 CONFIG_VFIO=m
 CONFIG_VFIO_PCI=m
+CONFIG_VFIO_MDEV=m
+CONFIG_VFIO_MDEV_DEVICE=m
 CONFIG_VIRTIO_PCI=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_VIRTIO_INPUT=y
+CONFIG_S390_AP_IOMMU=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
@@ -615,7 +623,6 @@ CONFIG_DEBUG_CREDENTIALS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=300
 CONFIG_NOTIFIER_ERROR_INJECTION=m
-CONFIG_PM_NOTIFIER_ERROR_INJECT=m
 CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAILSLAB=y
@@ -727,3 +734,4 @@ CONFIG_APPLDATA_BASE=y
 CONFIG_KVM=m
 CONFIG_KVM_S390_UCONTROL=y
 CONFIG_VHOST_NET=m
+CONFIG_VHOST_VSOCK=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 37fd60c20e22..32f539dc9c19 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -65,6 +65,8 @@ CONFIG_NR_CPUS=512
 CONFIG_NUMA=y
 CONFIG_HZ_100=y
 CONFIG_KEXEC_FILE=y
+CONFIG_EXPOLINE=y
+CONFIG_EXPOLINE_AUTO=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
@@ -82,9 +84,11 @@ CONFIG_PCI=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_S390=y
 CONFIG_CHSC_SCH=y
+CONFIG_VFIO_AP=m
 CONFIG_CRASH_DUMP=y
 CONFIG_BINFMT_MISC=m
 CONFIG_HIBERNATION=y
+CONFIG_PM_DEBUG=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_PACKET_DIAG=m
@@ -159,8 +163,6 @@ CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_CT_NETLINK=m
 CONFIG_NF_CT_NETLINK_TIMEOUT=m
 CONFIG_NF_TABLES=m
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
@@ -362,6 +364,8 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_OPENVSWITCH=m
+CONFIG_VSOCKETS=m
+CONFIG_VIRTIO_VSOCKETS=m
 CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
@@ -458,6 +462,7 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
+CONFIG_ISM=m
 CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
@@ -483,9 +488,12 @@ CONFIG_MLX4_INFINIBAND=m
 CONFIG_MLX5_INFINIBAND=m
 CONFIG_VFIO=m
 CONFIG_VFIO_PCI=m
+CONFIG_VFIO_MDEV=m
+CONFIG_VFIO_MDEV_DEVICE=m
 CONFIG_VIRTIO_PCI=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_VIRTIO_INPUT=y
+CONFIG_S390_AP_IOMMU=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
@@ -666,3 +674,4 @@ CONFIG_APPLDATA_BASE=y
 CONFIG_KVM=m
 CONFIG_KVM_S390_UCONTROL=y
 CONFIG_VHOST_NET=m
+CONFIG_VHOST_VSOCK=m
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 7cb6a52f727d..4d58a92b5d97 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -26,14 +26,23 @@ CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 # CONFIG_SYSFS_SYSCALL is not set
-CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
+CONFIG_LIVEPATCH=y
+CONFIG_NR_CPUS=256
+CONFIG_NUMA=y
+CONFIG_HZ_100=y
+CONFIG_KEXEC_FILE=y
+CONFIG_CRASH_DUMP=y
+CONFIG_HIBERNATION=y
+CONFIG_PM_DEBUG=y
+CONFIG_CMM=m
 CONFIG_OPROFILE=y
 CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
@@ -44,11 +53,7 @@ CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_DEFAULT_DEADLINE=y
-CONFIG_LIVEPATCH=y
-CONFIG_NR_CPUS=256
-CONFIG_NUMA=y
-CONFIG_HZ_100=y
-CONFIG_KEXEC_FILE=y
+CONFIG_BINFMT_MISC=m
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
@@ -60,9 +65,6 @@ CONFIG_ZBUD=m
 CONFIG_ZSMALLOC=m
 CONFIG_ZSMALLOC_STAT=y
 CONFIG_IDLE_PAGE_TRACKING=y
-CONFIG_CRASH_DUMP=y
-CONFIG_BINFMT_MISC=m
-CONFIG_HIBERNATION=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -98,6 +100,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_SCSI=y
+# CONFIG_SCSI_MQ_DEFAULT is not set
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
 CONFIG_BLK_DEV_SR=y
@@ -131,6 +134,7 @@ CONFIG_EQUALIZER=m
 CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
 # CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_AURORA is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
@@ -157,33 +161,6 @@ CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_INFO_DWARF4=y
-CONFIG_GDB_SCRIPTS=y
-CONFIG_UNUSED_SYMBOLS=y
-CONFIG_DEBUG_SECTION_MISMATCH=y
-CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_PAGEALLOC=y
-CONFIG_DETECT_HUNG_TASK=y
-CONFIG_PANIC_ON_OOPS=y
-CONFIG_PROVE_LOCKING=y
-CONFIG_LOCK_STAT=y
-CONFIG_DEBUG_LOCKDEP=y
-CONFIG_DEBUG_ATOMIC_SLEEP=y
-CONFIG_DEBUG_LIST=y
-CONFIG_DEBUG_SG=y
-CONFIG_DEBUG_NOTIFIERS=y
-CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_LATENCYTOP=y
-CONFIG_SCHED_TRACER=y
-CONFIG_FTRACE_SYSCALLS=y
-CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
-CONFIG_STACK_TRACER=y
-CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_FUNCTION_PROFILER=y
-# CONFIG_RUNTIME_TESTING_MENU is not set
-CONFIG_S390_PTDUMP=y
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_AUTHENC=m
 CONFIG_CRYPTO_TEST=m
@@ -193,6 +170,7 @@ CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_CTS=m
 CONFIG_CRYPTO_LRW=m
+CONFIG_CRYPTO_OFB=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_CMAC=m
@@ -231,7 +209,6 @@ CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_ZCRYPT=m
-CONFIG_ZCRYPT_MULTIDEVNODES=y
 CONFIG_PKEY=m
 CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_SHA1_S390=m
@@ -247,4 +224,30 @@ CONFIG_CRC7=m
 # CONFIG_XZ_DEC_ARM is not set
 # CONFIG_XZ_DEC_ARMTHUMB is not set
 # CONFIG_XZ_DEC_SPARC is not set
-CONFIG_CMM=m
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_DWARF4=y
+CONFIG_GDB_SCRIPTS=y
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_LOCK_STAT=y
+CONFIG_DEBUG_LOCKDEP=y
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_SG=y
+CONFIG_DEBUG_NOTIFIERS=y
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
+CONFIG_LATENCYTOP=y
+CONFIG_SCHED_TRACER=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_FUNCTION_PROFILER=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
+CONFIG_S390_PTDUMP=y
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index dbd689d556ce..ccbb53e22024 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -46,8 +46,6 @@ static inline int init_new_context(struct task_struct *tsk,
                 mm->context.asce_limit = STACK_TOP_MAX;
                 mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
                                    _ASCE_USER_BITS | _ASCE_TYPE_REGION3;
-                /* pgd_alloc() did not account this pud */
-                mm_inc_nr_puds(mm);
                 break;
         case -PAGE_SIZE:
                 /* forked 5-level task, set new asce with new_mm->pgd */
@@ -63,9 +61,6 @@ static inline int init_new_context(struct task_struct *tsk,
                 /* forked 2-level compat task, set new asce with new mm->pgd */
                 mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
                                    _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;
-                /* pgd_alloc() did not account this pmd */
-                mm_inc_nr_pmds(mm);
-                mm_inc_nr_puds(mm);
         }
         crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
         return 0;
diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
index f0f9bcf94c03..5ee733720a57 100644
--- a/arch/s390/include/asm/pgalloc.h
+++ b/arch/s390/include/asm/pgalloc.h
@@ -36,11 +36,11 @@ static inline void crst_table_init(unsigned long *crst, unsigned long entry)
 
 static inline unsigned long pgd_entry_type(struct mm_struct *mm)
 {
-        if (mm->context.asce_limit <= _REGION3_SIZE)
+        if (mm_pmd_folded(mm))
                 return _SEGMENT_ENTRY_EMPTY;
-        if (mm->context.asce_limit <= _REGION2_SIZE)
+        if (mm_pud_folded(mm))
                 return _REGION3_ENTRY_EMPTY;
-        if (mm->context.asce_limit <= _REGION1_SIZE)
+        if (mm_p4d_folded(mm))
                 return _REGION2_ENTRY_EMPTY;
         return _REGION1_ENTRY_EMPTY;
 }
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 411d435e7a7d..063732414dfb 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -493,6 +493,24 @@ static inline int is_module_addr(void *addr)
                                    _REGION_ENTRY_PROTECT | \
                                    _REGION_ENTRY_NOEXEC)
 
+static inline bool mm_p4d_folded(struct mm_struct *mm)
+{
+        return mm->context.asce_limit <= _REGION1_SIZE;
+}
+#define mm_p4d_folded(mm) mm_p4d_folded(mm)
+
+static inline bool mm_pud_folded(struct mm_struct *mm)
+{
+        return mm->context.asce_limit <= _REGION2_SIZE;
+}
+#define mm_pud_folded(mm) mm_pud_folded(mm)
+
+static inline bool mm_pmd_folded(struct mm_struct *mm)
+{
+        return mm->context.asce_limit <= _REGION3_SIZE;
+}
+#define mm_pmd_folded(mm) mm_pmd_folded(mm)
+
 static inline int mm_has_pgste(struct mm_struct *mm)
 {
 #ifdef CONFIG_PGSTE
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 302795c47c06..81038ab357ce 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -236,7 +236,7 @@ static inline unsigned long current_stack_pointer(void)
         return sp;
 }
 
-static __no_sanitize_address_or_inline unsigned short stap(void)
+static __no_kasan_or_inline unsigned short stap(void)
 {
         unsigned short cpu_address;
 
@@ -330,7 +330,7 @@ static inline void __load_psw(psw_t psw)
  * Set PSW mask to specified value, while leaving the
  * PSW addr pointing to the next instruction.
  */
-static __no_sanitize_address_or_inline void __load_psw_mask(unsigned long mask)
+static __no_kasan_or_inline void __load_psw_mask(unsigned long mask)
 {
         unsigned long addr;
         psw_t psw;
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 27248f42a03c..ce4e17c9aad6 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -14,7 +14,7 @@
  * General size of kernel stacks
  */
 #ifdef CONFIG_KASAN
-#define THREAD_SIZE_ORDER 3
+#define THREAD_SIZE_ORDER 4
 #else
 #define THREAD_SIZE_ORDER 2
 #endif
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 457b7ba0fbb6..b31c779cf581 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -136,7 +136,7 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
                                 unsigned long address)
 {
-        if (tlb->mm->context.asce_limit <= _REGION3_SIZE)
+        if (mm_pmd_folded(tlb->mm))
                 return;
         pgtable_pmd_page_dtor(virt_to_page(pmd));
         tlb_remove_table(tlb, pmd);
@@ -152,7 +152,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
 static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
                                 unsigned long address)
 {
-        if (tlb->mm->context.asce_limit <= _REGION1_SIZE)
+        if (mm_p4d_folded(tlb->mm))
                 return;
         tlb_remove_table(tlb, p4d);
 }
@@ -167,7 +167,7 @@ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
 static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
                                 unsigned long address)
 {
-        if (tlb->mm->context.asce_limit <= _REGION2_SIZE)
+        if (mm_pud_folded(tlb->mm))
                 return;
         tlb_remove_table(tlb, pud);
 }
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 724fba4d09d2..39191a0feed1 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -236,10 +236,10 @@ ENTRY(__switch_to)
         stmg    %r6,%r15,__SF_GPRS(%r15)        # store gprs of prev task
         lghi    %r4,__TASK_stack
         lghi    %r1,__TASK_thread
-        lg      %r5,0(%r4,%r3)                  # start of kernel stack of next
+        llill   %r5,STACK_INIT
         stg     %r15,__THREAD_ksp(%r1,%r2)      # store kernel stack of prev
-        lgr     %r15,%r5
-        aghi    %r15,STACK_INIT                 # end of kernel stack of next
+        lg      %r15,0(%r4,%r3)                 # start of kernel stack of next
+        agr     %r15,%r5                        # end of kernel stack of next
         stg     %r3,__LC_CURRENT                # store task struct of next
         stg     %r15,__LC_KERNEL_STACK          # store end of kernel stack
         lg      %r15,__THREAD_ksp(%r1,%r3)      # load kernel stack of next
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 84be7f02d0c2..39b13d71a8fe 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -203,22 +203,13 @@ device_initcall(ftrace_plt_init);
  */
 unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 {
-        struct ftrace_graph_ent trace;
-
         if (unlikely(ftrace_graph_is_dead()))
                 goto out;
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 goto out;
         ip -= MCOUNT_INSN_SIZE;
-        trace.func = ip;
-        trace.depth = current->curr_ret_stack + 1;
-        /* Only trace if the calling function expects to. */
-        if (!ftrace_graph_entry(&trace))
-                goto out;
-        if (ftrace_push_return_trace(parent, ip, &trace.depth, 0,
-                                     NULL) == -EBUSY)
-                goto out;
-        parent = (unsigned long) return_to_handler;
+        if (!function_graph_enter(parent, ip, 0, NULL))
+                parent = (unsigned long) return_to_handler;
 out:
         return parent;
 }
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index cc085e2d2ce9..d5523adeddbf 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -346,6 +346,8 @@ static int __hw_perf_event_init(struct perf_event *event)
                 break;
 
         case PERF_TYPE_HARDWARE:
+                if (is_sampling_event(event))   /* No sampling support */
+                        return -ENOENT;
                 ev = attr->config;
                 /* Count user space (problem-state) only */
                 if (!attr->exclude_user && attr->exclude_kernel) {
@@ -373,7 +375,7 @@ static int __hw_perf_event_init(struct perf_event *event)
                 return -ENOENT;
 
         if (ev > PERF_CPUM_CF_MAX_CTR)
-                return -EINVAL;
+                return -ENOENT;
 
         /* Obtain the counter set to which the specified counter belongs */
         set = get_counter_set(ev);
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index 7bf604ff50a1..bfabeb1889cc 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1842,10 +1842,30 @@ static void cpumsf_pmu_del(struct perf_event *event, int flags)
 CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC, PERF_EVENT_CPUM_SF);
 CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC_DIAG, PERF_EVENT_CPUM_SF_DIAG);
 
-static struct attribute *cpumsf_pmu_events_attr[] = {
-        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC),
-        NULL,
-        NULL,
+/* Attribute list for CPU_SF.
+ *
+ * The availablitiy depends on the CPU_MF sampling facility authorization
+ * for basic + diagnositic samples. This is determined at initialization
+ * time by the sampling facility device driver.
+ * If the authorization for basic samples is turned off, it should be
+ * also turned off for diagnostic sampling.
+ *
+ * During initialization of the device driver, check the authorization
+ * level for diagnostic sampling and installs the attribute
+ * file for diagnostic sampling if necessary.
+ *
+ * For now install a placeholder to reference all possible attributes:
+ * SF_CYCLES_BASIC and SF_CYCLES_BASIC_DIAG.
+ * Add another entry for the final NULL pointer.
+ */
+enum {
+        SF_CYCLES_BASIC_ATTR_IDX = 0,
+        SF_CYCLES_BASIC_DIAG_ATTR_IDX,
+        SF_CYCLES_ATTR_MAX
+};
+
+static struct attribute *cpumsf_pmu_events_attr[SF_CYCLES_ATTR_MAX + 1] = {
+        [SF_CYCLES_BASIC_ATTR_IDX] = CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC)
 };
 
 PMU_FORMAT_ATTR(event, "config:0-63");
@@ -2040,7 +2060,10 @@ static int __init init_cpum_sampling_pmu(void)
 
         if (si.ad) {
                 sfb_set_limits(CPUM_SF_MIN_SDB, CPUM_SF_MAX_SDB);
-                cpumsf_pmu_events_attr[1] =
+                /* Sampling of diagnostic data authorized,
+                 * install event into attribute list of PMU device.
+                 */
+                cpumsf_pmu_events_attr[SF_CYCLES_BASIC_DIAG_ATTR_IDX] =
                         CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC_DIAG);
         }
 
diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
index eb8aebea3ea7..e76309fbbcb3 100644
--- a/arch/s390/kernel/vdso32/Makefile
+++ b/arch/s390/kernel/vdso32/Makefile
@@ -37,7 +37,7 @@ KASAN_SANITIZE := n
 $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
 
 # link rule for the .so file, .lds has to be first
-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32)
+$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE
         $(call if_changed,vdso32ld)
 
 # strip rule for the .so file
@@ -46,12 +46,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
         $(call if_changed,objcopy)
 
 # assembly rules for the .S files
-$(obj-vdso32): %.o: %.S
+$(obj-vdso32): %.o: %.S FORCE
         $(call if_changed_dep,vdso32as)
 
 # actual build commands
 quiet_cmd_vdso32ld = VDSO32L $@
-      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
+      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
 quiet_cmd_vdso32as = VDSO32A $@
       cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
 
diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
index a22b2cf86eec..f849ac61c5da 100644
--- a/arch/s390/kernel/vdso64/Makefile
+++ b/arch/s390/kernel/vdso64/Makefile
@@ -37,7 +37,7 @@ KASAN_SANITIZE := n
 $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so
 
 # link rule for the .so file, .lds has to be first
-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64)
+$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE
         $(call if_changed,vdso64ld)
 
 # strip rule for the .so file
@@ -46,12 +46,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
         $(call if_changed,objcopy)
 
 # assembly rules for the .S files
-$(obj-vdso64): %.o: %.S
+$(obj-vdso64): %.o: %.S FORCE
         $(call if_changed_dep,vdso64as)
 
 # actual build commands
 quiet_cmd_vdso64ld = VDSO64L $@
-      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
+      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
 quiet_cmd_vdso64as = VDSO64A $@
       cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
 
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 21eb7407d51b..8429ab079715 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -154,14 +154,14 @@ SECTIONS
          * uncompressed image info used by the decompressor
          * it should match struct vmlinux_info
          */
-        .vmlinux.info 0 : {
+        .vmlinux.info 0 (INFO) : {
                 QUAD(_stext)                                    /* default_lma */
                 QUAD(startup_continue)                          /* entry */
                 QUAD(__bss_start - _stext)                      /* image_size */
                 QUAD(__bss_stop - __bss_start)                  /* bss_size */
                 QUAD(__boot_data_start)                         /* bootdata_off */
                 QUAD(__boot_data_end - __boot_data_start)       /* bootdata_size */
-        }
+        } :NONE
 
         /* Debugging sections.  */
         STABS_DEBUG
diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index 76d89ee8b428..6791562779ee 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -101,6 +101,7 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
                         mm->context.asce_limit = _REGION1_SIZE;
                         mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
                                 _ASCE_USER_BITS | _ASCE_TYPE_REGION2;
+                        mm_inc_nr_puds(mm);
                 } else {
                         crst_table_init(table, _REGION1_ENTRY_EMPTY);
                         pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd);
@@ -130,6 +131,7 @@ void crst_table_downgrade(struct mm_struct *mm)
         }
 
         pgd = mm->pgd;
+        mm_dec_nr_pmds(mm);
         mm->pgd = (pgd_t *) (pgd_val(*pgd) & _REGION_ENTRY_ORIGIN);
         mm->context.asce_limit = _REGION3_SIZE;
         mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c
index ae0d9e889534..d31bde0870d8 100644
--- a/arch/s390/numa/numa.c
+++ b/arch/s390/numa/numa.c
@@ -53,6 +53,7 @@ int __node_distance(int a, int b)
 {
         return mode->distance ? mode->distance(a, b) : 0;
 }
+EXPORT_SYMBOL(__node_distance);
 
 int numa_debug_enabled;
 
diff --git a/arch/sh/kernel/ftrace.c b/arch/sh/kernel/ftrace.c
index 96dd9f7da250..1b04270e5460 100644
--- a/arch/sh/kernel/ftrace.c
+++ b/arch/sh/kernel/ftrace.c
@@ -321,8 +321,7 @@ int ftrace_disable_ftrace_graph_caller(void)
 void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
 {
         unsigned long old;
-        int faulted, err;
-        struct ftrace_graph_ent trace;
+        int faulted;
         unsigned long return_hooker = (unsigned long)&return_to_handler;
 
         if (unlikely(ftrace_graph_is_dead()))
@@ -365,18 +364,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
                 return;
         }
 
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth, 0, NULL);
-        if (err == -EBUSY) {
+        if (function_graph_enter(old, self_addr, 0, NULL))
                 __raw_writel(old, parent);
-                return;
-        }
-
-        trace.func = self_addr;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
-                __raw_writel(old, parent);
-        }
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/sparc/kernel/ftrace.c b/arch/sparc/kernel/ftrace.c
index 915dda4ae412..684b84ce397f 100644
--- a/arch/sparc/kernel/ftrace.c
+++ b/arch/sparc/kernel/ftrace.c
@@ -126,20 +126,11 @@ unsigned long prepare_ftrace_return(unsigned long parent,
                                     unsigned long frame_pointer)
 {
         unsigned long return_hooker = (unsigned long) &return_to_handler;
-        struct ftrace_graph_ent trace;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return parent + 8UL;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return parent + 8UL;
-
-        if (ftrace_push_return_trace(parent, self_addr, &trace.depth,
-                                     frame_pointer, NULL) == -EBUSY)
+        if (function_graph_enter(parent, self_addr, frame_pointer, NULL))
                 return parent + 8UL;
 
         return return_hooker;
diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
index 40d008b0bd3e..05eb016fc41b 100644
--- a/arch/sparc/kernel/iommu.c
+++ b/arch/sparc/kernel/iommu.c
@@ -108,10 +108,9 @@ int iommu_table_init(struct iommu *iommu, int tsbsize,
         /* Allocate and initialize the free area map.  */
         sz = num_tsb_entries / 8;
         sz = (sz + 7UL) & ~7UL;
-        iommu->tbl.map = kmalloc_node(sz, GFP_KERNEL, numa_node);
+        iommu->tbl.map = kzalloc_node(sz, GFP_KERNEL, numa_node);
         if (!iommu->tbl.map)
                 return -ENOMEM;
-        memset(iommu->tbl.map, 0, sz);
 
         iommu_tbl_pool_init(&iommu->tbl, num_tsb_entries, IO_PAGE_SHIFT,
                             (tlb_type != hypervisor ? iommu_flushall : NULL),
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index 4c5b3fcbed94..e800ce13cc6e 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -683,6 +683,7 @@ void do_signal32(struct pt_regs * regs)
                                 regs->tpc -= 4;
                                 regs->tnpc -= 4;
                                 pt_regs_clear_syscall(regs);
+                                /* fall through */
                         case ERESTART_RESTARTBLOCK:
                                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                                 regs->tpc -= 4;
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 5665261cee37..83953780ca01 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -508,6 +508,7 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
                                 regs->pc -= 4;
                                 regs->npc -= 4;
                                 pt_regs_clear_syscall(regs);
+                                /* fall through */
                         case ERESTART_RESTARTBLOCK:
                                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                                 regs->pc -= 4;
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index e9de1803a22e..ca70787efd8e 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -533,6 +533,7 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
                                 regs->tpc -= 4;
                                 regs->tnpc -= 4;
                                 pt_regs_clear_syscall(regs);
+                                /* fall through */
                         case ERESTART_RESTARTBLOCK:
                                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                                 regs->tpc -= 4;
diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
index 222785af550b..5fda4f7bf15d 100644
--- a/arch/sparc/net/bpf_jit_comp_64.c
+++ b/arch/sparc/net/bpf_jit_comp_64.c
@@ -791,7 +791,7 @@ static int emit_compare_and_branch(const u8 code, const u8 dst, u8 src,
 }
 
 /* Just skip the save instruction and the ctx register move.  */
-#define BPF_TAILCALL_PROLOGUE_SKIP      16
+#define BPF_TAILCALL_PROLOGUE_SKIP      32
 #define BPF_TAILCALL_CNT_SP_OFF         (STACK_BIAS + 128)
 
 static void build_prologue(struct jit_ctx *ctx)
@@ -824,9 +824,15 @@ static void build_prologue(struct jit_ctx *ctx)
                 const u8 vfp = bpf2sparc[BPF_REG_FP];
 
                 emit(ADD | IMMED | RS1(FP) | S13(STACK_BIAS) | RD(vfp), ctx);
+        } else {
+                emit_nop(ctx);
         }
 
         emit_reg_move(I0, O0, ctx);
+        emit_reg_move(I1, O1, ctx);
+        emit_reg_move(I2, O2, ctx);
+        emit_reg_move(I3, O3, ctx);
+        emit_reg_move(I4, O4, ctx);
         /* If you add anything here, adjust BPF_TAILCALL_PROLOGUE_SKIP above. */
 }
 
@@ -1270,6 +1276,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp2 = bpf2sparc[TMP_REG_2];
                 u32 opcode = 0, rs2;
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 ctx->tmp_2_used = true;
                 emit_loadimm(imm, tmp2, ctx);
 
@@ -1308,6 +1317,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp = bpf2sparc[TMP_REG_1];
                 u32 opcode = 0, rs2;
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 switch (BPF_SIZE(code)) {
                 case BPF_W:
                         opcode = ST32;
@@ -1340,6 +1352,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp2 = bpf2sparc[TMP_REG_2];
                 const u8 tmp3 = bpf2sparc[TMP_REG_3];
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 ctx->tmp_1_used = true;
                 ctx->tmp_2_used = true;
                 ctx->tmp_3_used = true;
@@ -1360,6 +1375,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp2 = bpf2sparc[TMP_REG_2];
                 const u8 tmp3 = bpf2sparc[TMP_REG_3];
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 ctx->tmp_1_used = true;
                 ctx->tmp_2_used = true;
                 ctx->tmp_3_used = true;
@@ -1425,12 +1443,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
         struct bpf_prog *tmp, *orig_prog = prog;
         struct sparc64_jit_data *jit_data;
         struct bpf_binary_header *header;
+        u32 prev_image_size, image_size;
         bool tmp_blinded = false;
         bool extra_pass = false;
         struct jit_ctx ctx;
-        u32 image_size;
         u8 *image_ptr;
-        int pass;
+        int pass, i;
 
         if (!prog->jit_requested)
                 return orig_prog;
@@ -1461,61 +1479,82 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
                 header = jit_data->header;
                 extra_pass = true;
                 image_size = sizeof(u32) * ctx.idx;
+                prev_image_size = image_size;
+                pass = 1;
                 goto skip_init_ctx;
         }
 
         memset(&ctx, 0, sizeof(ctx));
         ctx.prog = prog;
 
-        ctx.offset = kcalloc(prog->len, sizeof(unsigned int), GFP_KERNEL);
+        ctx.offset = kmalloc_array(prog->len, sizeof(unsigned int), GFP_KERNEL);
         if (ctx.offset == NULL) {
                 prog = orig_prog;
                 goto out_off;
         }
 
-        /* Fake pass to detect features used, and get an accurate assessment
-         * of what the final image size will be.
+        /* Longest sequence emitted is for bswap32, 12 instructions.  Pre-cook
+         * the offset array so that we converge faster.
          */
-        if (build_body(&ctx)) {
-                prog = orig_prog;
-                goto out_off;
-        }
-        build_prologue(&ctx);
-        build_epilogue(&ctx);
-
-        /* Now we know the actual image size. */
-        image_size = sizeof(u32) * ctx.idx;
-        header = bpf_jit_binary_alloc(image_size, &image_ptr,
-                                      sizeof(u32), jit_fill_hole);
-        if (header == NULL) {
-                prog = orig_prog;
-                goto out_off;
-        }
+        for (i = 0; i < prog->len; i++)
+                ctx.offset[i] = i * (12 * 4);
 
-        ctx.image = (u32 *)image_ptr;
-skip_init_ctx:
-        for (pass = 1; pass < 3; pass++) {
+        prev_image_size = ~0U;
+        for (pass = 1; pass < 40; pass++) {
                 ctx.idx = 0;
 
                 build_prologue(&ctx);
-
                 if (build_body(&ctx)) {
-                        bpf_jit_binary_free(header);
                         prog = orig_prog;
                         goto out_off;
                 }
-
                 build_epilogue(&ctx);
 
                 if (bpf_jit_enable > 1)
-                        pr_info("Pass %d: shrink = %d, seen = [%c%c%c%c%c%c]\n", pass,
-                                image_size - (ctx.idx * 4),
+                        pr_info("Pass %d: size = %u, seen = [%c%c%c%c%c%c]\n", pass,
+                                ctx.idx * 4,
                                 ctx.tmp_1_used ? '1' : ' ',
                                 ctx.tmp_2_used ? '2' : ' ',
                                 ctx.tmp_3_used ? '3' : ' ',
                                 ctx.saw_frame_pointer ? 'F' : ' ',
                                 ctx.saw_call ? 'C' : ' ',
                                 ctx.saw_tail_call ? 'T' : ' ');
+
+                if (ctx.idx * 4 == prev_image_size)
+                        break;
+                prev_image_size = ctx.idx * 4;
+                cond_resched();
+        }
+
+        /* Now we know the actual image size. */
+        image_size = sizeof(u32) * ctx.idx;
+        header = bpf_jit_binary_alloc(image_size, &image_ptr,
+                                      sizeof(u32), jit_fill_hole);
+        if (header == NULL) {
+                prog = orig_prog;
+                goto out_off;
+        }
+
+        ctx.image = (u32 *)image_ptr;
+skip_init_ctx:
+        ctx.idx = 0;
+
+        build_prologue(&ctx);
+
+        if (build_body(&ctx)) {
+                bpf_jit_binary_free(header);
+                prog = orig_prog;
+                goto out_off;
+        }
+
+        build_epilogue(&ctx);
+
+        if (ctx.idx * 4 != prev_image_size) {
+                pr_err("bpf_jit: Failed to converge, prev_size=%u size=%d\n",
+                       prev_image_size, ctx.idx * 4);
+                bpf_jit_binary_free(header);
+                prog = orig_prog;
+                goto out_off;
         }
 
         if (bpf_jit_enable > 1)
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 74c002ddc0ce..28c40624bcb6 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1305,6 +1305,7 @@ static int ubd_queue_one_vec(struct blk_mq_hw_ctx *hctx, struct request *req,
                 io_req->fds[0] = dev->cow.fd;
         else
                 io_req->fds[0] = dev->fd;
+        io_req->error = 0;
 
         if (req_op(req) == REQ_OP_FLUSH) {
                 io_req->op = UBD_FLUSH;
@@ -1313,9 +1314,7 @@ static int ubd_queue_one_vec(struct blk_mq_hw_ctx *hctx, struct request *req,
                 io_req->cow_offset = -1;
                 io_req->offset = off;
                 io_req->length = bvec->bv_len;
-                io_req->error = 0;
                 io_req->sector_mask = 0;
-
                 io_req->op = rq_data_dir(req) == READ ? UBD_READ : UBD_WRITE;
                 io_req->offsets[0] = 0;
                 io_req->offsets[1] = dev->cow.data_offset;
@@ -1341,11 +1340,14 @@ static int ubd_queue_one_vec(struct blk_mq_hw_ctx *hctx, struct request *req,
 static blk_status_t ubd_queue_rq(struct blk_mq_hw_ctx *hctx,
                                  const struct blk_mq_queue_data *bd)
 {
+        struct ubd *ubd_dev = hctx->queue->queuedata;
         struct request *req = bd->rq;
         int ret = 0;
 
         blk_mq_start_request(req);
 
+        spin_lock_irq(&ubd_dev->lock);
+
         if (req_op(req) == REQ_OP_FLUSH) {
                 ret = ubd_queue_one_vec(hctx, req, 0, NULL);
         } else {
@@ -1361,9 +1363,11 @@ static blk_status_t ubd_queue_rq(struct blk_mq_hw_ctx *hctx,
                 }
         }
 out:
-        if (ret < 0) {
+        spin_unlock_irq(&ubd_dev->lock);
+
+        if (ret < 0)
                 blk_mq_requeue_request(req, true);
-        }
+
         return BLK_STS_OK;
 }
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ba7e3464ee92..8689e794a43c 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -444,10 +444,6 @@ config RETPOLINE
           branches. Requires a compiler with -mindirect-branch=thunk-extern
           support for full protection. The kernel may run slower.
 
-          Without compiler support, at least indirect branches in assembler
-          code are eliminated. Since this includes the syscall entry path,
-          it is not entirely pointless.
-
 config INTEL_RDT
         bool "Intel Resource Director Technology support"
         depends on X86 && CPU_SUP_INTEL
@@ -525,7 +521,6 @@ config X86_VSMP
         bool "ScaleMP vSMP"
         select HYPERVISOR_GUEST
         select PARAVIRT
-        select PARAVIRT_XXL
         depends on X86_64 && PCI
         depends on X86_EXTENDED_PLATFORM
         depends on SMP
@@ -1005,13 +1000,7 @@ config NR_CPUS
           to the kernel image.
 
 config SCHED_SMT
-        bool "SMT (Hyperthreading) scheduler support"
-        depends on SMP
-        ---help---
-          SMT scheduler support improves the CPU scheduler's decision making
-          when dealing with Intel Pentium 4 chips with HyperThreading at a
-          cost of slightly increased overhead in some places. If unsure say
-          N here.
+        def_bool y if SMP
 
 config SCHED_MC
         def_bool y
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 5b562e464009..f5d7f4134524 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -213,8 +213,6 @@ ifdef CONFIG_X86_64
 KBUILD_LDFLAGS += $(call ld-option, -z max-page-size=0x200000)
 endif
 
-# Speed up the build
-KBUILD_CFLAGS += -pipe
 # Workaround for a gcc prelease that unfortunately was shipped in a suse release
 KBUILD_CFLAGS += -Wno-sign-compare
 #
@@ -222,9 +220,10 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 
 # Avoid indirect branches in kernel to deal with Spectre
 ifdef CONFIG_RETPOLINE
-ifneq ($(RETPOLINE_CFLAGS),)
-  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+ifeq ($(RETPOLINE_CFLAGS),)
+  $(error You are building kernel with non-retpoline compiler, please update your compiler.)
 endif
+  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
 endif
 
 archscripts: scripts_basic
@@ -239,7 +238,7 @@ archheaders:
 archmacros:
         $(Q)$(MAKE) $(build)=arch/x86/kernel arch/x86/kernel/macros.s
 
-ASM_MACRO_FLAGS = -Wa,arch/x86/kernel/macros.s -Wa,-
+ASM_MACRO_FLAGS = -Wa,arch/x86/kernel/macros.s
 export ASM_MACRO_FLAGS
 KBUILD_CFLAGS += $(ASM_MACRO_FLAGS)
 
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 4c881c850125..850b8762e889 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -300,7 +300,7 @@ _start:
         # Part 2 of the header, from the old setup.S
 
                 .ascii  "HdrS"          # header signature
-                .word   0x020e          # header version number (>= 0x0105)
+                .word   0x020d          # header version number (>= 0x0105)
                                         # or else old loadlin-1.5 will fail)
                 .globl realmode_swtch
 realmode_swtch: .word   0, 0            # default_switch, SETUPSEG
@@ -558,10 +558,6 @@ pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
 init_size:              .long INIT_SIZE         # kernel initialization size
 handover_offset:        .long 0                 # Filled in by build.c
 
-acpi_rsdp_addr:         .quad 0                 # 64-bit physical pointer to the
-                                                # ACPI RSDP table, added with
-                                                # version 2.14
-
 # End of setup header #####################################################
 
         .section ".entrytext", "ax"
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 106911b603bd..374a19712e20 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -438,26 +438,6 @@ int x86_setup_perfctr(struct perf_event *event)
         if (config == -1LL)
                 return -EINVAL;
 
-        /*
-         * Branch tracing:
-         */
-        if (attr->config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
-            !attr->freq && hwc->sample_period == 1) {
-                /* BTS is not supported by this architecture. */
-                if (!x86_pmu.bts_active)
-                        return -EOPNOTSUPP;
-
-                /* BTS is currently only allowed for user-mode. */
-                if (!attr->exclude_kernel)
-                        return -EOPNOTSUPP;
-
-                /* disallow bts if conflicting events are present */
-                if (x86_add_exclusive(x86_lbr_exclusive_lbr))
-                        return -EBUSY;
-
-                event->destroy = hw_perf_lbr_event_destroy;
-        }
-
         hwc->config |= config;
 
         return 0;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 273c62e81546..ecc3e34ca955 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2306,14 +2306,18 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status)
         return handled;
 }
 
-static bool disable_counter_freezing;
+static bool disable_counter_freezing = true;
 static int __init intel_perf_counter_freezing_setup(char *s)
 {
-        disable_counter_freezing = true;
-        pr_info("Intel PMU Counter freezing feature disabled\n");
+        bool res;
+
+        if (kstrtobool(s, &res))
+                return -EINVAL;
+
+        disable_counter_freezing = !res;
         return 1;
 }
-__setup("disable_counter_freezing", intel_perf_counter_freezing_setup);
+__setup("perf_v4_pmi=", intel_perf_counter_freezing_setup);
 
 /*
  * Simplified handler for Arch Perfmon v4:
@@ -2470,16 +2474,7 @@ done:
 static struct event_constraint *
 intel_bts_constraints(struct perf_event *event)
 {
-        struct hw_perf_event *hwc = &event->hw;
-        unsigned int hw_event, bts_event;
-
-        if (event->attr.freq)
-                return NULL;
-
-        hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
-        bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
-
-        if (unlikely(hw_event == bts_event && hwc->sample_period == 1))
+        if (unlikely(intel_pmu_has_bts(event)))
                 return &bts_constraint;
 
         return NULL;
@@ -3098,6 +3093,43 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
         return flags;
 }
 
+static int intel_pmu_bts_config(struct perf_event *event)
+{
+        struct perf_event_attr *attr = &event->attr;
+
+        if (unlikely(intel_pmu_has_bts(event))) {
+                /* BTS is not supported by this architecture. */
+                if (!x86_pmu.bts_active)
+                        return -EOPNOTSUPP;
+
+                /* BTS is currently only allowed for user-mode. */
+                if (!attr->exclude_kernel)
+                        return -EOPNOTSUPP;
+
+                /* BTS is not allowed for precise events. */
+                if (attr->precise_ip)
+                        return -EOPNOTSUPP;
+
+                /* disallow bts if conflicting events are present */
+                if (x86_add_exclusive(x86_lbr_exclusive_lbr))
+                        return -EBUSY;
+
+                event->destroy = hw_perf_lbr_event_destroy;
+        }
+
+        return 0;
+}
+
+static int core_pmu_hw_config(struct perf_event *event)
+{
+        int ret = x86_pmu_hw_config(event);
+
+        if (ret)
+                return ret;
+
+        return intel_pmu_bts_config(event);
+}
+
 static int intel_pmu_hw_config(struct perf_event *event)
 {
         int ret = x86_pmu_hw_config(event);
@@ -3105,6 +3137,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
         if (ret)
                 return ret;
 
+        ret = intel_pmu_bts_config(event);
+        if (ret)
+                return ret;
+
         if (event->attr.precise_ip) {
                 if (!event->attr.freq) {
                         event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
@@ -3127,7 +3163,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 /*
                  * BTS is set up earlier in this path, so don't account twice
                  */
-                if (!intel_pmu_has_bts(event)) {
+                if (!unlikely(intel_pmu_has_bts(event))) {
                         /* disallow lbr if conflicting events are present */
                         if (x86_add_exclusive(x86_lbr_exclusive_lbr))
                                 return -EBUSY;
@@ -3596,7 +3632,7 @@ static __initconst const struct x86_pmu core_pmu = {
         .enable_all             = core_pmu_enable_all,
         .enable                 = core_pmu_enable_event,
         .disable                = x86_pmu_disable_event,
-        .hw_config              = x86_pmu_hw_config,
+        .hw_config              = core_pmu_hw_config,
         .schedule_events        = x86_schedule_events,
         .eventsel               = MSR_ARCH_PERFMON_EVENTSEL0,
         .perfctr                = MSR_ARCH_PERFMON_PERFCTR0,
diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index e17ab885b1e9..cb46d602a6b8 100644
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -129,8 +129,15 @@ struct intel_uncore_box {
         struct intel_uncore_extra_reg shared_regs[0];
 };
 
-#define UNCORE_BOX_FLAG_INITIATED       0
-#define UNCORE_BOX_FLAG_CTL_OFFS8       1 /* event config registers are 8-byte apart */
+/* CFL uncore 8th cbox MSRs */
+#define CFL_UNC_CBO_7_PERFEVTSEL0               0xf70
+#define CFL_UNC_CBO_7_PER_CTR0                  0xf76
+
+#define UNCORE_BOX_FLAG_INITIATED               0
+/* event config registers are 8-byte apart */
+#define UNCORE_BOX_FLAG_CTL_OFFS8               1
+/* CFL 8th CBOX has different MSR space */
+#define UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS      2
 
 struct uncore_event_desc {
         struct kobj_attribute attr;
@@ -297,17 +304,27 @@ unsigned int uncore_freerunning_counter(struct intel_uncore_box *box,
 static inline
 unsigned uncore_msr_event_ctl(struct intel_uncore_box *box, int idx)
 {
-        return box->pmu->type->event_ctl +
-                (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx) +
-                uncore_msr_box_offset(box);
+        if (test_bit(UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS, &box->flags)) {
+                return CFL_UNC_CBO_7_PERFEVTSEL0 +
+                       (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx);
+        } else {
+                return box->pmu->type->event_ctl +
+                       (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx) +
+                       uncore_msr_box_offset(box);
+        }
 }
 
 static inline
 unsigned uncore_msr_perf_ctr(struct intel_uncore_box *box, int idx)
 {
-        return box->pmu->type->perf_ctr +
-                (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx) +
-                uncore_msr_box_offset(box);
+        if (test_bit(UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS, &box->flags)) {
+                return CFL_UNC_CBO_7_PER_CTR0 +
+                       (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx);
+        } else {
+                return box->pmu->type->perf_ctr +
+                       (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx) +
+                       uncore_msr_box_offset(box);
+        }
 }
 
 static inline
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index 8527c3e1038b..2593b0d7aeee 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -15,6 +15,25 @@
 #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC  0x1910
 #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC  0x190f
 #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC  0x191f
+#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC   0x590c
+#define PCI_DEVICE_ID_INTEL_KBL_U_IMC   0x5904
+#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC  0x5914
+#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC  0x590f
+#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC  0x591f
+#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC  0x3ecc
+#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC  0x3ed0
+#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC  0x3e10
+#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC  0x3ec4
+#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC        0x3e0f
+#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC        0x3e1f
+#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC        0x3ec2
+#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC        0x3e30
+#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC        0x3e18
+#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC        0x3ec6
+#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC        0x3e31
+#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC        0x3e33
+#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC        0x3eca
+#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC        0x3e32
 
 /* SNB event control */
 #define SNB_UNC_CTL_EV_SEL_MASK                 0x000000ff
@@ -202,6 +221,10 @@ static void skl_uncore_msr_init_box(struct intel_uncore_box *box)
                 wrmsrl(SKL_UNC_PERF_GLOBAL_CTL,
                         SNB_UNC_GLOBAL_CTL_EN | SKL_UNC_GLOBAL_CTL_CORE_ALL);
         }
+
+        /* The 8th CBOX has different MSR space */
+        if (box->pmu->pmu_idx == 7)
+                __set_bit(UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS, &box->flags);
 }
 
 static void skl_uncore_msr_enable_box(struct intel_uncore_box *box)
@@ -228,7 +251,7 @@ static struct intel_uncore_ops skl_uncore_msr_ops = {
 static struct intel_uncore_type skl_uncore_cbox = {
         .name           = "cbox",
         .num_counters   = 4,
-        .num_boxes      = 5,
+        .num_boxes      = 8,
         .perf_ctr_bits  = 44,
         .fixed_ctr_bits = 48,
         .perf_ctr       = SNB_UNC_CBO_0_PER_CTR0,
@@ -569,7 +592,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
                 .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
         },
-
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_U_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_UQ_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SD_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SQ_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2U_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4U_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4H_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6H_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
         { /* end: all zeroes */ },
 };
 
@@ -618,6 +716,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
         IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core H Quad Core */
         IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core S Dual Core */
         IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core S Quad Core */
+        IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver),  /* 7th Gen Core Y */
+        IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver),  /* 7th Gen Core U */
+        IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver),  /* 7th Gen Core U Quad Core */
+        IMC_DEV(KBL_SD_IMC, &skl_uncore_pci_driver),  /* 7th Gen Core S Dual Core */
+        IMC_DEV(KBL_SQ_IMC, &skl_uncore_pci_driver),  /* 7th Gen Core S Quad Core */
+        IMC_DEV(CFL_2U_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core U 2 Cores */
+        IMC_DEV(CFL_4U_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core U 4 Cores */
+        IMC_DEV(CFL_4H_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core H 4 Cores */
+        IMC_DEV(CFL_6H_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core H 6 Cores */
+        IMC_DEV(CFL_2S_D_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 2 Cores Desktop */
+        IMC_DEV(CFL_4S_D_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 4 Cores Desktop */
+        IMC_DEV(CFL_6S_D_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 6 Cores Desktop */
+        IMC_DEV(CFL_8S_D_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 8 Cores Desktop */
+        IMC_DEV(CFL_4S_W_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 4 Cores Work Station */
+        IMC_DEV(CFL_6S_W_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 6 Cores Work Station */
+        IMC_DEV(CFL_8S_W_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 8 Cores Work Station */
+        IMC_DEV(CFL_4S_S_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 4 Cores Server */
+        IMC_DEV(CFL_6S_S_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 6 Cores Server */
+        IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver),  /* 8th Gen Core S 8 Cores Server */
         {  /* end marker */ }
 };
 
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index adae087cecdd..78d7b7031bfc 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -859,11 +859,16 @@ static inline int amd_pmu_init(void)
 
 static inline bool intel_pmu_has_bts(struct perf_event *event)
 {
-        if (event->attr.config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
-            !event->attr.freq && event->hw.sample_period == 1)
-                return true;
+        struct hw_perf_event *hwc = &event->hw;
+        unsigned int hw_event, bts_event;
+
+        if (event->attr.freq)
+                return false;
+
+        hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
+        bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
 
-        return false;
+        return hw_event == bts_event && hwc->sample_period == 1;
 }
 
 int intel_pmu_save_and_restart(struct perf_event *event);
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 5f7290e6e954..69dcdf195b61 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -226,7 +226,7 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
                      "3: movl $-2,%[err]\n\t"                           \
                      "jmp 2b\n\t"                                       \
                      ".popsection\n\t"                                  \
-                     _ASM_EXTABLE_UA(1b, 3b)                            \
+                     _ASM_EXTABLE(1b, 3b)                               \
                      : [err] "=r" (err)                                 \
                      : "D" (st), "m" (*st), "a" (lmask), "d" (hmask)    \
                      : "memory")
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 55e51ff7e421..fbda5a917c5b 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1094,7 +1094,8 @@ struct kvm_x86_ops {
         bool (*has_wbinvd_exit)(void);
 
         u64 (*read_l1_tsc_offset)(struct kvm_vcpu *vcpu);
-        void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
+        /* Returns actual tsc_offset set in active VMCS */
+        u64 (*write_l1_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
 
         void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2);
 
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 4da9b1c58d28..c1a812bd5a27 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -221,6 +221,8 @@ static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_am
 
 int mce_available(struct cpuinfo_x86 *c);
 bool mce_is_memory_error(struct mce *m);
+bool mce_is_correctable(struct mce *m);
+int mce_usable_address(struct mce *m);
 
 DECLARE_PER_CPU(unsigned, mce_exception_count);
 DECLARE_PER_CPU(unsigned, mce_poll_count);
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 0d6271cce198..1d0a7778e163 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -232,7 +232,7 @@ static inline u64 hv_do_fast_hypercall16(u16 code, u64 input1, u64 input2)
                                       : "cc");
         }
 #endif
-                return hv_status;
+        return hv_status;
 }
 
 /*
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 80f4a4f38c79..c8f73efb4ece 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -41,9 +41,10 @@
 
 #define MSR_IA32_SPEC_CTRL              0x00000048 /* Speculation Control */
 #define SPEC_CTRL_IBRS                  (1 << 0)   /* Indirect Branch Restricted Speculation */
-#define SPEC_CTRL_STIBP                 (1 << 1)   /* Single Thread Indirect Branch Predictors */
+#define SPEC_CTRL_STIBP_SHIFT           1          /* Single Thread Indirect Branch Predictor (STIBP) bit */
+#define SPEC_CTRL_STIBP                 (1 << SPEC_CTRL_STIBP_SHIFT)    /* STIBP mask */
 #define SPEC_CTRL_SSBD_SHIFT            2          /* Speculative Store Bypass Disable bit */
-#define SPEC_CTRL_SSBD                  (1 << SPEC_CTRL_SSBD_SHIFT)   /* Speculative Store Bypass Disable */
+#define SPEC_CTRL_SSBD                  (1 << SPEC_CTRL_SSBD_SHIFT)     /* Speculative Store Bypass Disable */
 
 #define MSR_IA32_PRED_CMD               0x00000049 /* Prediction Command */
 #define PRED_CMD_IBPB                   (1 << 0)   /* Indirect Branch Prediction Barrier */
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 80dc14422495..032b6009baab 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -3,6 +3,8 @@
 #ifndef _ASM_X86_NOSPEC_BRANCH_H_
 #define _ASM_X86_NOSPEC_BRANCH_H_
 
+#include <linux/static_key.h>
+
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
@@ -162,11 +164,12 @@
         _ASM_PTR " 999b\n\t"                                    \
         ".popsection\n\t"
 
-#if defined(CONFIG_X86_64) && defined(RETPOLINE)
+#ifdef CONFIG_RETPOLINE
+#ifdef CONFIG_X86_64
 
 /*
- * Since the inline asm uses the %V modifier which is only in newer GCC,
- * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE.
+ * Inline asm uses the %V modifier which is only in newer GCC
+ * which is ensured when CONFIG_RETPOLINE is defined.
  */
 # define CALL_NOSPEC                                            \
         ANNOTATE_NOSPEC_ALTERNATIVE                             \
@@ -181,7 +184,7 @@
         X86_FEATURE_RETPOLINE_AMD)
 # define THUNK_TARGET(addr) [thunk_target] "r" (addr)
 
-#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE)
+#else /* CONFIG_X86_32 */
 /*
  * For i386 we use the original ret-equivalent retpoline, because
  * otherwise we'll run out of registers. We don't care about CET
@@ -211,6 +214,7 @@
         X86_FEATURE_RETPOLINE_AMD)
 
 # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+#endif
 #else /* No retpoline for C / inline asm */
 # define CALL_NOSPEC "call *%[thunk_target]\n"
 # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
@@ -219,13 +223,19 @@
 /* The Spectre V2 mitigation variants */
 enum spectre_v2_mitigation {
         SPECTRE_V2_NONE,
-        SPECTRE_V2_RETPOLINE_MINIMAL,
-        SPECTRE_V2_RETPOLINE_MINIMAL_AMD,
         SPECTRE_V2_RETPOLINE_GENERIC,
         SPECTRE_V2_RETPOLINE_AMD,
         SPECTRE_V2_IBRS_ENHANCED,
 };
 
+/* The indirect branch speculation control variants */
+enum spectre_v2_user_mitigation {
+        SPECTRE_V2_USER_NONE,
+        SPECTRE_V2_USER_STRICT,
+        SPECTRE_V2_USER_PRCTL,
+        SPECTRE_V2_USER_SECCOMP,
+};
+
 /* The Speculative Store Bypass disable variants */
 enum ssb_mitigation {
         SPEC_STORE_BYPASS_NONE,
@@ -303,6 +313,10 @@ do {									\
         preempt_enable();                                               \
 } while (0)
 
+DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
+DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
 #endif /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index cd0cf1c568b4..8f657286d599 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -33,12 +33,14 @@
 
 /*
  * Set __PAGE_OFFSET to the most negative possible address +
- * PGDIR_SIZE*16 (pgd slot 272).  The gap is to allow a space for a
- * hypervisor to fit.  Choosing 16 slots here is arbitrary, but it's
- * what Xen requires.
+ * PGDIR_SIZE*17 (pgd slot 273).
+ *
+ * The gap is to allow a space for LDT remap for PTI (1 pgd slot) and space for
+ * a hypervisor (16 slots). Choosing 16 slots for a hypervisor is arbitrary,
+ * but it's what Xen requires.
  */
-#define __PAGE_OFFSET_BASE_L5   _AC(0xff10000000000000, UL)
-#define __PAGE_OFFSET_BASE_L4   _AC(0xffff880000000000, UL)
+#define __PAGE_OFFSET_BASE_L5   _AC(0xff11000000000000, UL)
+#define __PAGE_OFFSET_BASE_L4   _AC(0xffff888000000000, UL)
 
 #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT
 #define __PAGE_OFFSET           page_offset_base
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index 04edd2d58211..84bd9bdc1987 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -111,9 +111,7 @@ extern unsigned int ptrs_per_p4d;
  */
 #define MAXMEM                  (1UL << MAX_PHYSMEM_BITS)
 
-#define LDT_PGD_ENTRY_L4        -3UL
-#define LDT_PGD_ENTRY_L5        -112UL
-#define LDT_PGD_ENTRY           (pgtable_l5_enabled() ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4)
+#define LDT_PGD_ENTRY           -240UL
 #define LDT_BASE_ADDR           (LDT_PGD_ENTRY << PGDIR_SHIFT)
 #define LDT_END_ADDR            (LDT_BASE_ADDR + PGDIR_SIZE)
 
diff --git a/arch/x86/include/asm/qspinlock.h b/arch/x86/include/asm/qspinlock.h
index 87623c6b13db..bd5ac6cc37db 100644
--- a/arch/x86/include/asm/qspinlock.h
+++ b/arch/x86/include/asm/qspinlock.h
@@ -13,12 +13,15 @@
 #define queued_fetch_set_pending_acquire queued_fetch_set_pending_acquire
 static __always_inline u32 queued_fetch_set_pending_acquire(struct qspinlock *lock)
 {
-        u32 val = 0;
-
-        if (GEN_BINARY_RMWcc(LOCK_PREFIX "btsl", lock->val.counter, c,
-                             "I", _Q_PENDING_OFFSET))
-                val |= _Q_PENDING_VAL;
+        u32 val;
 
+        /*
+         * We can't use GEN_BINARY_RMWcc() inside an if() stmt because asm goto
+         * and CONFIG_PROFILE_ALL_BRANCHES=y results in a label inside a
+         * statement expression, which GCC doesn't like.
+         */
+        val = GEN_BINARY_RMWcc(LOCK_PREFIX "btsl", lock->val.counter, c,
+                               "I", _Q_PENDING_OFFSET) * _Q_PENDING_VAL;
         val |= atomic_read(&lock->val) & ~_Q_PENDING_MASK;
 
         return val;
diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h
index ae7c2c5cd7f0..5393babc0598 100644
--- a/arch/x86/include/asm/spec-ctrl.h
+++ b/arch/x86/include/asm/spec-ctrl.h
@@ -53,12 +53,24 @@ static inline u64 ssbd_tif_to_spec_ctrl(u64 tifn)
         return (tifn & _TIF_SSBD) >> (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
 }
 
+static inline u64 stibp_tif_to_spec_ctrl(u64 tifn)
+{
+        BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
+        return (tifn & _TIF_SPEC_IB) >> (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
+}
+
 static inline unsigned long ssbd_spec_ctrl_to_tif(u64 spec_ctrl)
 {
         BUILD_BUG_ON(TIF_SSBD < SPEC_CTRL_SSBD_SHIFT);
         return (spec_ctrl & SPEC_CTRL_SSBD) << (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
 }
 
+static inline unsigned long stibp_spec_ctrl_to_tif(u64 spec_ctrl)
+{
+        BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
+        return (spec_ctrl & SPEC_CTRL_STIBP) << (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
+}
+
 static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn)
 {
         return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL;
@@ -70,11 +82,7 @@ extern void speculative_store_bypass_ht_init(void);
 static inline void speculative_store_bypass_ht_init(void) { }
 #endif
 
-extern void speculative_store_bypass_update(unsigned long tif);
-
-static inline void speculative_store_bypass_update_current(void)
-{
-        speculative_store_bypass_update(current_thread_info()->flags);
-}
+extern void speculation_ctrl_update(unsigned long tif);
+extern void speculation_ctrl_update_current(void);
 
 #endif
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
index 36bd243843d6..7cf1a270d891 100644
--- a/arch/x86/include/asm/switch_to.h
+++ b/arch/x86/include/asm/switch_to.h
@@ -11,9 +11,6 @@ struct task_struct *__switch_to_asm(struct task_struct *prev,
 
 __visible struct task_struct *__switch_to(struct task_struct *prev,
                                           struct task_struct *next);
-struct tss_struct;
-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
-                      struct tss_struct *tss);
 
 /* This runs runs on the previous thread's stack. */
 static inline void prepare_switch_to(struct task_struct *next)
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 2ff2a30a264f..82b73b75d67c 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -79,10 +79,12 @@ struct thread_info {
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_SINGLESTEP          4       /* reenable singlestep on user return*/
-#define TIF_SSBD                        5       /* Reduced data speculation */
+#define TIF_SSBD                5       /* Speculative store bypass disable */
 #define TIF_SYSCALL_EMU         6       /* syscall emulation active */
 #define TIF_SYSCALL_AUDIT       7       /* syscall auditing active */
 #define TIF_SECCOMP             8       /* secure computing */
+#define TIF_SPEC_IB             9       /* Indirect branch speculation mitigation */
+#define TIF_SPEC_FORCE_UPDATE   10      /* Force speculation MSR update in context switch */
 #define TIF_USER_RETURN_NOTIFY  11      /* notify kernel of userspace return */
 #define TIF_UPROBE              12      /* breakpointed or singlestepping */
 #define TIF_PATCH_PENDING       13      /* pending live patching update */
@@ -110,6 +112,8 @@ struct thread_info {
 #define _TIF_SYSCALL_EMU        (1 << TIF_SYSCALL_EMU)
 #define _TIF_SYSCALL_AUDIT      (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP            (1 << TIF_SECCOMP)
+#define _TIF_SPEC_IB            (1 << TIF_SPEC_IB)
+#define _TIF_SPEC_FORCE_UPDATE  (1 << TIF_SPEC_FORCE_UPDATE)
 #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
 #define _TIF_UPROBE             (1 << TIF_UPROBE)
 #define _TIF_PATCH_PENDING      (1 << TIF_PATCH_PENDING)
@@ -145,8 +149,18 @@ struct thread_info {
          _TIF_FSCHECK)
 
 /* flags to check in __switch_to() */
-#define _TIF_WORK_CTXSW                                                 \
-        (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|_TIF_SSBD)
+#define _TIF_WORK_CTXSW_BASE                                            \
+        (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|         \
+         _TIF_SSBD | _TIF_SPEC_FORCE_UPDATE)
+
+/*
+ * Avoid calls to __switch_to_xtra() on UP as STIBP is not evaluated.
+ */
+#ifdef CONFIG_SMP
+# define _TIF_WORK_CTXSW        (_TIF_WORK_CTXSW_BASE | _TIF_SPEC_IB)
+#else
+# define _TIF_WORK_CTXSW        (_TIF_WORK_CTXSW_BASE)
+#endif
 
 #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
 #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index d760611cfc35..f4204bf377fc 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -169,10 +169,14 @@ struct tlb_state {
 
 #define LOADED_MM_SWITCHING ((struct mm_struct *)1)
 
+        /* Last user mm for optimizing IBPB */
+        union {
+                struct mm_struct        *last_user_mm;
+                unsigned long           last_user_mm_ibpb;
+        };
+
         u16 loaded_mm_asid;
         u16 next_asid;
-        /* last user mm's ctx id */
-        u64 last_ctx_id;
 
         /*
          * We can be in one of several states:
diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
index 0f842104862c..b85a7c54c6a1 100644
--- a/arch/x86/include/asm/x86_init.h
+++ b/arch/x86/include/asm/x86_init.h
@@ -303,6 +303,4 @@ extern void x86_init_noop(void);
 extern void x86_init_uint_noop(unsigned int unused);
 extern bool x86_pnpbios_disabled(void);
 
-void x86_verify_bootdata_version(void);
-
 #endif
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 123e669bf363..790ce08e41f2 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -9,7 +9,7 @@
 #include <linux/mm.h>
 #include <linux/device.h>
 
-#include <linux/uaccess.h>
+#include <asm/extable.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 
@@ -93,12 +93,39 @@ clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
  */
 static inline int xen_safe_write_ulong(unsigned long *addr, unsigned long val)
 {
-        return __put_user(val, (unsigned long __user *)addr);
+        int ret = 0;
+
+        asm volatile("1: mov %[val], %[ptr]\n"
+                     "2:\n"
+                     ".section .fixup, \"ax\"\n"
+                     "3: sub $1, %[ret]\n"
+                     "   jmp 2b\n"
+                     ".previous\n"
+                     _ASM_EXTABLE(1b, 3b)
+                     : [ret] "+r" (ret), [ptr] "=m" (*addr)
+                     : [val] "r" (val));
+
+        return ret;
 }
 
-static inline int xen_safe_read_ulong(unsigned long *addr, unsigned long *val)
+static inline int xen_safe_read_ulong(const unsigned long *addr,
+                                      unsigned long *val)
 {
-        return __get_user(*val, (unsigned long __user *)addr);
+        int ret = 0;
+        unsigned long rval = ~0ul;
+
+        asm volatile("1: mov %[ptr], %[rval]\n"
+                     "2:\n"
+                     ".section .fixup, \"ax\"\n"
+                     "3: sub $1, %[ret]\n"
+                     "   jmp 2b\n"
+                     ".previous\n"
+                     _ASM_EXTABLE(1b, 3b)
+                     : [ret] "+r" (ret), [rval] "+r" (rval)
+                     : [ptr] "m" (*addr));
+        *val = rval;
+
+        return ret;
 }
 
 #ifdef CONFIG_XEN_PV
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 22f89d040ddd..60733f137e9a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -16,9 +16,6 @@
 #define RAMDISK_PROMPT_FLAG             0x8000
 #define RAMDISK_LOAD_FLAG               0x4000
 
-/* version flags */
-#define VERSION_WRITTEN 0x8000
-
 /* loadflags */
 #define LOADED_HIGH     (1<<0)
 #define KASLR_FLAG      (1<<1)
@@ -89,7 +86,6 @@ struct setup_header {
         __u64   pref_address;
         __u32   init_size;
         __u32   handover_offset;
-        __u64   acpi_rsdp_addr;
 } __attribute__((packed));
 
 struct sys_desc_table {
@@ -159,7 +155,8 @@ struct boot_params {
         __u8  _pad2[4];                                 /* 0x054 */
         __u64  tboot_addr;                              /* 0x058 */
         struct ist_info ist_info;                       /* 0x060 */
-        __u8  _pad3[16];                                /* 0x070 */
+        __u64 acpi_rsdp_addr;                           /* 0x070 */
+        __u8  _pad3[8];                                 /* 0x078 */
         __u8  hd0_info[16];     /* obsolete! */         /* 0x080 */
         __u8  hd1_info[16];     /* obsolete! */         /* 0x090 */
         struct sys_desc_table sys_desc_table; /* obsolete! */   /* 0x0a0 */
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 92c76bf97ad8..06635fbca81c 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1776,5 +1776,5 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size)
 
 u64 x86_default_get_root_pointer(void)
 {
-        return boot_params.hdr.acpi_rsdp_addr;
+        return boot_params.acpi_rsdp_addr;
 }
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index c37e66e493bf..500278f5308e 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/nospec.h>
 #include <linux/prctl.h>
+#include <linux/sched/smt.h>
 
 #include <asm/spec-ctrl.h>
 #include <asm/cmdline.h>
@@ -53,6 +54,13 @@ static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
 u64 __ro_after_init x86_amd_ls_cfg_base;
 u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
 
+/* Control conditional STIPB in switch_to() */
+DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
+/* Control conditional IBPB in switch_mm() */
+DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+/* Control unconditional IBPB in switch_mm() */
+DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
 void __init check_bugs(void)
 {
         identify_boot_cpu();
@@ -123,31 +131,6 @@ void __init check_bugs(void)
 #endif
 }
 
-/* The kernel command line selection */
-enum spectre_v2_mitigation_cmd {
-        SPECTRE_V2_CMD_NONE,
-        SPECTRE_V2_CMD_AUTO,
-        SPECTRE_V2_CMD_FORCE,
-        SPECTRE_V2_CMD_RETPOLINE,
-        SPECTRE_V2_CMD_RETPOLINE_GENERIC,
-        SPECTRE_V2_CMD_RETPOLINE_AMD,
-};
-
-static const char *spectre_v2_strings[] = {
-        [SPECTRE_V2_NONE]                       = "Vulnerable",
-        [SPECTRE_V2_RETPOLINE_MINIMAL]          = "Vulnerable: Minimal generic ASM retpoline",
-        [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
-        [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
-        [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
-        [SPECTRE_V2_IBRS_ENHANCED]              = "Mitigation: Enhanced IBRS",
-};
-
-#undef pr_fmt
-#define pr_fmt(fmt)     "Spectre V2 : " fmt
-
-static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
-        SPECTRE_V2_NONE;
-
 void
 x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
 {
@@ -169,6 +152,10 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
                     static_cpu_has(X86_FEATURE_AMD_SSBD))
                         hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
 
+                /* Conditional STIBP enabled? */
+                if (static_branch_unlikely(&switch_to_cond_stibp))
+                        hostval |= stibp_tif_to_spec_ctrl(ti->flags);
+
                 if (hostval != guestval) {
                         msrval = setguest ? guestval : hostval;
                         wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
@@ -202,7 +189,7 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
                 tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) :
                                  ssbd_spec_ctrl_to_tif(hostval);
 
-                speculative_store_bypass_update(tif);
+                speculation_ctrl_update(tif);
         }
 }
 EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl);
@@ -217,6 +204,15 @@ static void x86_amd_ssb_disable(void)
                 wrmsrl(MSR_AMD64_LS_CFG, msrval);
 }
 
+#undef pr_fmt
+#define pr_fmt(fmt)     "Spectre V2 : " fmt
+
+static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+        SPECTRE_V2_NONE;
+
+static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
+        SPECTRE_V2_USER_NONE;
+
 #ifdef RETPOLINE
 static bool spectre_v2_bad_module;
 
@@ -238,67 +234,217 @@ static inline const char *spectre_v2_module_string(void)
 static inline const char *spectre_v2_module_string(void) { return ""; }
 #endif
 
-static void __init spec2_print_if_insecure(const char *reason)
+static inline bool match_option(const char *arg, int arglen, const char *opt)
 {
-        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
-                pr_info("%s selected on command line.\n", reason);
+        int len = strlen(opt);
+
+        return len == arglen && !strncmp(arg, opt, len);
 }
 
-static void __init spec2_print_if_secure(const char *reason)
+/* The kernel command line selection for spectre v2 */
+enum spectre_v2_mitigation_cmd {
+        SPECTRE_V2_CMD_NONE,
+        SPECTRE_V2_CMD_AUTO,
+        SPECTRE_V2_CMD_FORCE,
+        SPECTRE_V2_CMD_RETPOLINE,
+        SPECTRE_V2_CMD_RETPOLINE_GENERIC,
+        SPECTRE_V2_CMD_RETPOLINE_AMD,
+};
+
+enum spectre_v2_user_cmd {
+        SPECTRE_V2_USER_CMD_NONE,
+        SPECTRE_V2_USER_CMD_AUTO,
+        SPECTRE_V2_USER_CMD_FORCE,
+        SPECTRE_V2_USER_CMD_PRCTL,
+        SPECTRE_V2_USER_CMD_PRCTL_IBPB,
+        SPECTRE_V2_USER_CMD_SECCOMP,
+        SPECTRE_V2_USER_CMD_SECCOMP_IBPB,
+};
+
+static const char * const spectre_v2_user_strings[] = {
+        [SPECTRE_V2_USER_NONE]          = "User space: Vulnerable",
+        [SPECTRE_V2_USER_STRICT]        = "User space: Mitigation: STIBP protection",
+        [SPECTRE_V2_USER_PRCTL]         = "User space: Mitigation: STIBP via prctl",
+        [SPECTRE_V2_USER_SECCOMP]       = "User space: Mitigation: STIBP via seccomp and prctl",
+};
+
+static const struct {
+        const char                      *option;
+        enum spectre_v2_user_cmd        cmd;
+        bool                            secure;
+} v2_user_options[] __initdata = {
+        { "auto",               SPECTRE_V2_USER_CMD_AUTO,               false },
+        { "off",                SPECTRE_V2_USER_CMD_NONE,               false },
+        { "on",                 SPECTRE_V2_USER_CMD_FORCE,              true  },
+        { "prctl",              SPECTRE_V2_USER_CMD_PRCTL,              false },
+        { "prctl,ibpb",         SPECTRE_V2_USER_CMD_PRCTL_IBPB,         false },
+        { "seccomp",            SPECTRE_V2_USER_CMD_SECCOMP,            false },
+        { "seccomp,ibpb",       SPECTRE_V2_USER_CMD_SECCOMP_IBPB,       false },
+};
+
+static void __init spec_v2_user_print_cond(const char *reason, bool secure)
 {
-        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
-                pr_info("%s selected on command line.\n", reason);
+        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
+                pr_info("spectre_v2_user=%s forced on command line.\n", reason);
 }
 
-static inline bool retp_compiler(void)
+static enum spectre_v2_user_cmd __init
+spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
 {
-        return __is_defined(RETPOLINE);
+        char arg[20];
+        int ret, i;
+
+        switch (v2_cmd) {
+        case SPECTRE_V2_CMD_NONE:
+                return SPECTRE_V2_USER_CMD_NONE;
+        case SPECTRE_V2_CMD_FORCE:
+                return SPECTRE_V2_USER_CMD_FORCE;
+        default:
+                break;
+        }
+
+        ret = cmdline_find_option(boot_command_line, "spectre_v2_user",
+                                  arg, sizeof(arg));
+        if (ret < 0)
+                return SPECTRE_V2_USER_CMD_AUTO;
+
+        for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) {
+                if (match_option(arg, ret, v2_user_options[i].option)) {
+                        spec_v2_user_print_cond(v2_user_options[i].option,
+                                                v2_user_options[i].secure);
+                        return v2_user_options[i].cmd;
+                }
+        }
+
+        pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg);
+        return SPECTRE_V2_USER_CMD_AUTO;
 }
 
-static inline bool match_option(const char *arg, int arglen, const char *opt)
+static void __init
+spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
 {
-        int len = strlen(opt);
+        enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
+        bool smt_possible = IS_ENABLED(CONFIG_SMP);
+        enum spectre_v2_user_cmd cmd;
 
-        return len == arglen && !strncmp(arg, opt, len);
+        if (!boot_cpu_has(X86_FEATURE_IBPB) && !boot_cpu_has(X86_FEATURE_STIBP))
+                return;
+
+        if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
+            cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
+                smt_possible = false;
+
+        cmd = spectre_v2_parse_user_cmdline(v2_cmd);
+        switch (cmd) {
+        case SPECTRE_V2_USER_CMD_NONE:
+                goto set_mode;
+        case SPECTRE_V2_USER_CMD_FORCE:
+                mode = SPECTRE_V2_USER_STRICT;
+                break;
+        case SPECTRE_V2_USER_CMD_PRCTL:
+        case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+                mode = SPECTRE_V2_USER_PRCTL;
+                break;
+        case SPECTRE_V2_USER_CMD_AUTO:
+        case SPECTRE_V2_USER_CMD_SECCOMP:
+        case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+                if (IS_ENABLED(CONFIG_SECCOMP))
+                        mode = SPECTRE_V2_USER_SECCOMP;
+                else
+                        mode = SPECTRE_V2_USER_PRCTL;
+                break;
+        }
+
+        /* Initialize Indirect Branch Prediction Barrier */
+        if (boot_cpu_has(X86_FEATURE_IBPB)) {
+                setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+
+                switch (cmd) {
+                case SPECTRE_V2_USER_CMD_FORCE:
+                case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+                case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+                        static_branch_enable(&switch_mm_always_ibpb);
+                        break;
+                case SPECTRE_V2_USER_CMD_PRCTL:
+                case SPECTRE_V2_USER_CMD_AUTO:
+                case SPECTRE_V2_USER_CMD_SECCOMP:
+                        static_branch_enable(&switch_mm_cond_ibpb);
+                        break;
+                default:
+                        break;
+                }
+
+                pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+                        static_key_enabled(&switch_mm_always_ibpb) ?
+                        "always-on" : "conditional");
+        }
+
+        /* If enhanced IBRS is enabled no STIPB required */
+        if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+                return;
+
+        /*
+         * If SMT is not possible or STIBP is not available clear the STIPB
+         * mode.
+         */
+        if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP))
+                mode = SPECTRE_V2_USER_NONE;
+set_mode:
+        spectre_v2_user = mode;
+        /* Only print the STIBP mode when SMT possible */
+        if (smt_possible)
+                pr_info("%s\n", spectre_v2_user_strings[mode]);
 }
 
+static const char * const spectre_v2_strings[] = {
+        [SPECTRE_V2_NONE]                       = "Vulnerable",
+        [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
+        [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
+        [SPECTRE_V2_IBRS_ENHANCED]              = "Mitigation: Enhanced IBRS",
+};
+
 static const struct {
         const char *option;
         enum spectre_v2_mitigation_cmd cmd;
         bool secure;
-} mitigation_options[] = {
-        { "off",               SPECTRE_V2_CMD_NONE,              false },
-        { "on",                SPECTRE_V2_CMD_FORCE,             true },
-        { "retpoline",         SPECTRE_V2_CMD_RETPOLINE,         false },
-        { "retpoline,amd",     SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
-        { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
-        { "auto",              SPECTRE_V2_CMD_AUTO,              false },
+} mitigation_options[] __initdata = {
+        { "off",                SPECTRE_V2_CMD_NONE,              false },
+        { "on",                 SPECTRE_V2_CMD_FORCE,             true  },
+        { "retpoline",          SPECTRE_V2_CMD_RETPOLINE,         false },
+        { "retpoline,amd",      SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
+        { "retpoline,generic",  SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
+        { "auto",               SPECTRE_V2_CMD_AUTO,              false },
 };
 
+static void __init spec_v2_print_cond(const char *reason, bool secure)
+{
+        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
+                pr_info("%s selected on command line.\n", reason);
+}
+
 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 {
+        enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
         char arg[20];
         int ret, i;
-        enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
 
         if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
                 return SPECTRE_V2_CMD_NONE;
-        else {
-                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
-                if (ret < 0)
-                        return SPECTRE_V2_CMD_AUTO;
 
-                for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
-                        if (!match_option(arg, ret, mitigation_options[i].option))
-                                continue;
-                        cmd = mitigation_options[i].cmd;
-                        break;
-                }
+        ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
+        if (ret < 0)
+                return SPECTRE_V2_CMD_AUTO;
 
-                if (i >= ARRAY_SIZE(mitigation_options)) {
-                        pr_err("unknown option (%s). Switching to AUTO select\n", arg);
-                        return SPECTRE_V2_CMD_AUTO;
-                }
+        for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
+                if (!match_option(arg, ret, mitigation_options[i].option))
+                        continue;
+                cmd = mitigation_options[i].cmd;
+                break;
+        }
+
+        if (i >= ARRAY_SIZE(mitigation_options)) {
+                pr_err("unknown option (%s). Switching to AUTO select\n", arg);
+                return SPECTRE_V2_CMD_AUTO;
         }
 
         if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
@@ -316,54 +462,11 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
                 return SPECTRE_V2_CMD_AUTO;
         }
 
-        if (mitigation_options[i].secure)
-                spec2_print_if_secure(mitigation_options[i].option);
-        else
-                spec2_print_if_insecure(mitigation_options[i].option);
-
+        spec_v2_print_cond(mitigation_options[i].option,
+                           mitigation_options[i].secure);
         return cmd;
 }
 
-static bool stibp_needed(void)
-{
-        if (spectre_v2_enabled == SPECTRE_V2_NONE)
-                return false;
-
-        if (!boot_cpu_has(X86_FEATURE_STIBP))
-                return false;
-
-        return true;
-}
-
-static void update_stibp_msr(void *info)
-{
-        wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
-}
-
-void arch_smt_update(void)
-{
-        u64 mask;
-
-        if (!stibp_needed())
-                return;
-
-        mutex_lock(&spec_ctrl_mutex);
-        mask = x86_spec_ctrl_base;
-        if (cpu_smt_control == CPU_SMT_ENABLED)
-                mask |= SPEC_CTRL_STIBP;
-        else
-                mask &= ~SPEC_CTRL_STIBP;
-
-        if (mask != x86_spec_ctrl_base) {
-                pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
-                                cpu_smt_control == CPU_SMT_ENABLED ?
-                                "Enabling" : "Disabling");
-                x86_spec_ctrl_base = mask;
-                on_each_cpu(update_stibp_msr, NULL, 1);
-        }
-        mutex_unlock(&spec_ctrl_mutex);
-}
-
 static void __init spectre_v2_select_mitigation(void)
 {
         enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -417,14 +520,12 @@ retpoline_auto:
                         pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
                         goto retpoline_generic;
                 }
-                mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
-                                         SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
+                mode = SPECTRE_V2_RETPOLINE_AMD;
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
         } else {
         retpoline_generic:
-                mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
-                                         SPECTRE_V2_RETPOLINE_MINIMAL;
+                mode = SPECTRE_V2_RETPOLINE_GENERIC;
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
         }
 
@@ -443,12 +544,6 @@ specv2_set_mode:
         setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
         pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
 
-        /* Initialize Indirect Branch Prediction Barrier if supported */
-        if (boot_cpu_has(X86_FEATURE_IBPB)) {
-                setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
-                pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
-        }
-
         /*
          * Retpoline means the kernel is safe because it has no indirect
          * branches. Enhanced IBRS protects firmware too, so, enable restricted
@@ -465,10 +560,67 @@ specv2_set_mode:
                 pr_info("Enabling Restricted Speculation for firmware calls\n");
         }
 
+        /* Set up IBPB and STIBP depending on the general spectre V2 command */
+        spectre_v2_user_select_mitigation(cmd);
+
         /* Enable STIBP if appropriate */
         arch_smt_update();
 }
 
+static void update_stibp_msr(void * __unused)
+{
+        wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+}
+
+/* Update x86_spec_ctrl_base in case SMT state changed. */
+static void update_stibp_strict(void)
+{
+        u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
+
+        if (sched_smt_active())
+                mask |= SPEC_CTRL_STIBP;
+
+        if (mask == x86_spec_ctrl_base)
+                return;
+
+        pr_info("Update user space SMT mitigation: STIBP %s\n",
+                mask & SPEC_CTRL_STIBP ? "always-on" : "off");
+        x86_spec_ctrl_base = mask;
+        on_each_cpu(update_stibp_msr, NULL, 1);
+}
+
+/* Update the static key controlling the evaluation of TIF_SPEC_IB */
+static void update_indir_branch_cond(void)
+{
+        if (sched_smt_active())
+                static_branch_enable(&switch_to_cond_stibp);
+        else
+                static_branch_disable(&switch_to_cond_stibp);
+}
+
+void arch_smt_update(void)
+{
+        /* Enhanced IBRS implies STIBP. No update required. */
+        if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+                return;
+
+        mutex_lock(&spec_ctrl_mutex);
+
+        switch (spectre_v2_user) {
+        case SPECTRE_V2_USER_NONE:
+                break;
+        case SPECTRE_V2_USER_STRICT:
+                update_stibp_strict();
+                break;
+        case SPECTRE_V2_USER_PRCTL:
+        case SPECTRE_V2_USER_SECCOMP:
+                update_indir_branch_cond();
+                break;
+        }
+
+        mutex_unlock(&spec_ctrl_mutex);
+}
+
 #undef pr_fmt
 #define pr_fmt(fmt)     "Speculative Store Bypass: " fmt
 
@@ -483,7 +635,7 @@ enum ssb_mitigation_cmd {
         SPEC_STORE_BYPASS_CMD_SECCOMP,
 };
 
-static const char *ssb_strings[] = {
+static const char * const ssb_strings[] = {
         [SPEC_STORE_BYPASS_NONE]        = "Vulnerable",
         [SPEC_STORE_BYPASS_DISABLE]     = "Mitigation: Speculative Store Bypass disabled",
         [SPEC_STORE_BYPASS_PRCTL]       = "Mitigation: Speculative Store Bypass disabled via prctl",
@@ -493,7 +645,7 @@ static const char *ssb_strings[] = {
 static const struct {
         const char *option;
         enum ssb_mitigation_cmd cmd;
-} ssb_mitigation_options[] = {
+} ssb_mitigation_options[]  __initdata = {
         { "auto",       SPEC_STORE_BYPASS_CMD_AUTO },    /* Platform decides */
         { "on",         SPEC_STORE_BYPASS_CMD_ON },      /* Disable Speculative Store Bypass */
         { "off",        SPEC_STORE_BYPASS_CMD_NONE },    /* Don't touch Speculative Store Bypass */
@@ -604,10 +756,25 @@ static void ssb_select_mitigation(void)
 #undef pr_fmt
 #define pr_fmt(fmt)     "Speculation prctl: " fmt
 
-static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+static void task_update_spec_tif(struct task_struct *tsk)
 {
-        bool update;
+        /* Force the update of the real TIF bits */
+        set_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE);
 
+        /*
+         * Immediately update the speculation control MSRs for the current
+         * task, but for a non-current task delay setting the CPU
+         * mitigation until it is scheduled next.
+         *
+         * This can only happen for SECCOMP mitigation. For PRCTL it's
+         * always the current task.
+         */
+        if (tsk == current)
+                speculation_ctrl_update_current();
+}
+
+static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+{
         if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
             ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
                 return -ENXIO;
@@ -618,28 +785,56 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
                 if (task_spec_ssb_force_disable(task))
                         return -EPERM;
                 task_clear_spec_ssb_disable(task);
-                update = test_and_clear_tsk_thread_flag(task, TIF_SSBD);
+                task_update_spec_tif(task);
                 break;
         case PR_SPEC_DISABLE:
                 task_set_spec_ssb_disable(task);
-                update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
+                task_update_spec_tif(task);
                 break;
         case PR_SPEC_FORCE_DISABLE:
                 task_set_spec_ssb_disable(task);
                 task_set_spec_ssb_force_disable(task);
-                update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
+                task_update_spec_tif(task);
                 break;
         default:
                 return -ERANGE;
         }
+        return 0;
+}
 
-        /*
-         * If being set on non-current task, delay setting the CPU
-         * mitigation until it is next scheduled.
-         */
-        if (task == current && update)
-                speculative_store_bypass_update_current();
-
+static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+{
+        switch (ctrl) {
+        case PR_SPEC_ENABLE:
+                if (spectre_v2_user == SPECTRE_V2_USER_NONE)
+                        return 0;
+                /*
+                 * Indirect branch speculation is always disabled in strict
+                 * mode.
+                 */
+                if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
+                        return -EPERM;
+                task_clear_spec_ib_disable(task);
+                task_update_spec_tif(task);
+                break;
+        case PR_SPEC_DISABLE:
+        case PR_SPEC_FORCE_DISABLE:
+                /*
+                 * Indirect branch speculation is always allowed when
+                 * mitigation is force disabled.
+                 */
+                if (spectre_v2_user == SPECTRE_V2_USER_NONE)
+                        return -EPERM;
+                if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
+                        return 0;
+                task_set_spec_ib_disable(task);
+                if (ctrl == PR_SPEC_FORCE_DISABLE)
+                        task_set_spec_ib_force_disable(task);
+                task_update_spec_tif(task);
+                break;
+        default:
+                return -ERANGE;
+        }
         return 0;
 }
 
@@ -649,6 +844,8 @@ int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
         switch (which) {
         case PR_SPEC_STORE_BYPASS:
                 return ssb_prctl_set(task, ctrl);
+        case PR_SPEC_INDIRECT_BRANCH:
+                return ib_prctl_set(task, ctrl);
         default:
                 return -ENODEV;
         }
@@ -659,6 +856,8 @@ void arch_seccomp_spec_mitigate(struct task_struct *task)
 {
         if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
                 ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+        if (spectre_v2_user == SPECTRE_V2_USER_SECCOMP)
+                ib_prctl_set(task, PR_SPEC_FORCE_DISABLE);
 }
 #endif
 
@@ -681,11 +880,35 @@ static int ssb_prctl_get(struct task_struct *task)
         }
 }
 
+static int ib_prctl_get(struct task_struct *task)
+{
+        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+                return PR_SPEC_NOT_AFFECTED;
+
+        switch (spectre_v2_user) {
+        case SPECTRE_V2_USER_NONE:
+                return PR_SPEC_ENABLE;
+        case SPECTRE_V2_USER_PRCTL:
+        case SPECTRE_V2_USER_SECCOMP:
+                if (task_spec_ib_force_disable(task))
+                        return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
+                if (task_spec_ib_disable(task))
+                        return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
+                return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
+        case SPECTRE_V2_USER_STRICT:
+                return PR_SPEC_DISABLE;
+        default:
+                return PR_SPEC_NOT_AFFECTED;
+        }
+}
+
 int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
 {
         switch (which) {
         case PR_SPEC_STORE_BYPASS:
                 return ssb_prctl_get(task);
+        case PR_SPEC_INDIRECT_BRANCH:
+                return ib_prctl_get(task);
         default:
                 return -ENODEV;
         }
@@ -823,7 +1046,7 @@ early_param("l1tf", l1tf_cmdline);
 #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
 
 #if IS_ENABLED(CONFIG_KVM_INTEL)
-static const char *l1tf_vmx_states[] = {
+static const char * const l1tf_vmx_states[] = {
         [VMENTER_L1D_FLUSH_AUTO]                = "auto",
         [VMENTER_L1D_FLUSH_NEVER]               = "vulnerable",
         [VMENTER_L1D_FLUSH_COND]                = "conditional cache flushes",
@@ -839,13 +1062,14 @@ static ssize_t l1tf_show_state(char *buf)
 
         if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
             (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
-             cpu_smt_control == CPU_SMT_ENABLED))
+             sched_smt_active())) {
                 return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
                                l1tf_vmx_states[l1tf_vmx_mitigation]);
+        }
 
         return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
                        l1tf_vmx_states[l1tf_vmx_mitigation],
-                       cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled");
+                       sched_smt_active() ? "vulnerable" : "disabled");
 }
 #else
 static ssize_t l1tf_show_state(char *buf)
@@ -854,11 +1078,39 @@ static ssize_t l1tf_show_state(char *buf)
 }
 #endif
 
+static char *stibp_state(void)
+{
+        if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+                return "";
+
+        switch (spectre_v2_user) {
+        case SPECTRE_V2_USER_NONE:
+                return ", STIBP: disabled";
+        case SPECTRE_V2_USER_STRICT:
+                return ", STIBP: forced";
+        case SPECTRE_V2_USER_PRCTL:
+        case SPECTRE_V2_USER_SECCOMP:
+                if (static_key_enabled(&switch_to_cond_stibp))
+                        return ", STIBP: conditional";
+        }
+        return "";
+}
+
+static char *ibpb_state(void)
+{
+        if (boot_cpu_has(X86_FEATURE_IBPB)) {
+                if (static_key_enabled(&switch_mm_always_ibpb))
+                        return ", IBPB: always-on";
+                if (static_key_enabled(&switch_mm_cond_ibpb))
+                        return ", IBPB: conditional";
+                return ", IBPB: disabled";
+        }
+        return "";
+}
+
 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
                                char *buf, unsigned int bug)
 {
-        int ret;
-
         if (!boot_cpu_has_bug(bug))
                 return sprintf(buf, "Not affected\n");
 
@@ -876,13 +1128,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
                 return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 
         case X86_BUG_SPECTRE_V2:
-                ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
-                               boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+                return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+                               ibpb_state(),
                                boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
-                               (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+                               stibp_state(),
                                boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
                                spectre_v2_module_string());
-                return ret;
 
         case X86_BUG_SPEC_STORE_BYPASS:
                 return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 8c66d2fc8f81..36d2696c9563 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -485,7 +485,7 @@ static void mce_report_event(struct pt_regs *regs)
  * be somewhat complicated (e.g. segment offset would require an instruction
  * parser). So only support physical addresses up to page granuality for now.
  */
-static int mce_usable_address(struct mce *m)
+int mce_usable_address(struct mce *m)
 {
         if (!(m->status & MCI_STATUS_ADDRV))
                 return 0;
@@ -505,6 +505,7 @@ static int mce_usable_address(struct mce *m)
 
         return 1;
 }
+EXPORT_SYMBOL_GPL(mce_usable_address);
 
 bool mce_is_memory_error(struct mce *m)
 {
@@ -534,7 +535,7 @@ bool mce_is_memory_error(struct mce *m)
 }
 EXPORT_SYMBOL_GPL(mce_is_memory_error);
 
-static bool mce_is_correctable(struct mce *m)
+bool mce_is_correctable(struct mce *m)
 {
         if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
                 return false;
@@ -547,6 +548,7 @@ static bool mce_is_correctable(struct mce *m)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(mce_is_correctable);
 
 static bool cec_add_mce(struct mce *m)
 {
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index dd33c357548f..e12454e21b8a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -56,7 +56,7 @@
 /* Threshold LVT offset is at MSR0xC0000410[15:12] */
 #define SMCA_THR_LVT_OFF        0xF000
 
-static bool thresholding_en;
+static bool thresholding_irq_en;
 
 static const char * const th_names[] = {
         "load_store",
@@ -534,9 +534,8 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr,
 
 set_offset:
         offset = setup_APIC_mce_threshold(offset, new);
-
-        if ((offset == new) && (mce_threshold_vector != amd_threshold_interrupt))
-                mce_threshold_vector = amd_threshold_interrupt;
+        if (offset == new)
+                thresholding_irq_en = true;
 
 done:
         mce_threshold_block_init(&b, offset);
@@ -1357,9 +1356,6 @@ int mce_threshold_remove_device(unsigned int cpu)
 {
         unsigned int bank;
 
-        if (!thresholding_en)
-                return 0;
-
         for (bank = 0; bank < mca_cfg.banks; ++bank) {
                 if (!(per_cpu(bank_map, cpu) & (1 << bank)))
                         continue;
@@ -1377,9 +1373,6 @@ int mce_threshold_create_device(unsigned int cpu)
         struct threshold_bank **bp;
         int err = 0;
 
-        if (!thresholding_en)
-                return 0;
-
         bp = per_cpu(threshold_banks, cpu);
         if (bp)
                 return 0;
@@ -1408,9 +1401,6 @@ static __init int threshold_init_device(void)
 {
         unsigned lcpu = 0;
 
-        if (mce_threshold_vector == amd_threshold_interrupt)
-                thresholding_en = true;
-
         /* to hit CPUs online before the notifier is up */
         for_each_online_cpu(lcpu) {
                 int err = mce_threshold_create_device(lcpu);
@@ -1419,6 +1409,9 @@ static __init int threshold_init_device(void)
                         return err;
         }
 
+        if (thresholding_irq_en)
+                mce_threshold_vector = amd_threshold_interrupt;
+
         return 0;
 }
 /*
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index 1c72f3819eb1..e81a2db42df7 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -20,6 +20,7 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/kexec.h>
+#include <linux/i8253.h>
 #include <asm/processor.h>
 #include <asm/hypervisor.h>
 #include <asm/hyperv-tlfs.h>
@@ -295,6 +296,16 @@ static void __init ms_hyperv_init_platform(void)
         if (efi_enabled(EFI_BOOT))
                 x86_platform.get_nmi_reason = hv_get_nmi_reason;
 
+        /*
+         * Hyper-V VMs have a PIT emulation quirk such that zeroing the
+         * counter register during PIT shutdown restarts the PIT. So it
+         * continues to interrupt @18.2 HZ. Setting i8253_clear_counter
+         * to false tells pit_shutdown() not to zero the counter so that
+         * the PIT really is shutdown. Generation 2 VMs don't have a PIT,
+         * and setting this value has no effect.
+         */
+        i8253_clear_counter_on_shutdown = false;
+
 #if IS_ENABLED(CONFIG_HYPERV)
         /*
          * Setup the hook to get control post apic initialization.
diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
index d9ab49bed8af..0eda91f8eeac 100644
--- a/arch/x86/kernel/cpu/vmware.c
+++ b/arch/x86/kernel/cpu/vmware.c
@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock(char *s)
 }
 early_param("no-vmw-sched-clock", setup_vmw_sched_clock);
 
-static unsigned long long vmware_sched_clock(void)
+static unsigned long long notrace vmware_sched_clock(void)
 {
         unsigned long long ns;
 
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 61a949d84dfa..d99a8ee9e185 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -344,10 +344,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
                         sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
                 }
 
+                local_bh_disable();
                 fpu->initialized = 1;
-                preempt_disable();
                 fpu__restore(fpu);
-                preempt_enable();
+                local_bh_enable();
 
                 return err;
         } else {
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 01ebcb6f263e..7ee8067cbf45 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -994,7 +994,6 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
 {
         unsigned long old;
         int faulted;
-        struct ftrace_graph_ent trace;
         unsigned long return_hooker = (unsigned long)
                                 &return_to_handler;
 
@@ -1046,19 +1045,7 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
                 return;
         }
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
+        if (function_graph_enter(old, self_addr, frame_pointer, parent))
                 *parent = old;
-                return;
-        }
-
-        if (ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                     frame_pointer, parent) == -EBUSY) {
-                *parent = old;
-                return;
-        }
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index 76fa3b836598..ec6fefbfd3c0 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -37,7 +37,6 @@ asmlinkage __visible void __init i386_start_kernel(void)
         cr4_init_shadow();
 
         sanitize_boot_params(&boot_params);
-        x86_verify_bootdata_version();
 
         x86_early_init_platform_quirks();
 
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 7663a8eb602b..16b1cbd3a61e 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -457,8 +457,6 @@ void __init x86_64_start_reservations(char *real_mode_data)
         if (!boot_params.hdr.version)
                 copy_bootdata(__va(real_mode_data));
 
-        x86_verify_bootdata_version();
-
         x86_early_init_platform_quirks();
 
         switch (boot_params.hdr.hardware_subarch) {
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ab18e0884dc6..6135ae8ce036 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm)
 /*
  * If PTI is enabled, this maps the LDT into the kernelmode and
  * usermode tables for the given mm.
- *
- * There is no corresponding unmap function.  Even if the LDT is freed, we
- * leave the PTEs around until the slot is reused or the mm is destroyed.
- * This is harmless: the LDT is always in ordinary memory, and no one will
- * access the freed slot.
- *
- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
- * it useful, and the flush would slow down modify_ldt().
  */
 static int
 map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
@@ -214,8 +206,7 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
         unsigned long va;
         bool is_vmalloc;
         spinlock_t *ptl;
-        pgd_t *pgd;
-        int i;
+        int i, nr_pages;
 
         if (!static_cpu_has(X86_FEATURE_PTI))
                 return 0;
@@ -229,16 +220,11 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
         /* Check if the current mappings are sane */
         sanity_check_ldt_mapping(mm);
 
-        /*
-         * Did we already have the top level entry allocated?  We can't
-         * use pgd_none() for this because it doens't do anything on
-         * 4-level page table kernels.
-         */
-        pgd = pgd_offset(mm, LDT_BASE_ADDR);
-
         is_vmalloc = is_vmalloc_addr(ldt->entries);
 
-        for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
+        nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+        for (i = 0; i < nr_pages; i++) {
                 unsigned long offset = i << PAGE_SHIFT;
                 const void *src = (char *)ldt->entries + offset;
                 unsigned long pfn;
@@ -272,13 +258,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
         /* Propagate LDT mapping to the user page-table */
         map_ldt_struct_to_user(mm);
 
-        va = (unsigned long)ldt_slot_va(slot);
-        flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, PAGE_SHIFT, false);
-
         ldt->slot = slot;
         return 0;
 }
 
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+        unsigned long va;
+        int i, nr_pages;
+
+        if (!ldt)
+                return;
+
+        /* LDT map/unmap is only required for PTI */
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+        for (i = 0; i < nr_pages; i++) {
+                unsigned long offset = i << PAGE_SHIFT;
+                spinlock_t *ptl;
+                pte_t *ptep;
+
+                va = (unsigned long)ldt_slot_va(ldt->slot) + offset;
+                ptep = get_locked_pte(mm, va, &ptl);
+                pte_clear(mm, va, ptep);
+                pte_unmap_unlock(ptep, ptl);
+        }
+
+        va = (unsigned long)ldt_slot_va(ldt->slot);
+        flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, PAGE_SHIFT, false);
+}
+
 #else /* !CONFIG_PAGE_TABLE_ISOLATION */
 
 static int
@@ -286,6 +298,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
 {
         return 0;
 }
+
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+}
 #endif /* CONFIG_PAGE_TABLE_ISOLATION */
 
 static void free_ldt_pgtables(struct mm_struct *mm)
@@ -524,6 +540,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
         }
 
         install_ldt(mm, new_ldt);
+        unmap_ldt_struct(mm, old_ldt);
         free_ldt_struct(old_ldt);
         error = 0;
 
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index c93fcfdf1673..7d31192296a8 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -40,6 +40,8 @@
 #include <asm/prctl.h>
 #include <asm/spec-ctrl.h>
 
+#include "process.h"
+
 /*
  * per-CPU TSS segments. Threads are completely 'soft' on Linux,
  * no more per-task TSS's. The TSS size is kept cacheline-aligned
@@ -252,11 +254,12 @@ void arch_setup_new_exec(void)
                 enable_cpuid();
 }
 
-static inline void switch_to_bitmap(struct tss_struct *tss,
-                                    struct thread_struct *prev,
+static inline void switch_to_bitmap(struct thread_struct *prev,
                                     struct thread_struct *next,
                                     unsigned long tifp, unsigned long tifn)
 {
+        struct tss_struct *tss = this_cpu_ptr(&cpu_tss_rw);
+
         if (tifn & _TIF_IO_BITMAP) {
                 /*
                  * Copy the relevant range of the IO bitmap.
@@ -395,32 +398,85 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
         wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn));
 }
 
-static __always_inline void intel_set_ssb_state(unsigned long tifn)
+/*
+ * Update the MSRs managing speculation control, during context switch.
+ *
+ * tifp: Previous task's thread flags
+ * tifn: Next task's thread flags
+ */
+static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+                                                      unsigned long tifn)
 {
-        u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+        unsigned long tif_diff = tifp ^ tifn;
+        u64 msr = x86_spec_ctrl_base;
+        bool updmsr = false;
+
+        /*
+         * If TIF_SSBD is different, select the proper mitigation
+         * method. Note that if SSBD mitigation is disabled or permanentely
+         * enabled this branch can't be taken because nothing can set
+         * TIF_SSBD.
+         */
+        if (tif_diff & _TIF_SSBD) {
+                if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
+                        amd_set_ssb_virt_state(tifn);
+                } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
+                        amd_set_core_ssb_state(tifn);
+                } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
+                           static_cpu_has(X86_FEATURE_AMD_SSBD)) {
+                        msr |= ssbd_tif_to_spec_ctrl(tifn);
+                        updmsr  = true;
+                }
+        }
+
+        /*
+         * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled,
+         * otherwise avoid the MSR write.
+         */
+        if (IS_ENABLED(CONFIG_SMP) &&
+            static_branch_unlikely(&switch_to_cond_stibp)) {
+                updmsr |= !!(tif_diff & _TIF_SPEC_IB);
+                msr |= stibp_tif_to_spec_ctrl(tifn);
+        }
 
-        wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+        if (updmsr)
+                wrmsrl(MSR_IA32_SPEC_CTRL, msr);
 }
 
-static __always_inline void __speculative_store_bypass_update(unsigned long tifn)
+static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
 {
-        if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
-                amd_set_ssb_virt_state(tifn);
-        else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
-                amd_set_core_ssb_state(tifn);
-        else
-                intel_set_ssb_state(tifn);
+        if (test_and_clear_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE)) {
+                if (task_spec_ssb_disable(tsk))
+                        set_tsk_thread_flag(tsk, TIF_SSBD);
+                else
+                        clear_tsk_thread_flag(tsk, TIF_SSBD);
+
+                if (task_spec_ib_disable(tsk))
+                        set_tsk_thread_flag(tsk, TIF_SPEC_IB);
+                else
+                        clear_tsk_thread_flag(tsk, TIF_SPEC_IB);
+        }
+        /* Return the updated threadinfo flags*/
+        return task_thread_info(tsk)->flags;
 }
 
-void speculative_store_bypass_update(unsigned long tif)
+void speculation_ctrl_update(unsigned long tif)
 {
+        /* Forced update. Make sure all relevant TIF flags are different */
         preempt_disable();
-        __speculative_store_bypass_update(tif);
+        __speculation_ctrl_update(~tif, tif);
         preempt_enable();
 }
 
-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
-                      struct tss_struct *tss)
+/* Called from seccomp/prctl update */
+void speculation_ctrl_update_current(void)
+{
+        preempt_disable();
+        speculation_ctrl_update(speculation_ctrl_update_tif(current));
+        preempt_enable();
+}
+
+void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
 {
         struct thread_struct *prev, *next;
         unsigned long tifp, tifn;
@@ -430,7 +486,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
 
         tifn = READ_ONCE(task_thread_info(next_p)->flags);
         tifp = READ_ONCE(task_thread_info(prev_p)->flags);
-        switch_to_bitmap(tss, prev, next, tifp, tifn);
+        switch_to_bitmap(prev, next, tifp, tifn);
 
         propagate_user_return_notify(prev_p, next_p);
 
@@ -451,8 +507,15 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
         if ((tifp ^ tifn) & _TIF_NOCPUID)
                 set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
 
-        if ((tifp ^ tifn) & _TIF_SSBD)
-                __speculative_store_bypass_update(tifn);
+        if (likely(!((tifp | tifn) & _TIF_SPEC_FORCE_UPDATE))) {
+                __speculation_ctrl_update(tifp, tifn);
+        } else {
+                speculation_ctrl_update_tif(prev_p);
+                tifn = speculation_ctrl_update_tif(next_p);
+
+                /* Enforce MSR update to ensure consistent state */
+                __speculation_ctrl_update(~tifn, tifn);
+        }
 }
 
 /*
diff --git a/arch/x86/kernel/process.h b/arch/x86/kernel/process.h
new file mode 100644
index 000000000000..898e97cf6629
--- /dev/null
+++ b/arch/x86/kernel/process.h
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0
+//
+// Code shared between 32 and 64 bit
+
+#include <asm/spec-ctrl.h>
+
+void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p);
+
+/*
+ * This needs to be inline to optimize for the common case where no extra
+ * work needs to be done.
+ */
+static inline void switch_to_extra(struct task_struct *prev,
+                                   struct task_struct *next)
+{
+        unsigned long next_tif = task_thread_info(next)->flags;
+        unsigned long prev_tif = task_thread_info(prev)->flags;
+
+        if (IS_ENABLED(CONFIG_SMP)) {
+                /*
+                 * Avoid __switch_to_xtra() invocation when conditional
+                 * STIPB is disabled and the only different bit is
+                 * TIF_SPEC_IB. For CONFIG_SMP=n TIF_SPEC_IB is not
+                 * in the TIF_WORK_CTXSW masks.
+                 */
+                if (!static_branch_likely(&switch_to_cond_stibp)) {
+                        prev_tif &= ~_TIF_SPEC_IB;
+                        next_tif &= ~_TIF_SPEC_IB;
+                }
+        }
+
+        /*
+         * __switch_to_xtra() handles debug registers, i/o bitmaps,
+         * speculation mitigations etc.
+         */
+        if (unlikely(next_tif & _TIF_WORK_CTXSW_NEXT ||
+                     prev_tif & _TIF_WORK_CTXSW_PREV))
+                __switch_to_xtra(prev, next);
+}
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 5046a3c9dec2..d3e593eb189f 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -59,6 +59,8 @@
 #include <asm/intel_rdt_sched.h>
 #include <asm/proto.h>
 
+#include "process.h"
+
 void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
         unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
@@ -232,7 +234,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         struct fpu *prev_fpu = &prev->fpu;
         struct fpu *next_fpu = &next->fpu;
         int cpu = smp_processor_id();
-        struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
 
         /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
 
@@ -264,12 +265,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         if (get_kernel_rpl() && unlikely(prev->iopl != next->iopl))
                 set_iopl_mask(next->iopl);
 
-        /*
-         * Now maybe handle debug registers and/or IO bitmaps
-         */
-        if (unlikely(task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV ||
-                     task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT))
-                __switch_to_xtra(prev_p, next_p, tss);
+        switch_to_extra(prev_p, next_p);
 
         /*
          * Leave lazy mode, flushing any hypercalls made here.
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 0e0b4288a4b2..bbfbf017065c 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -60,6 +60,8 @@
 #include <asm/unistd_32_ia32.h>
 #endif
 
+#include "process.h"
+
 /* Prints also some state that isn't saved in the pt_regs */
 void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
@@ -553,7 +555,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         struct fpu *prev_fpu = &prev->fpu;
         struct fpu *next_fpu = &next->fpu;
         int cpu = smp_processor_id();
-        struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
 
         WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
                      this_cpu_read(irq_count) != -1);
@@ -617,12 +618,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         /* Reload sp0. */
         update_task_stack(next_p);
 
-        /*
-         * Now maybe reload the debug registers and handle I/O bitmaps
-         */
-        if (unlikely(task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT ||
-                     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
-                __switch_to_xtra(prev_p, next_p, tss);
+        switch_to_extra(prev_p, next_p);
 
 #ifdef CONFIG_XEN_PV
         /*
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index b74e7bfed6ab..d494b9bfe618 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1280,23 +1280,6 @@ void __init setup_arch(char **cmdline_p)
         unwind_init();
 }
 
-/*
- * From boot protocol 2.14 onwards we expect the bootloader to set the
- * version to "0x8000 | <used version>". In case we find a version >= 2.14
- * without the 0x8000 we assume the boot loader supports 2.13 only and
- * reset the version accordingly. The 0x8000 flag is removed in any case.
- */
-void __init x86_verify_bootdata_version(void)
-{
-        if (boot_params.hdr.version & VERSION_WRITTEN)
-                boot_params.hdr.version &= ~VERSION_WRITTEN;
-        else if (boot_params.hdr.version >= 0x020e)
-                boot_params.hdr.version = 0x020d;
-
-        if (boot_params.hdr.version < 0x020e)
-                boot_params.hdr.acpi_rsdp_addr = 0;
-}
-
 #ifdef CONFIG_X86_32
 
 static struct resource video_ram_resource = {
diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
index 1eae5af491c2..891a75dbc131 100644
--- a/arch/x86/kernel/vsmp_64.c
+++ b/arch/x86/kernel/vsmp_64.c
@@ -26,65 +26,8 @@
 
 #define TOPOLOGY_REGISTER_OFFSET 0x10
 
-#if defined CONFIG_PCI && defined CONFIG_PARAVIRT_XXL
-/*
- * Interrupt control on vSMPowered systems:
- * ~AC is a shadow of IF.  If IF is 'on' AC should be 'off'
- * and vice versa.
- */
-
-asmlinkage __visible unsigned long vsmp_save_fl(void)
-{
-        unsigned long flags = native_save_fl();
-
-        if (!(flags & X86_EFLAGS_IF) || (flags & X86_EFLAGS_AC))
-                flags &= ~X86_EFLAGS_IF;
-        return flags;
-}
-PV_CALLEE_SAVE_REGS_THUNK(vsmp_save_fl);
-
-__visible void vsmp_restore_fl(unsigned long flags)
-{
-        if (flags & X86_EFLAGS_IF)
-                flags &= ~X86_EFLAGS_AC;
-        else
-                flags |= X86_EFLAGS_AC;
-        native_restore_fl(flags);
-}
-PV_CALLEE_SAVE_REGS_THUNK(vsmp_restore_fl);
-
-asmlinkage __visible void vsmp_irq_disable(void)
-{
-        unsigned long flags = native_save_fl();
-
-        native_restore_fl((flags & ~X86_EFLAGS_IF) | X86_EFLAGS_AC);
-}
-PV_CALLEE_SAVE_REGS_THUNK(vsmp_irq_disable);
-
-asmlinkage __visible void vsmp_irq_enable(void)
-{
-        unsigned long flags = native_save_fl();
-
-        native_restore_fl((flags | X86_EFLAGS_IF) & (~X86_EFLAGS_AC));
-}
-PV_CALLEE_SAVE_REGS_THUNK(vsmp_irq_enable);
-
-static unsigned __init vsmp_patch(u8 type, void *ibuf,
-                                  unsigned long addr, unsigned len)
-{
-        switch (type) {
-        case PARAVIRT_PATCH(irq.irq_enable):
-        case PARAVIRT_PATCH(irq.irq_disable):
-        case PARAVIRT_PATCH(irq.save_fl):
-        case PARAVIRT_PATCH(irq.restore_fl):
-                return paravirt_patch_default(type, ibuf, addr, len);
-        default:
-                return native_patch(type, ibuf, addr, len);
-        }
-
-}
-
-static void __init set_vsmp_pv_ops(void)
+#ifdef CONFIG_PCI
+static void __init set_vsmp_ctl(void)
 {
         void __iomem *address;
         unsigned int cap, ctl, cfg;
@@ -109,28 +52,12 @@ static void __init set_vsmp_pv_ops(void)
         }
 #endif
 
-        if (cap & ctl & (1 << 4)) {
-                /* Setup irq ops and turn on vSMP  IRQ fastpath handling */
-                pv_ops.irq.irq_disable = PV_CALLEE_SAVE(vsmp_irq_disable);
-                pv_ops.irq.irq_enable = PV_CALLEE_SAVE(vsmp_irq_enable);
-                pv_ops.irq.save_fl = PV_CALLEE_SAVE(vsmp_save_fl);
-                pv_ops.irq.restore_fl = PV_CALLEE_SAVE(vsmp_restore_fl);
-                pv_ops.init.patch = vsmp_patch;
-                ctl &= ~(1 << 4);
-        }
         writel(ctl, address + 4);
         ctl = readl(address + 4);
         pr_info("vSMP CTL: control set to:0x%08x\n", ctl);
 
         early_iounmap(address, 8);
 }
-#else
-static void __init set_vsmp_pv_ops(void)
-{
-}
-#endif
-
-#ifdef CONFIG_PCI
 static int is_vsmp = -1;
 
 static void __init detect_vsmp_box(void)
@@ -164,11 +91,14 @@ static int is_vsmp_box(void)
 {
         return 0;
 }
+static void __init set_vsmp_ctl(void)
+{
+}
 #endif
 
 static void __init vsmp_cap_cpus(void)
 {
-#if !defined(CONFIG_X86_VSMP) && defined(CONFIG_SMP)
+#if !defined(CONFIG_X86_VSMP) && defined(CONFIG_SMP) && defined(CONFIG_PCI)
         void __iomem *address;
         unsigned int cfg, topology, node_shift, maxcpus;
 
@@ -221,6 +151,6 @@ void __init vsmp_init(void)
 
         vsmp_cap_cpus();
 
-        set_vsmp_pv_ops();
+        set_vsmp_ctl();
         return;
 }
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 89db20f8cb70..c4533d05c214 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -55,7 +55,7 @@
 #define PRIo64 "o"
 
 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
-#define apic_debug(fmt, arg...)
+#define apic_debug(fmt, arg...) do {} while (0)
 
 /* 14 is the version for Xeon and Pentium 8.4.8*/
 #define APIC_VERSION                    (0x14UL | ((KVM_APIC_LVT_NUM - 1) << 16))
@@ -576,6 +576,11 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
         rcu_read_lock();
         map = rcu_dereference(kvm->arch.apic_map);
 
+        if (unlikely(!map)) {
+                count = -EOPNOTSUPP;
+                goto out;
+        }
+
         if (min > map->max_apic_id)
                 goto out;
         /* Bits above cluster_size are masked in the caller.  */
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index cf5f572f2305..7c03c0f35444 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -5074,9 +5074,9 @@ static bool need_remote_flush(u64 old, u64 new)
 }
 
 static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
-                                    const u8 *new, int *bytes)
+                                    int *bytes)
 {
-        u64 gentry;
+        u64 gentry = 0;
         int r;
 
         /*
@@ -5088,22 +5088,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
                 /* Handle a 32-bit guest writing two halves of a 64-bit gpte */
                 *gpa &= ~(gpa_t)7;
                 *bytes = 8;
-                r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);
-                if (r)
-                        gentry = 0;
-                new = (const u8 *)&gentry;
         }
 
-        switch (*bytes) {
-        case 4:
-                gentry = *(const u32 *)new;
-                break;
-        case 8:
-                gentry = *(const u64 *)new;
-                break;
-        default:
-                gentry = 0;
-                break;
+        if (*bytes == 4 || *bytes == 8) {
+                r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes);
+                if (r)
+                        gentry = 0;
         }
 
         return gentry;
@@ -5207,8 +5197,6 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
 
         pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
 
-        gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);
-
         /*
          * No need to care whether allocation memory is successful
          * or not since pte prefetch is skiped if it does not have
@@ -5217,6 +5205,9 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
         mmu_topup_memory_caches(vcpu);
 
         spin_lock(&vcpu->kvm->mmu_lock);
+
+        gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes);
+
         ++vcpu->kvm->stat.mmu_pte_write;
         kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 0e21ccc46792..cc6467b35a85 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1446,7 +1446,7 @@ static u64 svm_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
         return vcpu->arch.tsc_offset;
 }
 
-static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
         u64 g_tsc_offset = 0;
@@ -1464,6 +1464,7 @@ static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
         svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
 
         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
+        return svm->vmcb->control.tsc_offset;
 }
 
 static void avic_init_vmcb(struct vcpu_svm *svm)
@@ -1664,20 +1665,23 @@ static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu,
 static int avic_init_access_page(struct kvm_vcpu *vcpu)
 {
         struct kvm *kvm = vcpu->kvm;
-        int ret;
+        int ret = 0;
 
+        mutex_lock(&kvm->slots_lock);
         if (kvm->arch.apic_access_page_done)
-                return 0;
+                goto out;
 
-        ret = x86_set_memory_region(kvm,
-                                    APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
-                                    APIC_DEFAULT_PHYS_BASE,
-                                    PAGE_SIZE);
+        ret = __x86_set_memory_region(kvm,
+                                      APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
+                                      APIC_DEFAULT_PHYS_BASE,
+                                      PAGE_SIZE);
         if (ret)
-                return ret;
+                goto out;
 
         kvm->arch.apic_access_page_done = true;
-        return 0;
+out:
+        mutex_unlock(&kvm->slots_lock);
+        return ret;
 }
 
 static int avic_init_backing_page(struct kvm_vcpu *vcpu)
@@ -2189,21 +2193,31 @@ out:
         return ERR_PTR(err);
 }
 
+static void svm_clear_current_vmcb(struct vmcb *vmcb)
+{
+        int i;
+
+        for_each_online_cpu(i)
+                cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL);
+}
+
 static void svm_free_vcpu(struct kvm_vcpu *vcpu)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
+        /*
+         * The vmcb page can be recycled, causing a false negative in
+         * svm_vcpu_load(). So, ensure that no logical CPU has this
+         * vmcb page recorded as its current vmcb.
+         */
+        svm_clear_current_vmcb(svm->vmcb);
+
         __free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));
         __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
         __free_page(virt_to_page(svm->nested.hsave));
         __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
         kvm_vcpu_uninit(vcpu);
         kmem_cache_free(kvm_vcpu_cache, svm);
-        /*
-         * The vmcb page can be recycled, causing a false negative in
-         * svm_vcpu_load(). So do a full IBPB now.
-         */
-        indirect_branch_prediction_barrier();
 }
 
 static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
@@ -7149,7 +7163,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
         .has_wbinvd_exit = svm_has_wbinvd_exit,
 
         .read_l1_tsc_offset = svm_read_l1_tsc_offset,
-        .write_tsc_offset = svm_write_tsc_offset,
+        .write_l1_tsc_offset = svm_write_l1_tsc_offset,
 
         .set_tdp_cr3 = set_tdp_cr3,
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4555077d69ce..02edd9960e9d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -174,6 +174,7 @@ module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
  * refer SDM volume 3b section 21.6.13 & 22.1.3.
  */
 static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
+module_param(ple_gap, uint, 0444);
 
 static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
 module_param(ple_window, uint, 0444);
@@ -984,6 +985,7 @@ struct vcpu_vmx {
         struct shared_msr_entry *guest_msrs;
         int                   nmsrs;
         int                   save_nmsrs;
+        bool                  guest_msrs_dirty;
         unsigned long         host_idt_base;
 #ifdef CONFIG_X86_64
         u64                   msr_host_kernel_gs_base;
@@ -1306,7 +1308,7 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
 static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
                                             u16 error_code);
 static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu);
-static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
                                                           u32 msr, int type);
 
 static DEFINE_PER_CPU(struct vmcs *, vmxarea);
@@ -1610,12 +1612,6 @@ static int nested_enable_evmcs(struct kvm_vcpu *vcpu,
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
 
-        /* We don't support disabling the feature for simplicity. */
-        if (vmx->nested.enlightened_vmcs_enabled)
-                return 0;
-
-        vmx->nested.enlightened_vmcs_enabled = true;
-
         /*
          * vmcs_version represents the range of supported Enlightened VMCS
          * versions: lower 8 bits is the minimal version, higher 8 bits is the
@@ -1625,6 +1621,12 @@ static int nested_enable_evmcs(struct kvm_vcpu *vcpu,
         if (vmcs_version)
                 *vmcs_version = (KVM_EVMCS_VERSION << 8) | 1;
 
+        /* We don't support disabling the feature for simplicity. */
+        if (vmx->nested.enlightened_vmcs_enabled)
+                return 0;
+
+        vmx->nested.enlightened_vmcs_enabled = true;
+
         vmx->nested.msrs.pinbased_ctls_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
         vmx->nested.msrs.entry_ctls_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
         vmx->nested.msrs.exit_ctls_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
@@ -2897,6 +2899,20 @@ static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
 
         vmx->req_immediate_exit = false;
 
+        /*
+         * Note that guest MSRs to be saved/restored can also be changed
+         * when guest state is loaded. This happens when guest transitions
+         * to/from long-mode by setting MSR_EFER.LMA.
+         */
+        if (!vmx->loaded_cpu_state || vmx->guest_msrs_dirty) {
+                vmx->guest_msrs_dirty = false;
+                for (i = 0; i < vmx->save_nmsrs; ++i)
+                        kvm_set_shared_msr(vmx->guest_msrs[i].index,
+                                           vmx->guest_msrs[i].data,
+                                           vmx->guest_msrs[i].mask);
+
+        }
+
         if (vmx->loaded_cpu_state)
                 return;
 
@@ -2957,11 +2973,6 @@ static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
                 vmcs_writel(HOST_GS_BASE, gs_base);
                 host_state->gs_base = gs_base;
         }
-
-        for (i = 0; i < vmx->save_nmsrs; ++i)
-                kvm_set_shared_msr(vmx->guest_msrs[i].index,
-                                   vmx->guest_msrs[i].data,
-                                   vmx->guest_msrs[i].mask);
 }
 
 static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
@@ -3436,6 +3447,7 @@ static void setup_msrs(struct vcpu_vmx *vmx)
                 move_msr_up(vmx, index, save_nmsrs++);
 
         vmx->save_nmsrs = save_nmsrs;
+        vmx->guest_msrs_dirty = true;
 
         if (cpu_has_vmx_msr_bitmap())
                 vmx_update_msr_bitmap(&vmx->vcpu);
@@ -3452,11 +3464,9 @@ static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
         return vcpu->arch.tsc_offset;
 }
 
-/*
- * writes 'offset' into guest's timestamp counter offset register
- */
-static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
+        u64 active_offset = offset;
         if (is_guest_mode(vcpu)) {
                 /*
                  * We're here if L1 chose not to trap WRMSR to TSC. According
@@ -3464,17 +3474,16 @@ static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
                  * set for L2 remains unchanged, and still needs to be added
                  * to the newly set TSC to get L2's TSC.
                  */
-                struct vmcs12 *vmcs12;
-                /* recalculate vmcs02.TSC_OFFSET: */
-                vmcs12 = get_vmcs12(vcpu);
-                vmcs_write64(TSC_OFFSET, offset +
-                        (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING) ?
-                         vmcs12->tsc_offset : 0));
+                struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+                if (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING))
+                        active_offset += vmcs12->tsc_offset;
         } else {
                 trace_kvm_write_tsc_offset(vcpu->vcpu_id,
                                            vmcs_read64(TSC_OFFSET), offset);
-                vmcs_write64(TSC_OFFSET, offset);
         }
+
+        vmcs_write64(TSC_OFFSET, active_offset);
+        return active_offset;
 }
 
 /*
@@ -5944,7 +5953,7 @@ static void free_vpid(int vpid)
         spin_unlock(&vmx_vpid_lock);
 }
 
-static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
                                                           u32 msr, int type)
 {
         int f = sizeof(unsigned long);
@@ -5982,7 +5991,7 @@ static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bit
         }
 }
 
-static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
                                                          u32 msr, int type)
 {
         int f = sizeof(unsigned long);
@@ -6020,7 +6029,7 @@ static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitm
         }
 }
 
-static void __always_inline vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
                                                       u32 msr, int type, bool value)
 {
         if (value)
@@ -8664,8 +8673,6 @@ static int copy_enlightened_to_vmcs12(struct vcpu_vmx *vmx)
         struct vmcs12 *vmcs12 = vmx->nested.cached_vmcs12;
         struct hv_enlightened_vmcs *evmcs = vmx->nested.hv_evmcs;
 
-        vmcs12->hdr.revision_id = evmcs->revision_id;
-
         /* HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE */
         vmcs12->tpr_threshold = evmcs->tpr_threshold;
         vmcs12->guest_rip = evmcs->guest_rip;
@@ -9369,7 +9376,30 @@ static int nested_vmx_handle_enlightened_vmptrld(struct kvm_vcpu *vcpu,
 
                 vmx->nested.hv_evmcs = kmap(vmx->nested.hv_evmcs_page);
 
-                if (vmx->nested.hv_evmcs->revision_id != VMCS12_REVISION) {
+                /*
+                 * Currently, KVM only supports eVMCS version 1
+                 * (== KVM_EVMCS_VERSION) and thus we expect guest to set this
+                 * value to first u32 field of eVMCS which should specify eVMCS
+                 * VersionNumber.
+                 *
+                 * Guest should be aware of supported eVMCS versions by host by
+                 * examining CPUID.0x4000000A.EAX[0:15]. Host userspace VMM is
+                 * expected to set this CPUID leaf according to the value
+                 * returned in vmcs_version from nested_enable_evmcs().
+                 *
+                 * However, it turns out that Microsoft Hyper-V fails to comply
+                 * to their own invented interface: When Hyper-V use eVMCS, it
+                 * just sets first u32 field of eVMCS to revision_id specified
+                 * in MSR_IA32_VMX_BASIC. Instead of used eVMCS version number
+                 * which is one of the supported versions specified in
+                 * CPUID.0x4000000A.EAX[0:15].
+                 *
+                 * To overcome Hyper-V bug, we accept here either a supported
+                 * eVMCS version or VMCS12 revision_id as valid values for first
+                 * u32 field of eVMCS.
+                 */
+                if ((vmx->nested.hv_evmcs->revision_id != KVM_EVMCS_VERSION) &&
+                    (vmx->nested.hv_evmcs->revision_id != VMCS12_REVISION)) {
                         nested_release_evmcs(vcpu);
                         return 0;
                 }
@@ -9390,9 +9420,11 @@ static int nested_vmx_handle_enlightened_vmptrld(struct kvm_vcpu *vcpu,
                  * present in struct hv_enlightened_vmcs, ...). Make sure there
                  * are no leftovers.
                  */
-                if (from_launch)
-                        memset(vmx->nested.cached_vmcs12, 0,
-                               sizeof(*vmx->nested.cached_vmcs12));
+                if (from_launch) {
+                        struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+                        memset(vmcs12, 0, sizeof(*vmcs12));
+                        vmcs12->hdr.revision_id = VMCS12_REVISION;
+                }
 
         }
         return 1;
@@ -15062,7 +15094,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
         .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
 
         .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
-        .write_tsc_offset = vmx_write_tsc_offset,
+        .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
 
         .set_tdp_cr3 = vmx_set_cr3,
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 5cd5647120f2..d02937760c3b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1665,8 +1665,7 @@ EXPORT_SYMBOL_GPL(kvm_read_l1_tsc);
 
 static void kvm_vcpu_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
-        kvm_x86_ops->write_tsc_offset(vcpu, offset);
-        vcpu->arch.tsc_offset = offset;
+        vcpu->arch.tsc_offset = kvm_x86_ops->write_l1_tsc_offset(vcpu, offset);
 }
 
 static inline bool kvm_check_tsc_unstable(void)
@@ -1794,7 +1793,8 @@ EXPORT_SYMBOL_GPL(kvm_write_tsc);
 static inline void adjust_tsc_offset_guest(struct kvm_vcpu *vcpu,
                                            s64 adjustment)
 {
-        kvm_vcpu_write_tsc_offset(vcpu, vcpu->arch.tsc_offset + adjustment);
+        u64 tsc_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu);
+        kvm_vcpu_write_tsc_offset(vcpu, tsc_offset + adjustment);
 }
 
 static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
@@ -6918,6 +6918,7 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr,
         clock_pairing.nsec = ts.tv_nsec;
         clock_pairing.tsc = kvm_read_l1_tsc(vcpu, cycle);
         clock_pairing.flags = 0;
+        memset(&clock_pairing.pad, 0, sizeof(clock_pairing.pad));
 
         ret = 0;
         if (kvm_write_guest(vcpu->kvm, paddr, &clock_pairing,
@@ -7455,7 +7456,8 @@ static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
         else {
                 if (vcpu->arch.apicv_active)
                         kvm_x86_ops->sync_pir_to_irr(vcpu);
-                kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
+                if (ioapic_in_kernel(vcpu->kvm))
+                        kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
         }
 
         if (is_guest_mode(vcpu))
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index bddd6b3cee1d..03b6b4c2238d 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -7,7 +7,6 @@
 #include <linux/export.h>
 #include <linux/cpu.h>
 #include <linux/debugfs.h>
-#include <linux/ptrace.h>
 
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
@@ -31,6 +30,12 @@
  */
 
 /*
+ * Use bit 0 to mangle the TIF_SPEC_IB state into the mm pointer which is
+ * stored in cpu_tlb_state.last_user_mm_ibpb.
+ */
+#define LAST_USER_MM_IBPB       0x1UL
+
+/*
  * We get here when we do something requiring a TLB invalidation
  * but could not go invalidate all of the contexts.  We do the
  * necessary invalidation by clearing out the 'ctx_id' which
@@ -181,17 +186,87 @@ static void sync_current_stack_to_mm(struct mm_struct *mm)
         }
 }
 
-static bool ibpb_needed(struct task_struct *tsk, u64 last_ctx_id)
+static inline unsigned long mm_mangle_tif_spec_ib(struct task_struct *next)
+{
+        unsigned long next_tif = task_thread_info(next)->flags;
+        unsigned long ibpb = (next_tif >> TIF_SPEC_IB) & LAST_USER_MM_IBPB;
+
+        return (unsigned long)next->mm | ibpb;
+}
+
+static void cond_ibpb(struct task_struct *next)
 {
+        if (!next || !next->mm)
+                return;
+
         /*
-         * Check if the current (previous) task has access to the memory
-         * of the @tsk (next) task. If access is denied, make sure to
-         * issue a IBPB to stop user->user Spectre-v2 attacks.
-         *
-         * Note: __ptrace_may_access() returns 0 or -ERRNO.
+         * Both, the conditional and the always IBPB mode use the mm
+         * pointer to avoid the IBPB when switching between tasks of the
+         * same process. Using the mm pointer instead of mm->context.ctx_id
+         * opens a hypothetical hole vs. mm_struct reuse, which is more or
+         * less impossible to control by an attacker. Aside of that it
+         * would only affect the first schedule so the theoretically
+         * exposed data is not really interesting.
          */
-        return (tsk && tsk->mm && tsk->mm->context.ctx_id != last_ctx_id &&
-                ptrace_may_access_sched(tsk, PTRACE_MODE_SPEC_IBPB));
+        if (static_branch_likely(&switch_mm_cond_ibpb)) {
+                unsigned long prev_mm, next_mm;
+
+                /*
+                 * This is a bit more complex than the always mode because
+                 * it has to handle two cases:
+                 *
+                 * 1) Switch from a user space task (potential attacker)
+                 *    which has TIF_SPEC_IB set to a user space task
+                 *    (potential victim) which has TIF_SPEC_IB not set.
+                 *
+                 * 2) Switch from a user space task (potential attacker)
+                 *    which has TIF_SPEC_IB not set to a user space task
+                 *    (potential victim) which has TIF_SPEC_IB set.
+                 *
+                 * This could be done by unconditionally issuing IBPB when
+                 * a task which has TIF_SPEC_IB set is either scheduled in
+                 * or out. Though that results in two flushes when:
+                 *
+                 * - the same user space task is scheduled out and later
+                 *   scheduled in again and only a kernel thread ran in
+                 *   between.
+                 *
+                 * - a user space task belonging to the same process is
+                 *   scheduled in after a kernel thread ran in between
+                 *
+                 * - a user space task belonging to the same process is
+                 *   scheduled in immediately.
+                 *
+                 * Optimize this with reasonably small overhead for the
+                 * above cases. Mangle the TIF_SPEC_IB bit into the mm
+                 * pointer of the incoming task which is stored in
+                 * cpu_tlbstate.last_user_mm_ibpb for comparison.
+                 */
+                next_mm = mm_mangle_tif_spec_ib(next);
+                prev_mm = this_cpu_read(cpu_tlbstate.last_user_mm_ibpb);
+
+                /*
+                 * Issue IBPB only if the mm's are different and one or
+                 * both have the IBPB bit set.
+                 */
+                if (next_mm != prev_mm &&
+                    (next_mm | prev_mm) & LAST_USER_MM_IBPB)
+                        indirect_branch_prediction_barrier();
+
+                this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, next_mm);
+        }
+
+        if (static_branch_unlikely(&switch_mm_always_ibpb)) {
+                /*
+                 * Only flush when switching to a user space task with a
+                 * different context than the user space task which ran
+                 * last on this CPU.
+                 */
+                if (this_cpu_read(cpu_tlbstate.last_user_mm) != next->mm) {
+                        indirect_branch_prediction_barrier();
+                        this_cpu_write(cpu_tlbstate.last_user_mm, next->mm);
+                }
+        }
 }
 
 void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
@@ -292,22 +367,12 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 new_asid = prev_asid;
                 need_flush = true;
         } else {
-                u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id);
-
                 /*
                  * Avoid user/user BTB poisoning by flushing the branch
                  * predictor when switching between processes. This stops
                  * one process from doing Spectre-v2 attacks on another.
-                 *
-                 * As an optimization, flush indirect branches only when
-                 * switching into a processes that can't be ptrace by the
-                 * current one (as in such case, attacker has much more
-                 * convenient way how to tamper with the next process than
-                 * branch buffer poisoning).
                  */
-                if (static_cpu_has(X86_FEATURE_USE_IBPB) &&
-                                ibpb_needed(tsk, last_ctx_id))
-                        indirect_branch_prediction_barrier();
+                cond_ibpb(tsk);
 
                 if (IS_ENABLED(CONFIG_VMAP_STACK)) {
                         /*
@@ -365,14 +430,6 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
         }
 
-        /*
-         * Record last user mm's context id, so we can avoid
-         * flushing branch buffer with IBPB if we switch back
-         * to the same user.
-         */
-        if (next != &init_mm)
-                this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
-
         /* Make sure we write CR3 before loaded_mm. */
         barrier();
 
@@ -441,7 +498,7 @@ void initialize_tlbstate_and_flush(void)
         write_cr3(build_cr3(mm->pgd, 0));
 
         /* Reinitialize tlbstate. */
-        this_cpu_write(cpu_tlbstate.last_ctx_id, mm->context.ctx_id);
+        this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, LAST_USER_MM_IBPB);
         this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
         this_cpu_write(cpu_tlbstate.next_asid, 1);
         this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e996e8e744cb..750f46ad018a 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -10,7 +10,6 @@
 #include <xen/xen.h>
 #include <xen/features.h>
 #include <xen/page.h>
-#include <xen/interface/memory.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -346,80 +345,3 @@ void xen_arch_unregister_cpu(int num)
 }
 EXPORT_SYMBOL(xen_arch_unregister_cpu);
 #endif
-
-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
-void __init arch_xen_balloon_init(struct resource *hostmem_resource)
-{
-        struct xen_memory_map memmap;
-        int rc;
-        unsigned int i, last_guest_ram;
-        phys_addr_t max_addr = PFN_PHYS(max_pfn);
-        struct e820_table *xen_e820_table;
-        const struct e820_entry *entry;
-        struct resource *res;
-
-        if (!xen_initial_domain())
-                return;
-
-        xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
-        if (!xen_e820_table)
-                return;
-
-        memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
-        set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
-        rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
-        if (rc) {
-                pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
-                goto out;
-        }
-
-        last_guest_ram = 0;
-        for (i = 0; i < memmap.nr_entries; i++) {
-                if (xen_e820_table->entries[i].addr >= max_addr)
-                        break;
-                if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
-                        last_guest_ram = i;
-        }
-
-        entry = &xen_e820_table->entries[last_guest_ram];
-        if (max_addr >= entry->addr + entry->size)
-                goto out; /* No unallocated host RAM. */
-
-        hostmem_resource->start = max_addr;
-        hostmem_resource->end = entry->addr + entry->size;
-
-        /*
-         * Mark non-RAM regions between the end of dom0 RAM and end of host RAM
-         * as unavailable. The rest of that region can be used for hotplug-based
-         * ballooning.
-         */
-        for (; i < memmap.nr_entries; i++) {
-                entry = &xen_e820_table->entries[i];
-
-                if (entry->type == E820_TYPE_RAM)
-                        continue;
-
-                if (entry->addr >= hostmem_resource->end)
-                        break;
-
-                res = kzalloc(sizeof(*res), GFP_KERNEL);
-                if (!res)
-                        goto out;
-
-                res->name = "Unavailable host RAM";
-                res->start = entry->addr;
-                res->end = (entry->addr + entry->size < hostmem_resource->end) ?
-                            entry->addr + entry->size : hostmem_resource->end;
-                rc = insert_resource(hostmem_resource, res);
-                if (rc) {
-                        pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
-                                __func__, res->start, res->end, rc);
-                        kfree(res);
-                        goto  out;
-                }
-        }
-
- out:
-        kfree(xen_e820_table);
-}
-#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 0d7b3ae4960b..a5d7ed125337 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1905,7 +1905,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         init_top_pgt[0] = __pgd(0);
 
         /* Pre-constructed entries are in pfn, so convert to mfn */
-        /* L4[272] -> level3_ident_pgt  */
+        /* L4[273] -> level3_ident_pgt  */
         /* L4[511] -> level3_kernel_pgt */
         convert_pfn_mfn(init_top_pgt);
 
@@ -1925,8 +1925,8 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         addr[0] = (unsigned long)pgd;
         addr[1] = (unsigned long)l3;
         addr[2] = (unsigned long)l2;
-        /* Graft it onto L4[272][0]. Note that we creating an aliasing problem:
-         * Both L4[272][0] and L4[511][510] have entries that point to the same
+        /* Graft it onto L4[273][0]. Note that we creating an aliasing problem:
+         * Both L4[273][0] and L4[511][510] have entries that point to the same
          * L2 (PMD) tables. Meaning that if you modify it in __va space
          * it will be also modified in the __ka space! (But if you just
          * modify the PMD table to point to other PTE's or none, then you
diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 2bce7958ce8b..0766a08bdf45 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -69,6 +69,11 @@ void xen_mc_flush(void)
 
         trace_xen_mc_flush(b->mcidx, b->argidx, b->cbidx);
 
+#if MC_DEBUG
+        memcpy(b->debug, b->entries,
+               b->mcidx * sizeof(struct multicall_entry));
+#endif
+
         switch (b->mcidx) {
         case 0:
                 /* no-op */
@@ -87,32 +92,34 @@ void xen_mc_flush(void)
                 break;
 
         default:
-#if MC_DEBUG
-                memcpy(b->debug, b->entries,
-                       b->mcidx * sizeof(struct multicall_entry));
-#endif
-
                 if (HYPERVISOR_multicall(b->entries, b->mcidx) != 0)
                         BUG();
                 for (i = 0; i < b->mcidx; i++)
                         if (b->entries[i].result < 0)
                                 ret++;
+        }
 
+        if (WARN_ON(ret)) {
+                pr_err("%d of %d multicall(s) failed: cpu %d\n",
+                       ret, b->mcidx, smp_processor_id());
+                for (i = 0; i < b->mcidx; i++) {
+                        if (b->entries[i].result < 0) {
 #if MC_DEBUG
-                if (ret) {
-                        printk(KERN_ERR "%d multicall(s) failed: cpu %d\n",
-                               ret, smp_processor_id());
-                        dump_stack();
-                        for (i = 0; i < b->mcidx; i++) {
-                                printk(KERN_DEBUG "  call %2d/%d: op=%lu arg=[%lx] result=%ld\t%pF\n",
-                                       i+1, b->mcidx,
+                                pr_err("  call %2d: op=%lu arg=[%lx] result=%ld\t%pF\n",
+                                       i + 1,
                                        b->debug[i].op,
                                        b->debug[i].args[0],
                                        b->entries[i].result,
                                        b->caller[i]);
+#else
+                                pr_err("  call %2d: op=%lu arg=[%lx] result=%ld\n",
+                                       i + 1,
+                                       b->entries[i].op,
+                                       b->entries[i].args[0],
+                                       b->entries[i].result);
+#endif
                         }
                 }
-#endif
         }
 
         b->mcidx = 0;
@@ -126,8 +133,6 @@ void xen_mc_flush(void)
         b->cbidx = 0;
 
         local_irq_restore(flags);
-
-        WARN_ON(ret);
 }
 
 struct multicall_space __xen_mc_entry(size_t args)
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index b06731705529..055e37e43541 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -656,8 +656,7 @@ bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 
         /*
          * The interface requires atomic updates on p2m elements.
-         * xen_safe_write_ulong() is using __put_user which does an atomic
-         * store via asm().
+         * xen_safe_write_ulong() is using an atomic store via asm().
          */
         if (likely(!xen_safe_write_ulong(xen_p2m_addr + pfn, mfn)))
                 return true;
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 1163e33121fb..075ed47993bb 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -808,6 +808,7 @@ char * __init xen_memory_setup(void)
         addr = xen_e820_table.entries[0].addr;
         size = xen_e820_table.entries[0].size;
         while (i < xen_e820_table.nr_entries) {
+                bool discard = false;
 
                 chunk_size = size;
                 type = xen_e820_table.entries[i].type;
@@ -823,10 +824,11 @@ char * __init xen_memory_setup(void)
                                 xen_add_extra_mem(pfn_s, n_pfns);
                                 xen_max_p2m_pfn = pfn_s + n_pfns;
                         } else
-                                type = E820_TYPE_UNUSABLE;
+                                discard = true;
                 }
 
-                xen_align_and_add_e820_region(addr, chunk_size, type);
+                if (!discard)
+                        xen_align_and_add_e820_region(addr, chunk_size, type);
 
                 addr += chunk_size;
                 size -= chunk_size;
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 441c88262169..3776122c87cc 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -3,24 +3,21 @@
  * Split spinlock implementation out into its own file, so it can be
  * compiled in a FTRACE-compatible way.
  */
-#include <linux/kernel_stat.h>
+#include <linux/kernel.h>
 #include <linux/spinlock.h>
-#include <linux/debugfs.h>
-#include <linux/log2.h>
-#include <linux/gfp.h>
 #include <linux/slab.h>
+#include <linux/atomic.h>
 
 #include <asm/paravirt.h>
 #include <asm/qspinlock.h>
 
-#include <xen/interface/xen.h>
 #include <xen/events.h>
 
 #include "xen-ops.h"
-#include "debugfs.h"
 
 static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
 static DEFINE_PER_CPU(char *, irq_name);
+static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest);
 static bool xen_pvspin = true;
 
 static void xen_qlock_kick(int cpu)
@@ -39,25 +36,25 @@ static void xen_qlock_kick(int cpu)
  */
 static void xen_qlock_wait(u8 *byte, u8 val)
 {
-        unsigned long flags;
         int irq = __this_cpu_read(lock_kicker_irq);
+        atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest);
 
         /* If kicker interrupts not initialized yet, just spin */
         if (irq == -1 || in_nmi())
                 return;
 
-        /* Guard against reentry. */
-        local_irq_save(flags);
+        /* Detect reentry. */
+        atomic_inc(nest_cnt);
 
-        /* If irq pending already clear it. */
-        if (xen_test_irq_pending(irq)) {
+        /* If irq pending already and no nested call clear it. */
+        if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) {
                 xen_clear_irq_pending(irq);
         } else if (READ_ONCE(*byte) == val) {
                 /* Block until irq becomes pending (or a spurious wakeup) */
                 xen_poll_irq(irq);
         }
 
-        local_irq_restore(flags);
+        atomic_dec(nest_cnt);
 }
 
 static irqreturn_t dummy_handler(int irq, void *dev_id)
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index be9bfd9aa865..34a23016dd14 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -23,7 +23,11 @@
 # error Linux requires the Xtensa Windowed Registers Option.
 #endif
 
-#define ARCH_SLAB_MINALIGN      XCHAL_DATA_WIDTH
+/* Xtensa ABI requires stack alignment to be at least 16 */
+
+#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16)
+
+#define ARCH_SLAB_MINALIGN STACK_ALIGN
 
 /*
  * User space process size: 1 GB.
diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c
index 67904f55f188..120dd746a147 100644
--- a/arch/xtensa/kernel/asm-offsets.c
+++ b/arch/xtensa/kernel/asm-offsets.c
@@ -94,14 +94,14 @@ int main(void)
         DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp));
         DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable));
 #if XTENSA_HAVE_COPROCESSORS
-        DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp));
+        DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0));
+        DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1));
+        DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2));
+        DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3));
+        DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4));
+        DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5));
+        DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6));
+        DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7));
 #endif
         DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user));
         DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t));
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index 2f76118ecf62..9053a5622d2c 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -88,9 +88,12 @@ _SetupMMU:
         initialize_mmu
 #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY
         rsr     a2, excsave1
-        movi    a3, 0x08000000
+        movi    a3, XCHAL_KSEG_PADDR
+        bltu    a2, a3, 1f
+        sub     a2, a2, a3
+        movi    a3, XCHAL_KSEG_SIZE
         bgeu    a2, a3, 1f
-        movi    a3, 0xd0000000
+        movi    a3, XCHAL_KSEG_CACHED_VADDR
         add     a2, a2, a3
         wsr     a2, excsave1
 1:
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 483dcfb6e681..4bb68133a72a 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -94,18 +94,21 @@ void coprocessor_release_all(struct thread_info *ti)
 
 void coprocessor_flush_all(struct thread_info *ti)
 {
-        unsigned long cpenable;
+        unsigned long cpenable, old_cpenable;
         int i;
 
         preempt_disable();
 
+        RSR_CPENABLE(old_cpenable);
         cpenable = ti->cpenable;
+        WSR_CPENABLE(cpenable);
 
         for (i = 0; i < XCHAL_CP_MAX; i++) {
                 if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti)
                         coprocessor_flush(ti, i);
                 cpenable >>= 1;
         }
+        WSR_CPENABLE(old_cpenable);
 
         preempt_enable();
 }
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index c0845cb1cbb9..d9541be0605a 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -127,12 +127,37 @@ static int ptrace_setregs(struct task_struct *child, void __user *uregs)
 }
 
 
+#if XTENSA_HAVE_COPROCESSORS
+#define CP_OFFSETS(cp) \
+        { \
+                .elf_xtregs_offset = offsetof(elf_xtregs_t, cp), \
+                .ti_offset = offsetof(struct thread_info, xtregs_cp.cp), \
+                .sz = sizeof(xtregs_ ## cp ## _t), \
+        }
+
+static const struct {
+        size_t elf_xtregs_offset;
+        size_t ti_offset;
+        size_t sz;
+} cp_offsets[] = {
+        CP_OFFSETS(cp0),
+        CP_OFFSETS(cp1),
+        CP_OFFSETS(cp2),
+        CP_OFFSETS(cp3),
+        CP_OFFSETS(cp4),
+        CP_OFFSETS(cp5),
+        CP_OFFSETS(cp6),
+        CP_OFFSETS(cp7),
+};
+#endif
+
 static int ptrace_getxregs(struct task_struct *child, void __user *uregs)
 {
         struct pt_regs *regs = task_pt_regs(child);
         struct thread_info *ti = task_thread_info(child);
         elf_xtregs_t __user *xtregs = uregs;
         int ret = 0;
+        int i __maybe_unused;
 
         if (!access_ok(VERIFY_WRITE, uregs, sizeof(elf_xtregs_t)))
                 return -EIO;
@@ -140,8 +165,13 @@ static int ptrace_getxregs(struct task_struct *child, void __user *uregs)
 #if XTENSA_HAVE_COPROCESSORS
         /* Flush all coprocessor registers to memory. */
         coprocessor_flush_all(ti);
-        ret |= __copy_to_user(&xtregs->cp0, &ti->xtregs_cp,
-                              sizeof(xtregs_coprocessor_t));
+
+        for (i = 0; i < ARRAY_SIZE(cp_offsets); ++i)
+                ret |= __copy_to_user((char __user *)xtregs +
+                                      cp_offsets[i].elf_xtregs_offset,
+                                      (const char *)ti +
+                                      cp_offsets[i].ti_offset,
+                                      cp_offsets[i].sz);
 #endif
         ret |= __copy_to_user(&xtregs->opt, &regs->xtregs_opt,
                               sizeof(xtregs->opt));
@@ -157,6 +187,7 @@ static int ptrace_setxregs(struct task_struct *child, void __user *uregs)
         struct pt_regs *regs = task_pt_regs(child);
         elf_xtregs_t *xtregs = uregs;
         int ret = 0;
+        int i __maybe_unused;
 
         if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
                 return -EFAULT;
@@ -166,8 +197,11 @@ static int ptrace_setxregs(struct task_struct *child, void __user *uregs)
         coprocessor_flush_all(ti);
         coprocessor_release_all(ti);
 
-        ret |= __copy_from_user(&ti->xtregs_cp, &xtregs->cp0,
-                                sizeof(xtregs_coprocessor_t));
+        for (i = 0; i < ARRAY_SIZE(cp_offsets); ++i)
+                ret |= __copy_from_user((char *)ti + cp_offsets[i].ti_offset,
+                                        (const char __user *)xtregs +
+                                        cp_offsets[i].elf_xtregs_offset,
+                                        cp_offsets[i].sz);
 #endif
         ret |= __copy_from_user(&regs->xtregs_opt, &xtregs->opt,
                                 sizeof(xtregs->opt));
diff --git a/block/bio.c b/block/bio.c
index d5368a445561..4f4d9884443b 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
         if (bio_flagged(bio_src, BIO_THROTTLED))
                 bio_set_flag(bio, BIO_THROTTLED);
         bio->bi_opf = bio_src->bi_opf;
+        bio->bi_ioprio = bio_src->bi_ioprio;
         bio->bi_write_hint = bio_src->bi_write_hint;
         bio->bi_iter = bio_src->bi_iter;
         bio->bi_io_vec = bio_src->bi_io_vec;
@@ -1260,6 +1261,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                 if (ret)
                         goto cleanup;
         } else {
+                zero_fill_bio(bio);
                 iov_iter_advance(iter, bio->bi_iter.bi_size);
         }
 
diff --git a/block/blk-core.c b/block/blk-core.c
index ce12515f9b9b..deb56932f8c4 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -798,9 +798,8 @@ void blk_cleanup_queue(struct request_queue *q)
          * dispatch may still be in-progress since we dispatch requests
          * from more than one contexts.
          *
-         * No need to quiesce queue if it isn't initialized yet since
-         * blk_freeze_queue() should be enough for cases of passthrough
-         * request.
+         * We rely on driver to deal with the race in case that queue
+         * initialization isn't done.
          */
         if (q->mq_ops && blk_queue_init_done(q))
                 blk_mq_quiesce_queue(q);
diff --git a/block/blk-lib.c b/block/blk-lib.c
index 76f867ea9a9b..5f2c429d4378 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -51,16 +51,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
         if ((sector | nr_sects) & bs_mask)
                 return -EINVAL;
 
-        while (nr_sects) {
-                unsigned int req_sects = nr_sects;
-                sector_t end_sect;
+        if (!nr_sects)
+                return -EINVAL;
 
-                if (!req_sects)
-                        goto fail;
-                if (req_sects > UINT_MAX >> 9)
-                        req_sects = UINT_MAX >> 9;
+        while (nr_sects) {
+                sector_t req_sects = min_t(sector_t, nr_sects,
+                                bio_allowed_max_sectors(q));
 
-                end_sect = sector + req_sects;
+                WARN_ON_ONCE((req_sects << 9) > UINT_MAX);
 
                 bio = blk_next_bio(bio, 0, gfp_mask);
                 bio->bi_iter.bi_sector = sector;
@@ -68,8 +66,8 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
                 bio_set_op_attrs(bio, op, 0);
 
                 bio->bi_iter.bi_size = req_sects << 9;
+                sector += req_sects;
                 nr_sects -= req_sects;
-                sector = end_sect;
 
                 /*
                  * We can loop for a long time in here, if someone does
@@ -82,14 +80,6 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
 
         *biop = bio;
         return 0;
-
-fail:
-        if (bio) {
-                submit_bio_wait(bio);
-                bio_put(bio);
-        }
-        *biop = NULL;
-        return -EOPNOTSUPP;
 }
 EXPORT_SYMBOL(__blkdev_issue_discard);
 
@@ -161,7 +151,7 @@ static int __blkdev_issue_write_same(struct block_device *bdev, sector_t sector,
                 return -EOPNOTSUPP;
 
         /* Ensure that max_write_same_sectors doesn't overflow bi_size */
-        max_write_same_sectors = UINT_MAX >> 9;
+        max_write_same_sectors = bio_allowed_max_sectors(q);
 
         while (nr_sects) {
                 bio = blk_next_bio(bio, 1, gfp_mask);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 6b5ad275ed56..7695034f4b87 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -46,7 +46,7 @@ static inline bool bio_will_gap(struct request_queue *q,
                 bio_get_first_bvec(prev_rq->bio, &pb);
         else
                 bio_get_first_bvec(prev, &pb);
-        if (pb.bv_offset)
+        if (pb.bv_offset & queue_virt_boundary(q))
                 return true;
 
         /*
@@ -90,7 +90,8 @@ static struct bio *blk_bio_discard_split(struct request_queue *q,
         /* Zero-sector (unknown) and one-sector granularities are the same.  */
         granularity = max(q->limits.discard_granularity >> 9, 1U);
 
-        max_discard_sectors = min(q->limits.max_discard_sectors, UINT_MAX >> 9);
+        max_discard_sectors = min(q->limits.max_discard_sectors,
+                        bio_allowed_max_sectors(q));
         max_discard_sectors -= max_discard_sectors % granularity;
 
         if (unlikely(!max_discard_sectors)) {
@@ -819,7 +820,7 @@ static struct request *attempt_merge(struct request_queue *q,
 
         req->__data_len += blk_rq_bytes(next);
 
-        if (req_op(req) != REQ_OP_DISCARD)
+        if (!blk_discard_mergable(req))
                 elv_merge_requests(q, req, next);
 
         /*
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3f91c6e5b17a..3262d83b9e07 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1715,6 +1715,15 @@ static blk_status_t __blk_mq_issue_directly(struct blk_mq_hw_ctx *hctx,
                 break;
         case BLK_STS_RESOURCE:
         case BLK_STS_DEV_RESOURCE:
+                /*
+                 * If direct dispatch fails, we cannot allow any merging on
+                 * this IO. Drivers (like SCSI) may have set up permanent state
+                 * for this request, like SG tables and mappings, and if we
+                 * merge to it later on then we'll still only do IO to the
+                 * original part.
+                 */
+                rq->cmd_flags |= REQ_NOMERGE;
+
                 blk_mq_update_dispatch_busy(hctx, true);
                 __blk_mq_requeue_request(rq);
                 break;
@@ -1727,6 +1736,18 @@ static blk_status_t __blk_mq_issue_directly(struct blk_mq_hw_ctx *hctx,
         return ret;
 }
 
+/*
+ * Don't allow direct dispatch of anything but regular reads/writes,
+ * as some of the other commands can potentially share request space
+ * with data we need for the IO scheduler. If we attempt a direct dispatch
+ * on those and fail, we can't safely add it to the scheduler afterwards
+ * without potentially overwriting data that the driver has already written.
+ */
+static bool blk_rq_can_direct_dispatch(struct request *rq)
+{
+        return req_op(rq) == REQ_OP_READ || req_op(rq) == REQ_OP_WRITE;
+}
+
 static blk_status_t __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                                                 struct request *rq,
                                                 blk_qc_t *cookie,
@@ -1748,7 +1769,7 @@ static blk_status_t __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                 goto insert;
         }
 
-        if (q->elevator && !bypass_insert)
+        if (!blk_rq_can_direct_dispatch(rq) || (q->elevator && !bypass_insert))
                 goto insert;
 
         if (!blk_mq_get_dispatch_budget(hctx))
@@ -1810,6 +1831,9 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
                 struct request *rq = list_first_entry(list, struct request,
                                 queuelist);
 
+                if (!blk_rq_can_direct_dispatch(rq))
+                        break;
+
                 list_del_init(&rq->queuelist);
                 ret = blk_mq_request_issue_directly(rq);
                 if (ret != BLK_STS_OK) {
diff --git a/block/blk.h b/block/blk.h
index a1841b8ff129..0089fefdf771 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -169,7 +169,7 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 static inline bool __bvec_gap_to_prev(struct request_queue *q,
                 struct bio_vec *bprv, unsigned int offset)
 {
-        return offset ||
+        return (offset & queue_virt_boundary(q)) ||
                 ((bprv->bv_offset + bprv->bv_len) & queue_virt_boundary(q));
 }
 
@@ -396,6 +396,16 @@ static inline unsigned long blk_rq_deadline(struct request *rq)
 }
 
 /*
+ * The max size one bio can handle is UINT_MAX becasue bvec_iter.bi_size
+ * is defined as 'unsigned int', meantime it has to aligned to with logical
+ * block size which is the minimum accepted unit by hardware.
+ */
+static inline unsigned int bio_allowed_max_sectors(struct request_queue *q)
+{
+        return round_down(UINT_MAX, queue_logical_block_size(q)) >> 9;
+}
+
+/*
  * Internal io_context interface
  */
 void get_io_context(struct io_context *ioc);
diff --git a/block/bounce.c b/block/bounce.c
index 36869afc258c..559c55bda040 100644
--- a/block/bounce.c
+++ b/block/bounce.c
@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask,
                 return NULL;
         bio->bi_disk            = bio_src->bi_disk;
         bio->bi_opf             = bio_src->bi_opf;
+        bio->bi_ioprio          = bio_src->bi_ioprio;
         bio->bi_write_hint      = bio_src->bi_write_hint;
         bio->bi_iter.bi_sector  = bio_src->bi_iter.bi_sector;
         bio->bi_iter.bi_size    = bio_src->bi_iter.bi_size;
diff --git a/crypto/crypto_user_base.c b/crypto/crypto_user_base.c
index e41f6cc33fff..784748dbb19f 100644
--- a/crypto/crypto_user_base.c
+++ b/crypto/crypto_user_base.c
@@ -84,7 +84,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_cipher rcipher;
 
-        strlcpy(rcipher.type, "cipher", sizeof(rcipher.type));
+        strncpy(rcipher.type, "cipher", sizeof(rcipher.type));
 
         rcipher.blocksize = alg->cra_blocksize;
         rcipher.min_keysize = alg->cra_cipher.cia_min_keysize;
@@ -103,7 +103,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_comp rcomp;
 
-        strlcpy(rcomp.type, "compression", sizeof(rcomp.type));
+        strncpy(rcomp.type, "compression", sizeof(rcomp.type));
         if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS,
                     sizeof(struct crypto_report_comp), &rcomp))
                 goto nla_put_failure;
@@ -117,7 +117,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_acomp racomp;
 
-        strlcpy(racomp.type, "acomp", sizeof(racomp.type));
+        strncpy(racomp.type, "acomp", sizeof(racomp.type));
 
         if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP,
                     sizeof(struct crypto_report_acomp), &racomp))
@@ -132,7 +132,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_akcipher rakcipher;
 
-        strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
+        strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
 
         if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER,
                     sizeof(struct crypto_report_akcipher), &rakcipher))
@@ -147,7 +147,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_kpp rkpp;
 
-        strlcpy(rkpp.type, "kpp", sizeof(rkpp.type));
+        strncpy(rkpp.type, "kpp", sizeof(rkpp.type));
 
         if (nla_put(skb, CRYPTOCFGA_REPORT_KPP,
                     sizeof(struct crypto_report_kpp), &rkpp))
@@ -161,10 +161,10 @@ nla_put_failure:
 static int crypto_report_one(struct crypto_alg *alg,
                              struct crypto_user_alg *ualg, struct sk_buff *skb)
 {
-        strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
-        strlcpy(ualg->cru_driver_name, alg->cra_driver_name,
+        strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
+        strncpy(ualg->cru_driver_name, alg->cra_driver_name,
                 sizeof(ualg->cru_driver_name));
-        strlcpy(ualg->cru_module_name, module_name(alg->cra_module),
+        strncpy(ualg->cru_module_name, module_name(alg->cra_module),
                 sizeof(ualg->cru_module_name));
 
         ualg->cru_type = 0;
@@ -177,7 +177,7 @@ static int crypto_report_one(struct crypto_alg *alg,
         if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
                 struct crypto_report_larval rl;
 
-                strlcpy(rl.type, "larval", sizeof(rl.type));
+                strncpy(rl.type, "larval", sizeof(rl.type));
                 if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL,
                             sizeof(struct crypto_report_larval), &rl))
                         goto nla_put_failure;
diff --git a/crypto/crypto_user_stat.c b/crypto/crypto_user_stat.c
index 021ad06bbb62..1dfaa0ccd555 100644
--- a/crypto/crypto_user_stat.c
+++ b/crypto/crypto_user_stat.c
@@ -37,6 +37,8 @@ static int crypto_report_aead(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&raead, 0, sizeof(raead));
+
         strncpy(raead.type, "aead", sizeof(raead.type));
 
         v32 = atomic_read(&alg->encrypt_cnt);
@@ -65,6 +67,8 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rcipher, 0, sizeof(rcipher));
+
         strlcpy(rcipher.type, "cipher", sizeof(rcipher.type));
 
         v32 = atomic_read(&alg->encrypt_cnt);
@@ -93,6 +97,8 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rcomp, 0, sizeof(rcomp));
+
         strlcpy(rcomp.type, "compression", sizeof(rcomp.type));
         v32 = atomic_read(&alg->compress_cnt);
         rcomp.stat_compress_cnt = v32;
@@ -120,6 +126,8 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&racomp, 0, sizeof(racomp));
+
         strlcpy(racomp.type, "acomp", sizeof(racomp.type));
         v32 = atomic_read(&alg->compress_cnt);
         racomp.stat_compress_cnt = v32;
@@ -147,6 +155,8 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rakcipher, 0, sizeof(rakcipher));
+
         strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
         v32 = atomic_read(&alg->encrypt_cnt);
         rakcipher.stat_encrypt_cnt = v32;
@@ -177,6 +187,8 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg)
         struct crypto_stat rkpp;
         u32 v;
 
+        memset(&rkpp, 0, sizeof(rkpp));
+
         strlcpy(rkpp.type, "kpp", sizeof(rkpp.type));
 
         v = atomic_read(&alg->setsecret_cnt);
@@ -203,6 +215,8 @@ static int crypto_report_ahash(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rhash, 0, sizeof(rhash));
+
         strncpy(rhash.type, "ahash", sizeof(rhash.type));
 
         v32 = atomic_read(&alg->hash_cnt);
@@ -227,6 +241,8 @@ static int crypto_report_shash(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rhash, 0, sizeof(rhash));
+
         strncpy(rhash.type, "shash", sizeof(rhash.type));
 
         v32 = atomic_read(&alg->hash_cnt);
@@ -251,6 +267,8 @@ static int crypto_report_rng(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rrng, 0, sizeof(rrng));
+
         strncpy(rrng.type, "rng", sizeof(rrng.type));
 
         v32 = atomic_read(&alg->generate_cnt);
@@ -275,6 +293,8 @@ static int crypto_reportstat_one(struct crypto_alg *alg,
                                  struct crypto_user_alg *ualg,
                                  struct sk_buff *skb)
 {
+        memset(ualg, 0, sizeof(*ualg));
+
         strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
         strlcpy(ualg->cru_driver_name, alg->cra_driver_name,
                 sizeof(ualg->cru_driver_name));
@@ -291,6 +311,7 @@ static int crypto_reportstat_one(struct crypto_alg *alg,
         if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
                 struct crypto_stat rl;
 
+                memset(&rl, 0, sizeof(rl));
                 strlcpy(rl.type, "larval", sizeof(rl.type));
                 if (nla_put(skb, CRYPTOCFGA_STAT_LARVAL,
                             sizeof(struct crypto_stat), &rl))
diff --git a/crypto/simd.c b/crypto/simd.c
index ea7240be3001..78e8d037ae2b 100644
--- a/crypto/simd.c
+++ b/crypto/simd.c
@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm)
 
         ctx->cryptd_tfm = cryptd_tfm;
 
-        reqsize = sizeof(struct skcipher_request);
-        reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base);
+        reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm));
+        reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base));
+        reqsize += sizeof(struct skcipher_request);
 
         crypto_skcipher_set_reqsize(tfm, reqsize);
 
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 8f3a444c6ea9..7cea769c37df 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -512,7 +512,7 @@ config CRC_PMIC_OPREGION
 
 config XPOWER_PMIC_OPREGION
         bool "ACPI operation region support for XPower AXP288 PMIC"
-        depends on MFD_AXP20X_I2C && IOSF_MBI
+        depends on MFD_AXP20X_I2C && IOSF_MBI=y
         help
           This config adds ACPI operation region support for XPower AXP288 PMIC.
 
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index eaa60c94205a..1f32caa87686 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = {
         {"PNP0200",  0},        /* AT DMA Controller */
         {"ACPI0009", 0},        /* IOxAPIC */
         {"ACPI000A", 0},        /* IOAPIC */
+        {"SMB0001",  0},        /* ACPI SMBUS virtual device */
         {"", 0},
 };
 
diff --git a/drivers/acpi/acpica/exserial.c b/drivers/acpi/acpica/exserial.c
index 0d42f30e5b25..9920fac6413f 100644
--- a/drivers/acpi/acpica/exserial.c
+++ b/drivers/acpi/acpica/exserial.c
@@ -244,7 +244,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
 {
         acpi_status status;
         u32 buffer_length;
-        u32 data_length;
         void *buffer;
         union acpi_operand_object *buffer_desc;
         u32 function;
@@ -282,14 +281,12 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
         case ACPI_ADR_SPACE_SMBUS:
 
                 buffer_length = ACPI_SMBUS_BUFFER_SIZE;
-                data_length = ACPI_SMBUS_DATA_SIZE;
                 function = ACPI_WRITE | (obj_desc->field.attribute << 16);
                 break;
 
         case ACPI_ADR_SPACE_IPMI:
 
                 buffer_length = ACPI_IPMI_BUFFER_SIZE;
-                data_length = ACPI_IPMI_DATA_SIZE;
                 function = ACPI_WRITE;
                 break;
 
@@ -310,7 +307,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
                 /* Add header length to get the full size of the buffer */
 
                 buffer_length += ACPI_SERIAL_HEADER_SIZE;
-                data_length = source_desc->buffer.pointer[1];
                 function = ACPI_WRITE | (accessor_type << 16);
                 break;
 
@@ -318,20 +314,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
                 return_ACPI_STATUS(AE_AML_INVALID_SPACE_ID);
         }
 
-#if 0
-        OBSOLETE ?
-            /* Check for possible buffer overflow */
-            if (data_length > source_desc->buffer.length) {
-                ACPI_ERROR((AE_INFO,
-                            "Length in buffer header (%u)(%u) is greater than "
-                            "the physical buffer length (%u) and will overflow",
-                            data_length, buffer_length,
-                            source_desc->buffer.length));
-
-                return_ACPI_STATUS(AE_AML_BUFFER_LIMIT);
-        }
-#endif
-
         /* Create the transfer/bidirectional/return buffer */
 
         buffer_desc = acpi_ut_create_buffer_object(buffer_length);
@@ -342,7 +324,8 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
         /* Copy the input buffer data to the transfer buffer */
 
         buffer = buffer_desc->buffer.pointer;
-        memcpy(buffer, source_desc->buffer.pointer, data_length);
+        memcpy(buffer, source_desc->buffer.pointer,
+               min(buffer_length, source_desc->buffer.length));
 
         /* Lock entire transaction if requested */
 
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 2a361e22d38d..70f4e80b9246 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
  */
 static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
 {
-        struct acpi_iort_node *node, *msi_parent;
+        struct acpi_iort_node *node, *msi_parent = NULL;
         struct fwnode_handle *iort_fwnode;
         struct acpi_iort_its_group *its;
         int i;
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index f8c638f3c946..14d9f5bea015 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2928,9 +2928,9 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc)
                 return rc;
 
         if (ars_status_process_records(acpi_desc))
-                return -ENOMEM;
+                dev_err(acpi_desc->dev, "Failed to process ARS records\n");
 
-        return 0;
+        return rc;
 }
 
 static int ars_register(struct acpi_nfit_desc *acpi_desc,
@@ -3341,8 +3341,6 @@ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
                 struct nvdimm *nvdimm, unsigned int cmd)
 {
         struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
-        struct nfit_spa *nfit_spa;
-        int rc = 0;
 
         if (nvdimm)
                 return 0;
@@ -3355,17 +3353,10 @@ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
          * just needs guarantees that any ARS it initiates are not
          * interrupted by any intervening start requests from userspace.
          */
-        mutex_lock(&acpi_desc->init_mutex);
-        list_for_each_entry(nfit_spa, &acpi_desc->spas, list)
-                if (acpi_desc->scrub_spa
-                                || test_bit(ARS_REQ_SHORT, &nfit_spa->ars_state)
-                                || test_bit(ARS_REQ_LONG, &nfit_spa->ars_state)) {
-                        rc = -EBUSY;
-                        break;
-                }
-        mutex_unlock(&acpi_desc->init_mutex);
+        if (work_busy(&acpi_desc->dwork.work))
+                return -EBUSY;
 
-        return rc;
+        return 0;
 }
 
 int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index e9626bf6ca29..d6c1b10f6c25 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -25,8 +25,12 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
         struct acpi_nfit_desc *acpi_desc;
         struct nfit_spa *nfit_spa;
 
-        /* We only care about memory errors */
-        if (!mce_is_memory_error(mce))
+        /* We only care about uncorrectable memory errors */
+        if (!mce_is_memory_error(mce) || mce_is_correctable(mce))
+                return NOTIFY_DONE;
+
+        /* Verify the address reported in the MCE is valid. */
+        if (!mce_usable_address(mce))
                 return NOTIFY_DONE;
 
         /*
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cb30a524d16d..9f1000d2a40c 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2974,7 +2974,6 @@ static void binder_transaction(struct binder_proc *proc,
                 t->buffer = NULL;
                 goto err_binder_alloc_buf_failed;
         }
-        t->buffer->allow_user_free = 0;
         t->buffer->debug_id = t->debug_id;
         t->buffer->transaction = t;
         t->buffer->target_node = target_node;
@@ -3510,14 +3509,18 @@ static int binder_thread_write(struct binder_proc *proc,
 
                         buffer = binder_alloc_prepare_to_free(&proc->alloc,
                                                               data_ptr);
-                        if (buffer == NULL) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
-                                break;
-                        }
-                        if (!buffer->allow_user_free) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
+                        if (IS_ERR_OR_NULL(buffer)) {
+                                if (PTR_ERR(buffer) == -EPERM) {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                } else {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx no match\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                }
                                 break;
                         }
                         binder_debug(BINDER_DEBUG_FREE_BUFFER,
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 64fd96eada31..030c98f35cca 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -151,16 +151,12 @@ static struct binder_buffer *binder_alloc_prepare_to_free_locked(
                 else {
                         /*
                          * Guard against user threads attempting to
-                         * free the buffer twice
+                         * free the buffer when in use by kernel or
+                         * after it's already been freed.
                          */
-                        if (buffer->free_in_progress) {
-                                binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
-                                                   "%d:%d FREE_BUFFER u%016llx user freed buffer twice\n",
-                                                   alloc->pid, current->pid,
-                                                   (u64)user_ptr);
-                                return NULL;
-                        }
-                        buffer->free_in_progress = 1;
+                        if (!buffer->allow_user_free)
+                                return ERR_PTR(-EPERM);
+                        buffer->allow_user_free = 0;
                         return buffer;
                 }
         }
@@ -500,7 +496,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
 
         rb_erase(best_fit, &alloc->free_buffers);
         buffer->free = 0;
-        buffer->free_in_progress = 0;
+        buffer->allow_user_free = 0;
         binder_insert_allocated_buffer_locked(alloc, buffer);
         binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
                      "%d: binder_alloc_buf size %zd got %pK\n",
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index 9ef64e563856..fb3238c74c8a 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -50,8 +50,7 @@ struct binder_buffer {
         unsigned free:1;
         unsigned allow_user_free:1;
         unsigned async_transaction:1;
-        unsigned free_in_progress:1;
-        unsigned debug_id:28;
+        unsigned debug_id:29;
 
         struct binder_transaction *transaction;
 
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 6e594644cb1d..b8c3f9e6af89 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4553,7 +4553,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* These specific Samsung models/firmware-revs do not handle LPM well */
         { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
         { "SAMSUNG SSD PM830 mSATA *",  "CXM13D1Q", ATA_HORKAGE_NOLPM, },
-        { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
+        { "SAMSUNG MZ7TD256HAFV-000L9", NULL,       ATA_HORKAGE_NOLPM, },
 
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500IT_*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
@@ -4602,6 +4602,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SSD*INTEL*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Samsung*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "SAMSUNG*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "SAMSUNG*MZ7KM*",             NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "ST[1248][0248]0[FH]*",       NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
 
         /*
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 10ecb232245d..4b1ff5bc256a 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -1,14 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Renesas R-Car SATA driver
  *
  * Author: Vladimir Barinov <source@cogentembedded.com>
  * Copyright (C) 2013-2015 Cogent Embedded, Inc.
  * Copyright (C) 2013-2015 Renesas Solutions Corp.
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 4e46dc9e41ad..11e1663bdc4d 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1410,7 +1410,7 @@ static int init_q(struct fs_dev *dev, struct queue *txq, int queue,
 
         func_enter ();
 
-        fs_dprintk (FS_DEBUG_INIT, "Inititing queue at %x: %d entries:\n", 
+        fs_dprintk (FS_DEBUG_INIT, "Initializing queue at %x: %d entries:\n",
                     queue, nentries);
 
         p = aligned_kmalloc (sz, GFP_KERNEL, 0x10);
@@ -1443,7 +1443,7 @@ static int init_fp(struct fs_dev *dev, struct freepool *fp, int queue,
 {
         func_enter ();
 
-        fs_dprintk (FS_DEBUG_INIT, "Inititing free pool at %x:\n", queue);
+        fs_dprintk (FS_DEBUG_INIT, "Initializing free pool at %x:\n", queue);
 
         write_fs (dev, FP_CNF(queue), (bufsize * RBFP_RBS) | RBFP_RBSVAL | RBFP_CME);
         write_fs (dev, FP_SA(queue),  0);
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index 4aaf00d2098b..e038e2b3b7ea 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -26,8 +26,14 @@ struct devres_node {
 
 struct devres {
         struct devres_node              node;
-        /* -- 3 pointers */
-        unsigned long long              data[]; /* guarantee ull alignment */
+        /*
+         * Some archs want to perform DMA into kmalloc caches
+         * and need a guaranteed alignment larger than
+         * the alignment of a 64-bit integer.
+         * Thus we use ARCH_KMALLOC_MINALIGN here and get exactly the same
+         * buffer alignment as if it was allocated by plain kmalloc().
+         */
+        u8 __aligned(ARCH_KMALLOC_MINALIGN) data[];
 };
 
 struct devres_group {
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index a8cfa011c284..fb23578e9a41 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4148,10 +4148,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive)
         bio.bi_end_io = floppy_rb0_cb;
         bio_set_op_attrs(&bio, REQ_OP_READ, 0);
 
+        init_completion(&cbdata.complete);
+
         submit_bio(&bio);
         process_fd_request();
 
-        init_completion(&cbdata.complete);
         wait_for_completion(&cbdata.complete);
 
         __free_page(page);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 56452cabce5b..0ed4b200fa58 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1919,6 +1919,7 @@ static int negotiate_mq(struct blkfront_info *info)
                               GFP_KERNEL);
         if (!info->rinfo) {
                 xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
+                info->nr_rings = 0;
                 return -ENOMEM;
         }
 
diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
index ef0ca9414f37..ff83e899df71 100644
--- a/drivers/clk/clk-fixed-factor.c
+++ b/drivers/clk/clk-fixed-factor.c
@@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev)
 {
         struct clk *clk = platform_get_drvdata(pdev);
 
+        of_clk_del_provider(pdev->dev.of_node);
         clk_unregister_fixed_factor(clk);
 
         return 0;
diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
index c981159b02c0..792735d7e46e 100644
--- a/drivers/clk/meson/axg.c
+++ b/drivers/clk/meson/axg.c
@@ -325,6 +325,7 @@ static struct clk_regmap axg_fclk_div2 = {
                 .ops = &clk_regmap_gate_ops,
                 .parent_names = (const char *[]){ "fclk_div2_div" },
                 .num_parents = 1,
+                .flags = CLK_IS_CRITICAL,
         },
 };
 
@@ -349,6 +350,18 @@ static struct clk_regmap axg_fclk_div3 = {
                 .ops = &clk_regmap_gate_ops,
                 .parent_names = (const char *[]){ "fclk_div3_div" },
                 .num_parents = 1,
+                /*
+                 * FIXME:
+                 * This clock, as fdiv2, is used by the SCPI FW and is required
+                 * by the platform to operate correctly.
+                 * Until the following condition are met, we need this clock to
+                 * be marked as critical:
+                 * a) The SCPI generic driver claims and enable all the clocks
+                 *    it needs
+                 * b) CCF has a clock hand-off mechanism to make the sure the
+                 *    clock stays on until the proper driver comes along
+                 */
+                .flags = CLK_IS_CRITICAL,
         },
 };
 
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 9309cfaaa464..4ada9668fd49 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -506,6 +506,18 @@ static struct clk_regmap gxbb_fclk_div3 = {
                 .ops = &clk_regmap_gate_ops,
                 .parent_names = (const char *[]){ "fclk_div3_div" },
                 .num_parents = 1,
+                /*
+                 * FIXME:
+                 * This clock, as fdiv2, is used by the SCPI FW and is required
+                 * by the platform to operate correctly.
+                 * Until the following condition are met, we need this clock to
+                 * be marked as critical:
+                 * a) The SCPI generic driver claims and enable all the clocks
+                 *    it needs
+                 * b) CCF has a clock hand-off mechanism to make the sure the
+                 *    clock stays on until the proper driver comes along
+                 */
+                .flags = CLK_IS_CRITICAL,
         },
 };
 
diff --git a/drivers/clk/qcom/gcc-qcs404.c b/drivers/clk/qcom/gcc-qcs404.c
index e4ca6a45f313..ef1b267cb058 100644
--- a/drivers/clk/qcom/gcc-qcs404.c
+++ b/drivers/clk/qcom/gcc-qcs404.c
@@ -265,7 +265,7 @@ static struct clk_fixed_factor cxo = {
         .div = 1,
         .hw.init = &(struct clk_init_data){
                 .name = "cxo",
-                .parent_names = (const char *[]){ "xo_board" },
+                .parent_names = (const char *[]){ "xo-board" },
                 .num_parents = 1,
                 .ops = &clk_fixed_factor_ops,
         },
diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c
index 9c38895542f4..d4350bb10b83 100644
--- a/drivers/clocksource/i8253.c
+++ b/drivers/clocksource/i8253.c
@@ -20,6 +20,13 @@
 DEFINE_RAW_SPINLOCK(i8253_lock);
 EXPORT_SYMBOL(i8253_lock);
 
+/*
+ * Handle PIT quirk in pit_shutdown() where zeroing the counter register
+ * restarts the PIT, negating the shutdown. On platforms with the quirk,
+ * platform specific code can set this to false.
+ */
+bool i8253_clear_counter_on_shutdown __ro_after_init = true;
+
 #ifdef CONFIG_CLKSRC_I8253
 /*
  * Since the PIT overflows every tick, its not very useful
@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_event_device *evt)
         raw_spin_lock(&i8253_lock);
 
         outb_p(0x30, PIT_MODE);
-        outb_p(0, PIT_CH0);
-        outb_p(0, PIT_CH0);
+
+        if (i8253_clear_counter_on_shutdown) {
+                outb_p(0, PIT_CH0);
+                outb_p(0, PIT_CH0);
+        }
 
         raw_spin_unlock(&i8253_lock);
         return 0;
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 8cfee0ab804b..d8c3595e9023 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -160,8 +160,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
         /* Ensure the arm clock divider is what we expect */
         ret = clk_set_rate(clks[ARM].clk, new_freq * 1000);
         if (ret) {
+                int ret1;
+
                 dev_err(cpu_dev, "failed to set clock rate: %d\n", ret);
-                regulator_set_voltage_tol(arm_reg, volt_old, 0);
+                ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0);
+                if (ret1)
+                        dev_warn(cpu_dev,
+                                 "failed to restore vddarm voltage: %d\n", ret1);
                 return ret;
         }
 
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index 3f0e2a14895a..22b53bf26817 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -201,19 +201,28 @@ static const struct of_device_id ti_cpufreq_of_match[] = {
         {},
 };
 
+static const struct of_device_id *ti_cpufreq_match_node(void)
+{
+        struct device_node *np;
+        const struct of_device_id *match;
+
+        np = of_find_node_by_path("/");
+        match = of_match_node(ti_cpufreq_of_match, np);
+        of_node_put(np);
+
+        return match;
+}
+
 static int ti_cpufreq_probe(struct platform_device *pdev)
 {
         u32 version[VERSION_COUNT];
-        struct device_node *np;
         const struct of_device_id *match;
         struct opp_table *ti_opp_table;
         struct ti_cpufreq_data *opp_data;
         const char * const reg_names[] = {"vdd", "vbb"};
         int ret;
 
-        np = of_find_node_by_path("/");
-        match = of_match_node(ti_cpufreq_of_match, np);
-        of_node_put(np);
+        match = dev_get_platdata(&pdev->dev);
         if (!match)
                 return -ENODEV;
 
@@ -290,7 +299,14 @@ fail_put_node:
 
 static int ti_cpufreq_init(void)
 {
-        platform_device_register_simple("ti-cpufreq", -1, NULL, 0);
+        const struct of_device_id *match;
+
+        /* Check to ensure we are on a compatible platform */
+        match = ti_cpufreq_match_node();
+        if (match)
+                platform_device_register_data(NULL, "ti-cpufreq", -1, match,
+                                              sizeof(*match));
+
         return 0;
 }
 module_init(ti_cpufreq_init);
diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
index 073557f433eb..3a407a3ef22b 100644
--- a/drivers/cpuidle/cpuidle-arm.c
+++ b/drivers/cpuidle/cpuidle-arm.c
@@ -82,7 +82,6 @@ static int __init arm_idle_init_cpu(int cpu)
 {
         int ret;
         struct cpuidle_driver *drv;
-        struct cpuidle_device *dev;
 
         drv = kmemdup(&arm_idle_driver, sizeof(*drv), GFP_KERNEL);
         if (!drv)
@@ -103,13 +102,6 @@ static int __init arm_idle_init_cpu(int cpu)
                 goto out_kfree_drv;
         }
 
-        ret = cpuidle_register_driver(drv);
-        if (ret) {
-                if (ret != -EBUSY)
-                        pr_err("Failed to register cpuidle driver\n");
-                goto out_kfree_drv;
-        }
-
         /*
          * Call arch CPU operations in order to initialize
          * idle states suspend back-end specific data
@@ -117,37 +109,21 @@ static int __init arm_idle_init_cpu(int cpu)
         ret = arm_cpuidle_init(cpu);
 
         /*
-         * Skip the cpuidle device initialization if the reported
+         * Allow the initialization to continue for other CPUs, if the reported
          * failure is a HW misconfiguration/breakage (-ENXIO).
          */
-        if (ret == -ENXIO)
-                return 0;
-
         if (ret) {
                 pr_err("CPU %d failed to init idle CPU ops\n", cpu);
-                goto out_unregister_drv;
-        }
-
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
-        if (!dev) {
-                ret = -ENOMEM;
-                goto out_unregister_drv;
+                ret = ret == -ENXIO ? 0 : ret;
+                goto out_kfree_drv;
         }
-        dev->cpu = cpu;
 
-        ret = cpuidle_register_device(dev);
-        if (ret) {
-                pr_err("Failed to register cpuidle device for CPU %d\n",
-                       cpu);
-                goto out_kfree_dev;
-        }
+        ret = cpuidle_register(drv, NULL);
+        if (ret)
+                goto out_kfree_drv;
 
         return 0;
 
-out_kfree_dev:
-        kfree(dev);
-out_unregister_drv:
-        cpuidle_unregister_driver(drv);
 out_kfree_drv:
         kfree(drv);
         return ret;
@@ -178,9 +154,7 @@ out_fail:
         while (--cpu >= 0) {
                 dev = per_cpu(cpuidle_devices, cpu);
                 drv = cpuidle_get_cpu_driver(dev);
-                cpuidle_unregister_device(dev);
-                cpuidle_unregister_driver(drv);
-                kfree(dev);
+                cpuidle_unregister(drv);
                 kfree(drv);
         }
 
diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
index f7d6d690116e..cdc4f9a171d9 100644
--- a/drivers/crypto/hisilicon/sec/sec_algs.c
+++ b/drivers/crypto/hisilicon/sec/sec_algs.c
@@ -732,6 +732,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
         int *splits_in_nents;
         int *splits_out_nents = NULL;
         struct sec_request_el *el, *temp;
+        bool split = skreq->src != skreq->dst;
 
         mutex_init(&sec_req->lock);
         sec_req->req_base = &skreq->base;
@@ -750,7 +751,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
         if (ret)
                 goto err_free_split_sizes;
 
-        if (skreq->src != skreq->dst) {
+        if (split) {
                 sec_req->len_out = sg_nents(skreq->dst);
                 ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps,
                                            &splits_out, &splits_out_nents,
@@ -785,8 +786,9 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
                                                split_sizes[i],
                                                skreq->src != skreq->dst,
                                                splits_in[i], splits_in_nents[i],
-                                               splits_out[i],
-                                               splits_out_nents[i], info);
+                                               split ? splits_out[i] : NULL,
+                                               split ? splits_out_nents[i] : 0,
+                                               info);
                 if (IS_ERR(el)) {
                         ret = PTR_ERR(el);
                         goto err_free_elements;
@@ -806,13 +808,6 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
          * more refined but this is unlikely to happen so no need.
          */
 
-        /* Cleanup - all elements in pointer arrays have been coppied */
-        kfree(splits_in_nents);
-        kfree(splits_in);
-        kfree(splits_out_nents);
-        kfree(splits_out);
-        kfree(split_sizes);
-
         /* Grab a big lock for a long time to avoid concurrency issues */
         mutex_lock(&queue->queuelock);
 
@@ -827,13 +822,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
              (!queue->havesoftqueue ||
               kfifo_avail(&queue->softqueue) > steps)) ||
             !list_empty(&ctx->backlog)) {
+                ret = -EBUSY;
                 if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) {
                         list_add_tail(&sec_req->backlog_head, &ctx->backlog);
                         mutex_unlock(&queue->queuelock);
-                        return -EBUSY;
+                        goto out;
                 }
 
-                ret = -EBUSY;
                 mutex_unlock(&queue->queuelock);
                 goto err_free_elements;
         }
@@ -842,7 +837,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
         if (ret)
                 goto err_free_elements;
 
-        return -EINPROGRESS;
+        ret = -EINPROGRESS;
+out:
+        /* Cleanup - all elements in pointer arrays have been copied */
+        kfree(splits_in_nents);
+        kfree(splits_in);
+        kfree(splits_out_nents);
+        kfree(splits_out);
+        kfree(split_sizes);
+        return ret;
 
 err_free_elements:
         list_for_each_entry_safe(el, temp, &sec_req->elements, head) {
@@ -854,7 +857,7 @@ err_free_elements:
                                  crypto_skcipher_ivsize(atfm),
                                  DMA_BIDIRECTIONAL);
 err_unmap_out_sg:
-        if (skreq->src != skreq->dst)
+        if (split)
                 sec_unmap_sg_on_err(skreq->dst, steps, splits_out,
                                     splits_out_nents, sec_req->len_out,
                                     info->dev);
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 5b44ef226904..fc359ca4503d 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -184,6 +184,7 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
         exp_info.ops  = &udmabuf_ops;
         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
         exp_info.priv = ubuf;
+        exp_info.flags = O_RDWR;
 
         buf = dma_buf_export(&exp_info);
         if (IS_ERR(buf)) {
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 7cbac6e8c113..01d936c9fe89 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1641,6 +1641,12 @@ static void atc_free_chan_resources(struct dma_chan *chan)
         atchan->descs_allocated = 0;
         atchan->status = 0;
 
+        /*
+         * Free atslave allocated in at_dma_xlate()
+         */
+        kfree(chan->private);
+        chan->private = NULL;
+
         dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
 }
 
@@ -1675,7 +1681,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
         dma_cap_zero(mask);
         dma_cap_set(DMA_SLAVE, mask);
 
-        atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL);
+        atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
         if (!atslave)
                 return NULL;
 
@@ -2000,6 +2006,8 @@ static int at_dma_remove(struct platform_device *pdev)
         struct resource         *io;
 
         at_dma_off(atdma);
+        if (pdev->dev.of_node)
+                of_dma_controller_free(pdev->dev.of_node);
         dma_async_device_unregister(&atdma->dma_common);
 
         dma_pool_destroy(atdma->memset_pool);
diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
index 388a929baf95..1a6a77df8a5e 100644
--- a/drivers/firmware/efi/arm-init.c
+++ b/drivers/firmware/efi/arm-init.c
@@ -265,6 +265,10 @@ void __init efi_init(void)
                                     (params.mmap & ~PAGE_MASK)));
 
         init_screen_info();
+
+        /* ARM does not permit early mappings to persist across paging_init() */
+        if (IS_ENABLED(CONFIG_ARM))
+                efi_memmap_unmap();
 }
 
 static int __init register_gop_device(void)
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 922cfb813109..a00934d263c5 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void)
 {
         u64 mapsize;
 
-        if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
+        if (!efi_enabled(EFI_BOOT)) {
                 pr_info("EFI services will not be available.\n");
                 return 0;
         }
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 249eb70691b0..415849bab233 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -592,7 +592,11 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
 
                 early_memunmap(tbl, sizeof(*tbl));
         }
+        return 0;
+}
 
+int __init efi_apply_persistent_mem_reservations(void)
+{
         if (efi.mem_reserve != EFI_INVALID_TABLE_ADDR) {
                 unsigned long prsv = efi.mem_reserve;
 
@@ -963,36 +967,59 @@ bool efi_is_table_address(unsigned long phys_addr)
 }
 
 static DEFINE_SPINLOCK(efi_mem_reserve_persistent_lock);
+static struct linux_efi_memreserve *efi_memreserve_root __ro_after_init;
 
-int efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
+static int __init efi_memreserve_map_root(void)
 {
-        struct linux_efi_memreserve *rsv, *parent;
-
         if (efi.mem_reserve == EFI_INVALID_TABLE_ADDR)
                 return -ENODEV;
 
-        rsv = kmalloc(sizeof(*rsv), GFP_KERNEL);
-        if (!rsv)
+        efi_memreserve_root = memremap(efi.mem_reserve,
+                                       sizeof(*efi_memreserve_root),
+                                       MEMREMAP_WB);
+        if (WARN_ON_ONCE(!efi_memreserve_root))
                 return -ENOMEM;
+        return 0;
+}
 
-        parent = memremap(efi.mem_reserve, sizeof(*rsv), MEMREMAP_WB);
-        if (!parent) {
-                kfree(rsv);
-                return -ENOMEM;
+int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
+{
+        struct linux_efi_memreserve *rsv;
+        int rc;
+
+        if (efi_memreserve_root == (void *)ULONG_MAX)
+                return -ENODEV;
+
+        if (!efi_memreserve_root) {
+                rc = efi_memreserve_map_root();
+                if (rc)
+                        return rc;
         }
 
+        rsv = kmalloc(sizeof(*rsv), GFP_ATOMIC);
+        if (!rsv)
+                return -ENOMEM;
+
         rsv->base = addr;
         rsv->size = size;
 
         spin_lock(&efi_mem_reserve_persistent_lock);
-        rsv->next = parent->next;
-        parent->next = __pa(rsv);
+        rsv->next = efi_memreserve_root->next;
+        efi_memreserve_root->next = __pa(rsv);
         spin_unlock(&efi_mem_reserve_persistent_lock);
 
-        memunmap(parent);
+        return 0;
+}
 
+static int __init efi_memreserve_root_init(void)
+{
+        if (efi_memreserve_root)
+                return 0;
+        if (efi_memreserve_map_root())
+                efi_memreserve_root = (void *)ULONG_MAX;
         return 0;
 }
+early_initcall(efi_memreserve_root_init);
 
 #ifdef CONFIG_KEXEC
 static int update_efi_random_seed(struct notifier_block *nb,
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 30ac0c975f8a..3d36142cf812 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -75,6 +75,9 @@ void install_memreserve_table(efi_system_table_t *sys_table_arg)
         efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID;
         efi_status_t status;
 
+        if (IS_ENABLED(CONFIG_ARM))
+                return;
+
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv),
                                 (void **)&rsv);
         if (status != EFI_SUCCESS) {
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index 8830fa601e45..0c0d2312f4a8 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
                         return efi_status;
                 }
         }
+
+        /* shrink the FDT back to its minimum size */
+        fdt_pack(fdt);
+
         return EFI_SUCCESS;
 
 fdt_set_fail:
diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c
index fa2904fb841f..38b686c67b17 100644
--- a/drivers/firmware/efi/memmap.c
+++ b/drivers/firmware/efi/memmap.c
@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data)
 
 void __init efi_memmap_unmap(void)
 {
+        if (!efi_enabled(EFI_MEMMAP))
+                return;
+
         if (!efi.memmap.late) {
                 unsigned long size;
 
diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index a19d845bdb06..8903b9ccfc2b 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -67,7 +67,7 @@ struct efi_runtime_work efi_rts_work;
         }                                                               \
                                                                         \
         init_completion(&efi_rts_work.efi_rts_comp);                    \
-        INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts);            \
+        INIT_WORK(&efi_rts_work.work, efi_call_rts);                    \
         efi_rts_work.arg1 = _arg1;                                      \
         efi_rts_work.arg2 = _arg2;                                      \
         efi_rts_work.arg3 = _arg3;                                      \
diff --git a/drivers/fsi/Kconfig b/drivers/fsi/Kconfig
index af3a20dd5aa4..99c99a5d57fe 100644
--- a/drivers/fsi/Kconfig
+++ b/drivers/fsi/Kconfig
@@ -46,6 +46,7 @@ config FSI_MASTER_AST_CF
         tristate "FSI master based on Aspeed ColdFire coprocessor"
         depends on GPIOLIB
         depends on GPIO_ASPEED
+        select GENERIC_ALLOCATOR
         ---help---
         This option enables a FSI master using the AST2400 and AST2500 GPIO
         lines driven by the internal ColdFire coprocessor. This requires
diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
index df94021dd9d1..81dc01ac2351 100644
--- a/drivers/fsi/fsi-scom.c
+++ b/drivers/fsi/fsi-scom.c
@@ -20,7 +20,6 @@
 #include <linux/fs.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
-#include <linux/cdev.h>
 #include <linux/list.h>
 
 #include <uapi/linux/fsi.h>
diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c
index b01ba4438501..31e891f00175 100644
--- a/drivers/gnss/serial.c
+++ b/drivers/gnss/serial.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 
@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
index 79cb98950013..71d014edd167 100644
--- a/drivers/gnss/sirf.c
+++ b/drivers/gnss/sirf.c
@@ -16,6 +16,7 @@
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 5c1564fcc24e..bdb29e51b417 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -258,7 +258,7 @@ static int davinci_gpio_probe(struct platform_device *pdev)
         chips->chip.set = davinci_gpio_set;
 
         chips->chip.ngpio = ngpio;
-        chips->chip.base = -1;
+        chips->chip.base = pdata->no_auto_base ? pdata->base : -1;
 
 #ifdef CONFIG_OF_GPIO
         chips->chip.of_gpio_n_cells = 2;
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 8269cffc2967..6a50f9f59c90 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -35,8 +35,8 @@
 #define gpio_mockup_err(...)    pr_err(GPIO_MOCKUP_NAME ": " __VA_ARGS__)
 
 enum {
-        GPIO_MOCKUP_DIR_OUT = 0,
-        GPIO_MOCKUP_DIR_IN = 1,
+        GPIO_MOCKUP_DIR_IN = 0,
+        GPIO_MOCKUP_DIR_OUT = 1,
 };
 
 /*
@@ -131,7 +131,7 @@ static int gpio_mockup_get_direction(struct gpio_chip *gc, unsigned int offset)
 {
         struct gpio_mockup_chip *chip = gpiochip_get_data(gc);
 
-        return chip->lines[offset].dir;
+        return !chip->lines[offset].dir;
 }
 
 static int gpio_mockup_to_irq(struct gpio_chip *gc, unsigned int offset)
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index bfe4c5c9f41c..e9600b556f39 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -268,8 +268,8 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 
         if (pxa_gpio_has_pinctrl()) {
                 ret = pinctrl_gpio_direction_input(chip->base + offset);
-                if (!ret)
-                        return 0;
+                if (ret)
+                        return ret;
         }
 
         spin_lock_irqsave(&gpio_lock, flags);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 230e41562462..a2cbb474901c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1295,7 +1295,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL);
         if (!gdev->descs) {
                 status = -ENOMEM;
-                goto err_free_gdev;
+                goto err_free_ida;
         }
 
         if (chip->ngpio == 0) {
@@ -1427,8 +1427,9 @@ err_free_label:
         kfree_const(gdev->label);
 err_free_descs:
         kfree(gdev->descs);
-err_free_gdev:
+err_free_ida:
         ida_simple_remove(&gpio_ida, gdev->id);
+err_free_gdev:
         /* failures here can mean systems won't boot... */
         pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
                gdev->base, gdev->base + gdev->ngpio - 1,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index d0102cfc8efb..104b2e0d893b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -151,6 +151,7 @@ extern int amdgpu_compute_multipipe;
 extern int amdgpu_gpu_recovery;
 extern int amdgpu_emu_mode;
 extern uint amdgpu_smu_memory_pool_size;
+extern uint amdgpu_dc_feature_mask;
 extern struct amdgpu_mgpu_info mgpu_info;
 
 #ifdef CONFIG_DRM_AMDGPU_SI
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index c31a8849e9f8..1580ec60b89f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -501,8 +501,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
 
-        amdgpu_dpm_switch_power_profile(adev,
-                                        PP_SMC_POWER_PROFILE_COMPUTE, !idle);
+        if (adev->powerplay.pp_funcs &&
+            adev->powerplay.pp_funcs->switch_power_profile)
+                amdgpu_dpm_switch_power_profile(adev,
+                                                PP_SMC_POWER_PROFILE_COMPUTE,
+                                                !idle);
 }
 
 bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 6748cd7fc129..686a26de50f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -626,6 +626,13 @@ int amdgpu_display_modeset_create_props(struct amdgpu_device *adev)
                                          "dither",
                                          amdgpu_dither_enum_list, sz);
 
+        if (amdgpu_device_has_dc_support(adev)) {
+                adev->mode_info.max_bpc_property =
+                        drm_property_create_range(adev->ddev, 0, "max bpc", 8, 16);
+                if (!adev->mode_info.max_bpc_property)
+                        return -ENOMEM;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 943dbf3c5da1..8de55f7f1a3a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -127,6 +127,9 @@ int amdgpu_compute_multipipe = -1;
 int amdgpu_gpu_recovery = -1; /* auto */
 int amdgpu_emu_mode = 0;
 uint amdgpu_smu_memory_pool_size = 0;
+/* FBC (bit 0) disabled by default*/
+uint amdgpu_dc_feature_mask = 0;
+
 struct amdgpu_mgpu_info mgpu_info = {
         .mutex = __MUTEX_INITIALIZER(mgpu_info.mutex),
 };
@@ -631,6 +634,14 @@ module_param(halt_if_hws_hang, int, 0644);
 MODULE_PARM_DESC(halt_if_hws_hang, "Halt if HWS hang is detected (0 = off (default), 1 = on)");
 #endif
 
+/**
+ * DOC: dcfeaturemask (uint)
+ * Override display features enabled. See enum DC_FEATURE_MASK in drivers/gpu/drm/amd/include/amd_shared.h.
+ * The default is the current set of stable display features.
+ */
+MODULE_PARM_DESC(dcfeaturemask, "all stable DC features enabled (default))");
+module_param_named(dcfeaturemask, amdgpu_dc_feature_mask, uint, 0444);
+
 static const struct pci_device_id pciidlist[] = {
 #ifdef  CONFIG_DRM_AMDGPU_SI
         {0x1002, 0x6780, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI},
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index b9e9e8b02fb7..d1b4d9b6aae0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -339,6 +339,8 @@ struct amdgpu_mode_info {
         struct drm_property *audio_property;
         /* FMT dithering */
         struct drm_property *dither_property;
+        /* maximum number of bits per channel for monitor color */
+        struct drm_property *max_bpc_property;
         /* hardcoded DFP edid from BIOS */
         struct edid *bios_hardcoded_edid;
         int bios_hardcoded_edid_size;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 352b30409060..0877ff9a9594 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -181,7 +181,7 @@ static unsigned amdgpu_vm_num_entries(struct amdgpu_device *adev,
 
         if (level == adev->vm_manager.root_level)
                 /* For the root directory */
-                return round_up(adev->vm_manager.max_pfn, 1 << shift) >> shift;
+                return round_up(adev->vm_manager.max_pfn, 1ULL << shift) >> shift;
         else if (level != AMDGPU_VM_PTB)
                 /* Everything in between */
                 return 512;
@@ -1632,13 +1632,6 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                         continue;
                 }
 
-                /* First check if the entry is already handled */
-                if (cursor.pfn < frag_start) {
-                        cursor.entry->huge = true;
-                        amdgpu_vm_pt_next(adev, &cursor);
-                        continue;
-                }
-
                 /* If it isn't already handled it can't be a huge page */
                 if (cursor.entry->huge) {
                         /* Add the entry to the relocated list to update it. */
@@ -1663,9 +1656,11 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                         if (!amdgpu_vm_pt_descendant(adev, &cursor))
                                 return -ENOENT;
                         continue;
-                } else if (frag >= parent_shift) {
+                } else if (frag >= parent_shift &&
+                           cursor.level - 1 != adev->vm_manager.root_level) {
                         /* If the fragment size is even larger than the parent
-                         * shift we should go up one level and check it again.
+                         * shift we should go up one level and check it again
+                         * unless one level up is the root level.
                          */
                         if (!amdgpu_vm_pt_ancestor(&cursor))
                                 return -ENOENT;
@@ -1673,10 +1668,10 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                 }
 
                 /* Looks good so far, calculate parameters for the update */
-                incr = AMDGPU_GPU_PAGE_SIZE << shift;
+                incr = (uint64_t)AMDGPU_GPU_PAGE_SIZE << shift;
                 mask = amdgpu_vm_entries_mask(adev, cursor.level);
                 pe_start = ((cursor.pfn >> shift) & mask) * 8;
-                entry_end = (mask + 1) << shift;
+                entry_end = (uint64_t)(mask + 1) << shift;
                 entry_end += cursor.pfn & ~(entry_end - 1);
                 entry_end = min(entry_end, end);
 
@@ -1689,7 +1684,7 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                                               flags | AMDGPU_PTE_FRAG(frag));
 
                         pe_start += nptes * 8;
-                        dst += nptes * AMDGPU_GPU_PAGE_SIZE << shift;
+                        dst += (uint64_t)nptes * AMDGPU_GPU_PAGE_SIZE << shift;
 
                         frag_start = upd_end;
                         if (frag_start >= frag_end) {
@@ -1701,8 +1696,17 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                         }
                 } while (frag_start < entry_end);
 
-                if (frag >= shift)
+                if (amdgpu_vm_pt_descendant(adev, &cursor)) {
+                        /* Mark all child entries as huge */
+                        while (cursor.pfn < frag_start) {
+                                cursor.entry->huge = true;
+                                amdgpu_vm_pt_next(adev, &cursor);
+                        }
+
+                } else if (frag >= shift) {
+                        /* or just move on to the next on the same level. */
                         amdgpu_vm_pt_next(adev, &cursor);
+                }
         }
 
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 6d7baf59d6e1..21363b2b2ee5 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2440,12 +2440,13 @@ static void gfx_v9_0_rlc_start(struct amdgpu_device *adev)
 #endif
 
         WREG32_FIELD15(GC, 0, RLC_CNTL, RLC_ENABLE_F32, 1);
+        udelay(50);
 
         /* carrizo do enable cp interrupt after cp inited */
-        if (!(adev->flags & AMD_IS_APU))
+        if (!(adev->flags & AMD_IS_APU)) {
                 gfx_v9_0_enable_gui_idle_interrupt(adev, true);
-
-        udelay(50);
+                udelay(50);
+        }
 
 #ifdef AMDGPU_RLC_DEBUG_RETRY
         /* RLC_GPM_GENERAL_6 : RLC Ucode version */
diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
index ceb7847b504f..bfa317ad20a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
@@ -72,7 +72,7 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
 
         /* Program the system aperture low logical page number. */
         WREG32_SOC15(GC, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR,
-                     min(adev->gmc.vram_start, adev->gmc.agp_start) >> 18);
+                     min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18);
 
         if (adev->asic_type == CHIP_RAVEN && adev->rev_id >= 0x8)
                 /*
@@ -82,11 +82,11 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
                  * to get rid of the VM fault and hardware hang.
                  */
                 WREG32_SOC15(GC, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max((adev->gmc.vram_end >> 18) + 0x1,
+                             max((adev->gmc.fb_end >> 18) + 0x1,
                                  adev->gmc.agp_end >> 18));
         else
                 WREG32_SOC15(GC, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max(adev->gmc.vram_end, adev->gmc.agp_end) >> 18);
+                             max(adev->gmc.fb_end, adev->gmc.agp_end) >> 18);
 
         /* Set default page address. */
         value = adev->vram_scratch.gpu_addr - adev->gmc.vram_start
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index e1c2b4e9c7b2..73ad02aea2b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -46,6 +46,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin");
 MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin");
 MODULE_FIRMWARE("amdgpu/verde_mc.bin");
 MODULE_FIRMWARE("amdgpu/oland_mc.bin");
+MODULE_FIRMWARE("amdgpu/hainan_mc.bin");
 MODULE_FIRMWARE("amdgpu/si58_mc.bin");
 
 #define MC_SEQ_MISC0__MT__MASK   0xf0000000
diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
index fd23ba1226a5..a0db67adc34c 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
@@ -90,7 +90,7 @@ static void mmhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
 
         /* Program the system aperture low logical page number. */
         WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR,
-                     min(adev->gmc.vram_start, adev->gmc.agp_start) >> 18);
+                     min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18);
 
         if (adev->asic_type == CHIP_RAVEN && adev->rev_id >= 0x8)
                 /*
@@ -100,11 +100,11 @@ static void mmhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
                  * to get rid of the VM fault and hardware hang.
                  */
                 WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max((adev->gmc.vram_end >> 18) + 0x1,
+                             max((adev->gmc.fb_end >> 18) + 0x1,
                                  adev->gmc.agp_end >> 18));
         else
                 WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max(adev->gmc.vram_end, adev->gmc.agp_end) >> 18);
+                             max(adev->gmc.fb_end, adev->gmc.agp_end) >> 18);
 
         /* Set default page address. */
         value = adev->vram_scratch.gpu_addr - adev->gmc.vram_start +
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index bf5e6a413dee..4cc0dcb1a187 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -65,6 +65,13 @@
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL                                                             0x01ba
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL_BASE_IDX                                                    0
 
+/* for Vega20 register name change */
+#define mmHDP_MEM_POWER_CTRL    0x00d4
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK  0x00000001L
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK    0x00000002L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK   0x00010000L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK             0x00020000L
+#define mmHDP_MEM_POWER_CTRL_BASE_IDX   0
 /*
  * Indirect registers accessor
  */
@@ -870,15 +877,33 @@ static void soc15_update_hdp_light_sleep(struct amdgpu_device *adev, bool enable
 {
         uint32_t def, data;
 
-        def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+        if (adev->asic_type == CHIP_VEGA20) {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL));
 
-        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
-                data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
-        else
-                data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK;
+                else
+                        data &= ~(HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK);
 
-        if (def != data)
-                WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL), data);
+        } else {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                else
+                        data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+        }
 }
 
 static void soc15_update_drm_clock_gating(struct amdgpu_device *adev, bool enable)
diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
index a99f71797aa3..a0fda6f9252a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev)
         else
                 wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4);
         WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off));
-        WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF);
+        WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF);
 
         /* set rptr, wptr to 0 */
         WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0);
diff --git a/drivers/gpu/drm/amd/amdgpu/vega20_reg_init.c b/drivers/gpu/drm/amd/amdgpu/vega20_reg_init.c
index 2d4473557b0d..d13fc4fcb517 100644
--- a/drivers/gpu/drm/amd/amdgpu/vega20_reg_init.c
+++ b/drivers/gpu/drm/amd/amdgpu/vega20_reg_init.c
@@ -49,6 +49,7 @@ int vega20_reg_base_init(struct amdgpu_device *adev)
                 adev->reg_offset[SMUIO_HWIP][i] = (uint32_t *)(&(SMUIO_BASE.instance[i]));
                 adev->reg_offset[NBIF_HWIP][i] = (uint32_t *)(&(NBIO_BASE.instance[i]));
                 adev->reg_offset[THM_HWIP][i] = (uint32_t *)(&(THM_BASE.instance[i]));
+                adev->reg_offset[CLK_HWIP][i] = (uint32_t *)(&(CLK_BASE.instance[i]));
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b0df6dc9a775..ca925200fe09 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -429,6 +429,9 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
             adev->asic_type < CHIP_RAVEN)
                 init_data.flags.gpu_vm_support = true;
 
+        if (amdgpu_dc_feature_mask & DC_FBC_MASK)
+                init_data.flags.fbc_support = true;
+
         /* Display Core create. */
         adev->dm.dc = dc_create(&init_data);
 
@@ -1524,13 +1527,6 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd)
 {
         struct amdgpu_display_manager *dm = bl_get_data(bd);
 
-        /*
-         * PWM interperts 0 as 100% rather than 0% because of HW
-         * limitation for level 0.So limiting minimum brightness level
-         * to 1.
-         */
-        if (bd->props.brightness < 1)
-                return 1;
         if (dc_link_set_backlight_level(dm->backlight_link,
                         bd->props.brightness, 0, 0))
                 return 0;
@@ -2362,8 +2358,15 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
 static enum dc_color_depth
 convert_color_depth_from_display_info(const struct drm_connector *connector)
 {
+        struct dm_connector_state *dm_conn_state =
+                to_dm_connector_state(connector->state);
         uint32_t bpc = connector->display_info.bpc;
 
+        /* TODO: Remove this when there's support for max_bpc in drm */
+        if (dm_conn_state && bpc > dm_conn_state->max_bpc)
+                /* Round down to nearest even number. */
+                bpc = dm_conn_state->max_bpc - (dm_conn_state->max_bpc & 1);
+
         switch (bpc) {
         case 0:
                 /*
@@ -2707,18 +2710,11 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
         drm_connector = &aconnector->base;
 
         if (!aconnector->dc_sink) {
-                /*
-                 * Create dc_sink when necessary to MST
-                 * Don't apply fake_sink to MST
-                 */
-                if (aconnector->mst_port) {
-                        dm_dp_mst_dc_sink_create(drm_connector);
-                        return stream;
+                if (!aconnector->mst_port) {
+                        sink = create_fake_sink(aconnector);
+                        if (!sink)
+                                return stream;
                 }
-
-                sink = create_fake_sink(aconnector);
-                if (!sink)
-                        return stream;
         } else {
                 sink = aconnector->dc_sink;
         }
@@ -2954,6 +2950,9 @@ int amdgpu_dm_connector_atomic_set_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 dm_new_state->underscan_enable = val;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                dm_new_state->max_bpc = val;
+                ret = 0;
         }
 
         return ret;
@@ -2996,6 +2995,9 @@ int amdgpu_dm_connector_atomic_get_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 *val = dm_state->underscan_enable;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                *val = dm_state->max_bpc;
+                ret = 0;
         }
         return ret;
 }
@@ -3308,7 +3310,7 @@ void dm_drm_plane_destroy_state(struct drm_plane *plane,
 static const struct drm_plane_funcs dm_plane_funcs = {
         .update_plane   = drm_atomic_helper_update_plane,
         .disable_plane  = drm_atomic_helper_disable_plane,
-        .destroy        = drm_plane_cleanup,
+        .destroy        = drm_primary_helper_destroy,
         .reset = dm_drm_plane_reset,
         .atomic_duplicate_state = dm_drm_plane_duplicate_state,
         .atomic_destroy_state = dm_drm_plane_destroy_state,
@@ -3806,6 +3808,9 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         drm_object_attach_property(&aconnector->base.base,
                                 adev->mode_info.underscan_vborder_property,
                                 0);
+        drm_object_attach_property(&aconnector->base.base,
+                                adev->mode_info.max_bpc_property,
+                                0);
 
 }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index 978b34a5011c..6e069d777ab2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -160,8 +160,6 @@ struct amdgpu_dm_connector {
         struct mutex hpd_lock;
 
         bool fake_enable;
-
-        bool mst_connected;
 };
 
 #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)
@@ -206,6 +204,7 @@ struct dm_connector_state {
         enum amdgpu_rmx_type scaling;
         uint8_t underscan_vborder;
         uint8_t underscan_hborder;
+        uint8_t max_bpc;
         bool underscan_enable;
         bool freesync_enable;
         bool freesync_capable;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 03601d717fed..1b0d209d8367 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -205,40 +205,6 @@ static const struct drm_connector_funcs dm_dp_mst_connector_funcs = {
         .atomic_get_property = amdgpu_dm_connector_atomic_get_property
 };
 
-void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
-{
-        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
-        struct dc_sink *dc_sink;
-        struct dc_sink_init_data init_params = {
-                        .link = aconnector->dc_link,
-                        .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
-
-        /* FIXME none of this is safe. we shouldn't touch aconnector here in
-         * atomic_check
-         */
-
-        /*
-         * TODO: Need to further figure out why ddc.algo is NULL while MST port exists
-         */
-        if (!aconnector->port || !aconnector->port->aux.ddc.algo)
-                return;
-
-        ASSERT(aconnector->edid);
-
-        dc_sink = dc_link_add_remote_sink(
-                aconnector->dc_link,
-                (uint8_t *)aconnector->edid,
-                (aconnector->edid->extensions + 1) * EDID_LENGTH,
-                &init_params);
-
-        dc_sink->priv = aconnector;
-        aconnector->dc_sink = dc_sink;
-
-        if (aconnector->dc_sink)
-                amdgpu_dm_update_freesync_caps(
-                                connector, aconnector->edid);
-}
-
 static int dm_dp_mst_get_modes(struct drm_connector *connector)
 {
         struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
@@ -319,12 +285,7 @@ dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector)
         struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_encoder *amdgpu_encoder;
         struct drm_encoder *encoder;
-        const struct drm_connector_helper_funcs *connector_funcs =
-                connector->base.helper_private;
-        struct drm_encoder *enc_master =
-                connector_funcs->best_encoder(&connector->base);
 
-        DRM_DEBUG_KMS("enc master is %p\n", enc_master);
         amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL);
         if (!amdgpu_encoder)
                 return NULL;
@@ -354,25 +315,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
         struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_dm_connector *aconnector;
         struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
-
-        drm_connector_list_iter_begin(dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                aconnector = to_amdgpu_dm_connector(connector);
-                if (aconnector->mst_port == master
-                                && !aconnector->port) {
-                        DRM_INFO("DM_MST: reusing connector: %p [id: %d] [master: %p]\n",
-                                                aconnector, connector->base.id, aconnector->mst_port);
-
-                        aconnector->port = port;
-                        drm_connector_set_path_property(connector, pathprop);
-
-                        drm_connector_list_iter_end(&conn_iter);
-                        aconnector->mst_connected = true;
-                        return &aconnector->base;
-                }
-        }
-        drm_connector_list_iter_end(&conn_iter);
 
         aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);
         if (!aconnector)
@@ -400,10 +342,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                 master->connector_id);
 
         aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
+        drm_connector_attach_encoder(&aconnector->base,
+                                     &aconnector->mst_encoder->base);
 
-        /*
-         * TODO: understand why this one is needed
-         */
         drm_object_attach_property(
                 &connector->base,
                 dev->mode_config.path_property,
@@ -421,8 +362,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
          */
         amdgpu_dm_connector_funcs_reset(connector);
 
-        aconnector->mst_connected = true;
-
         DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
                         aconnector, connector->base.id, aconnector->mst_port);
 
@@ -434,6 +373,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
 static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                                         struct drm_connector *connector)
 {
+        struct amdgpu_dm_connector *master = container_of(mgr, struct amdgpu_dm_connector, mst_mgr);
+        struct drm_device *dev = master->base.dev;
+        struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
 
         DRM_INFO("DM_MST: Disabling connector: %p [id: %d] [master: %p]\n",
@@ -447,7 +389,10 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                 aconnector->dc_sink = NULL;
         }
 
-        aconnector->mst_connected = false;
+        drm_connector_unregister(connector);
+        if (adev->mode_info.rfbdev)
+                drm_fb_helper_remove_one_connector(&adev->mode_info.rfbdev->helper, connector);
+        drm_connector_put(connector);
 }
 
 static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
@@ -458,18 +403,10 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
         drm_kms_helper_hotplug_event(dev);
 }
 
-static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
-{
-        mutex_lock(&connector->dev->mode_config.mutex);
-        drm_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
-        mutex_unlock(&connector->dev->mode_config.mutex);
-}
-
 static void dm_dp_mst_register_connector(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct amdgpu_device *adev = dev->dev_private;
-        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
 
         if (adev->mode_info.rfbdev)
                 drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
@@ -477,9 +414,6 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector)
                 DRM_ERROR("adev->mode_info.rfbdev is NULL\n");
 
         drm_connector_register(connector);
-
-        if (aconnector->mst_connected)
-                dm_dp_mst_link_status_reset(connector);
 }
 
 static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
index 8cf51da26657..2da851b40042 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
@@ -31,6 +31,5 @@ struct amdgpu_dm_connector;
 
 void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
                                        struct amdgpu_dm_connector *aconnector);
-void dm_dp_mst_dc_sink_create(struct drm_connector *connector);
 
 #endif
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index fb04a4ad141f..5da2186b3615 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1722,7 +1722,7 @@ static void write_i2c_retimer_setting(
                 i2c_success = i2c_write(pipe_ctx, slave_address,
                                 buffer, sizeof(buffer));
                 RETIMER_REDRIVER_INFO("retimer write to slave_address = 0x%x,\
-                        offset = 0x%d, reg_val = 0x%d, i2c_success = %d\n",
+                        offset = 0x%x, reg_val = 0x%x, i2c_success = %d\n",
                         slave_address, buffer[0], buffer[1], i2c_success?1:0);
                 if (!i2c_success)
                         /* Write failure */
@@ -1734,7 +1734,7 @@ static void write_i2c_retimer_setting(
                 i2c_success = i2c_write(pipe_ctx, slave_address,
                                 buffer, sizeof(buffer));
                 RETIMER_REDRIVER_INFO("retimer write to slave_address = 0x%x,\
-                        offset = 0x%d, reg_val = 0x%d, i2c_success = %d\n",
+                        offset = 0x%x, reg_val = 0x%x, i2c_success = %d\n",
                         slave_address, buffer[0], buffer[1], i2c_success?1:0);
                 if (!i2c_success)
                         /* Write failure */
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 199527171100..b57fa61b3034 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -169,6 +169,7 @@ struct link_training_settings;
 struct dc_config {
         bool gpu_vm_support;
         bool disable_disp_pll_sharing;
+        bool fbc_support;
 };
 
 enum visual_confirm {
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index b75ede5f84f7..b459867a05b2 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1736,7 +1736,12 @@ static void set_static_screen_control(struct pipe_ctx **pipe_ctx,
         if (events->force_trigger)
                 value |= 0x1;
 
-        value |= 0x84;
+        if (num_pipes) {
+                struct dc *dc = pipe_ctx[0]->stream->ctx->dc;
+
+                if (dc->fbc_compressor)
+                        value |= 0x84;
+        }
 
         for (i = 0; i < num_pipes; i++)
                 pipe_ctx[i]->stream_res.tg->funcs->
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
index e3624ca24574..7c9fd9052ee2 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
@@ -1362,7 +1362,8 @@ static bool construct(
                 pool->base.sw_i2cs[i] = NULL;
         }
 
-        dc->fbc_compressor = dce110_compressor_create(ctx);
+        if (dc->config.fbc_support)
+                dc->fbc_compressor = dce110_compressor_create(ctx);
 
         if (!underlay_create(ctx, &pool->base))
                 goto res_create_fail;
diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
index 2083c308007c..470d7b89071a 100644
--- a/drivers/gpu/drm/amd/include/amd_shared.h
+++ b/drivers/gpu/drm/amd/include/amd_shared.h
@@ -133,6 +133,10 @@ enum PP_FEATURE_MASK {
         PP_AVFS_MASK = 0x40000,
 };
 
+enum DC_FEATURE_MASK {
+        DC_FBC_MASK = 0x1,
+};
+
 /**
  * struct amd_ip_funcs - general hooks for managing amdgpu IP Blocks
  */
diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h
index d2e7c0fa96c2..8eb0bb241210 100644
--- a/drivers/gpu/drm/amd/include/atomfirmware.h
+++ b/drivers/gpu/drm/amd/include/atomfirmware.h
@@ -1325,7 +1325,7 @@ struct atom_smu_info_v3_3 {
   struct   atom_common_table_header  table_header;
   uint8_t  smuip_min_ver;
   uint8_t  smuip_max_ver;
-  uint8_t  smu_rsd1;
+  uint8_t  waflclk_ss_mode;
   uint8_t  gpuclk_ss_mode;
   uint16_t sclk_ss_percentage;
   uint16_t sclk_ss_rate_10hz;
@@ -1355,7 +1355,10 @@ struct atom_smu_info_v3_3 {
   uint32_t syspll3_1_vco_freq_10khz;
   uint32_t bootup_fclk_10khz;
   uint32_t bootup_waflclk_10khz;
-  uint32_t reserved[3];
+  uint32_t smu_info_caps;
+  uint16_t waflclk_ss_percentage;    // in unit of 0.001%
+  uint16_t smuinitoffset;
+  uint32_t reserved;
 };
 
 /*
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index ed35ec0341e6..88f6b35ea6fe 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -4525,12 +4525,12 @@ static int smu7_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *sclk_table = &(data->dpm_table.sclk_table);
         struct smu7_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.sclk_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -4567,12 +4567,12 @@ static int smu7_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *mclk_table = &(data->dpm_table.mclk_table);
         struct smu7_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mclk_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
-        value = (mclk_table->dpm_levels[mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
index 99a33c33a32c..101c09b212ad 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
@@ -713,20 +713,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
         for (i = 0; i < wm_with_clock_ranges->num_wm_dmif_sets; i++) {
                 table->WatermarkRow[1][i].MinClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].MaxClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].MinUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].MaxUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].WmSetting = (uint8_t)
                                 wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_set_id;
         }
@@ -734,20 +734,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
         for (i = 0; i < wm_with_clock_ranges->num_wm_mcif_sets; i++) {
                 table->WatermarkRow[0][i].MinClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].MaxClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].MinUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].MaxUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].WmSetting = (uint8_t)
                                 wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_set_id;
         }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 8c4db86bb4b7..e2bc6e0c229f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4522,15 +4522,13 @@ static int vega10_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega10_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
-
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels
-                        [golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
                         [golden_sclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
@@ -4575,16 +4573,13 @@ static int vega10_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega10_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 74bc37308dc0..54364444ecd1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -2243,12 +2243,12 @@ static int vega12_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega12_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -2264,16 +2264,13 @@ static int vega12_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega12_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index 57143d51e3ee..b4eadd47f3a4 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -75,7 +75,17 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
         data->phy_clk_quad_eqn_b = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
         data->phy_clk_quad_eqn_c = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
 
-        data->registry_data.disallowed_features = 0x0;
+        /*
+         * Disable the following features for now:
+         *   GFXCLK DS
+         *   SOCLK DS
+         *   LCLK DS
+         *   DCEFCLK DS
+         *   FCLK DS
+         *   MP1CLK DS
+         *   MP0CLK DS
+         */
+        data->registry_data.disallowed_features = 0xE0041C00;
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -120,6 +130,7 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
         data->registry_data.disable_auto_wattman = 1;
         data->registry_data.auto_wattman_debug = 0;
         data->registry_data.auto_wattman_sample_period = 100;
+        data->registry_data.fclk_gfxclk_ratio = 0x3F6CCCCD;
         data->registry_data.auto_wattman_threshold = 50;
         data->registry_data.gfxoff_controlled_by_driver = 1;
         data->gfxoff_allowed = false;
@@ -829,6 +840,28 @@ static int vega20_enable_all_smu_features(struct pp_hwmgr *hwmgr)
         return 0;
 }
 
+static int vega20_notify_smc_display_change(struct pp_hwmgr *hwmgr)
+{
+        struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);
+
+        if (data->smu_features[GNLD_DPM_UCLK].enabled)
+                return smum_send_msg_to_smc_with_parameter(hwmgr,
+                        PPSMC_MSG_SetUclkFastSwitch,
+                        1);
+
+        return 0;
+}
+
+static int vega20_send_clock_ratio(struct pp_hwmgr *hwmgr)
+{
+        struct vega20_hwmgr *data =
+                        (struct vega20_hwmgr *)(hwmgr->backend);
+
+        return smum_send_msg_to_smc_with_parameter(hwmgr,
+                        PPSMC_MSG_SetFclkGfxClkRatio,
+                        data->registry_data.fclk_gfxclk_ratio);
+}
+
 static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr)
 {
         struct vega20_hwmgr *data =
@@ -1290,12 +1323,13 @@ static int vega20_get_sclk_od(
                         &(data->dpm_table.gfx_table);
         struct vega20_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((sclk_table->dpm_levels[sclk_table->count - 1].value -
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) * 100,
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -1335,12 +1369,13 @@ static int vega20_get_mclk_od(
                         &(data->dpm_table.mem_table);
         struct vega20_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((mclk_table->dpm_levels[mclk_table->count - 1].value -
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) * 100,
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -1532,6 +1567,16 @@ static int vega20_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
                         "[EnableDPMTasks] Failed to enable all smu features!",
                         return result);
 
+        result = vega20_notify_smc_display_change(hwmgr);
+        PP_ASSERT_WITH_CODE(!result,
+                        "[EnableDPMTasks] Failed to notify smc display change!",
+                        return result);
+
+        result = vega20_send_clock_ratio(hwmgr);
+        PP_ASSERT_WITH_CODE(!result,
+                        "[EnableDPMTasks] Failed to send clock ratio!",
+                        return result);
+
         /* Initialize UVD/VCE powergating state */
         vega20_init_powergate_state(hwmgr);
 
@@ -1972,19 +2017,6 @@ static int vega20_read_sensor(struct pp_hwmgr *hwmgr, int idx,
         return ret;
 }
 
-static int vega20_notify_smc_display_change(struct pp_hwmgr *hwmgr,
-                bool has_disp)
-{
-        struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);
-
-        if (data->smu_features[GNLD_DPM_UCLK].enabled)
-                return smum_send_msg_to_smc_with_parameter(hwmgr,
-                        PPSMC_MSG_SetUclkFastSwitch,
-                        has_disp ? 1 : 0);
-
-        return 0;
-}
-
 int vega20_display_clock_voltage_request(struct pp_hwmgr *hwmgr,
                 struct pp_display_clock_request *clock_req)
 {
@@ -2044,13 +2076,6 @@ static int vega20_notify_smc_display_config_after_ps_adjustment(
         struct pp_display_clock_request clock_req;
         int ret = 0;
 
-        if ((hwmgr->display_config->num_display > 1) &&
-             !hwmgr->display_config->multi_monitor_in_sync &&
-             !hwmgr->display_config->nb_pstate_switch_disable)
-                vega20_notify_smc_display_change(hwmgr, false);
-        else
-                vega20_notify_smc_display_change(hwmgr, true);
-
         min_clocks.dcefClock = hwmgr->display_config->min_dcef_set_clk;
         min_clocks.dcefClockInSR = hwmgr->display_config->min_dcef_deep_sleep_set_clk;
         min_clocks.memoryClock = hwmgr->display_config->min_mem_set_clock;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
index 56fe6a0d42e8..25faaa5c5b10 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
@@ -328,6 +328,7 @@ struct vega20_registry_data {
         uint8_t   disable_auto_wattman;
         uint32_t  auto_wattman_debug;
         uint32_t  auto_wattman_sample_period;
+        uint32_t  fclk_gfxclk_ratio;
         uint8_t   auto_wattman_threshold;
         uint8_t   log_avfs_param;
         uint8_t   enable_enginess;
diff --git a/drivers/gpu/drm/amd/powerplay/inc/vega20_ppsmc.h b/drivers/gpu/drm/amd/powerplay/inc/vega20_ppsmc.h
index 45d64a81e945..4f63a736ea0e 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/vega20_ppsmc.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/vega20_ppsmc.h
@@ -105,7 +105,8 @@
 #define PPSMC_MSG_SetSystemVirtualDramAddrHigh   0x4B
 #define PPSMC_MSG_SetSystemVirtualDramAddrLow    0x4C
 #define PPSMC_MSG_WaflTest                       0x4D
-// Unused ID 0x4E to 0x50
+#define PPSMC_MSG_SetFclkGfxClkRatio             0x4E
+// Unused ID 0x4F to 0x50
 #define PPSMC_MSG_AllowGfxOff                    0x51
 #define PPSMC_MSG_DisallowGfxOff                 0x52
 #define PPSMC_MSG_GetPptLimit                    0x53
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index 69dab82a3771..bf589c53b908 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = {
 
 MODULE_DEVICE_TABLE(pci, pciidlist);
 
+static void ast_kick_out_firmware_fb(struct pci_dev *pdev)
+{
+        struct apertures_struct *ap;
+        bool primary = false;
+
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+
+        ap->ranges[0].base = pci_resource_start(pdev, 0);
+        ap->ranges[0].size = pci_resource_len(pdev, 0);
+
+#ifdef CONFIG_X86
+        primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
+#endif
+        drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary);
+        kfree(ap);
+}
+
 static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        ast_kick_out_firmware_fb(pdev);
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index dac355812adc..373700c05a00 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -583,7 +583,8 @@ void ast_driver_unload(struct drm_device *dev)
         drm_mode_config_cleanup(dev);
 
         ast_mm_fini(ast);
-        pci_iounmap(dev->pdev, ast->ioregs);
+        if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET)
+                pci_iounmap(dev->pdev, ast->ioregs);
         pci_iounmap(dev->pdev, ast->regs);
         kfree(ast);
 }
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 5e77d456d9bb..8bb355d5d43d 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
         }
         ast_bo_unreserve(bo);
 
+        ast_set_offset_reg(crtc);
         ast_set_start_address_crt1(crtc, (u32)gpu_addr);
 
         return 0;
@@ -972,9 +973,21 @@ static int get_clock(void *i2c_priv)
 {
         struct ast_i2c_chan *i2c = i2c_priv;
         struct ast_private *ast = i2c->dev->dev_private;
-        uint32_t val;
+        uint32_t val, val2, count, pass;
+
+        count = 0;
+        pass = 0;
+        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
+        do {
+                val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
+                if (val == val2) {
+                        pass++;
+                } else {
+                        pass = 0;
+                        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
+                }
+        } while ((pass < 5) && (count++ < 0x10000));
 
-        val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4;
         return val & 1 ? 1 : 0;
 }
 
@@ -982,9 +995,21 @@ static int get_data(void *i2c_priv)
 {
         struct ast_i2c_chan *i2c = i2c_priv;
         struct ast_private *ast = i2c->dev->dev_private;
-        uint32_t val;
+        uint32_t val, val2, count, pass;
+
+        count = 0;
+        pass = 0;
+        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
+        do {
+                val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
+                if (val == val2) {
+                        pass++;
+                } else {
+                        pass = 0;
+                        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
+                }
+        } while ((pass < 5) && (count++ < 0x10000));
 
-        val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5;
         return val & 1 ? 1 : 0;
 }
 
@@ -997,7 +1022,7 @@ static void set_clock(void *i2c_priv, int clock)
 
         for (i = 0; i < 0x10000; i++) {
                 ujcrb7 = ((clock & 0x01) ? 0 : 1);
-                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfe, ujcrb7);
+                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf4, ujcrb7);
                 jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x01);
                 if (ujcrb7 == jtemp)
                         break;
@@ -1013,7 +1038,7 @@ static void set_data(void *i2c_priv, int data)
 
         for (i = 0; i < 0x10000; i++) {
                 ujcrb7 = ((data & 0x01) ? 0 : 1) << 2;
-                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfb, ujcrb7);
+                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf1, ujcrb7);
                 jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x04);
                 if (ujcrb7 == jtemp)
                         break;
@@ -1254,7 +1279,7 @@ static int ast_cursor_move(struct drm_crtc *crtc,
         ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07));
 
         /* dummy write to fire HWC */
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00);
+        ast_show_cursor(crtc);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index d9c0f7573905..1669c42c40ed 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -142,6 +142,7 @@ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
 
         lockdep_assert_held_once(&dev->master_mutex);
 
+        WARN_ON(fpriv->is_master);
         old_master = fpriv->master;
         fpriv->master = drm_master_create(dev);
         if (!fpriv->master) {
@@ -170,6 +171,7 @@ out_err:
         /* drop references and restore old master on failure */
         drm_master_put(&fpriv->master);
         fpriv->master = old_master;
+        fpriv->is_master = 0;
 
         return ret;
 }
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 5ff1d79b86c4..0e0df398222d 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1275,6 +1275,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
         mutex_lock(&mgr->lock);
         mstb = mgr->mst_primary;
 
+        if (!mstb)
+                goto out;
+
         for (i = 0; i < lct - 1; i++) {
                 int shift = (i % 2) ? 0 : 4;
                 int port_num = (rad[i / 2] >> shift) & 0xf;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index a502f3e519fd..dd852a25d375 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -219,6 +219,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
         mutex_lock(&fb_helper->lock);
         drm_connector_list_iter_begin(dev, &conn_iter);
         drm_for_each_connector_iter(connector, &conn_iter) {
+                if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
+                        continue;
+
                 ret = __drm_fb_helper_add_one_connector(fb_helper, connector);
                 if (ret)
                         goto fail;
diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c
index 90a1c846fc25..8aaa5e86a979 100644
--- a/drivers/gpu/drm/drm_fourcc.c
+++ b/drivers/gpu/drm/drm_fourcc.c
@@ -97,9 +97,9 @@ EXPORT_SYMBOL(drm_mode_legacy_fb_format);
 
 /**
  * drm_driver_legacy_fb_format - compute drm fourcc code from legacy description
+ * @dev: DRM device
  * @bpp: bits per pixels
  * @depth: bit depth per pixel
- * @native: use host native byte order
  *
  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
  * Unlike drm_mode_legacy_fb_format() this looks at the drivers mode_config,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
index e7c3ed6c9a2e..9b476368aa31 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
@@ -93,7 +93,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job)
          * If the GPU managed to complete this jobs fence, the timout is
          * spurious. Bail out.
          */
-        if (fence_completed(gpu, submit->out_fence->seqno))
+        if (dma_fence_is_signaled(submit->out_fence))
                 return;
 
         /*
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 94529aa82339..aef487dd8731 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -164,13 +164,6 @@ static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
         return frm;
 }
 
-static u32 decon_get_vblank_counter(struct exynos_drm_crtc *crtc)
-{
-        struct decon_context *ctx = crtc->ctx;
-
-        return decon_get_frame_count(ctx, false);
-}
-
 static void decon_setup_trigger(struct decon_context *ctx)
 {
         if (!ctx->crtc->i80_mode && !(ctx->out_type & I80_HW_TRG))
@@ -536,7 +529,6 @@ static const struct exynos_drm_crtc_ops decon_crtc_ops = {
         .disable                = decon_disable,
         .enable_vblank          = decon_enable_vblank,
         .disable_vblank         = decon_disable_vblank,
-        .get_vblank_counter     = decon_get_vblank_counter,
         .atomic_begin           = decon_atomic_begin,
         .update_plane           = decon_update_plane,
         .disable_plane          = decon_disable_plane,
@@ -554,7 +546,6 @@ static int decon_bind(struct device *dev, struct device *master, void *data)
         int ret;
 
         ctx->drm_dev = drm_dev;
-        drm_dev->max_vblank_count = 0xffffffff;
 
         for (win = ctx->first_win; win < WINDOWS_NR; win++) {
                 ctx->configs[win].pixel_formats = decon_formats;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index eea90251808f..2696289ecc78 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -162,16 +162,6 @@ static void exynos_drm_crtc_disable_vblank(struct drm_crtc *crtc)
                 exynos_crtc->ops->disable_vblank(exynos_crtc);
 }
 
-static u32 exynos_drm_crtc_get_vblank_counter(struct drm_crtc *crtc)
-{
-        struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
-
-        if (exynos_crtc->ops->get_vblank_counter)
-                return exynos_crtc->ops->get_vblank_counter(exynos_crtc);
-
-        return 0;
-}
-
 static const struct drm_crtc_funcs exynos_crtc_funcs = {
         .set_config     = drm_atomic_helper_set_config,
         .page_flip      = drm_atomic_helper_page_flip,
@@ -181,7 +171,6 @@ static const struct drm_crtc_funcs exynos_crtc_funcs = {
         .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
         .enable_vblank = exynos_drm_crtc_enable_vblank,
         .disable_vblank = exynos_drm_crtc_disable_vblank,
-        .get_vblank_counter = exynos_drm_crtc_get_vblank_counter,
 };
 
 struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index ec9604f1272b..5e61e707f955 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -135,7 +135,6 @@ struct exynos_drm_crtc_ops {
         void (*disable)(struct exynos_drm_crtc *crtc);
         int (*enable_vblank)(struct exynos_drm_crtc *crtc);
         void (*disable_vblank)(struct exynos_drm_crtc *crtc);
-        u32 (*get_vblank_counter)(struct exynos_drm_crtc *crtc);
         enum drm_mode_status (*mode_valid)(struct exynos_drm_crtc *crtc,
                 const struct drm_display_mode *mode);
         bool (*mode_fixup)(struct exynos_drm_crtc *crtc,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 07af7758066d..d81e62ae286a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -14,6 +14,7 @@
 
 #include <drm/drmP.h>
 #include <drm/drm_crtc_helper.h>
+#include <drm/drm_fb_helper.h>
 #include <drm/drm_mipi_dsi.h>
 #include <drm/drm_panel.h>
 #include <drm/drm_atomic_helper.h>
@@ -1474,12 +1475,12 @@ static int exynos_dsi_create_connector(struct drm_encoder *encoder)
 {
         struct exynos_dsi *dsi = encoder_to_dsi(encoder);
         struct drm_connector *connector = &dsi->connector;
+        struct drm_device *drm = encoder->dev;
         int ret;
 
         connector->polled = DRM_CONNECTOR_POLL_HPD;
 
-        ret = drm_connector_init(encoder->dev, connector,
-                                 &exynos_dsi_connector_funcs,
+        ret = drm_connector_init(drm, connector, &exynos_dsi_connector_funcs,
                                  DRM_MODE_CONNECTOR_DSI);
         if (ret) {
                 DRM_ERROR("Failed to initialize connector with drm\n");
@@ -1489,7 +1490,12 @@ static int exynos_dsi_create_connector(struct drm_encoder *encoder)
         connector->status = connector_status_disconnected;
         drm_connector_helper_add(connector, &exynos_dsi_connector_helper_funcs);
         drm_connector_attach_encoder(connector, encoder);
+        if (!drm->registered)
+                return 0;
 
+        connector->funcs->reset(connector);
+        drm_fb_helper_add_one_connector(drm->fb_helper, connector);
+        drm_connector_register(connector);
         return 0;
 }
 
@@ -1527,7 +1533,9 @@ static int exynos_dsi_host_attach(struct mipi_dsi_host *host,
                 }
 
                 dsi->panel = of_drm_find_panel(device->dev.of_node);
-                if (dsi->panel) {
+                if (IS_ERR(dsi->panel)) {
+                        dsi->panel = NULL;
+                } else {
                         drm_panel_attach(dsi->panel, &dsi->connector);
                         dsi->connector.status = connector_status_connected;
                 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 918dd2c82209..01d182289efa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -192,7 +192,7 @@ int exynos_drm_fbdev_init(struct drm_device *dev)
         struct drm_fb_helper *helper;
         int ret;
 
-        if (!dev->mode_config.num_crtc || !dev->mode_config.num_connector)
+        if (!dev->mode_config.num_crtc)
                 return 0;
 
         fbdev = kzalloc(sizeof(*fbdev), GFP_KERNEL);
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index fe754022e356..359d37d5c958 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -61,10 +61,12 @@ static int alloc_gm(struct intel_vgpu *vgpu, bool high_gm)
         }
 
         mutex_lock(&dev_priv->drm.struct_mutex);
+        mmio_hw_access_pre(dev_priv);
         ret = i915_gem_gtt_insert(&dev_priv->ggtt.vm, node,
                                   size, I915_GTT_PAGE_SIZE,
                                   I915_COLOR_UNEVICTABLE,
                                   start, end, flags);
+        mmio_hw_access_post(dev_priv);
         mutex_unlock(&dev_priv->drm.struct_mutex);
         if (ret)
                 gvt_err("fail to alloc %s gm space from host\n",
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 2402395a068d..c7103dd2d8d5 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1905,7 +1905,6 @@ static struct intel_vgpu_mm *intel_vgpu_create_ggtt_mm(struct intel_vgpu *vgpu)
                 vgpu_free_mm(mm);
                 return ERR_PTR(-ENOMEM);
         }
-        mm->ggtt_mm.last_partial_off = -1UL;
 
         return mm;
 }
@@ -1930,7 +1929,6 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
                 invalidate_ppgtt_mm(mm);
         } else {
                 vfree(mm->ggtt_mm.virtual_ggtt);
-                mm->ggtt_mm.last_partial_off = -1UL;
         }
 
         vgpu_free_mm(mm);
@@ -2168,6 +2166,8 @@ static int emulate_ggtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         struct intel_gvt_gtt_entry e, m;
         dma_addr_t dma_addr;
         int ret;
+        struct intel_gvt_partial_pte *partial_pte, *pos, *n;
+        bool partial_update = false;
 
         if (bytes != 4 && bytes != 8)
                 return -EINVAL;
@@ -2178,68 +2178,57 @@ static int emulate_ggtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         if (!vgpu_gmadr_is_valid(vgpu, gma))
                 return 0;
 
-        ggtt_get_guest_entry(ggtt_mm, &e, g_gtt_index);
-
+        e.type = GTT_TYPE_GGTT_PTE;
         memcpy((void *)&e.val64 + (off & (info->gtt_entry_size - 1)), p_data,
                         bytes);
 
         /* If ggtt entry size is 8 bytes, and it's split into two 4 bytes
-         * write, we assume the two 4 bytes writes are consecutive.
-         * Otherwise, we abort and report error
+         * write, save the first 4 bytes in a list and update virtual
+         * PTE. Only update shadow PTE when the second 4 bytes comes.
          */
         if (bytes < info->gtt_entry_size) {
-                if (ggtt_mm->ggtt_mm.last_partial_off == -1UL) {
-                        /* the first partial part*/
-                        ggtt_mm->ggtt_mm.last_partial_off = off;
-                        ggtt_mm->ggtt_mm.last_partial_data = e.val64;
-                        return 0;
-                } else if ((g_gtt_index ==
-                                (ggtt_mm->ggtt_mm.last_partial_off >>
-                                info->gtt_entry_size_shift)) &&
-                        (off != ggtt_mm->ggtt_mm.last_partial_off)) {
-                        /* the second partial part */
-
-                        int last_off = ggtt_mm->ggtt_mm.last_partial_off &
-                                (info->gtt_entry_size - 1);
-
-                        memcpy((void *)&e.val64 + last_off,
-                                (void *)&ggtt_mm->ggtt_mm.last_partial_data +
-                                last_off, bytes);
-
-                        ggtt_mm->ggtt_mm.last_partial_off = -1UL;
-                } else {
-                        int last_offset;
-
-                        gvt_vgpu_err("failed to populate guest ggtt entry: abnormal ggtt entry write sequence, last_partial_off=%lx, offset=%x, bytes=%d, ggtt entry size=%d\n",
-                                        ggtt_mm->ggtt_mm.last_partial_off, off,
-                                        bytes, info->gtt_entry_size);
-
-                        /* set host ggtt entry to scratch page and clear
-                         * virtual ggtt entry as not present for last
-                         * partially write offset
-                         */
-                        last_offset = ggtt_mm->ggtt_mm.last_partial_off &
-                                        (~(info->gtt_entry_size - 1));
-
-                        ggtt_get_host_entry(ggtt_mm, &m, last_offset);
-                        ggtt_invalidate_pte(vgpu, &m);
-                        ops->set_pfn(&m, gvt->gtt.scratch_mfn);
-                        ops->clear_present(&m);
-                        ggtt_set_host_entry(ggtt_mm, &m, last_offset);
-                        ggtt_invalidate(gvt->dev_priv);
-
-                        ggtt_get_guest_entry(ggtt_mm, &e, last_offset);
-                        ops->clear_present(&e);
-                        ggtt_set_guest_entry(ggtt_mm, &e, last_offset);
-
-                        ggtt_mm->ggtt_mm.last_partial_off = off;
-                        ggtt_mm->ggtt_mm.last_partial_data = e.val64;
+                bool found = false;
+
+                list_for_each_entry_safe(pos, n,
+                                &ggtt_mm->ggtt_mm.partial_pte_list, list) {
+                        if (g_gtt_index == pos->offset >>
+                                        info->gtt_entry_size_shift) {
+                                if (off != pos->offset) {
+                                        /* the second partial part*/
+                                        int last_off = pos->offset &
+                                                (info->gtt_entry_size - 1);
+
+                                        memcpy((void *)&e.val64 + last_off,
+                                                (void *)&pos->data + last_off,
+                                                bytes);
+
+                                        list_del(&pos->list);
+                                        kfree(pos);
+                                        found = true;
+                                        break;
+                                }
+
+                                /* update of the first partial part */
+                                pos->data = e.val64;
+                                ggtt_set_guest_entry(ggtt_mm, &e, g_gtt_index);
+                                return 0;
+                        }
+                }
 
-                        return 0;
+                if (!found) {
+                        /* the first partial part */
+                        partial_pte = kzalloc(sizeof(*partial_pte), GFP_KERNEL);
+                        if (!partial_pte)
+                                return -ENOMEM;
+                        partial_pte->offset = off;
+                        partial_pte->data = e.val64;
+                        list_add_tail(&partial_pte->list,
+                                &ggtt_mm->ggtt_mm.partial_pte_list);
+                        partial_update = true;
                 }
         }
 
-        if (ops->test_present(&e)) {
+        if (!partial_update && (ops->test_present(&e))) {
                 gfn = ops->get_pfn(&e);
                 m = e;
 
@@ -2263,16 +2252,18 @@ static int emulate_ggtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
                 } else
                         ops->set_pfn(&m, dma_addr >> PAGE_SHIFT);
         } else {
-                ggtt_get_host_entry(ggtt_mm, &m, g_gtt_index);
-                ggtt_invalidate_pte(vgpu, &m);
                 ops->set_pfn(&m, gvt->gtt.scratch_mfn);
                 ops->clear_present(&m);
         }
 
 out:
+        ggtt_set_guest_entry(ggtt_mm, &e, g_gtt_index);
+
+        ggtt_get_host_entry(ggtt_mm, &e, g_gtt_index);
+        ggtt_invalidate_pte(vgpu, &e);
+
         ggtt_set_host_entry(ggtt_mm, &m, g_gtt_index);
         ggtt_invalidate(gvt->dev_priv);
-        ggtt_set_guest_entry(ggtt_mm, &e, g_gtt_index);
         return 0;
 }
 
@@ -2430,6 +2421,8 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
 
         intel_vgpu_reset_ggtt(vgpu, false);
 
+        INIT_LIST_HEAD(&gtt->ggtt_mm->ggtt_mm.partial_pte_list);
+
         return create_scratch_page_tree(vgpu);
 }
 
@@ -2454,6 +2447,15 @@ static void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu)
 
 static void intel_vgpu_destroy_ggtt_mm(struct intel_vgpu *vgpu)
 {
+        struct intel_gvt_partial_pte *pos, *next;
+
+        list_for_each_entry_safe(pos, next,
+                                 &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list,
+                                 list) {
+                gvt_dbg_mm("partial PTE update on hold 0x%lx : 0x%llx\n",
+                        pos->offset, pos->data);
+                kfree(pos);
+        }
         intel_vgpu_destroy_mm(vgpu->gtt.ggtt_mm);
         vgpu->gtt.ggtt_mm = NULL;
 }
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index 7a9b36176efb..d8cb04cc946d 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -35,7 +35,6 @@
 #define _GVT_GTT_H_
 
 #define I915_GTT_PAGE_SHIFT         12
-#define I915_GTT_PAGE_MASK              (~(I915_GTT_PAGE_SIZE - 1))
 
 struct intel_vgpu_mm;
 
@@ -133,6 +132,12 @@ enum intel_gvt_mm_type {
 
 #define GVT_RING_CTX_NR_PDPS    GEN8_3LVL_PDPES
 
+struct intel_gvt_partial_pte {
+        unsigned long offset;
+        u64 data;
+        struct list_head list;
+};
+
 struct intel_vgpu_mm {
         enum intel_gvt_mm_type type;
         struct intel_vgpu *vgpu;
@@ -157,8 +162,7 @@ struct intel_vgpu_mm {
                 } ppgtt_mm;
                 struct {
                         void *virtual_ggtt;
-                        unsigned long last_partial_off;
-                        u64 last_partial_data;
+                        struct list_head partial_pte_list;
                 } ggtt_mm;
         };
 };
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 90f50f67909a..aa280bb07125 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1609,7 +1609,7 @@ static int bxt_gt_disp_pwron_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
-static int bxt_edp_psr_imr_iir_write(struct intel_vgpu *vgpu,
+static int edp_psr_imr_iir_write(struct intel_vgpu *vgpu,
                 unsigned int offset, void *p_data, unsigned int bytes)
 {
         vgpu_vreg(vgpu, offset) = 0;
@@ -2607,6 +2607,9 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(_MMIO(0x1a178), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(_MMIO(0x1a17c), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(_MMIO(0x2217c), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DH(EDP_PSR_IMR, D_BDW_PLUS, NULL, edp_psr_imr_iir_write);
+        MMIO_DH(EDP_PSR_IIR, D_BDW_PLUS, NULL, edp_psr_imr_iir_write);
         return 0;
 }
 
@@ -3205,9 +3208,6 @@ static int init_bxt_mmio_info(struct intel_gvt *gvt)
         MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_B), D_BXT);
         MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_C), D_BXT);
 
-        MMIO_DH(EDP_PSR_IMR, D_BXT, NULL, bxt_edp_psr_imr_iir_write);
-        MMIO_DH(EDP_PSR_IIR, D_BXT, NULL, bxt_edp_psr_imr_iir_write);
-
         MMIO_D(RC6_CTX_BASE, D_BXT);
 
         MMIO_D(GEN8_PUSHBUS_CONTROL, D_BXT);
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 10e63eea5492..d6e02c15ef97 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -131,7 +131,7 @@ static struct engine_mmio gen9_engine_mmio_list[] __cacheline_aligned = {
         {RCS, GAMT_CHKN_BIT_REG, 0x0, false}, /* 0x4ab8 */
 
         {RCS, GEN9_GAMT_ECO_REG_RW_IA, 0x0, false}, /* 0x4ab0 */
-        {RCS, GEN9_CSFE_CHICKEN1_RCS, 0x0, false}, /* 0x20d4 */
+        {RCS, GEN9_CSFE_CHICKEN1_RCS, 0xffff, false}, /* 0x20d4 */
 
         {RCS, GEN8_GARBCNTL, 0x0, false}, /* 0xb004 */
         {RCS, GEN7_FF_THREAD_MODE, 0x0, false}, /* 0x20a0 */
@@ -158,6 +158,8 @@ static void load_render_mocs(struct drm_i915_private *dev_priv)
         int ring_id, i;
 
         for (ring_id = 0; ring_id < ARRAY_SIZE(regs); ring_id++) {
+                if (!HAS_ENGINE(dev_priv, ring_id))
+                        continue;
                 offset.reg = regs[ring_id];
                 for (i = 0; i < GEN9_MOCS_SIZE; i++) {
                         gen9_render_mocs.control_table[ring_id][i] =
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 44e2c0f5ec50..ffdbbac4400e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1175,8 +1175,6 @@ skl_dram_get_channels_info(struct drm_i915_private *dev_priv)
                 return -EINVAL;
         }
 
-        dram_info->valid_dimm = true;
-
         /*
          * If any of the channel is single rank channel, worst case output
          * will be same as if single rank memory, so consider single rank
@@ -1193,8 +1191,7 @@ skl_dram_get_channels_info(struct drm_i915_private *dev_priv)
                 return -EINVAL;
         }
 
-        if (ch0.is_16gb_dimm || ch1.is_16gb_dimm)
-                dram_info->is_16gb_dimm = true;
+        dram_info->is_16gb_dimm = ch0.is_16gb_dimm || ch1.is_16gb_dimm;
 
         dev_priv->dram_info.symmetric_memory = intel_is_dram_symmetric(val_ch0,
                                                                        val_ch1,
@@ -1314,7 +1311,6 @@ bxt_get_dram_info(struct drm_i915_private *dev_priv)
                 return -EINVAL;
         }
 
-        dram_info->valid_dimm = true;
         dram_info->valid = true;
         return 0;
 }
@@ -1327,12 +1323,17 @@ intel_get_dram_info(struct drm_i915_private *dev_priv)
         int ret;
 
         dram_info->valid = false;
-        dram_info->valid_dimm = false;
-        dram_info->is_16gb_dimm = false;
         dram_info->rank = I915_DRAM_RANK_INVALID;
         dram_info->bandwidth_kbps = 0;
         dram_info->num_channels = 0;
 
+        /*
+         * Assume 16Gb DIMMs are present until proven otherwise.
+         * This is only used for the level 0 watermark latency
+         * w/a which does not apply to bxt/glk.
+         */
+        dram_info->is_16gb_dimm = !IS_GEN9_LP(dev_priv);
+
         if (INTEL_GEN(dev_priv) < 9 || IS_GEMINILAKE(dev_priv))
                 return;
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8624b4bdc242..9102571e9692 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1948,7 +1948,6 @@ struct drm_i915_private {
 
         struct dram_info {
                 bool valid;
-                bool valid_dimm;
                 bool is_16gb_dimm;
                 u8 num_channels;
                 enum dram_rank {
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 09187286d346..d4fac09095f8 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -460,7 +460,7 @@ eb_validate_vma(struct i915_execbuffer *eb,
          * any non-page-aligned or non-canonical addresses.
          */
         if (unlikely(entry->flags & EXEC_OBJECT_PINNED &&
-                     entry->offset != gen8_canonical_addr(entry->offset & PAGE_MASK)))
+                     entry->offset != gen8_canonical_addr(entry->offset & I915_GTT_PAGE_MASK)))
                 return -EINVAL;
 
         /* pad_to_size was once a reserved field, so sanitize it */
@@ -1268,7 +1268,7 @@ relocate_entry(struct i915_vma *vma,
                 else if (gen >= 4)
                         len = 4;
                 else
-                        len = 3;
+                        len = 6;
 
                 batch = reloc_gpu(eb, vma, len);
                 if (IS_ERR(batch))
@@ -1309,6 +1309,11 @@ relocate_entry(struct i915_vma *vma,
                         *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
                         *batch++ = addr;
                         *batch++ = target_offset;
+
+                        /* And again for good measure (blb/pnv) */
+                        *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
+                        *batch++ = addr;
+                        *batch++ = target_offset;
                 }
 
                 goto out;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 56c7f8637311..07999fe09ad2 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1757,7 +1757,7 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *base, struct seq_file *m)
                         if (i == 4)
                                 continue;
 
-                        seq_printf(m, "\t\t(%03d, %04d) %08lx: ",
+                        seq_printf(m, "\t\t(%03d, %04d) %08llx: ",
                                    pde, pte,
                                    (pde * GEN6_PTES + pte) * I915_GTT_PAGE_SIZE);
                         for (i = 0; i < 4; i++) {
@@ -3413,6 +3413,11 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
                 ggtt->vm.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
                 if (ggtt->vm.clear_range != nop_clear_range)
                         ggtt->vm.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+
+                /* Prevent recursively calling stop_machine() and deadlocks. */
+                dev_info(dev_priv->drm.dev,
+                         "Disabling error capture for VT-d workaround\n");
+                i915_disable_error_state(dev_priv, -ENODEV);
         }
 
         ggtt->invalidate = gen6_ggtt_invalidate;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h
index 7e2af5f4f39b..28039290655c 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
@@ -42,13 +42,15 @@
 #include "i915_selftest.h"
 #include "i915_timeline.h"
 
-#define I915_GTT_PAGE_SIZE_4K BIT(12)
-#define I915_GTT_PAGE_SIZE_64K BIT(16)
-#define I915_GTT_PAGE_SIZE_2M BIT(21)
+#define I915_GTT_PAGE_SIZE_4K   BIT_ULL(12)
+#define I915_GTT_PAGE_SIZE_64K  BIT_ULL(16)
+#define I915_GTT_PAGE_SIZE_2M   BIT_ULL(21)
 
 #define I915_GTT_PAGE_SIZE I915_GTT_PAGE_SIZE_4K
 #define I915_GTT_MAX_PAGE_SIZE I915_GTT_PAGE_SIZE_2M
 
+#define I915_GTT_PAGE_MASK -I915_GTT_PAGE_SIZE
+
 #define I915_GTT_MIN_ALIGNMENT I915_GTT_PAGE_SIZE
 
 #define I915_FENCE_REG_NONE -1
@@ -659,20 +661,20 @@ int i915_gem_gtt_insert(struct i915_address_space *vm,
                         u64 start, u64 end, unsigned int flags);
 
 /* Flags used by pin/bind&friends. */
-#define PIN_NONBLOCK            BIT(0)
-#define PIN_MAPPABLE            BIT(1)
-#define PIN_ZONE_4G             BIT(2)
-#define PIN_NONFAULT            BIT(3)
-#define PIN_NOEVICT             BIT(4)
-
-#define PIN_MBZ                 BIT(5) /* I915_VMA_PIN_OVERFLOW */
-#define PIN_GLOBAL              BIT(6) /* I915_VMA_GLOBAL_BIND */
-#define PIN_USER                BIT(7) /* I915_VMA_LOCAL_BIND */
-#define PIN_UPDATE              BIT(8)
-
-#define PIN_HIGH                BIT(9)
-#define PIN_OFFSET_BIAS         BIT(10)
-#define PIN_OFFSET_FIXED        BIT(11)
+#define PIN_NONBLOCK            BIT_ULL(0)
+#define PIN_MAPPABLE            BIT_ULL(1)
+#define PIN_ZONE_4G             BIT_ULL(2)
+#define PIN_NONFAULT            BIT_ULL(3)
+#define PIN_NOEVICT             BIT_ULL(4)
+
+#define PIN_MBZ                 BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */
+#define PIN_GLOBAL              BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */
+#define PIN_USER                BIT_ULL(7) /* I915_VMA_LOCAL_BIND */
+#define PIN_UPDATE              BIT_ULL(8)
+
+#define PIN_HIGH                BIT_ULL(9)
+#define PIN_OFFSET_BIAS         BIT_ULL(10)
+#define PIN_OFFSET_FIXED        BIT_ULL(11)
 #define PIN_OFFSET_MASK         (-I915_GTT_PAGE_SIZE)
 
 #endif
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 8762d17b6659..3eb33e000d6f 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -648,6 +648,9 @@ int i915_error_state_to_str(struct drm_i915_error_state_buf *m,
                 return 0;
         }
 
+        if (IS_ERR(error))
+                return PTR_ERR(error);
+
         if (*error->error_msg)
                 err_printf(m, "%s\n", error->error_msg);
         err_printf(m, "Kernel: " UTS_RELEASE "\n");
@@ -1859,6 +1862,7 @@ void i915_capture_error_state(struct drm_i915_private *i915,
         error = i915_capture_gpu_state(i915);
         if (!error) {
                 DRM_DEBUG_DRIVER("out of memory, not capturing error state\n");
+                i915_disable_error_state(i915, -ENOMEM);
                 return;
         }
 
@@ -1914,5 +1918,14 @@ void i915_reset_error_state(struct drm_i915_private *i915)
         i915->gpu_error.first_error = NULL;
         spin_unlock_irq(&i915->gpu_error.lock);
 
-        i915_gpu_state_put(error);
+        if (!IS_ERR(error))
+                i915_gpu_state_put(error);
+}
+
+void i915_disable_error_state(struct drm_i915_private *i915, int err)
+{
+        spin_lock_irq(&i915->gpu_error.lock);
+        if (!i915->gpu_error.first_error)
+                i915->gpu_error.first_error = ERR_PTR(err);
+        spin_unlock_irq(&i915->gpu_error.lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.h b/drivers/gpu/drm/i915/i915_gpu_error.h
index 8710fb18ed74..3ec89a504de5 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.h
+++ b/drivers/gpu/drm/i915/i915_gpu_error.h
@@ -343,6 +343,7 @@ static inline void i915_gpu_state_put(struct i915_gpu_state *gpu)
 
 struct i915_gpu_state *i915_first_error_state(struct drm_i915_private *i915);
 void i915_reset_error_state(struct drm_i915_private *i915);
+void i915_disable_error_state(struct drm_i915_private *i915, int err);
 
 #else
 
@@ -355,13 +356,18 @@ static inline void i915_capture_error_state(struct drm_i915_private *dev_priv,
 static inline struct i915_gpu_state *
 i915_first_error_state(struct drm_i915_private *i915)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 static inline void i915_reset_error_state(struct drm_i915_private *i915)
 {
 }
 
+static inline void i915_disable_error_state(struct drm_i915_private *i915,
+                                            int err)
+{
+}
+
 #endif /* IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR) */
 
 #endif /* _I915_GPU_ERROR_H_ */
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 7c491ea3d052..e31c27e45734 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2095,8 +2095,12 @@ enum i915_power_well_id {
 
 /* ICL PHY DFLEX registers */
 #define PORT_TX_DFLEXDPMLE1             _MMIO(0x1638C0)
-#define   DFLEXDPMLE1_DPMLETC_MASK(n)   (0xf << (4 * (n)))
-#define   DFLEXDPMLE1_DPMLETC(n, x)     ((x) << (4 * (n)))
+#define   DFLEXDPMLE1_DPMLETC_MASK(tc_port)     (0xf << (4 * (tc_port)))
+#define   DFLEXDPMLE1_DPMLETC_ML0(tc_port)      (1 << (4 * (tc_port)))
+#define   DFLEXDPMLE1_DPMLETC_ML1_0(tc_port)    (3 << (4 * (tc_port)))
+#define   DFLEXDPMLE1_DPMLETC_ML3(tc_port)      (8 << (4 * (tc_port)))
+#define   DFLEXDPMLE1_DPMLETC_ML3_2(tc_port)    (12 << (4 * (tc_port)))
+#define   DFLEXDPMLE1_DPMLETC_ML3_0(tc_port)    (15 << (4 * (tc_port)))
 
 /* BXT PHY Ref registers */
 #define _PORT_REF_DW3_A                 0x16218C
@@ -4593,12 +4597,12 @@ enum {
 
 #define  DRM_DIP_ENABLE                 (1 << 28)
 #define  PSR_VSC_BIT_7_SET              (1 << 27)
-#define  VSC_SELECT_MASK                (0x3 << 26)
-#define  VSC_SELECT_SHIFT               26
-#define  VSC_DIP_HW_HEA_DATA            (0 << 26)
-#define  VSC_DIP_HW_HEA_SW_DATA         (1 << 26)
-#define  VSC_DIP_HW_DATA_SW_HEA         (2 << 26)
-#define  VSC_DIP_SW_HEA_DATA            (3 << 26)
+#define  VSC_SELECT_MASK                (0x3 << 25)
+#define  VSC_SELECT_SHIFT               25
+#define  VSC_DIP_HW_HEA_DATA            (0 << 25)
+#define  VSC_DIP_HW_HEA_SW_DATA         (1 << 25)
+#define  VSC_DIP_HW_DATA_SW_HEA         (2 << 25)
+#define  VSC_DIP_SW_HEA_DATA            (3 << 25)
 #define  VDIP_ENABLE_PPS                (1 << 24)
 
 /* Panel power sequencing */
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index 769f3f586661..ee3ca2de983b 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -144,6 +144,9 @@ static const struct {
 /* HDMI N/CTS table */
 #define TMDS_297M 297000
 #define TMDS_296M 296703
+#define TMDS_594M 594000
+#define TMDS_593M 593407
+
 static const struct {
         int sample_rate;
         int clock;
@@ -164,6 +167,20 @@ static const struct {
         { 176400, TMDS_297M, 18816, 247500 },
         { 192000, TMDS_296M, 23296, 281250 },
         { 192000, TMDS_297M, 20480, 247500 },
+        { 44100, TMDS_593M, 8918, 937500 },
+        { 44100, TMDS_594M, 9408, 990000 },
+        { 48000, TMDS_593M, 5824, 562500 },
+        { 48000, TMDS_594M, 6144, 594000 },
+        { 32000, TMDS_593M, 5824, 843750 },
+        { 32000, TMDS_594M, 3072, 445500 },
+        { 88200, TMDS_593M, 17836, 937500 },
+        { 88200, TMDS_594M, 18816, 990000 },
+        { 96000, TMDS_593M, 11648, 562500 },
+        { 96000, TMDS_594M, 12288, 594000 },
+        { 176400, TMDS_593M, 35672, 937500 },
+        { 176400, TMDS_594M, 37632, 990000 },
+        { 192000, TMDS_593M, 23296, 562500 },
+        { 192000, TMDS_594M, 24576, 594000 },
 };
 
 /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index 29075c763428..8d74276029e6 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -2138,16 +2138,8 @@ void intel_set_cdclk(struct drm_i915_private *dev_priv,
 static int intel_pixel_rate_to_cdclk(struct drm_i915_private *dev_priv,
                                      int pixel_rate)
 {
-        if (INTEL_GEN(dev_priv) >= 10)
+        if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv))
                 return DIV_ROUND_UP(pixel_rate, 2);
-        else if (IS_GEMINILAKE(dev_priv))
-                /*
-                 * FIXME: Avoid using a pixel clock that is more than 99% of the cdclk
-                 * as a temporary workaround. Use a higher cdclk instead. (Note that
-                 * intel_compute_max_dotclk() limits the max pixel clock to 99% of max
-                 * cdclk.)
-                 */
-                return DIV_ROUND_UP(pixel_rate * 100, 2 * 99);
         else if (IS_GEN9(dev_priv) ||
                  IS_BROADWELL(dev_priv) || IS_HASWELL(dev_priv))
                 return pixel_rate;
@@ -2543,14 +2535,8 @@ static int intel_compute_max_dotclk(struct drm_i915_private *dev_priv)
 {
         int max_cdclk_freq = dev_priv->max_cdclk_freq;
 
-        if (INTEL_GEN(dev_priv) >= 10)
+        if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv))
                 return 2 * max_cdclk_freq;
-        else if (IS_GEMINILAKE(dev_priv))
-                /*
-                 * FIXME: Limiting to 99% as a temporary workaround. See
-                 * intel_min_cdclk() for details.
-                 */
-                return 2 * max_cdclk_freq * 99 / 100;
         else if (IS_GEN9(dev_priv) ||
                  IS_BROADWELL(dev_priv) || IS_HASWELL(dev_priv))
                 return max_cdclk_freq;
diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
index 0ef0c6448d53..01fa98299bae 100644
--- a/drivers/gpu/drm/i915/intel_device_info.c
+++ b/drivers/gpu/drm/i915/intel_device_info.c
@@ -474,7 +474,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
                         u8 eu_disabled_mask;
                         u32 n_disabled;
 
-                        if (!(sseu->subslice_mask[ss] & BIT(ss)))
+                        if (!(sseu->subslice_mask[s] & BIT(ss)))
                                 /* skip disabled subslice */
                                 continue;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9741cc419e1b..c9878dd1f7cd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2890,6 +2890,7 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
+        intel_state->base.rotation = plane_config->rotation;
         intel_fill_fb_ggtt_view(&intel_state->view, fb,
                                 intel_state->base.rotation);
         intel_state->color_plane[0].stride =
@@ -4850,8 +4851,31 @@ static void cpt_verify_modeset(struct drm_device *dev, int pipe)
  * chroma samples for both of the luma samples, and thus we don't
  * actually get the expected MPEG2 chroma siting convention :(
  * The same behaviour is observed on pre-SKL platforms as well.
+ *
+ * Theory behind the formula (note that we ignore sub-pixel
+ * source coordinates):
+ * s = source sample position
+ * d = destination sample position
+ *
+ * Downscaling 4:1:
+ * -0.5
+ * | 0.0
+ * | |     1.5 (initial phase)
+ * | |     |
+ * v v     v
+ * | s | s | s | s |
+ * |       d       |
+ *
+ * Upscaling 1:4:
+ * -0.5
+ * | -0.375 (initial phase)
+ * | |     0.0
+ * | |     |
+ * v v     v
+ * |       s       |
+ * | d | d | d | d |
  */
-u16 skl_scaler_calc_phase(int sub, bool chroma_cosited)
+u16 skl_scaler_calc_phase(int sub, int scale, bool chroma_cosited)
 {
         int phase = -0x8000;
         u16 trip = 0;
@@ -4859,6 +4883,15 @@ u16 skl_scaler_calc_phase(int sub, bool chroma_cosited)
         if (chroma_cosited)
                 phase += (sub - 1) * 0x8000 / sub;
 
+        phase += scale / (2 * sub);
+
+        /*
+         * Hardware initial phase limited to [-0.5:1.5].
+         * Since the max hardware scale factor is 3.0, we
+         * should never actually excdeed 1.0 here.
+         */
+        WARN_ON(phase < -0x8000 || phase > 0x18000);
+
         if (phase < 0)
                 phase = 0x10000 + phase;
         else
@@ -5067,13 +5100,20 @@ static void skylake_pfit_enable(struct intel_crtc *crtc)
 
         if (crtc->config->pch_pfit.enabled) {
                 u16 uv_rgb_hphase, uv_rgb_vphase;
+                int pfit_w, pfit_h, hscale, vscale;
                 int id;
 
                 if (WARN_ON(crtc->config->scaler_state.scaler_id < 0))
                         return;
 
-                uv_rgb_hphase = skl_scaler_calc_phase(1, false);
-                uv_rgb_vphase = skl_scaler_calc_phase(1, false);
+                pfit_w = (crtc->config->pch_pfit.size >> 16) & 0xFFFF;
+                pfit_h = crtc->config->pch_pfit.size & 0xFFFF;
+
+                hscale = (crtc->config->pipe_src_w << 16) / pfit_w;
+                vscale = (crtc->config->pipe_src_h << 16) / pfit_h;
+
+                uv_rgb_hphase = skl_scaler_calc_phase(1, hscale, false);
+                uv_rgb_vphase = skl_scaler_calc_phase(1, vscale, false);
 
                 id = scaler_state->scaler_id;
                 I915_WRITE(SKL_PS_CTRL(pipe, id), PS_SCALER_EN |
@@ -7843,8 +7883,15 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
                         plane_config->tiling = I915_TILING_X;
                         fb->modifier = I915_FORMAT_MOD_X_TILED;
                 }
+
+                if (val & DISPPLANE_ROTATE_180)
+                        plane_config->rotation = DRM_MODE_ROTATE_180;
         }
 
+        if (IS_CHERRYVIEW(dev_priv) && pipe == PIPE_B &&
+            val & DISPPLANE_MIRROR)
+                plane_config->rotation |= DRM_MODE_REFLECT_X;
+
         pixel_format = val & DISPPLANE_PIXFORMAT_MASK;
         fourcc = i9xx_format_to_fourcc(pixel_format);
         fb->format = drm_format_info(fourcc);
@@ -8913,6 +8960,29 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
                 goto error;
         }
 
+        /*
+         * DRM_MODE_ROTATE_ is counter clockwise to stay compatible with Xrandr
+         * while i915 HW rotation is clockwise, thats why this swapping.
+         */
+        switch (val & PLANE_CTL_ROTATE_MASK) {
+        case PLANE_CTL_ROTATE_0:
+                plane_config->rotation = DRM_MODE_ROTATE_0;
+                break;
+        case PLANE_CTL_ROTATE_90:
+                plane_config->rotation = DRM_MODE_ROTATE_270;
+                break;
+        case PLANE_CTL_ROTATE_180:
+                plane_config->rotation = DRM_MODE_ROTATE_180;
+                break;
+        case PLANE_CTL_ROTATE_270:
+                plane_config->rotation = DRM_MODE_ROTATE_90;
+                break;
+        }
+
+        if (INTEL_GEN(dev_priv) >= 10 &&
+            val & PLANE_CTL_FLIP_HORIZONTAL)
+                plane_config->rotation |= DRM_MODE_REFLECT_X;
+
         base = I915_READ(PLANE_SURF(pipe, plane_id)) & 0xfffff000;
         plane_config->base = base;
 
@@ -12768,17 +12838,12 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
                         intel_check_cpu_fifo_underruns(dev_priv);
                         intel_check_pch_fifo_underruns(dev_priv);
 
-                        if (!new_crtc_state->active) {
-                                /*
-                                 * Make sure we don't call initial_watermarks
-                                 * for ILK-style watermark updates.
-                                 *
-                                 * No clue what this is supposed to achieve.
-                                 */
-                                if (INTEL_GEN(dev_priv) >= 9)
-                                        dev_priv->display.initial_watermarks(intel_state,
-                                                                             to_intel_crtc_state(new_crtc_state));
-                        }
+                        /* FIXME unify this for all platforms */
+                        if (!new_crtc_state->active &&
+                            !HAS_GMCH_DISPLAY(dev_priv) &&
+                            dev_priv->display.initial_watermarks)
+                                dev_priv->display.initial_watermarks(intel_state,
+                                                                     to_intel_crtc_state(new_crtc_state));
                 }
         }
 
@@ -14646,7 +14711,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
              fb->height < SKL_MIN_YUV_420_SRC_H ||
              (fb->width % 4) != 0 || (fb->height % 4) != 0)) {
                 DRM_DEBUG_KMS("src dimensions not correct for NV12\n");
-                return -EINVAL;
+                goto err;
         }
 
         for (i = 0; i < fb->format->num_planes; i++) {
@@ -15233,6 +15298,14 @@ retry:
                         ret = drm_atomic_add_affected_planes(state, crtc);
                         if (ret)
                                 goto out;
+
+                        /*
+                         * FIXME hack to force a LUT update to avoid the
+                         * plane update forcing the pipe gamma on without
+                         * having a proper LUT loaded. Remove once we
+                         * have readout for pipe gamma enable.
+                         */
+                        crtc_state->color_mgmt_changed = true;
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 1b00f8ea145b..a911691dbd0f 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -452,6 +452,10 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
         if (!intel_connector)
                 return NULL;
 
+        intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
+        intel_connector->mst_port = intel_dp;
+        intel_connector->port = port;
+
         connector = &intel_connector->base;
         ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,
                                  DRM_MODE_CONNECTOR_DisplayPort);
@@ -462,10 +466,6 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
 
         drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs);
 
-        intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
-        intel_connector->mst_port = intel_dp;
-        intel_connector->port = port;
-
         for_each_pipe(dev_priv, pipe) {
                 struct drm_encoder *enc =
                         &intel_dp->mst_encoders[pipe]->base.base;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f8dc84b2d2d3..db6fa1d0cbda 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -547,6 +547,7 @@ struct intel_initial_plane_config {
         unsigned int tiling;
         int size;
         u32 base;
+        u8 rotation;
 };
 
 #define SKL_MIN_SRC_W 8
@@ -1646,7 +1647,7 @@ void intel_mode_from_pipe_config(struct drm_display_mode *mode,
 void intel_crtc_arm_fifo_underrun(struct intel_crtc *crtc,
                                   struct intel_crtc_state *crtc_state);
 
-u16 skl_scaler_calc_phase(int sub, bool chroma_center);
+u16 skl_scaler_calc_phase(int sub, int scale, bool chroma_center);
 int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state);
 int skl_max_scale(const struct intel_crtc_state *crtc_state,
                   u32 pixel_format);
diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
index 648a13c6043c..9a8018130237 100644
--- a/drivers/gpu/drm/i915/intel_hotplug.c
+++ b/drivers/gpu/drm/i915/intel_hotplug.c
@@ -228,7 +228,9 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
                 drm_for_each_connector_iter(connector, &conn_iter) {
                         struct intel_connector *intel_connector = to_intel_connector(connector);
 
-                        if (intel_connector->encoder->hpd_pin == pin) {
+                        /* Don't check MST ports, they don't have pins */
+                        if (!intel_connector->mst_port &&
+                            intel_connector->encoder->hpd_pin == pin) {
                                 if (connector->polled != intel_connector->polled)
                                         DRM_DEBUG_DRIVER("Reenabling HPD on connector %s\n",
                                                          connector->name);
@@ -395,37 +397,54 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
         struct intel_encoder *encoder;
         bool storm_detected = false;
         bool queue_dig = false, queue_hp = false;
+        u32 long_hpd_pulse_mask = 0;
+        u32 short_hpd_pulse_mask = 0;
+        enum hpd_pin pin;
 
         if (!pin_mask)
                 return;
 
         spin_lock(&dev_priv->irq_lock);
+
+        /*
+         * Determine whether ->hpd_pulse() exists for each pin, and
+         * whether we have a short or a long pulse. This is needed
+         * as each pin may have up to two encoders (HDMI and DP) and
+         * only the one of them (DP) will have ->hpd_pulse().
+         */
         for_each_intel_encoder(&dev_priv->drm, encoder) {
-                enum hpd_pin pin = encoder->hpd_pin;
                 bool has_hpd_pulse = intel_encoder_has_hpd_pulse(encoder);
+                enum port port = encoder->port;
+                bool long_hpd;
 
+                pin = encoder->hpd_pin;
                 if (!(BIT(pin) & pin_mask))
                         continue;
 
-                if (has_hpd_pulse) {
-                        bool long_hpd = long_mask & BIT(pin);
-                        enum port port = encoder->port;
+                if (!has_hpd_pulse)
+                        continue;
 
-                        DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port),
-                                         long_hpd ? "long" : "short");
-                        /*
-                         * For long HPD pulses we want to have the digital queue happen,
-                         * but we still want HPD storm detection to function.
-                         */
-                        queue_dig = true;
-                        if (long_hpd) {
-                                dev_priv->hotplug.long_port_mask |= (1 << port);
-                        } else {
-                                /* for short HPD just trigger the digital queue */
-                                dev_priv->hotplug.short_port_mask |= (1 << port);
-                                continue;
-                        }
+                long_hpd = long_mask & BIT(pin);
+
+                DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port),
+                                 long_hpd ? "long" : "short");
+                queue_dig = true;
+
+                if (long_hpd) {
+                        long_hpd_pulse_mask |= BIT(pin);
+                        dev_priv->hotplug.long_port_mask |= BIT(port);
+                } else {
+                        short_hpd_pulse_mask |= BIT(pin);
+                        dev_priv->hotplug.short_port_mask |= BIT(port);
                 }
+        }
+
+        /* Now process each pin just once */
+        for_each_hpd_pin(pin) {
+                bool long_hpd;
+
+                if (!(BIT(pin) & pin_mask))
+                        continue;
 
                 if (dev_priv->hotplug.stats[pin].state == HPD_DISABLED) {
                         /*
@@ -442,11 +461,22 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
                 if (dev_priv->hotplug.stats[pin].state != HPD_ENABLED)
                         continue;
 
-                if (!has_hpd_pulse) {
+                /*
+                 * Delegate to ->hpd_pulse() if one of the encoders for this
+                 * pin has it, otherwise let the hotplug_work deal with this
+                 * pin directly.
+                 */
+                if (((short_hpd_pulse_mask | long_hpd_pulse_mask) & BIT(pin))) {
+                        long_hpd = long_hpd_pulse_mask & BIT(pin);
+                } else {
                         dev_priv->hotplug.event_bits |= BIT(pin);
+                        long_hpd = true;
                         queue_hp = true;
                 }
 
+                if (!long_hpd)
+                        continue;
+
                 if (intel_hpd_irq_storm_detect(dev_priv, pin)) {
                         dev_priv->hotplug.event_bits &= ~BIT(pin);
                         storm_detected = true;
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index cdf19553ffac..5d5336fbe7b0 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -297,8 +297,10 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv)
         lpe_audio_platdev_destroy(dev_priv);
 
         irq_free_desc(dev_priv->lpe_audio.irq);
-}
 
+        dev_priv->lpe_audio.irq = -1;
+        dev_priv->lpe_audio.platdev = NULL;
+}
 
 /**
  * intel_lpe_audio_notify() - notify lpe audio event
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 43957bb37a42..37c94a54efcb 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -424,7 +424,8 @@ static u64 execlists_update_context(struct i915_request *rq)
 
         reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
 
-        /* True 32b PPGTT with dynamic page allocation: update PDP
+        /*
+         * True 32b PPGTT with dynamic page allocation: update PDP
          * registers and point the unallocated PDPs to scratch page.
          * PML4 is allocated during ppgtt init, so this is not needed
          * in 48-bit mode.
@@ -432,6 +433,17 @@ static u64 execlists_update_context(struct i915_request *rq)
         if (ppgtt && !i915_vm_is_48bit(&ppgtt->vm))
                 execlists_update_context_pdps(ppgtt, reg_state);
 
+        /*
+         * Make sure the context image is complete before we submit it to HW.
+         *
+         * Ostensibly, writes (including the WCB) should be flushed prior to
+         * an uncached write such as our mmio register access, the empirical
+         * evidence (esp. on Braswell) suggests that the WC write into memory
+         * may not be visible to the HW prior to the completion of the UC
+         * register write and that we may begin execution from the context
+         * before its image is complete leading to invalid PD chasing.
+         */
+        wmb();
         return ce->lrc_desc;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 1db9b8328275..3fe358db1276 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2493,6 +2493,9 @@ static uint32_t ilk_compute_pri_wm(const struct intel_crtc_state *cstate,
         uint32_t method1, method2;
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2522,6 +2525,9 @@ static uint32_t ilk_compute_spr_wm(const struct intel_crtc_state *cstate,
         uint32_t method1, method2;
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2545,6 +2551,9 @@ static uint32_t ilk_compute_cur_wm(const struct intel_crtc_state *cstate,
 {
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2881,8 +2890,7 @@ static void intel_read_wm_latency(struct drm_i915_private *dev_priv,
                  * any underrun. If not able to get Dimm info assume 16GB dimm
                  * to avoid any underrun.
                  */
-                if (!dev_priv->dram_info.valid_dimm ||
-                    dev_priv->dram_info.is_16gb_dimm)
+                if (dev_priv->dram_info.is_16gb_dimm)
                         wm[0] += 1;
 
         } else if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv)) {
@@ -3009,6 +3017,34 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
         intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
 }
 
+static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
+{
+        /*
+         * On some SNB machines (Thinkpad X220 Tablet at least)
+         * LP3 usage can cause vblank interrupts to be lost.
+         * The DEIIR bit will go high but it looks like the CPU
+         * never gets interrupted.
+         *
+         * It's not clear whether other interrupt source could
+         * be affected or if this is somehow limited to vblank
+         * interrupts only. To play it safe we disable LP3
+         * watermarks entirely.
+         */
+        if (dev_priv->wm.pri_latency[3] == 0 &&
+            dev_priv->wm.spr_latency[3] == 0 &&
+            dev_priv->wm.cur_latency[3] == 0)
+                return;
+
+        dev_priv->wm.pri_latency[3] = 0;
+        dev_priv->wm.spr_latency[3] = 0;
+        dev_priv->wm.cur_latency[3] = 0;
+
+        DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n");
+        intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
+        intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
+        intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+}
+
 static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
 {
         intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
@@ -3025,8 +3061,10 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
         intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
         intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
 
-        if (IS_GEN6(dev_priv))
+        if (IS_GEN6(dev_priv)) {
                 snb_wm_latency_quirk(dev_priv);
+                snb_wm_lp3_irq_quirk(dev_priv);
+        }
 }
 
 static void skl_setup_wm_latency(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index d0ef50bf930a..187bb0ceb4ac 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -91,6 +91,7 @@ static int
 gen4_render_ring_flush(struct i915_request *rq, u32 mode)
 {
         u32 cmd, *cs;
+        int i;
 
         /*
          * read/write caches:
@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
                         cmd |= MI_INVALIDATE_ISP;
         }
 
-        cs = intel_ring_begin(rq, 2);
+        i = 2;
+        if (mode & EMIT_INVALIDATE)
+                i += 20;
+
+        cs = intel_ring_begin(rq, i);
         if (IS_ERR(cs))
                 return PTR_ERR(cs);
 
         *cs++ = cmd;
-        *cs++ = MI_NOOP;
+
+        /*
+         * A random delay to let the CS invalidate take effect? Without this
+         * delay, the GPU relocation path fails as the CS does not see
+         * the updated contents. Just as important, if we apply the flushes
+         * to the EMIT_FLUSH branch (i.e. immediately after the relocation
+         * write and before the invalidate on the next batch), the relocations
+         * still fail. This implies that is a delay following invalidation
+         * that is required to reset the caches as opposed to a delay to
+         * ensure the memory is written.
+         */
+        if (mode & EMIT_INVALIDATE) {
+                *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
+                *cs++ = i915_ggtt_offset(rq->engine->scratch) |
+                        PIPE_CONTROL_GLOBAL_GTT;
+                *cs++ = 0;
+                *cs++ = 0;
+
+                for (i = 0; i < 12; i++)
+                        *cs++ = MI_FLUSH;
+
+                *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
+                *cs++ = i915_ggtt_offset(rq->engine->scratch) |
+                        PIPE_CONTROL_GLOBAL_GTT;
+                *cs++ = 0;
+                *cs++ = 0;
+        }
+
+        *cs++ = cmd;
+
         intel_ring_advance(rq, cs);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 0fdabce647ab..44e4491a4918 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -2749,6 +2749,12 @@ static const struct i915_power_well_desc icl_power_wells[] = {
                 },
         },
         {
+                .name = "DC off",
+                .domains = ICL_DISPLAY_DC_OFF_POWER_DOMAINS,
+                .ops = &gen9_dc_off_power_well_ops,
+                .id = DISP_PW_ID_NONE,
+        },
+        {
                 .name = "power well 2",
                 .domains = ICL_PW_2_POWER_DOMAINS,
                 .ops = &hsw_power_well_ops,
@@ -2760,12 +2766,6 @@ static const struct i915_power_well_desc icl_power_wells[] = {
                 },
         },
         {
-                .name = "DC off",
-                .domains = ICL_DISPLAY_DC_OFF_POWER_DOMAINS,
-                .ops = &gen9_dc_off_power_well_ops,
-                .id = DISP_PW_ID_NONE,
-        },
-        {
                 .name = "power well 3",
                 .domains = ICL_PW_3_POWER_DOMAINS,
                 .ops = &hsw_power_well_ops,
@@ -3176,8 +3176,7 @@ static u8 intel_dbuf_max_slices(struct drm_i915_private *dev_priv)
 void icl_dbuf_slices_update(struct drm_i915_private *dev_priv,
                             u8 req_slices)
 {
-        u8 hw_enabled_slices = dev_priv->wm.skl_hw.ddb.enabled_slices;
-        u32 val;
+        const u8 hw_enabled_slices = dev_priv->wm.skl_hw.ddb.enabled_slices;
         bool ret;
 
         if (req_slices > intel_dbuf_max_slices(dev_priv)) {
@@ -3188,7 +3187,6 @@ void icl_dbuf_slices_update(struct drm_i915_private *dev_priv,
         if (req_slices == hw_enabled_slices || req_slices == 0)
                 return;
 
-        val = I915_READ(DBUF_CTL_S2);
         if (req_slices > hw_enabled_slices)
                 ret = intel_dbuf_slice_set(dev_priv, DBUF_CTL_S2, true);
         else
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 5fd2f7bf3927..d3090a7537bb 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -302,13 +302,65 @@ skl_plane_max_stride(struct intel_plane *plane,
                 return min(8192 * cpp, 32768);
 }
 
+static void
+skl_program_scaler(struct intel_plane *plane,
+                   const struct intel_crtc_state *crtc_state,
+                   const struct intel_plane_state *plane_state)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum pipe pipe = plane->pipe;
+        int scaler_id = plane_state->scaler_id;
+        const struct intel_scaler *scaler =
+                &crtc_state->scaler_state.scalers[scaler_id];
+        int crtc_x = plane_state->base.dst.x1;
+        int crtc_y = plane_state->base.dst.y1;
+        uint32_t crtc_w = drm_rect_width(&plane_state->base.dst);
+        uint32_t crtc_h = drm_rect_height(&plane_state->base.dst);
+        u16 y_hphase, uv_rgb_hphase;
+        u16 y_vphase, uv_rgb_vphase;
+        int hscale, vscale;
+
+        hscale = drm_rect_calc_hscale(&plane_state->base.src,
+                                      &plane_state->base.dst,
+                                      0, INT_MAX);
+        vscale = drm_rect_calc_vscale(&plane_state->base.src,
+                                      &plane_state->base.dst,
+                                      0, INT_MAX);
+
+        /* TODO: handle sub-pixel coordinates */
+        if (plane_state->base.fb->format->format == DRM_FORMAT_NV12) {
+                y_hphase = skl_scaler_calc_phase(1, hscale, false);
+                y_vphase = skl_scaler_calc_phase(1, vscale, false);
+
+                /* MPEG2 chroma siting convention */
+                uv_rgb_hphase = skl_scaler_calc_phase(2, hscale, true);
+                uv_rgb_vphase = skl_scaler_calc_phase(2, vscale, false);
+        } else {
+                /* not used */
+                y_hphase = 0;
+                y_vphase = 0;
+
+                uv_rgb_hphase = skl_scaler_calc_phase(1, hscale, false);
+                uv_rgb_vphase = skl_scaler_calc_phase(1, vscale, false);
+        }
+
+        I915_WRITE_FW(SKL_PS_CTRL(pipe, scaler_id),
+                      PS_SCALER_EN | PS_PLANE_SEL(plane->id) | scaler->mode);
+        I915_WRITE_FW(SKL_PS_PWR_GATE(pipe, scaler_id), 0);
+        I915_WRITE_FW(SKL_PS_VPHASE(pipe, scaler_id),
+                      PS_Y_PHASE(y_vphase) | PS_UV_RGB_PHASE(uv_rgb_vphase));
+        I915_WRITE_FW(SKL_PS_HPHASE(pipe, scaler_id),
+                      PS_Y_PHASE(y_hphase) | PS_UV_RGB_PHASE(uv_rgb_hphase));
+        I915_WRITE_FW(SKL_PS_WIN_POS(pipe, scaler_id), (crtc_x << 16) | crtc_y);
+        I915_WRITE_FW(SKL_PS_WIN_SZ(pipe, scaler_id), (crtc_w << 16) | crtc_h);
+}
+
 void
 skl_update_plane(struct intel_plane *plane,
                  const struct intel_crtc_state *crtc_state,
                  const struct intel_plane_state *plane_state)
 {
         struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
-        const struct drm_framebuffer *fb = plane_state->base.fb;
         enum plane_id plane_id = plane->id;
         enum pipe pipe = plane->pipe;
         u32 plane_ctl = plane_state->ctl;
@@ -318,8 +370,6 @@ skl_update_plane(struct intel_plane *plane,
         u32 aux_stride = skl_plane_stride(plane_state, 1);
         int crtc_x = plane_state->base.dst.x1;
         int crtc_y = plane_state->base.dst.y1;
-        uint32_t crtc_w = drm_rect_width(&plane_state->base.dst);
-        uint32_t crtc_h = drm_rect_height(&plane_state->base.dst);
         uint32_t x = plane_state->color_plane[0].x;
         uint32_t y = plane_state->color_plane[0].y;
         uint32_t src_w = drm_rect_width(&plane_state->base.src) >> 16;
@@ -329,8 +379,6 @@ skl_update_plane(struct intel_plane *plane,
         /* Sizes are 0 based */
         src_w--;
         src_h--;
-        crtc_w--;
-        crtc_h--;
 
         spin_lock_irqsave(&dev_priv->uncore.lock, irqflags);
 
@@ -353,41 +401,8 @@ skl_update_plane(struct intel_plane *plane,
                       (plane_state->color_plane[1].y << 16) |
                       plane_state->color_plane[1].x);
 
-        /* program plane scaler */
         if (plane_state->scaler_id >= 0) {
-                int scaler_id = plane_state->scaler_id;
-                const struct intel_scaler *scaler =
-                        &crtc_state->scaler_state.scalers[scaler_id];
-                u16 y_hphase, uv_rgb_hphase;
-                u16 y_vphase, uv_rgb_vphase;
-
-                /* TODO: handle sub-pixel coordinates */
-                if (fb->format->format == DRM_FORMAT_NV12) {
-                        y_hphase = skl_scaler_calc_phase(1, false);
-                        y_vphase = skl_scaler_calc_phase(1, false);
-
-                        /* MPEG2 chroma siting convention */
-                        uv_rgb_hphase = skl_scaler_calc_phase(2, true);
-                        uv_rgb_vphase = skl_scaler_calc_phase(2, false);
-                } else {
-                        /* not used */
-                        y_hphase = 0;
-                        y_vphase = 0;
-
-                        uv_rgb_hphase = skl_scaler_calc_phase(1, false);
-                        uv_rgb_vphase = skl_scaler_calc_phase(1, false);
-                }
-
-                I915_WRITE_FW(SKL_PS_CTRL(pipe, scaler_id),
-                              PS_SCALER_EN | PS_PLANE_SEL(plane_id) | scaler->mode);
-                I915_WRITE_FW(SKL_PS_PWR_GATE(pipe, scaler_id), 0);
-                I915_WRITE_FW(SKL_PS_VPHASE(pipe, scaler_id),
-                              PS_Y_PHASE(y_vphase) | PS_UV_RGB_PHASE(uv_rgb_vphase));
-                I915_WRITE_FW(SKL_PS_HPHASE(pipe, scaler_id),
-                              PS_Y_PHASE(y_hphase) | PS_UV_RGB_PHASE(uv_rgb_hphase));
-                I915_WRITE_FW(SKL_PS_WIN_POS(pipe, scaler_id), (crtc_x << 16) | crtc_y);
-                I915_WRITE_FW(SKL_PS_WIN_SZ(pipe, scaler_id),
-                              ((crtc_w + 1) << 16)|(crtc_h + 1));
+                skl_program_scaler(plane, crtc_state, plane_state);
 
                 I915_WRITE_FW(PLANE_POS(pipe, plane_id), 0);
         } else {
diff --git a/drivers/gpu/drm/i915/selftests/huge_pages.c b/drivers/gpu/drm/i915/selftests/huge_pages.c
index 8d03f64eabd7..5c22f2c8d4cf 100644
--- a/drivers/gpu/drm/i915/selftests/huge_pages.c
+++ b/drivers/gpu/drm/i915/selftests/huge_pages.c
@@ -551,7 +551,7 @@ static int igt_mock_ppgtt_misaligned_dma(void *arg)
                         err = igt_check_page_sizes(vma);
 
                         if (vma->page_sizes.gtt != I915_GTT_PAGE_SIZE_4K) {
-                                pr_err("page_sizes.gtt=%u, expected %lu\n",
+                                pr_err("page_sizes.gtt=%u, expected %llu\n",
                                        vma->page_sizes.gtt, I915_GTT_PAGE_SIZE_4K);
                                 err = -EINVAL;
                         }
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
index 8e2e269db97e..127d81513671 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
@@ -1337,7 +1337,7 @@ static int igt_gtt_reserve(void *arg)
                 GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
                 if (vma->node.start != total ||
                     vma->node.size != 2*I915_GTT_PAGE_SIZE) {
-                        pr_err("i915_gem_gtt_reserve (pass 1) placement failed, found (%llx + %llx), expected (%llx + %lx)\n",
+                        pr_err("i915_gem_gtt_reserve (pass 1) placement failed, found (%llx + %llx), expected (%llx + %llx)\n",
                                vma->node.start, vma->node.size,
                                total, 2*I915_GTT_PAGE_SIZE);
                         err = -EINVAL;
@@ -1386,7 +1386,7 @@ static int igt_gtt_reserve(void *arg)
                 GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
                 if (vma->node.start != total ||
                     vma->node.size != 2*I915_GTT_PAGE_SIZE) {
-                        pr_err("i915_gem_gtt_reserve (pass 2) placement failed, found (%llx + %llx), expected (%llx + %lx)\n",
+                        pr_err("i915_gem_gtt_reserve (pass 2) placement failed, found (%llx + %llx), expected (%llx + %llx)\n",
                                vma->node.start, vma->node.size,
                                total, 2*I915_GTT_PAGE_SIZE);
                         err = -EINVAL;
@@ -1430,7 +1430,7 @@ static int igt_gtt_reserve(void *arg)
                 GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
                 if (vma->node.start != offset ||
                     vma->node.size != 2*I915_GTT_PAGE_SIZE) {
-                        pr_err("i915_gem_gtt_reserve (pass 3) placement failed, found (%llx + %llx), expected (%llx + %lx)\n",
+                        pr_err("i915_gem_gtt_reserve (pass 3) placement failed, found (%llx + %llx), expected (%llx + %llx)\n",
                                vma->node.start, vma->node.size,
                                offset, 2*I915_GTT_PAGE_SIZE);
                         err = -EINVAL;
diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
index 05520202c967..191b314f9e9e 100644
--- a/drivers/gpu/drm/meson/meson_crtc.c
+++ b/drivers/gpu/drm/meson/meson_crtc.c
@@ -45,6 +45,7 @@ struct meson_crtc {
         struct drm_crtc base;
         struct drm_pending_vblank_event *event;
         struct meson_drm *priv;
+        bool enabled;
 };
 #define to_meson_crtc(x) container_of(x, struct meson_crtc, base)
 
@@ -80,8 +81,7 @@ static const struct drm_crtc_funcs meson_crtc_funcs = {
 
 };
 
-static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
-                                     struct drm_crtc_state *old_state)
+static void meson_crtc_enable(struct drm_crtc *crtc)
 {
         struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
         struct drm_crtc_state *crtc_state = crtc->state;
@@ -101,6 +101,22 @@ static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
         writel_bits_relaxed(VPP_POSTBLEND_ENABLE, VPP_POSTBLEND_ENABLE,
                             priv->io_base + _REG(VPP_MISC));
 
+        drm_crtc_vblank_on(crtc);
+
+        meson_crtc->enabled = true;
+}
+
+static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+                                     struct drm_crtc_state *old_state)
+{
+        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+        struct meson_drm *priv = meson_crtc->priv;
+
+        DRM_DEBUG_DRIVER("\n");
+
+        if (!meson_crtc->enabled)
+                meson_crtc_enable(crtc);
+
         priv->viu.osd1_enabled = true;
 }
 
@@ -110,6 +126,8 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
         struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
         struct meson_drm *priv = meson_crtc->priv;
 
+        drm_crtc_vblank_off(crtc);
+
         priv->viu.osd1_enabled = false;
         priv->viu.osd1_commit = false;
 
@@ -124,6 +142,8 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
 
                 crtc->state->event = NULL;
         }
+
+        meson_crtc->enabled = false;
 }
 
 static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
@@ -132,6 +152,9 @@ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
         struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
         unsigned long flags;
 
+        if (crtc->state->enable && !meson_crtc->enabled)
+                meson_crtc_enable(crtc);
+
         if (crtc->state->event) {
                 WARN_ON(drm_crtc_vblank_get(crtc) != 0);
 
diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index df7247cd93f9..2cb2ad26d716 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -706,6 +706,7 @@ static const struct regmap_config meson_dw_hdmi_regmap_config = {
         .reg_read = meson_dw_hdmi_reg_read,
         .reg_write = meson_dw_hdmi_reg_write,
         .max_register = 0x10000,
+        .fast_io = true,
 };
 
 static bool meson_hdmi_connector_is_available(struct device *dev)
diff --git a/drivers/gpu/drm/meson/meson_venc.c b/drivers/gpu/drm/meson/meson_venc.c
index 514245e69b38..be76f3d64bf2 100644
--- a/drivers/gpu/drm/meson/meson_venc.c
+++ b/drivers/gpu/drm/meson/meson_venc.c
@@ -71,6 +71,7 @@
  */
 
 /* HHI Registers */
+#define HHI_GCLK_MPEG2          0x148 /* 0x52 offset in data sheet */
 #define HHI_VDAC_CNTL0          0x2F4 /* 0xbd offset in data sheet */
 #define HHI_VDAC_CNTL1          0x2F8 /* 0xbe offset in data sheet */
 #define HHI_HDMI_PHY_CNTL0      0x3a0 /* 0xe8 offset in data sheet */
@@ -714,6 +715,7 @@ struct meson_hdmi_venc_vic_mode {
         { 5, &meson_hdmi_encp_mode_1080i60 },
         { 20, &meson_hdmi_encp_mode_1080i50 },
         { 32, &meson_hdmi_encp_mode_1080p24 },
+        { 33, &meson_hdmi_encp_mode_1080p50 },
         { 34, &meson_hdmi_encp_mode_1080p30 },
         { 31, &meson_hdmi_encp_mode_1080p50 },
         { 16, &meson_hdmi_encp_mode_1080p60 },
@@ -854,6 +856,13 @@ void meson_venc_hdmi_mode_set(struct meson_drm *priv, int vic,
         unsigned int sof_lines;
         unsigned int vsync_lines;
 
+        /* Use VENCI for 480i and 576i and double HDMI pixels */
+        if (mode->flags & DRM_MODE_FLAG_DBLCLK) {
+                hdmi_repeat = true;
+                use_enci = true;
+                venc_hdmi_latency = 1;
+        }
+
         if (meson_venc_hdmi_supported_vic(vic)) {
                 vmode = meson_venc_hdmi_get_vic_vmode(vic);
                 if (!vmode) {
@@ -865,13 +874,7 @@ void meson_venc_hdmi_mode_set(struct meson_drm *priv, int vic,
         } else {
                 meson_venc_hdmi_get_dmt_vmode(mode, &vmode_dmt);
                 vmode = &vmode_dmt;
-        }
-
-        /* Use VENCI for 480i and 576i and double HDMI pixels */
-        if (mode->flags & DRM_MODE_FLAG_DBLCLK) {
-                hdmi_repeat = true;
-                use_enci = true;
-                venc_hdmi_latency = 1;
+                use_enci = false;
         }
 
         /* Repeat VENC pixels for 480/576i/p, 720p50/60 and 1080p50/60 */
@@ -1529,10 +1532,12 @@ unsigned int meson_venci_get_field(struct meson_drm *priv)
 void meson_venc_enable_vsync(struct meson_drm *priv)
 {
         writel_relaxed(2, priv->io_base + _REG(VENC_INTCTRL));
+        regmap_update_bits(priv->hhi, HHI_GCLK_MPEG2, BIT(25), BIT(25));
 }
 
 void meson_venc_disable_vsync(struct meson_drm *priv)
 {
+        regmap_update_bits(priv->hhi, HHI_GCLK_MPEG2, BIT(25), 0);
         writel_relaxed(0, priv->io_base + _REG(VENC_INTCTRL));
 }
 
diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
index 6bcfa527c180..26a0857878bf 100644
--- a/drivers/gpu/drm/meson/meson_viu.c
+++ b/drivers/gpu/drm/meson/meson_viu.c
@@ -184,18 +184,18 @@ void meson_viu_set_osd_lut(struct meson_drm *priv, enum viu_lut_sel_e lut_sel,
         if (lut_sel == VIU_LUT_OSD_OETF) {
                 writel(0, priv->io_base + _REG(addr_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
                         writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
                 writel(r_map[OSD_OETF_LUT_SIZE - 1] | (g_map[0] << 16),
                         priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
                         writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
                                 priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
                         writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
@@ -211,18 +211,18 @@ void meson_viu_set_osd_lut(struct meson_drm *priv, enum viu_lut_sel_e lut_sel,
         } else if (lut_sel == VIU_LUT_OSD_EOTF) {
                 writel(0, priv->io_base + _REG(addr_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
                         writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
                 writel(r_map[OSD_EOTF_LUT_SIZE - 1] | (g_map[0] << 16),
                         priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
                         writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
                                 priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
                         writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 394c129cfb3b..0a485c5b982e 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -5409,11 +5409,14 @@ static int dsi_probe(struct platform_device *pdev)
 
         /* DSI on OMAP3 doesn't have register DSI_GNQ, set number
          * of data to 3 by default */
-        if (dsi->data->quirks & DSI_QUIRK_GNQ)
+        if (dsi->data->quirks & DSI_QUIRK_GNQ) {
+                dsi_runtime_get(dsi);
                 /* NB_DATA_LANES */
                 dsi->num_lanes_supported = 1 + REG_GET(dsi, DSI_GNQ, 11, 9);
-        else
+                dsi_runtime_put(dsi);
+        } else {
                 dsi->num_lanes_supported = 3;
+        }
 
         r = dsi_init_output(dsi);
         if (r)
@@ -5426,15 +5429,19 @@ static int dsi_probe(struct platform_device *pdev)
         }
 
         r = of_platform_populate(dev->of_node, NULL, NULL, dev);
-        if (r)
+        if (r) {
                 DSSERR("Failed to populate DSI child devices: %d\n", r);
+                goto err_uninit_output;
+        }
 
         r = component_add(&pdev->dev, &dsi_component_ops);
         if (r)
-                goto err_uninit_output;
+                goto err_of_depopulate;
 
         return 0;
 
+err_of_depopulate:
+        of_platform_depopulate(dev);
 err_uninit_output:
         dsi_uninit_output(dsi);
 err_pm_disable:
@@ -5470,19 +5477,12 @@ static int dsi_runtime_suspend(struct device *dev)
         /* wait for current handler to finish before turning the DSI off */
         synchronize_irq(dsi->irq);
 
-        dispc_runtime_put(dsi->dss->dispc);
-
         return 0;
 }
 
 static int dsi_runtime_resume(struct device *dev)
 {
         struct dsi_data *dsi = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(dsi->dss->dispc);
-        if (r)
-                return r;
 
         dsi->is_enabled = true;
         /* ensure the irq handler sees the is_enabled value */
diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c
index 1aaf260aa9b8..7553c7fc1c45 100644
--- a/drivers/gpu/drm/omapdrm/dss/dss.c
+++ b/drivers/gpu/drm/omapdrm/dss/dss.c
@@ -1484,16 +1484,23 @@ static int dss_probe(struct platform_device *pdev)
                                                    dss);
 
         /* Add all the child devices as components. */
+        r = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+        if (r)
+                goto err_uninit_debugfs;
+
         omapdss_gather_components(&pdev->dev);
 
         device_for_each_child(&pdev->dev, &match, dss_add_child_component);
 
         r = component_master_add_with_match(&pdev->dev, &dss_component_ops, match);
         if (r)
-                goto err_uninit_debugfs;
+                goto err_of_depopulate;
 
         return 0;
 
+err_of_depopulate:
+        of_platform_depopulate(&pdev->dev);
+
 err_uninit_debugfs:
         dss_debugfs_remove_file(dss->debugfs.clk);
         dss_debugfs_remove_file(dss->debugfs.dss);
@@ -1522,6 +1529,8 @@ static int dss_remove(struct platform_device *pdev)
 {
         struct dss_device *dss = platform_get_drvdata(pdev);
 
+        of_platform_depopulate(&pdev->dev);
+
         component_master_del(&pdev->dev, &dss_component_ops);
 
         dss_debugfs_remove_file(dss->debugfs.clk);
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
index cf6230eac31a..aabdda394c9c 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
@@ -635,10 +635,14 @@ static int hdmi4_bind(struct device *dev, struct device *master, void *data)
 
         hdmi->dss = dss;
 
-        r = hdmi_pll_init(dss, hdmi->pdev, &hdmi->pll, &hdmi->wp);
+        r = hdmi_runtime_get(hdmi);
         if (r)
                 return r;
 
+        r = hdmi_pll_init(dss, hdmi->pdev, &hdmi->pll, &hdmi->wp);
+        if (r)
+                goto err_runtime_put;
+
         r = hdmi4_cec_init(hdmi->pdev, &hdmi->core, &hdmi->wp);
         if (r)
                 goto err_pll_uninit;
@@ -652,12 +656,16 @@ static int hdmi4_bind(struct device *dev, struct device *master, void *data)
         hdmi->debugfs = dss_debugfs_create_file(dss, "hdmi", hdmi_dump_regs,
                                                hdmi);
 
+        hdmi_runtime_put(hdmi);
+
         return 0;
 
 err_cec_uninit:
         hdmi4_cec_uninit(&hdmi->core);
 err_pll_uninit:
         hdmi_pll_uninit(&hdmi->pll);
+err_runtime_put:
+        hdmi_runtime_put(hdmi);
         return r;
 }
 
@@ -833,32 +841,6 @@ static int hdmi4_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int hdmi_runtime_suspend(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-
-        dispc_runtime_put(hdmi->dss->dispc);
-
-        return 0;
-}
-
-static int hdmi_runtime_resume(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(hdmi->dss->dispc);
-        if (r < 0)
-                return r;
-
-        return 0;
-}
-
-static const struct dev_pm_ops hdmi_pm_ops = {
-        .runtime_suspend = hdmi_runtime_suspend,
-        .runtime_resume = hdmi_runtime_resume,
-};
-
 static const struct of_device_id hdmi_of_match[] = {
         { .compatible = "ti,omap4-hdmi", },
         {},
@@ -869,7 +851,6 @@ struct platform_driver omapdss_hdmi4hw_driver = {
         .remove         = hdmi4_remove,
         .driver         = {
                 .name   = "omapdss_hdmi",
-                .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
                 .suppress_bind_attrs = true,
         },
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
index b0e4a7463f8c..9e8556f67a29 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
@@ -825,32 +825,6 @@ static int hdmi5_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int hdmi_runtime_suspend(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-
-        dispc_runtime_put(hdmi->dss->dispc);
-
-        return 0;
-}
-
-static int hdmi_runtime_resume(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(hdmi->dss->dispc);
-        if (r < 0)
-                return r;
-
-        return 0;
-}
-
-static const struct dev_pm_ops hdmi_pm_ops = {
-        .runtime_suspend = hdmi_runtime_suspend,
-        .runtime_resume = hdmi_runtime_resume,
-};
-
 static const struct of_device_id hdmi_of_match[] = {
         { .compatible = "ti,omap5-hdmi", },
         { .compatible = "ti,dra7-hdmi", },
@@ -862,7 +836,6 @@ struct platform_driver omapdss_hdmi5hw_driver = {
         .remove         = hdmi5_remove,
         .driver         = {
                 .name   = "omapdss_hdmi5",
-                .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
                 .suppress_bind_attrs = true,
         },
diff --git a/drivers/gpu/drm/omapdrm/dss/venc.c b/drivers/gpu/drm/omapdrm/dss/venc.c
index ff0b18c8e4ac..b5f52727f8b1 100644
--- a/drivers/gpu/drm/omapdrm/dss/venc.c
+++ b/drivers/gpu/drm/omapdrm/dss/venc.c
@@ -946,19 +946,12 @@ static int venc_runtime_suspend(struct device *dev)
         if (venc->tv_dac_clk)
                 clk_disable_unprepare(venc->tv_dac_clk);
 
-        dispc_runtime_put(venc->dss->dispc);
-
         return 0;
 }
 
 static int venc_runtime_resume(struct device *dev)
 {
         struct venc_device *venc = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(venc->dss->dispc);
-        if (r < 0)
-                return r;
 
         if (venc->tv_dac_clk)
                 clk_prepare_enable(venc->tv_dac_clk);
diff --git a/drivers/gpu/drm/omapdrm/omap_crtc.c b/drivers/gpu/drm/omapdrm/omap_crtc.c
index 62928ec0e7db..caffc547ef97 100644
--- a/drivers/gpu/drm/omapdrm/omap_crtc.c
+++ b/drivers/gpu/drm/omapdrm/omap_crtc.c
@@ -350,11 +350,14 @@ static void omap_crtc_arm_event(struct drm_crtc *crtc)
 static void omap_crtc_atomic_enable(struct drm_crtc *crtc,
                                     struct drm_crtc_state *old_state)
 {
+        struct omap_drm_private *priv = crtc->dev->dev_private;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
         int ret;
 
         DBG("%s", omap_crtc->name);
 
+        priv->dispc_ops->runtime_get(priv->dispc);
+
         spin_lock_irq(&crtc->dev->event_lock);
         drm_crtc_vblank_on(crtc);
         ret = drm_crtc_vblank_get(crtc);
@@ -367,6 +370,7 @@ static void omap_crtc_atomic_enable(struct drm_crtc *crtc,
 static void omap_crtc_atomic_disable(struct drm_crtc *crtc,
                                      struct drm_crtc_state *old_state)
 {
+        struct omap_drm_private *priv = crtc->dev->dev_private;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
 
         DBG("%s", omap_crtc->name);
@@ -379,6 +383,8 @@ static void omap_crtc_atomic_disable(struct drm_crtc *crtc,
         spin_unlock_irq(&crtc->dev->event_lock);
 
         drm_crtc_vblank_off(crtc);
+
+        priv->dispc_ops->runtime_put(priv->dispc);
 }
 
 static enum drm_mode_status omap_crtc_mode_valid(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_group.c b/drivers/gpu/drm/rcar-du/rcar_du_group.c
index d85f0a1c1581..cebf313c6e1f 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_group.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_group.c
@@ -202,10 +202,25 @@ void rcar_du_group_put(struct rcar_du_group *rgrp)
 
 static void __rcar_du_group_start_stop(struct rcar_du_group *rgrp, bool start)
 {
-        struct rcar_du_crtc *rcrtc = &rgrp->dev->crtcs[rgrp->index * 2];
+        struct rcar_du_device *rcdu = rgrp->dev;
+
+        /*
+         * Group start/stop is controlled by the DRES and DEN bits of DSYSR0
+         * for the first group and DSYSR2 for the second group. On most DU
+         * instances, this maps to the first CRTC of the group, and we can just
+         * use rcar_du_crtc_dsysr_clr_set() to access the correct DSYSR. On
+         * M3-N, however, DU2 doesn't exist, but DSYSR2 does. We thus need to
+         * access the register directly using group read/write.
+         */
+        if (rcdu->info->channels_mask & BIT(rgrp->index * 2)) {
+                struct rcar_du_crtc *rcrtc = &rgrp->dev->crtcs[rgrp->index * 2];
 
-        rcar_du_crtc_dsysr_clr_set(rcrtc, DSYSR_DRES | DSYSR_DEN,
-                                   start ? DSYSR_DEN : DSYSR_DRES);
+                rcar_du_crtc_dsysr_clr_set(rcrtc, DSYSR_DRES | DSYSR_DEN,
+                                           start ? DSYSR_DEN : DSYSR_DRES);
+        } else {
+                rcar_du_group_write(rgrp, DSYSR,
+                                    start ? DSYSR_DEN : DSYSR_DRES);
+        }
 }
 
 void rcar_du_group_start_stop(struct rcar_du_group *rgrp, bool start)
diff --git a/drivers/gpu/drm/sun4i/sun4i_lvds.c b/drivers/gpu/drm/sun4i/sun4i_lvds.c
index af7dcb6da351..e7eb0d1e17be 100644
--- a/drivers/gpu/drm/sun4i/sun4i_lvds.c
+++ b/drivers/gpu/drm/sun4i/sun4i_lvds.c
@@ -75,7 +75,7 @@ static void sun4i_lvds_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Enabling LVDS output\n");
 
-        if (!IS_ERR(tcon->panel)) {
+        if (tcon->panel) {
                 drm_panel_prepare(tcon->panel);
                 drm_panel_enable(tcon->panel);
         }
@@ -88,7 +88,7 @@ static void sun4i_lvds_encoder_disable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Disabling LVDS output\n");
 
-        if (!IS_ERR(tcon->panel)) {
+        if (tcon->panel) {
                 drm_panel_disable(tcon->panel);
                 drm_panel_unprepare(tcon->panel);
         }
diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4i_rgb.c
index bf068da6b12e..f4a22689eb54 100644
--- a/drivers/gpu/drm/sun4i/sun4i_rgb.c
+++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c
@@ -135,7 +135,7 @@ static void sun4i_rgb_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Enabling RGB output\n");
 
-        if (!IS_ERR(tcon->panel)) {
+        if (tcon->panel) {
                 drm_panel_prepare(tcon->panel);
                 drm_panel_enable(tcon->panel);
         }
@@ -148,7 +148,7 @@ static void sun4i_rgb_encoder_disable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Disabling RGB output\n");
 
-        if (!IS_ERR(tcon->panel)) {
+        if (tcon->panel) {
                 drm_panel_disable(tcon->panel);
                 drm_panel_unprepare(tcon->panel);
         }
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index c78cd35a1294..f949287d926c 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -491,7 +491,8 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
         sun4i_tcon0_mode_set_common(tcon, mode);
 
         /* Set dithering if needed */
-        sun4i_tcon0_mode_set_dithering(tcon, tcon->panel->connector);
+        if (tcon->panel)
+                sun4i_tcon0_mode_set_dithering(tcon, tcon->panel->connector);
 
         /* Adjust clock delay */
         clk_delay = sun4i_tcon_get_clk_delay(mode, 0);
@@ -555,7 +556,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
          * Following code is a way to avoid quirks all around TCON
          * and DOTCLOCK drivers.
          */
-        if (!IS_ERR(tcon->panel)) {
+        if (tcon->panel) {
                 struct drm_panel *panel = tcon->panel;
                 struct drm_connector *connector = panel->connector;
                 struct drm_display_info display_info = connector->display_info;
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 127468785f74..1f94b9affe4b 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -214,6 +214,12 @@ static int vc4_atomic_commit(struct drm_device *dev,
                 return 0;
         }
 
+        /* We know for sure we don't want an async update here. Set
+         * state->legacy_cursor_update to false to prevent
+         * drm_atomic_helper_setup_commit() from auto-completing
+         * commit->flip_done.
+         */
+        state->legacy_cursor_update = false;
         ret = drm_atomic_helper_setup_commit(state, nonblock);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 9dc3fcbd290b..c6635f23918a 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -807,7 +807,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb)
 static void vc4_plane_atomic_async_update(struct drm_plane *plane,
                                           struct drm_plane_state *state)
 {
-        struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
+        struct vc4_plane_state *vc4_state, *new_vc4_state;
 
         if (plane->state->fb != state->fb) {
                 vc4_plane_async_set_fb(plane, state->fb);
@@ -828,7 +828,18 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
         plane->state->src_y = state->src_y;
 
         /* Update the display list based on the new crtc_x/y. */
-        vc4_plane_atomic_check(plane, plane->state);
+        vc4_plane_atomic_check(plane, state);
+
+        new_vc4_state = to_vc4_plane_state(state);
+        vc4_state = to_vc4_plane_state(plane->state);
+
+        /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
+        vc4_state->dlist[vc4_state->pos0_offset] =
+                new_vc4_state->dlist[vc4_state->pos0_offset];
+        vc4_state->dlist[vc4_state->pos2_offset] =
+                new_vc4_state->dlist[vc4_state->pos2_offset];
+        vc4_state->dlist[vc4_state->ptr0_offset] =
+                new_vc4_state->dlist[vc4_state->ptr0_offset];
 
         /* Note that we can't just call vc4_plane_write_dlist()
          * because that would smash the context data that the HVS is
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index cf2a18571d48..a132c37d7334 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -380,6 +380,9 @@ int vga_switcheroo_register_audio_client(struct pci_dev *pdev,
                         mutex_unlock(&vgasr_mutex);
                         return -EINVAL;
                 }
+                /* notify if GPU has been already bound */
+                if (ops->gpu_bound)
+                        ops->gpu_bound(pdev, id);
         }
         mutex_unlock(&vgasr_mutex);
 
diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
index aec253b44156..3cd7229b6e54 100644
--- a/drivers/hid/hid-alps.c
+++ b/drivers/hid/hid-alps.c
@@ -660,6 +660,20 @@ exit:
         return ret;
 }
 
+static int alps_sp_open(struct input_dev *dev)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+
+        return hid_hw_open(hid);
+}
+
+static void alps_sp_close(struct input_dev *dev)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+
+        hid_hw_close(hid);
+}
+
 static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
 {
         struct alps_dev *data = hid_get_drvdata(hdev);
@@ -733,6 +747,10 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
                 input2->id.version = input->id.version;
                 input2->dev.parent = input->dev.parent;
 
+                input_set_drvdata(input2, hdev);
+                input2->open = alps_sp_open;
+                input2->close = alps_sp_close;
+
                 __set_bit(EV_KEY, input2->evbit);
                 data->sp_btn_cnt = (data->sp_btn_info & 0x0F);
                 for (i = 0; i < data->sp_btn_cnt; i++)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index dc6d6477e961..a1fa2fc8c9b5 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -359,6 +359,9 @@ static bool asus_kbd_wmi_led_control_present(struct hid_device *hdev)
         u32 value;
         int ret;
 
+        if (!IS_ENABLED(CONFIG_ASUS_WMI))
+                return false;
+
         ret = asus_wmi_evaluate_method(ASUS_WMI_METHODID_DSTS2,
                                        ASUS_WMI_DEVID_KBD_BACKLIGHT, 0, &value);
         hid_dbg(hdev, "WMI backlight check: rc %d value %x", ret, value);
diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
index b372854cf38d..704049e62d58 100644
--- a/drivers/hid/hid-hyperv.c
+++ b/drivers/hid/hid-hyperv.c
@@ -309,7 +309,7 @@ static void mousevsc_on_receive(struct hv_device *device,
                 hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
                                  input_dev->input_buf, len, 1);
 
-                pm_wakeup_event(&input_dev->device->device, 0);
+                pm_wakeup_hard_event(&input_dev->device->device);
 
                 break;
         default:
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index f63489c882bb..ed35c9a9a110 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -275,6 +275,9 @@
 
 #define USB_VENDOR_ID_CIDC              0x1677
 
+#define I2C_VENDOR_ID_CIRQUE            0x0488
+#define I2C_PRODUCT_ID_CIRQUE_121F      0x121F
+
 #define USB_VENDOR_ID_CJTOUCH           0x24b8
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020  0x0020
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0040  0x0040
@@ -707,6 +710,7 @@
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
 #define USB_DEVICE_ID_LG_MELFAS_MT      0x6007
+#define I2C_DEVICE_ID_LG_8001           0x8001
 
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
@@ -805,6 +809,7 @@
 #define USB_DEVICE_ID_MS_TYPE_COVER_2    0x07a9
 #define USB_DEVICE_ID_MS_POWER_COVER     0x07da
 #define USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER  0x02fd
+#define USB_DEVICE_ID_MS_PIXART_MOUSE    0x00cb
 
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -927,6 +932,9 @@
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003         0x3003
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008         0x3008
 
+#define I2C_VENDOR_ID_RAYDIUM           0x2386
+#define I2C_PRODUCT_ID_RAYDIUM_4B33     0x4b33
+
 #define USB_VENDOR_ID_RAZER            0x1532
 #define USB_DEVICE_ID_RAZER_BLADE_14   0x011D
 
@@ -1040,6 +1048,7 @@
 #define USB_VENDOR_ID_SYMBOL            0x05e0
 #define USB_DEVICE_ID_SYMBOL_SCANNER_1  0x0800
 #define USB_DEVICE_ID_SYMBOL_SCANNER_2  0x1300
+#define USB_DEVICE_ID_SYMBOL_SCANNER_3  0x1200
 
 #define USB_VENDOR_ID_SYNAPTICS         0x06cb
 #define USB_DEVICE_ID_SYNAPTICS_TP      0x0001
@@ -1201,6 +1210,8 @@
 #define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
 #define USB_DEVICE_ID_PRIMAX_REZEL      0x4e72
+#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F  0x4d0f
+#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22  0x4e22
 
 
 #define USB_VENDOR_ID_RISO_KAGAKU       0x1294  /* Riso Kagaku Corp. */
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index a2f74e6adc70..d6fab5798487 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -325,6 +325,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
                 USB_DEVICE_ID_ELECOM_BM084),
           HID_BATTERY_QUIRK_IGNORE },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
+                USB_DEVICE_ID_SYMBOL_SCANNER_3),
+          HID_BATTERY_QUIRK_IGNORE },
         {}
 };
 
@@ -1838,47 +1841,3 @@ void hidinput_disconnect(struct hid_device *hid)
 }
 EXPORT_SYMBOL_GPL(hidinput_disconnect);
 
-/**
- * hid_scroll_counter_handle_scroll() - Send high- and low-resolution scroll
- *                                      events given a high-resolution wheel
- *                                      movement.
- * @counter: a hid_scroll_counter struct describing the wheel.
- * @hi_res_value: the movement of the wheel, in the mouse's high-resolution
- *                units.
- *
- * Given a high-resolution movement, this function converts the movement into
- * microns and emits high-resolution scroll events for the input device. It also
- * uses the multiplier from &struct hid_scroll_counter to emit low-resolution
- * scroll events when appropriate for backwards-compatibility with userspace
- * input libraries.
- */
-void hid_scroll_counter_handle_scroll(struct hid_scroll_counter *counter,
-                                      int hi_res_value)
-{
-        int low_res_value, remainder, multiplier;
-
-        input_report_rel(counter->dev, REL_WHEEL_HI_RES,
-                         hi_res_value * counter->microns_per_hi_res_unit);
-
-        /*
-         * Update the low-res remainder with the high-res value,
-         * but reset if the direction has changed.
-         */
-        remainder = counter->remainder;
-        if ((remainder ^ hi_res_value) < 0)
-                remainder = 0;
-        remainder += hi_res_value;
-
-        /*
-         * Then just use the resolution multiplier to see if
-         * we should send a low-res (aka regular wheel) event.
-         */
-        multiplier = counter->resolution_multiplier;
-        low_res_value = remainder / multiplier;
-        remainder -= low_res_value * multiplier;
-        counter->remainder = remainder;
-
-        if (low_res_value)
-                input_report_rel(counter->dev, REL_WHEEL, low_res_value);
-}
-EXPORT_SYMBOL_GPL(hid_scroll_counter_handle_scroll);
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index f01280898b24..19cc980eebce 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -64,14 +64,6 @@ MODULE_PARM_DESC(disable_tap_to_click,
 #define HIDPP_QUIRK_NO_HIDINPUT                 BIT(23)
 #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS        BIT(24)
 #define HIDPP_QUIRK_UNIFYING                    BIT(25)
-#define HIDPP_QUIRK_HI_RES_SCROLL_1P0           BIT(26)
-#define HIDPP_QUIRK_HI_RES_SCROLL_X2120         BIT(27)
-#define HIDPP_QUIRK_HI_RES_SCROLL_X2121         BIT(28)
-
-/* Convenience constant to check for any high-res support. */
-#define HIDPP_QUIRK_HI_RES_SCROLL       (HIDPP_QUIRK_HI_RES_SCROLL_1P0 | \
-                                         HIDPP_QUIRK_HI_RES_SCROLL_X2120 | \
-                                         HIDPP_QUIRK_HI_RES_SCROLL_X2121)
 
 #define HIDPP_QUIRK_DELAYED_INIT                HIDPP_QUIRK_NO_HIDINPUT
 
@@ -157,7 +149,6 @@ struct hidpp_device {
         unsigned long capabilities;
 
         struct hidpp_battery battery;
-        struct hid_scroll_counter vertical_wheel_counter;
 };
 
 /* HID++ 1.0 error codes */
@@ -409,53 +400,32 @@ static void hidpp_prefix_name(char **name, int name_length)
 #define HIDPP_SET_LONG_REGISTER                         0x82
 #define HIDPP_GET_LONG_REGISTER                         0x83
 
-/**
- * hidpp10_set_register_bit() - Sets a single bit in a HID++ 1.0 register.
- * @hidpp_dev: the device to set the register on.
- * @register_address: the address of the register to modify.
- * @byte: the byte of the register to modify. Should be less than 3.
- * Return: 0 if successful, otherwise a negative error code.
- */
-static int hidpp10_set_register_bit(struct hidpp_device *hidpp_dev,
-        u8 register_address, u8 byte, u8 bit)
+#define HIDPP_REG_GENERAL                               0x00
+
+static int hidpp10_enable_battery_reporting(struct hidpp_device *hidpp_dev)
 {
         struct hidpp_report response;
         int ret;
         u8 params[3] = { 0 };
 
         ret = hidpp_send_rap_command_sync(hidpp_dev,
-                                          REPORT_ID_HIDPP_SHORT,
-                                          HIDPP_GET_REGISTER,
-                                          register_address,
-                                          NULL, 0, &response);
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_GET_REGISTER,
+                                        HIDPP_REG_GENERAL,
+                                        NULL, 0, &response);
         if (ret)
                 return ret;
 
         memcpy(params, response.rap.params, 3);
 
-        params[byte] |= BIT(bit);
+        /* Set the battery bit */
+        params[0] |= BIT(4);
 
         return hidpp_send_rap_command_sync(hidpp_dev,
-                                           REPORT_ID_HIDPP_SHORT,
-                                           HIDPP_SET_REGISTER,
-                                           register_address,
-                                           params, 3, &response);
-}
-
-
-#define HIDPP_REG_GENERAL                               0x00
-
-static int hidpp10_enable_battery_reporting(struct hidpp_device *hidpp_dev)
-{
-        return hidpp10_set_register_bit(hidpp_dev, HIDPP_REG_GENERAL, 0, 4);
-}
-
-#define HIDPP_REG_FEATURES                              0x01
-
-/* On HID++ 1.0 devices, high-res scroll was called "scrolling acceleration". */
-static int hidpp10_enable_scrolling_acceleration(struct hidpp_device *hidpp_dev)
-{
-        return hidpp10_set_register_bit(hidpp_dev, HIDPP_REG_FEATURES, 0, 6);
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_SET_REGISTER,
+                                        HIDPP_REG_GENERAL,
+                                        params, 3, &response);
 }
 
 #define HIDPP_REG_BATTERY_STATUS                        0x07
@@ -1167,100 +1137,6 @@ static int hidpp_battery_get_property(struct power_supply *psy,
 }
 
 /* -------------------------------------------------------------------------- */
-/* 0x2120: Hi-resolution scrolling                                            */
-/* -------------------------------------------------------------------------- */
-
-#define HIDPP_PAGE_HI_RESOLUTION_SCROLLING                      0x2120
-
-#define CMD_HI_RESOLUTION_SCROLLING_SET_HIGHRES_SCROLLING_MODE  0x10
-
-static int hidpp_hrs_set_highres_scrolling_mode(struct hidpp_device *hidpp,
-        bool enabled, u8 *multiplier)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        u8 params[1];
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp,
-                                     HIDPP_PAGE_HI_RESOLUTION_SCROLLING,
-                                     &feature_index,
-                                     &feature_type);
-        if (ret)
-                return ret;
-
-        params[0] = enabled ? BIT(0) : 0;
-        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
-                                          CMD_HI_RESOLUTION_SCROLLING_SET_HIGHRES_SCROLLING_MODE,
-                                          params, sizeof(params), &response);
-        if (ret)
-                return ret;
-        *multiplier = response.fap.params[1];
-        return 0;
-}
-
-/* -------------------------------------------------------------------------- */
-/* 0x2121: HiRes Wheel                                                        */
-/* -------------------------------------------------------------------------- */
-
-#define HIDPP_PAGE_HIRES_WHEEL          0x2121
-
-#define CMD_HIRES_WHEEL_GET_WHEEL_CAPABILITY    0x00
-#define CMD_HIRES_WHEEL_SET_WHEEL_MODE          0x20
-
-static int hidpp_hrw_get_wheel_capability(struct hidpp_device *hidpp,
-        u8 *multiplier)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_HIRES_WHEEL,
-                                     &feature_index, &feature_type);
-        if (ret)
-                goto return_default;
-
-        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
-                                          CMD_HIRES_WHEEL_GET_WHEEL_CAPABILITY,
-                                          NULL, 0, &response);
-        if (ret)
-                goto return_default;
-
-        *multiplier = response.fap.params[0];
-        return 0;
-return_default:
-        hid_warn(hidpp->hid_dev,
-                 "Couldn't get wheel multiplier (error %d), assuming %d.\n",
-                 ret, *multiplier);
-        return ret;
-}
-
-static int hidpp_hrw_set_wheel_mode(struct hidpp_device *hidpp, bool invert,
-        bool high_resolution, bool use_hidpp)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        u8 params[1];
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_HIRES_WHEEL,
-                                     &feature_index, &feature_type);
-        if (ret)
-                return ret;
-
-        params[0] = (invert          ? BIT(2) : 0) |
-                    (high_resolution ? BIT(1) : 0) |
-                    (use_hidpp       ? BIT(0) : 0);
-
-        return hidpp_send_fap_command_sync(hidpp, feature_index,
-                                           CMD_HIRES_WHEEL_SET_WHEEL_MODE,
-                                           params, sizeof(params), &response);
-}
-
-/* -------------------------------------------------------------------------- */
 /* 0x4301: Solar Keyboard                                                     */
 /* -------------------------------------------------------------------------- */
 
@@ -2523,8 +2399,7 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
                 input_report_rel(mydata->input, REL_Y, v);
 
                 v = hid_snto32(data[6], 8);
-                hid_scroll_counter_handle_scroll(
-                                &hidpp->vertical_wheel_counter, v);
+                input_report_rel(mydata->input, REL_WHEEL, v);
 
                 input_sync(mydata->input);
         }
@@ -2653,72 +2528,6 @@ static int g920_get_config(struct hidpp_device *hidpp)
 }
 
 /* -------------------------------------------------------------------------- */
-/* High-resolution scroll wheels                                              */
-/* -------------------------------------------------------------------------- */
-
-/**
- * struct hi_res_scroll_info - Stores info on a device's high-res scroll wheel.
- * @product_id: the HID product ID of the device being described.
- * @microns_per_hi_res_unit: the distance moved by the user's finger for each
- *                         high-resolution unit reported by the device, in
- *                         256ths of a millimetre.
- */
-struct hi_res_scroll_info {
-        __u32 product_id;
-        int microns_per_hi_res_unit;
-};
-
-static struct hi_res_scroll_info hi_res_scroll_devices[] = {
-        { /* Anywhere MX */
-          .product_id = 0x1017, .microns_per_hi_res_unit = 445 },
-        { /* Performance MX */
-          .product_id = 0x101a, .microns_per_hi_res_unit = 406 },
-        { /* M560 */
-          .product_id = 0x402d, .microns_per_hi_res_unit = 435 },
-        { /* MX Master 2S */
-          .product_id = 0x4069, .microns_per_hi_res_unit = 406 },
-};
-
-static int hi_res_scroll_look_up_microns(__u32 product_id)
-{
-        int i;
-        int num_devices = sizeof(hi_res_scroll_devices)
-                          / sizeof(hi_res_scroll_devices[0]);
-        for (i = 0; i < num_devices; i++) {
-                if (hi_res_scroll_devices[i].product_id == product_id)
-                        return hi_res_scroll_devices[i].microns_per_hi_res_unit;
-        }
-        /* We don't have a value for this device, so use a sensible default. */
-        return 406;
-}
-
-static int hi_res_scroll_enable(struct hidpp_device *hidpp)
-{
-        int ret;
-        u8 multiplier = 8;
-
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_X2121) {
-                ret = hidpp_hrw_set_wheel_mode(hidpp, false, true, false);
-                hidpp_hrw_get_wheel_capability(hidpp, &multiplier);
-        } else if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_X2120) {
-                ret = hidpp_hrs_set_highres_scrolling_mode(hidpp, true,
-                                                           &multiplier);
-        } else /* if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_1P0) */
-                ret = hidpp10_enable_scrolling_acceleration(hidpp);
-
-        if (ret)
-                return ret;
-
-        hidpp->vertical_wheel_counter.resolution_multiplier = multiplier;
-        hidpp->vertical_wheel_counter.microns_per_hi_res_unit =
-                hi_res_scroll_look_up_microns(hidpp->hid_dev->product);
-        hid_info(hidpp->hid_dev, "multiplier = %d, microns = %d\n",
-                 multiplier,
-                 hidpp->vertical_wheel_counter.microns_per_hi_res_unit);
-        return 0;
-}
-
-/* -------------------------------------------------------------------------- */
 /* Generic HID++ devices                                                      */
 /* -------------------------------------------------------------------------- */
 
@@ -2763,11 +2572,6 @@ static void hidpp_populate_input(struct hidpp_device *hidpp,
                 wtp_populate_input(hidpp, input, origin_is_hid_core);
         else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
                 m560_populate_input(hidpp, input, origin_is_hid_core);
-
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL) {
-                input_set_capability(input, EV_REL, REL_WHEEL_HI_RES);
-                hidpp->vertical_wheel_counter.dev = input;
-        }
 }
 
 static int hidpp_input_configured(struct hid_device *hdev,
@@ -2886,27 +2690,6 @@ static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
         return 0;
 }
 
-static int hidpp_event(struct hid_device *hdev, struct hid_field *field,
-        struct hid_usage *usage, __s32 value)
-{
-        /* This function will only be called for scroll events, due to the
-         * restriction imposed in hidpp_usages.
-         */
-        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
-        struct hid_scroll_counter *counter = &hidpp->vertical_wheel_counter;
-        /* A scroll event may occur before the multiplier has been retrieved or
-         * the input device set, or high-res scroll enabling may fail. In such
-         * cases we must return early (falling back to default behaviour) to
-         * avoid a crash in hid_scroll_counter_handle_scroll.
-         */
-        if (!(hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL) || value == 0
-            || counter->dev == NULL || counter->resolution_multiplier == 0)
-                return 0;
-
-        hid_scroll_counter_handle_scroll(counter, value);
-        return 1;
-}
-
 static int hidpp_initialize_battery(struct hidpp_device *hidpp)
 {
         static atomic_t battery_no = ATOMIC_INIT(0);
@@ -3118,9 +2901,6 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
         if (hidpp->battery.ps)
                 power_supply_changed(hidpp->battery.ps);
 
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL)
-                hi_res_scroll_enable(hidpp);
-
         if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) || hidpp->delayed_input)
                 /* if the input nodes are already created, we can stop now */
                 return;
@@ -3306,63 +3086,35 @@ static void hidpp_remove(struct hid_device *hdev)
         mutex_destroy(&hidpp->send_mutex);
 }
 
-#define LDJ_DEVICE(product) \
-        HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE, \
-                   USB_VENDOR_ID_LOGITECH, (product))
-
 static const struct hid_device_id hidpp_devices[] = {
         { /* wireless touchpad */
-          LDJ_DEVICE(0x4011),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4011),
           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
                          HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
         { /* wireless touchpad T650 */
-          LDJ_DEVICE(0x4101),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4101),
           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
         { /* wireless touchpad T651 */
           HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
                 USB_DEVICE_ID_LOGITECH_T651),
           .driver_data = HIDPP_QUIRK_CLASS_WTP },
-        { /* Mouse Logitech Anywhere MX */
-          LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
-        { /* Mouse Logitech Cube */
-          LDJ_DEVICE(0x4010), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
-        { /* Mouse Logitech M335 */
-          LDJ_DEVICE(0x4050), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech M515 */
-          LDJ_DEVICE(0x4007), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
         { /* Mouse logitech M560 */
-          LDJ_DEVICE(0x402d),
-          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560
-                | HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
-        { /* Mouse Logitech M705 (firmware RQM17) */
-          LDJ_DEVICE(0x101b), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
-        { /* Mouse Logitech M705 (firmware RQM67) */
-          LDJ_DEVICE(0x406d), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech M720 */
-          LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Anywhere 2 */
-          LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Anywhere 2S */
-          LDJ_DEVICE(0x406a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Master */
-          LDJ_DEVICE(0x4041), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0x4060), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0x4071), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Master 2S */
-          LDJ_DEVICE(0x4069), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech Performance MX */
-          LDJ_DEVICE(0x101a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x402d),
+          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
         { /* Keyboard logitech K400 */
-          LDJ_DEVICE(0x4024),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4024),
           .driver_data = HIDPP_QUIRK_CLASS_K400 },
         { /* Solar Keyboard Logitech K750 */
-          LDJ_DEVICE(0x4002),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4002),
           .driver_data = HIDPP_QUIRK_CLASS_K750 },
 
-        { LDJ_DEVICE(HID_ANY_ID) },
+        { HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
 
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
                 .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
@@ -3371,19 +3123,12 @@ static const struct hid_device_id hidpp_devices[] = {
 
 MODULE_DEVICE_TABLE(hid, hidpp_devices);
 
-static const struct hid_usage_id hidpp_usages[] = {
-        { HID_GD_WHEEL, EV_REL, REL_WHEEL },
-        { HID_ANY_ID - 1, HID_ANY_ID - 1, HID_ANY_ID - 1}
-};
-
 static struct hid_driver hidpp_driver = {
         .name = "logitech-hidpp-device",
         .id_table = hidpp_devices,
         .probe = hidpp_probe,
         .remove = hidpp_remove,
         .raw_event = hidpp_raw_event,
-        .usage_table = hidpp_usages,
-        .event = hidpp_event,
         .input_configured = hidpp_input_configured,
         .input_mapping = hidpp_input_mapping,
         .input_mapped = hidpp_input_mapped,
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f7c6de2b6730..dca0a3a90fb8 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1814,6 +1814,12 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
                         USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
 
+        /* Cirque devices */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+                        I2C_VENDOR_ID_CIRQUE,
+                        I2C_PRODUCT_ID_CIRQUE_121F) },
+
         /* CJTouch panels */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_CJTOUCH,
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 52c3b01917e7..c85a79986b6a 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -107,7 +107,7 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS), HID_QUIRK_NOGET },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PIXART_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS },
@@ -130,6 +130,8 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index e8a114157f87..bb012bc032e0 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -358,7 +358,7 @@ static ssize_t show_value(struct device *dev, struct device_attribute *attr,
                                                 sensor_inst->hsdev,
                                                 sensor_inst->hsdev->usage,
                                                 usage, report_id,
-                                                SENSOR_HUB_SYNC);
+                                                SENSOR_HUB_SYNC, false);
         } else if (!strncmp(name, "units", strlen("units")))
                 value = sensor_inst->fields[field_index].attribute.units;
         else if (!strncmp(name, "unit-expo", strlen("unit-expo")))
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 2b63487057c2..4256fdc5cd6d 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -299,7 +299,8 @@ EXPORT_SYMBOL_GPL(sensor_hub_get_feature);
 int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                                         u32 usage_id,
                                         u32 attr_usage_id, u32 report_id,
-                                        enum sensor_hub_read_flags flag)
+                                        enum sensor_hub_read_flags flag,
+                                        bool is_signed)
 {
         struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
         unsigned long flags;
@@ -331,10 +332,16 @@ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                                                 &hsdev->pending.ready, HZ*5);
                 switch (hsdev->pending.raw_size) {
                 case 1:
-                        ret_val = *(u8 *)hsdev->pending.raw_data;
+                        if (is_signed)
+                                ret_val = *(s8 *)hsdev->pending.raw_data;
+                        else
+                                ret_val = *(u8 *)hsdev->pending.raw_data;
                         break;
                 case 2:
-                        ret_val = *(u16 *)hsdev->pending.raw_data;
+                        if (is_signed)
+                                ret_val = *(s16 *)hsdev->pending.raw_data;
+                        else
+                                ret_val = *(u16 *)hsdev->pending.raw_data;
                         break;
                 case 4:
                         ret_val = *(u32 *)hsdev->pending.raw_data;
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 0422ec2b13d2..dc4128bfe2ca 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -23,8 +23,9 @@
  * In order to avoid breaking them this driver creates a layered hidraw device,
  * so it can detect when the client is running and then:
  *  - it will not send any command to the controller.
- *  - this input device will be disabled, to avoid double input of the same
+ *  - this input device will be removed, to avoid double input of the same
  *    user action.
+ * When the client is closed, this input device will be created again.
  *
  * For additional functions, such as changing the right-pad margin or switching
  * the led, you can use the user-space tool at:
@@ -113,7 +114,7 @@ struct steam_device {
         spinlock_t lock;
         struct hid_device *hdev, *client_hdev;
         struct mutex mutex;
-        bool client_opened, input_opened;
+        bool client_opened;
         struct input_dev __rcu *input;
         unsigned long quirks;
         struct work_struct work_connect;
@@ -279,18 +280,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
         }
 }
 
-static void steam_update_lizard_mode(struct steam_device *steam)
-{
-        mutex_lock(&steam->mutex);
-        if (!steam->client_opened) {
-                if (steam->input_opened)
-                        steam_set_lizard_mode(steam, false);
-                else
-                        steam_set_lizard_mode(steam, lizard_mode);
-        }
-        mutex_unlock(&steam->mutex);
-}
-
 static int steam_input_open(struct input_dev *dev)
 {
         struct steam_device *steam = input_get_drvdata(dev);
@@ -301,7 +290,6 @@ static int steam_input_open(struct input_dev *dev)
                 return ret;
 
         mutex_lock(&steam->mutex);
-        steam->input_opened = true;
         if (!steam->client_opened && lizard_mode)
                 steam_set_lizard_mode(steam, false);
         mutex_unlock(&steam->mutex);
@@ -313,7 +301,6 @@ static void steam_input_close(struct input_dev *dev)
         struct steam_device *steam = input_get_drvdata(dev);
 
         mutex_lock(&steam->mutex);
-        steam->input_opened = false;
         if (!steam->client_opened && lizard_mode)
                 steam_set_lizard_mode(steam, true);
         mutex_unlock(&steam->mutex);
@@ -400,7 +387,7 @@ static int steam_battery_register(struct steam_device *steam)
         return 0;
 }
 
-static int steam_register(struct steam_device *steam)
+static int steam_input_register(struct steam_device *steam)
 {
         struct hid_device *hdev = steam->hdev;
         struct input_dev *input;
@@ -414,17 +401,6 @@ static int steam_register(struct steam_device *steam)
                 return 0;
         }
 
-        /*
-         * Unlikely, but getting the serial could fail, and it is not so
-         * important, so make up a serial number and go on.
-         */
-        if (steam_get_serial(steam) < 0)
-                strlcpy(steam->serial_no, "XXXXXXXXXX",
-                                sizeof(steam->serial_no));
-
-        hid_info(hdev, "Steam Controller '%s' connected",
-                        steam->serial_no);
-
         input = input_allocate_device();
         if (!input)
                 return -ENOMEM;
@@ -492,11 +468,6 @@ static int steam_register(struct steam_device *steam)
                 goto input_register_fail;
 
         rcu_assign_pointer(steam->input, input);
-
-        /* ignore battery errors, we can live without it */
-        if (steam->quirks & STEAM_QUIRK_WIRELESS)
-                steam_battery_register(steam);
-
         return 0;
 
 input_register_fail:
@@ -504,27 +475,88 @@ input_register_fail:
         return ret;
 }
 
-static void steam_unregister(struct steam_device *steam)
+static void steam_input_unregister(struct steam_device *steam)
 {
         struct input_dev *input;
+        rcu_read_lock();
+        input = rcu_dereference(steam->input);
+        rcu_read_unlock();
+        if (!input)
+                return;
+        RCU_INIT_POINTER(steam->input, NULL);
+        synchronize_rcu();
+        input_unregister_device(input);
+}
+
+static void steam_battery_unregister(struct steam_device *steam)
+{
         struct power_supply *battery;
 
         rcu_read_lock();
-        input = rcu_dereference(steam->input);
         battery = rcu_dereference(steam->battery);
         rcu_read_unlock();
 
-        if (battery) {
-                RCU_INIT_POINTER(steam->battery, NULL);
-                synchronize_rcu();
-                power_supply_unregister(battery);
+        if (!battery)
+                return;
+        RCU_INIT_POINTER(steam->battery, NULL);
+        synchronize_rcu();
+        power_supply_unregister(battery);
+}
+
+static int steam_register(struct steam_device *steam)
+{
+        int ret;
+
+        /*
+         * This function can be called several times in a row with the
+         * wireless adaptor, without steam_unregister() between them, because
+         * another client send a get_connection_status command, for example.
+         * The battery and serial number are set just once per device.
+         */
+        if (!steam->serial_no[0]) {
+                /*
+                 * Unlikely, but getting the serial could fail, and it is not so
+                 * important, so make up a serial number and go on.
+                 */
+                if (steam_get_serial(steam) < 0)
+                        strlcpy(steam->serial_no, "XXXXXXXXXX",
+                                        sizeof(steam->serial_no));
+
+                hid_info(steam->hdev, "Steam Controller '%s' connected",
+                                steam->serial_no);
+
+                /* ignore battery errors, we can live without it */
+                if (steam->quirks & STEAM_QUIRK_WIRELESS)
+                        steam_battery_register(steam);
+
+                mutex_lock(&steam_devices_lock);
+                list_add(&steam->list, &steam_devices);
+                mutex_unlock(&steam_devices_lock);
         }
-        if (input) {
-                RCU_INIT_POINTER(steam->input, NULL);
-                synchronize_rcu();
+
+        mutex_lock(&steam->mutex);
+        if (!steam->client_opened) {
+                steam_set_lizard_mode(steam, lizard_mode);
+                ret = steam_input_register(steam);
+        } else {
+                ret = 0;
+        }
+        mutex_unlock(&steam->mutex);
+
+        return ret;
+}
+
+static void steam_unregister(struct steam_device *steam)
+{
+        steam_battery_unregister(steam);
+        steam_input_unregister(steam);
+        if (steam->serial_no[0]) {
                 hid_info(steam->hdev, "Steam Controller '%s' disconnected",
                                 steam->serial_no);
-                input_unregister_device(input);
+                mutex_lock(&steam_devices_lock);
+                list_del(&steam->list);
+                mutex_unlock(&steam_devices_lock);
+                steam->serial_no[0] = 0;
         }
 }
 
@@ -600,6 +632,9 @@ static int steam_client_ll_open(struct hid_device *hdev)
         mutex_lock(&steam->mutex);
         steam->client_opened = true;
         mutex_unlock(&steam->mutex);
+
+        steam_input_unregister(steam);
+
         return ret;
 }
 
@@ -609,13 +644,13 @@ static void steam_client_ll_close(struct hid_device *hdev)
 
         mutex_lock(&steam->mutex);
         steam->client_opened = false;
-        if (steam->input_opened)
-                steam_set_lizard_mode(steam, false);
-        else
-                steam_set_lizard_mode(steam, lizard_mode);
         mutex_unlock(&steam->mutex);
 
         hid_hw_close(steam->hdev);
+        if (steam->connected) {
+                steam_set_lizard_mode(steam, lizard_mode);
+                steam_input_register(steam);
+        }
 }
 
 static int steam_client_ll_raw_request(struct hid_device *hdev,
@@ -744,11 +779,6 @@ static int steam_probe(struct hid_device *hdev,
                 }
         }
 
-        mutex_lock(&steam_devices_lock);
-        steam_update_lizard_mode(steam);
-        list_add(&steam->list, &steam_devices);
-        mutex_unlock(&steam_devices_lock);
-
         return 0;
 
 hid_hw_open_fail:
@@ -774,10 +804,6 @@ static void steam_remove(struct hid_device *hdev)
                 return;
         }
 
-        mutex_lock(&steam_devices_lock);
-        list_del(&steam->list);
-        mutex_unlock(&steam_devices_lock);
-
         hid_destroy_device(steam->client_hdev);
         steam->client_opened = false;
         cancel_work_sync(&steam->work_connect);
@@ -792,12 +818,14 @@ static void steam_remove(struct hid_device *hdev)
 static void steam_do_connect_event(struct steam_device *steam, bool connected)
 {
         unsigned long flags;
+        bool changed;
 
         spin_lock_irqsave(&steam->lock, flags);
+        changed = steam->connected != connected;
         steam->connected = connected;
         spin_unlock_irqrestore(&steam->lock, flags);
 
-        if (schedule_work(&steam->work_connect) == 0)
+        if (changed && schedule_work(&steam->work_connect) == 0)
                 dbg_hid("%s: connected=%d event already queued\n",
                                 __func__, connected);
 }
@@ -1019,13 +1047,8 @@ static int steam_raw_event(struct hid_device *hdev,
                         return 0;
                 rcu_read_lock();
                 input = rcu_dereference(steam->input);
-                if (likely(input)) {
+                if (likely(input))
                         steam_do_input_event(steam, input, data);
-                } else {
-                        dbg_hid("%s: input data without connect event\n",
-                                        __func__);
-                        steam_do_connect_event(steam, true);
-                }
                 rcu_read_unlock();
                 break;
         case STEAM_EV_CONNECT:
@@ -1074,7 +1097,10 @@ static int steam_param_set_lizard_mode(const char *val,
 
         mutex_lock(&steam_devices_lock);
         list_for_each_entry(steam, &steam_devices, list) {
-                steam_update_lizard_mode(steam);
+                mutex_lock(&steam->mutex);
+                if (!steam->client_opened)
+                        steam_set_lizard_mode(steam, lizard_mode);
+                mutex_unlock(&steam->mutex);
         }
         mutex_unlock(&steam_devices_lock);
         return 0;
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 4aab96cf0818..8555ce7e737b 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -49,6 +49,7 @@
 #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV        BIT(0)
 #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET        BIT(1)
 #define I2C_HID_QUIRK_NO_RUNTIME_PM             BIT(2)
+#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP         BIT(3)
 
 /* flags */
 #define I2C_HID_STARTED         0
@@ -158,6 +159,8 @@ struct i2c_hid {
 
         bool                    irq_wake_enabled;
         struct mutex            reset_lock;
+
+        unsigned long           sleep_delay;
 };
 
 static const struct i2c_hid_quirks {
@@ -172,6 +175,10 @@ static const struct i2c_hid_quirks {
         { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
                 I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
+        { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
+                I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+        { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
@@ -387,6 +394,7 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
 {
         struct i2c_hid *ihid = i2c_get_clientdata(client);
         int ret;
+        unsigned long now, delay;
 
         i2c_hid_dbg(ihid, "%s\n", __func__);
 
@@ -404,9 +412,22 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
                         goto set_pwr_exit;
         }
 
+        if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
+            power_state == I2C_HID_PWR_ON) {
+                now = jiffies;
+                if (time_after(ihid->sleep_delay, now)) {
+                        delay = jiffies_to_usecs(ihid->sleep_delay - now);
+                        usleep_range(delay, delay + 1);
+                }
+        }
+
         ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
                 0, NULL, 0, NULL, 0);
 
+        if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
+            power_state == I2C_HID_PWR_SLEEP)
+                ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
+
         if (ret)
                 dev_err(&client->dev, "failed to change power setting.\n");
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
index cac262a912c1..89f2976f9c53 100644
--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -331,6 +331,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
                 .driver_data = (void *)&sipodev_desc
         },
         {
+                .ident = "Direkt-Tek DTLAPY133-1",
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Direkt-Tek"),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "DTLAPY133-1"),
+                },
+                .driver_data = (void *)&sipodev_desc
+        },
+        {
                 .ident = "Mediacom Flexbook Edge 11",
                 .matches = {
                         DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 3c5507313606..840634e0f1e3 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -12,6 +12,7 @@
 
 #include <linux/atomic.h>
 #include <linux/compat.h>
+#include <linux/cred.h>
 #include <linux/device.h>
 #include <linux/fs.h>
 #include <linux/hid.h>
@@ -496,12 +497,13 @@ static int uhid_dev_create2(struct uhid_device *uhid,
                 goto err_free;
         }
 
-        len = min(sizeof(hid->name), sizeof(ev->u.create2.name));
-        strlcpy(hid->name, ev->u.create2.name, len);
-        len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys));
-        strlcpy(hid->phys, ev->u.create2.phys, len);
-        len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq));
-        strlcpy(hid->uniq, ev->u.create2.uniq, len);
+        /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
+        len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
+        strncpy(hid->name, ev->u.create2.name, len);
+        len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
+        strncpy(hid->phys, ev->u.create2.phys, len);
+        len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
+        strncpy(hid->uniq, ev->u.create2.uniq, len);
 
         hid->ll_driver = &uhid_hid_driver;
         hid->bus = ev->u.create2.bus;
@@ -722,6 +724,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 
         switch (uhid->input_buf.type) {
         case UHID_CREATE:
+                /*
+                 * 'struct uhid_create_req' contains a __user pointer which is
+                 * copied from, so it's unsafe to allow this with elevated
+                 * privileges (e.g. from a setuid binary) or via kernel_write().
+                 */
+                if (file->f_cred != current_cred() || uaccess_kernel()) {
+                        pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
+                                    task_tgid_vnr(current), current->comm);
+                        ret = -EACCES;
+                        goto unlock;
+                }
                 ret = uhid_dev_create(uhid, &uhid->input_buf);
                 break;
         case UHID_CREATE2:
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 23872d08308c..a746017fac17 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
                         if (cmd == HIDIOCGCOLLECTIONINDEX) {
                                 if (uref->usage_index >= field->maxusage)
                                         goto inval;
+                                uref->usage_index =
+                                        array_index_nospec(uref->usage_index,
+                                                           field->maxusage);
                         } else if (uref->usage_index >= field->report_count)
                                 goto inval;
                 }
 
-                if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-                    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-                     uref->usage_index + uref_multi->num_values > field->report_count))
-                        goto inval;
+                if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
+                        if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+                            uref->usage_index + uref_multi->num_values >
+                            field->report_count)
+                                goto inval;
+
+                        uref->usage_index =
+                                array_index_nospec(uref->usage_index,
+                                                   field->report_count -
+                                                   uref_multi->num_values);
+                }
 
                 switch (cmd) {
                 case HIDIOCGUSAGE:
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index de8193f3b838..fe00b12e4417 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -516,6 +516,14 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
         }
         wait_for_completion(&msginfo->waitevent);
 
+        if (msginfo->response.gpadl_created.creation_status != 0) {
+                pr_err("Failed to establish GPADL: err = 0x%x\n",
+                       msginfo->response.gpadl_created.creation_status);
+
+                ret = -EDQUOT;
+                goto cleanup;
+        }
+
         if (channel->rescind) {
                 ret = -ENODEV;
                 goto cleanup;
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index a7513a8a8e37..d6106e1a0d4a 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -353,6 +353,9 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
 
                 out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
 
+                /* fallthrough */
+
+        case KVP_OP_GET_IP_INFO:
                 utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
                                 MAX_ADAPTER_ID_SIZE,
                                 UTF16_LITTLE_ENDIAN,
@@ -405,7 +408,11 @@ kvp_send_key(struct work_struct *dummy)
                 process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
                 break;
         case KVP_OP_GET_IP_INFO:
-                /* We only need to pass on message->kvp_hdr.operation.  */
+                /*
+                 * We only need to pass on the info of operation, adapter_id
+                 * and addr_family to the userland kvp daemon.
+                 */
+                process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
                 break;
         case KVP_OP_SET:
                 switch (in_msg->body.kvp_set.data.value_type) {
@@ -446,9 +453,9 @@ kvp_send_key(struct work_struct *dummy)
 
                 }
 
-                break;
-
-        case KVP_OP_GET:
+                /*
+                 * The key is always a string - utf16 encoding.
+                 */
                 message->body.kvp_set.data.key_size =
                         utf16s_to_utf8s(
                         (wchar_t *)in_msg->body.kvp_set.data.key,
@@ -456,6 +463,17 @@ kvp_send_key(struct work_struct *dummy)
                         UTF16_LITTLE_ENDIAN,
                         message->body.kvp_set.data.key,
                         HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+
+                break;
+
+        case KVP_OP_GET:
+                message->body.kvp_get.data.key_size =
+                        utf16s_to_utf8s(
+                        (wchar_t *)in_msg->body.kvp_get.data.key,
+                        in_msg->body.kvp_get.data.key_size,
+                        UTF16_LITTLE_ENDIAN,
+                        message->body.kvp_get.data.key,
+                        HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
                 break;
 
         case KVP_OP_DELETE:
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index 975c95169884..84f61cec6319 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -649,8 +649,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
                                 if (info[i]->config[j] & HWMON_T_INPUT) {
                                         err = hwmon_thermal_add_sensor(dev,
                                                                 hwdev, j);
-                                        if (err)
-                                                goto free_device;
+                                        if (err) {
+                                                device_unregister(hdev);
+                                                goto ida_remove;
+                                        }
                                 }
                         }
                 }
@@ -658,8 +660,6 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
 
         return hdev;
 
-free_device:
-        device_unregister(hdev);
 free_hwmon:
         kfree(hwdev);
 ida_remove:
diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index 0ccca87f5271..293dd1c6c7b3 100644
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -181,7 +181,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr,
         return sprintf(buf, "%s\n", sdata->label);
 }
 
-static int __init get_logical_cpu(int hwcpu)
+static int get_logical_cpu(int hwcpu)
 {
         int cpu;
 
@@ -192,9 +192,8 @@ static int __init get_logical_cpu(int hwcpu)
         return -ENOENT;
 }
 
-static void __init make_sensor_label(struct device_node *np,
-                                     struct sensor_data *sdata,
-                                     const char *label)
+static void make_sensor_label(struct device_node *np,
+                              struct sensor_data *sdata, const char *label)
 {
         u32 id;
         size_t n;
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index 71d3445ba869..07ee19573b3f 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -274,7 +274,7 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg,
                 break;
         case INA2XX_CURRENT:
                 /* signed register, result in mA */
-                val = regval * data->current_lsb_uA;
+                val = (s16)regval * data->current_lsb_uA;
                 val = DIV_ROUND_CLOSEST(val, 1000);
                 break;
         case INA2XX_CALIBRATION:
@@ -491,7 +491,7 @@ static int ina2xx_probe(struct i2c_client *client,
         }
 
         data->groups[group++] = &ina2xx_group;
-        if (id->driver_data == ina226)
+        if (chip == ina226)
                 data->groups[group++] = &ina226_group;
 
         hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
@@ -500,7 +500,7 @@ static int ina2xx_probe(struct i2c_client *client,
                 return PTR_ERR(hwmon_dev);
 
         dev_info(dev, "power monitor %s (Rshunt = %li uOhm)\n",
-                 id->name, data->rshunt);
+                 client->name, data->rshunt);
 
         return 0;
 }
diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index de46577c7d5a..d8fa4bea4bc8 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -51,7 +51,7 @@
  */
 #define MLXREG_FAN_GET_RPM(rval, d, s)  (DIV_ROUND_CLOSEST(15000000 * 100, \
                                          ((rval) + (s)) * (d)))
-#define MLXREG_FAN_GET_FAULT(val, mask) (!!((val) ^ (mask)))
+#define MLXREG_FAN_GET_FAULT(val, mask) (!((val) ^ (mask)))
 #define MLXREG_FAN_PWM_DUTY2STATE(duty) (DIV_ROUND_CLOSEST((duty) *     \
                                          MLXREG_FAN_MAX_STATE,          \
                                          MLXREG_FAN_MAX_DUTY))
diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
index be5ba4690895..0d0457245e7d 100644
--- a/drivers/hwmon/raspberrypi-hwmon.c
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -115,7 +115,6 @@ static int rpi_hwmon_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
         struct rpi_hwmon_data *data;
-        int ret;
 
         data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -124,11 +123,6 @@ static int rpi_hwmon_probe(struct platform_device *pdev)
         /* Parent driver assure that firmware is correct */
         data->fw = dev_get_drvdata(dev->parent);
 
-        /* Init throttled */
-        ret = rpi_firmware_property(data->fw, RPI_FIRMWARE_GET_THROTTLED,
-                                    &data->last_throttled,
-                                    sizeof(data->last_throttled));
-
         data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "rpi_volt",
                                                                data,
                                                                &rpi_chip_info,
diff --git a/drivers/hwmon/w83795.c b/drivers/hwmon/w83795.c
index 49276bbdac3d..1bb80f992aa8 100644
--- a/drivers/hwmon/w83795.c
+++ b/drivers/hwmon/w83795.c
@@ -1691,7 +1691,7 @@ store_sf_setup(struct device *dev, struct device_attribute *attr,
  * somewhere else in the code
  */
 #define SENSOR_ATTR_TEMP(index) {                                       \
-        SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 4 ? S_IWUSR : 0), \
+        SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 5 ? S_IWUSR : 0), \
                 show_temp_mode, store_temp_mode, NOT_USED, index - 1),  \
         SENSOR_ATTR_2(temp##index##_input, S_IRUGO, show_temp,          \
                 NULL, TEMP_READ, index - 1),                            \
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 56ccb1ea7da5..f2c681971201 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -224,6 +224,15 @@ config I2C_NFORCE2_S4985
           This driver can also be built as a module.  If so, the module
           will be called i2c-nforce2-s4985.
 
+config I2C_NVIDIA_GPU
+        tristate "NVIDIA GPU I2C controller"
+        depends on PCI
+        help
+          If you say yes to this option, support will be included for the
+          NVIDIA GPU I2C controller which is used to communicate with the GPU's
+          Type-C controller. This driver can also be built as a module called
+          i2c-nvidia-gpu.
+
 config I2C_SIS5595
         tristate "SiS 5595"
         depends on PCI
@@ -752,7 +761,7 @@ config I2C_OCORES
 
 config I2C_OMAP
         tristate "OMAP I2C adapter"
-        depends on ARCH_OMAP
+        depends on ARCH_OMAP || ARCH_K3
         default y if MACH_OMAP_H3 || MACH_OMAP_OSK
         help
           If you say yes to this option, support will be included for the
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 18b26af82b1c..5f0cb6915969 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -19,6 +19,7 @@ obj-$(CONFIG_I2C_ISCH)		+= i2c-isch.o
 obj-$(CONFIG_I2C_ISMT)          += i2c-ismt.o
 obj-$(CONFIG_I2C_NFORCE2)       += i2c-nforce2.o
 obj-$(CONFIG_I2C_NFORCE2_S4985) += i2c-nforce2-s4985.o
+obj-$(CONFIG_I2C_NVIDIA_GPU)    += i2c-nvidia-gpu.o
 obj-$(CONFIG_I2C_PIIX4)         += i2c-piix4.o
 obj-$(CONFIG_I2C_SIS5595)       += i2c-sis5595.o
 obj-$(CONFIG_I2C_SIS630)        += i2c-sis630.o
diff --git a/drivers/i2c/busses/i2c-nvidia-gpu.c b/drivers/i2c/busses/i2c-nvidia-gpu.c
new file mode 100644
index 000000000000..8822357bca0c
--- /dev/null
+++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Nvidia GPU I2C controller Driver
+ *
+ * Copyright (C) 2018 NVIDIA Corporation. All rights reserved.
+ * Author: Ajay Gupta <ajayg@nvidia.com>
+ */
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/pm.h>
+#include <linux/pm_runtime.h>
+
+#include <asm/unaligned.h>
+
+/* I2C definitions */
+#define I2C_MST_CNTL                            0x00
+#define I2C_MST_CNTL_GEN_START                  BIT(0)
+#define I2C_MST_CNTL_GEN_STOP                   BIT(1)
+#define I2C_MST_CNTL_CMD_READ                   (1 << 2)
+#define I2C_MST_CNTL_CMD_WRITE                  (2 << 2)
+#define I2C_MST_CNTL_BURST_SIZE_SHIFT           6
+#define I2C_MST_CNTL_GEN_NACK                   BIT(28)
+#define I2C_MST_CNTL_STATUS                     GENMASK(30, 29)
+#define I2C_MST_CNTL_STATUS_OKAY                (0 << 29)
+#define I2C_MST_CNTL_STATUS_NO_ACK              (1 << 29)
+#define I2C_MST_CNTL_STATUS_TIMEOUT             (2 << 29)
+#define I2C_MST_CNTL_STATUS_BUS_BUSY            (3 << 29)
+#define I2C_MST_CNTL_CYCLE_TRIGGER              BIT(31)
+
+#define I2C_MST_ADDR                            0x04
+
+#define I2C_MST_I2C0_TIMING                             0x08
+#define I2C_MST_I2C0_TIMING_SCL_PERIOD_100KHZ           0x10e
+#define I2C_MST_I2C0_TIMING_TIMEOUT_CLK_CNT             16
+#define I2C_MST_I2C0_TIMING_TIMEOUT_CLK_CNT_MAX         255
+#define I2C_MST_I2C0_TIMING_TIMEOUT_CHECK               BIT(24)
+
+#define I2C_MST_DATA                                    0x0c
+
+#define I2C_MST_HYBRID_PADCTL                           0x20
+#define I2C_MST_HYBRID_PADCTL_MODE_I2C                  BIT(0)
+#define I2C_MST_HYBRID_PADCTL_I2C_SCL_INPUT_RCV         BIT(14)
+#define I2C_MST_HYBRID_PADCTL_I2C_SDA_INPUT_RCV         BIT(15)
+
+struct gpu_i2c_dev {
+        struct device *dev;
+        void __iomem *regs;
+        struct i2c_adapter adapter;
+        struct i2c_board_info *gpu_ccgx_ucsi;
+};
+
+static void gpu_enable_i2c_bus(struct gpu_i2c_dev *i2cd)
+{
+        u32 val;
+
+        /* enable I2C */
+        val = readl(i2cd->regs + I2C_MST_HYBRID_PADCTL);
+        val |= I2C_MST_HYBRID_PADCTL_MODE_I2C |
+                I2C_MST_HYBRID_PADCTL_I2C_SCL_INPUT_RCV |
+                I2C_MST_HYBRID_PADCTL_I2C_SDA_INPUT_RCV;
+        writel(val, i2cd->regs + I2C_MST_HYBRID_PADCTL);
+
+        /* enable 100KHZ mode */
+        val = I2C_MST_I2C0_TIMING_SCL_PERIOD_100KHZ;
+        val |= (I2C_MST_I2C0_TIMING_TIMEOUT_CLK_CNT_MAX
+            << I2C_MST_I2C0_TIMING_TIMEOUT_CLK_CNT);
+        val |= I2C_MST_I2C0_TIMING_TIMEOUT_CHECK;
+        writel(val, i2cd->regs + I2C_MST_I2C0_TIMING);
+}
+
+static int gpu_i2c_check_status(struct gpu_i2c_dev *i2cd)
+{
+        unsigned long target = jiffies + msecs_to_jiffies(1000);
+        u32 val;
+
+        do {
+                val = readl(i2cd->regs + I2C_MST_CNTL);
+                if (!(val & I2C_MST_CNTL_CYCLE_TRIGGER))
+                        break;
+                if ((val & I2C_MST_CNTL_STATUS) !=
+                                I2C_MST_CNTL_STATUS_BUS_BUSY)
+                        break;
+                usleep_range(500, 600);
+        } while (time_is_after_jiffies(target));
+
+        if (time_is_before_jiffies(target)) {
+                dev_err(i2cd->dev, "i2c timeout error %x\n", val);
+                return -ETIME;
+        }
+
+        val = readl(i2cd->regs + I2C_MST_CNTL);
+        switch (val & I2C_MST_CNTL_STATUS) {
+        case I2C_MST_CNTL_STATUS_OKAY:
+                return 0;
+        case I2C_MST_CNTL_STATUS_NO_ACK:
+                return -EIO;
+        case I2C_MST_CNTL_STATUS_TIMEOUT:
+                return -ETIME;
+        default:
+                return 0;
+        }
+}
+
+static int gpu_i2c_read(struct gpu_i2c_dev *i2cd, u8 *data, u16 len)
+{
+        int status;
+        u32 val;
+
+        val = I2C_MST_CNTL_GEN_START | I2C_MST_CNTL_CMD_READ |
+                (len << I2C_MST_CNTL_BURST_SIZE_SHIFT) |
+                I2C_MST_CNTL_CYCLE_TRIGGER | I2C_MST_CNTL_GEN_NACK;
+        writel(val, i2cd->regs + I2C_MST_CNTL);
+
+        status = gpu_i2c_check_status(i2cd);
+        if (status < 0)
+                return status;
+
+        val = readl(i2cd->regs + I2C_MST_DATA);
+        switch (len) {
+        case 1:
+                data[0] = val;
+                break;
+        case 2:
+                put_unaligned_be16(val, data);
+                break;
+        case 3:
+                put_unaligned_be16(val >> 8, data);
+                data[2] = val;
+                break;
+        case 4:
+                put_unaligned_be32(val, data);
+                break;
+        default:
+                break;
+        }
+        return status;
+}
+
+static int gpu_i2c_start(struct gpu_i2c_dev *i2cd)
+{
+        writel(I2C_MST_CNTL_GEN_START, i2cd->regs + I2C_MST_CNTL);
+        return gpu_i2c_check_status(i2cd);
+}
+
+static int gpu_i2c_stop(struct gpu_i2c_dev *i2cd)
+{
+        writel(I2C_MST_CNTL_GEN_STOP, i2cd->regs + I2C_MST_CNTL);
+        return gpu_i2c_check_status(i2cd);
+}
+
+static int gpu_i2c_write(struct gpu_i2c_dev *i2cd, u8 data)
+{
+        u32 val;
+
+        writel(data, i2cd->regs + I2C_MST_DATA);
+
+        val = I2C_MST_CNTL_CMD_WRITE | (1 << I2C_MST_CNTL_BURST_SIZE_SHIFT);
+        writel(val, i2cd->regs + I2C_MST_CNTL);
+
+        return gpu_i2c_check_status(i2cd);
+}
+
+static int gpu_i2c_master_xfer(struct i2c_adapter *adap,
+                               struct i2c_msg *msgs, int num)
+{
+        struct gpu_i2c_dev *i2cd = i2c_get_adapdata(adap);
+        int status, status2;
+        int i, j;
+
+        /*
+         * The controller supports maximum 4 byte read due to known
+         * limitation of sending STOP after every read.
+         */
+        for (i = 0; i < num; i++) {
+                if (msgs[i].flags & I2C_M_RD) {
+                        /* program client address before starting read */
+                        writel(msgs[i].addr, i2cd->regs + I2C_MST_ADDR);
+                        /* gpu_i2c_read has implicit start */
+                        status = gpu_i2c_read(i2cd, msgs[i].buf, msgs[i].len);
+                        if (status < 0)
+                                goto stop;
+                } else {
+                        u8 addr = i2c_8bit_addr_from_msg(msgs + i);
+
+                        status = gpu_i2c_start(i2cd);
+                        if (status < 0) {
+                                if (i == 0)
+                                        return status;
+                                goto stop;
+                        }
+
+                        status = gpu_i2c_write(i2cd, addr);
+                        if (status < 0)
+                                goto stop;
+
+                        for (j = 0; j < msgs[i].len; j++) {
+                                status = gpu_i2c_write(i2cd, msgs[i].buf[j]);
+                                if (status < 0)
+                                        goto stop;
+                        }
+                }
+        }
+        status = gpu_i2c_stop(i2cd);
+        if (status < 0)
+                return status;
+
+        return i;
+stop:
+        status2 = gpu_i2c_stop(i2cd);
+        if (status2 < 0)
+                dev_err(i2cd->dev, "i2c stop failed %d\n", status2);
+        return status;
+}
+
+static const struct i2c_adapter_quirks gpu_i2c_quirks = {
+        .max_read_len = 4,
+        .flags = I2C_AQ_COMB_WRITE_THEN_READ,
+};
+
+static u32 gpu_i2c_functionality(struct i2c_adapter *adap)
+{
+        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+}
+
+static const struct i2c_algorithm gpu_i2c_algorithm = {
+        .master_xfer    = gpu_i2c_master_xfer,
+        .functionality  = gpu_i2c_functionality,
+};
+
+/*
+ * This driver is for Nvidia GPU cards with USB Type-C interface.
+ * We want to identify the cards using vendor ID and class code only
+ * to avoid dependency of adding product id for any new card which
+ * requires this driver.
+ * Currently there is no class code defined for UCSI device over PCI
+ * so using UNKNOWN class for now and it will be updated when UCSI
+ * over PCI gets a class code.
+ * There is no other NVIDIA cards with UNKNOWN class code. Even if the
+ * driver gets loaded for an undesired card then eventually i2c_read()
+ * (initiated from UCSI i2c_client) will timeout or UCSI commands will
+ * timeout.
+ */
+#define PCI_CLASS_SERIAL_UNKNOWN        0x0c80
+static const struct pci_device_id gpu_i2c_ids[] = {
+        { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+                PCI_CLASS_SERIAL_UNKNOWN << 8, 0xffffff00},
+        { }
+};
+MODULE_DEVICE_TABLE(pci, gpu_i2c_ids);
+
+static int gpu_populate_client(struct gpu_i2c_dev *i2cd, int irq)
+{
+        struct i2c_client *ccgx_client;
+
+        i2cd->gpu_ccgx_ucsi = devm_kzalloc(i2cd->dev,
+                                           sizeof(*i2cd->gpu_ccgx_ucsi),
+                                           GFP_KERNEL);
+        if (!i2cd->gpu_ccgx_ucsi)
+                return -ENOMEM;
+
+        strlcpy(i2cd->gpu_ccgx_ucsi->type, "ccgx-ucsi",
+                sizeof(i2cd->gpu_ccgx_ucsi->type));
+        i2cd->gpu_ccgx_ucsi->addr = 0x8;
+        i2cd->gpu_ccgx_ucsi->irq = irq;
+        ccgx_client = i2c_new_device(&i2cd->adapter, i2cd->gpu_ccgx_ucsi);
+        if (!ccgx_client)
+                return -ENODEV;
+
+        return 0;
+}
+
+static int gpu_i2c_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+        struct gpu_i2c_dev *i2cd;
+        int status;
+
+        i2cd = devm_kzalloc(&pdev->dev, sizeof(*i2cd), GFP_KERNEL);
+        if (!i2cd)
+                return -ENOMEM;
+
+        i2cd->dev = &pdev->dev;
+        dev_set_drvdata(&pdev->dev, i2cd);
+
+        status = pcim_enable_device(pdev);
+        if (status < 0) {
+                dev_err(&pdev->dev, "pcim_enable_device failed %d\n", status);
+                return status;
+        }
+
+        pci_set_master(pdev);
+
+        i2cd->regs = pcim_iomap(pdev, 0, 0);
+        if (!i2cd->regs) {
+                dev_err(&pdev->dev, "pcim_iomap failed\n");
+                return -ENOMEM;
+        }
+
+        status = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI);
+        if (status < 0) {
+                dev_err(&pdev->dev, "pci_alloc_irq_vectors err %d\n", status);
+                return status;
+        }
+
+        gpu_enable_i2c_bus(i2cd);
+
+        i2c_set_adapdata(&i2cd->adapter, i2cd);
+        i2cd->adapter.owner = THIS_MODULE;
+        strlcpy(i2cd->adapter.name, "NVIDIA GPU I2C adapter",
+                sizeof(i2cd->adapter.name));
+        i2cd->adapter.algo = &gpu_i2c_algorithm;
+        i2cd->adapter.quirks = &gpu_i2c_quirks;
+        i2cd->adapter.dev.parent = &pdev->dev;
+        status = i2c_add_adapter(&i2cd->adapter);
+        if (status < 0)
+                goto free_irq_vectors;
+
+        status = gpu_populate_client(i2cd, pdev->irq);
+        if (status < 0) {
+                dev_err(&pdev->dev, "gpu_populate_client failed %d\n", status);
+                goto del_adapter;
+        }
+
+        return 0;
+
+del_adapter:
+        i2c_del_adapter(&i2cd->adapter);
+free_irq_vectors:
+        pci_free_irq_vectors(pdev);
+        return status;
+}
+
+static void gpu_i2c_remove(struct pci_dev *pdev)
+{
+        struct gpu_i2c_dev *i2cd = dev_get_drvdata(&pdev->dev);
+
+        i2c_del_adapter(&i2cd->adapter);
+        pci_free_irq_vectors(pdev);
+}
+
+static int gpu_i2c_resume(struct device *dev)
+{
+        struct gpu_i2c_dev *i2cd = dev_get_drvdata(dev);
+
+        gpu_enable_i2c_bus(i2cd);
+        return 0;
+}
+
+static UNIVERSAL_DEV_PM_OPS(gpu_i2c_driver_pm, NULL, gpu_i2c_resume, NULL);
+
+static struct pci_driver gpu_i2c_driver = {
+        .name           = "nvidia-gpu",
+        .id_table       = gpu_i2c_ids,
+        .probe          = gpu_i2c_probe,
+        .remove         = gpu_i2c_remove,
+        .driver         = {
+                .pm     = &gpu_i2c_driver_pm,
+        },
+};
+
+module_pci_driver(gpu_i2c_driver);
+
+MODULE_AUTHOR("Ajay Gupta <ajayg@nvidia.com>");
+MODULE_DESCRIPTION("Nvidia GPU I2C controller Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
index 527f55c8c4c7..db075bc0d952 100644
--- a/drivers/i2c/busses/i2c-qcom-geni.c
+++ b/drivers/i2c/busses/i2c-qcom-geni.c
@@ -571,18 +571,19 @@ static int geni_i2c_probe(struct platform_device *pdev)
 
         dev_dbg(&pdev->dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth);
 
-        ret = i2c_add_adapter(&gi2c->adap);
-        if (ret) {
-                dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
-                return ret;
-        }
-
         gi2c->suspended = 1;
         pm_runtime_set_suspended(gi2c->se.dev);
         pm_runtime_set_autosuspend_delay(gi2c->se.dev, I2C_AUTO_SUSPEND_DELAY);
         pm_runtime_use_autosuspend(gi2c->se.dev);
         pm_runtime_enable(gi2c->se.dev);
 
+        ret = i2c_add_adapter(&gi2c->adap);
+        if (ret) {
+                dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
+                pm_runtime_disable(gi2c->se.dev);
+                return ret;
+        }
+
         return 0;
 }
 
@@ -590,8 +591,8 @@ static int geni_i2c_remove(struct platform_device *pdev)
 {
         struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev);
 
-        pm_runtime_disable(gi2c->se.dev);
         i2c_del_adapter(&gi2c->adap);
+        pm_runtime_disable(gi2c->se.dev);
         return 0;
 }
 
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 45c997430332..4c8c7a620d08 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -614,18 +614,7 @@ static int ide_drivers_show(struct seq_file *s, void *p)
         return 0;
 }
 
-static int ide_drivers_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, &ide_drivers_show, NULL);
-}
-
-static const struct file_operations ide_drivers_operations = {
-        .owner          = THIS_MODULE,
-        .open           = ide_drivers_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(ide_drivers);
 
 void proc_ide_create(void)
 {
@@ -634,7 +623,7 @@ void proc_ide_create(void)
         if (!proc_ide_root)
                 return;
 
-        proc_create("drivers", 0, proc_ide_root, &ide_drivers_operations);
+        proc_create("drivers", 0, proc_ide_root, &ide_drivers_fops);
 }
 
 void proc_ide_destroy(void)
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index c5b902b86b44..203ed4adc04a 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
         struct device_node *root = of_find_node_by_path("/");
         const char *model = of_get_property(root, "model", NULL);
 
+        of_node_put(root);
         /* Get cable type from device-tree. */
         if (cable && !strncmp(cable, "80-", 3)) {
                 /* Some drives fail to detect 80c cable in PowerBook */
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 41d97faf5013..38ff374a3ca4 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -149,6 +149,7 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
         struct hid_sensor_hub_device *hsdev =
                                         accel_state->common_attributes.hsdev;
 
@@ -158,12 +159,14 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&accel_state->common_attributes, true);
                 report_id = accel_state->accel[chan->scan_index].report_id;
+                min = accel_state->accel[chan->scan_index].logical_minimum;
                 address = accel_3d_addresses[chan->scan_index];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                         accel_state->common_attributes.hsdev,
                                         hsdev->usage, address, report_id,
-                                        SENSOR_HUB_SYNC);
+                                        SENSOR_HUB_SYNC,
+                                        min < 0);
                 else {
                         *val = 0;
                         hid_sensor_power_state(&accel_state->common_attributes,
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index 36941e69f959..88e857c4baf4 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -111,6 +111,7 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -118,13 +119,15 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&gyro_state->common_attributes, true);
                 report_id = gyro_state->gyro[chan->scan_index].report_id;
+                min = gyro_state->gyro[chan->scan_index].logical_minimum;
                 address = gyro_3d_addresses[chan->scan_index];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                         gyro_state->common_attributes.hsdev,
                                         HID_USAGE_SENSOR_GYRO_3D, address,
                                         report_id,
-                                        SENSOR_HUB_SYNC);
+                                        SENSOR_HUB_SYNC,
+                                        min < 0);
                 else {
                         *val = 0;
                         hid_sensor_power_state(&gyro_state->common_attributes,
diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
index beab6d6fd6e1..4bc95f31c730 100644
--- a/drivers/iio/humidity/hid-sensor-humidity.c
+++ b/drivers/iio/humidity/hid-sensor-humidity.c
@@ -75,7 +75,8 @@ static int humidity_read_raw(struct iio_dev *indio_dev,
                                 HID_USAGE_SENSOR_HUMIDITY,
                                 HID_USAGE_SENSOR_ATMOSPHERIC_HUMIDITY,
                                 humid_st->humidity_attr.report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                humid_st->humidity_attr.logical_minimum < 0);
                 hid_sensor_power_state(&humid_st->common_attributes, false);
 
                 return IIO_VAL_INT;
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 406caaee9a3c..94f33250ba5a 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -93,6 +93,7 @@ static int als_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -102,8 +103,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
                 case  CHANNEL_SCAN_INDEX_INTENSITY:
                 case  CHANNEL_SCAN_INDEX_ILLUM:
                         report_id = als_state->als_illum.report_id;
-                        address =
-                        HID_USAGE_SENSOR_LIGHT_ILLUM;
+                        min = als_state->als_illum.logical_minimum;
+                        address = HID_USAGE_SENSOR_LIGHT_ILLUM;
                         break;
                 default:
                         report_id = -1;
@@ -116,7 +117,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
                                         als_state->common_attributes.hsdev,
                                         HID_USAGE_SENSOR_ALS, address,
                                         report_id,
-                                        SENSOR_HUB_SYNC);
+                                        SENSOR_HUB_SYNC,
+                                        min < 0);
                         hid_sensor_power_state(&als_state->common_attributes,
                                                 false);
                 } else {
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index 45107f7537b5..cf5a0c242609 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -73,6 +73,7 @@ static int prox_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -81,8 +82,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
                 switch (chan->scan_index) {
                 case  CHANNEL_SCAN_INDEX_PRESENCE:
                         report_id = prox_state->prox_attr.report_id;
-                        address =
-                        HID_USAGE_SENSOR_HUMAN_PRESENCE;
+                        min = prox_state->prox_attr.logical_minimum;
+                        address = HID_USAGE_SENSOR_HUMAN_PRESENCE;
                         break;
                 default:
                         report_id = -1;
@@ -95,7 +96,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
                                 prox_state->common_attributes.hsdev,
                                 HID_USAGE_SENSOR_PROX, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                         hid_sensor_power_state(&prox_state->common_attributes,
                                                 false);
                 } else {
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index d55c4885211a..f3c0d41e5a8c 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -163,21 +163,23 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&magn_state->magn_flux_attributes, true);
-                report_id =
-                        magn_state->magn[chan->address].report_id;
+                report_id = magn_state->magn[chan->address].report_id;
+                min = magn_state->magn[chan->address].logical_minimum;
                 address = magn_3d_addresses[chan->address];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                 magn_state->magn_flux_attributes.hsdev,
                                 HID_USAGE_SENSOR_COMPASS_3D, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                 else {
                         *val = 0;
                         hid_sensor_power_state(
diff --git a/drivers/iio/magnetometer/st_magn_buffer.c b/drivers/iio/magnetometer/st_magn_buffer.c
index 0a9e8fadfa9d..37ab30566464 100644
--- a/drivers/iio/magnetometer/st_magn_buffer.c
+++ b/drivers/iio/magnetometer/st_magn_buffer.c
@@ -30,11 +30,6 @@ int st_magn_trig_set_state(struct iio_trigger *trig, bool state)
         return st_sensors_set_dataready_irq(indio_dev, state);
 }
 
-static int st_magn_buffer_preenable(struct iio_dev *indio_dev)
-{
-        return st_sensors_set_enable(indio_dev, true);
-}
-
 static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
 {
         int err;
@@ -50,7 +45,7 @@ static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
         if (err < 0)
                 goto st_magn_buffer_postenable_error;
 
-        return err;
+        return st_sensors_set_enable(indio_dev, true);
 
 st_magn_buffer_postenable_error:
         kfree(mdata->buffer_data);
@@ -63,11 +58,11 @@ static int st_magn_buffer_predisable(struct iio_dev *indio_dev)
         int err;
         struct st_sensor_data *mdata = iio_priv(indio_dev);
 
-        err = iio_triggered_buffer_predisable(indio_dev);
+        err = st_sensors_set_enable(indio_dev, false);
         if (err < 0)
                 goto st_magn_buffer_predisable_error;
 
-        err = st_sensors_set_enable(indio_dev, false);
+        err = iio_triggered_buffer_predisable(indio_dev);
 
 st_magn_buffer_predisable_error:
         kfree(mdata->buffer_data);
@@ -75,7 +70,6 @@ st_magn_buffer_predisable_error:
 }
 
 static const struct iio_buffer_setup_ops st_magn_buffer_setup_ops = {
-        .preenable = &st_magn_buffer_preenable,
         .postenable = &st_magn_buffer_postenable,
         .predisable = &st_magn_buffer_predisable,
 };
diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
index 1e5451d1ff88..bdc5e4554ee4 100644
--- a/drivers/iio/orientation/hid-sensor-incl-3d.c
+++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
@@ -111,21 +111,23 @@ static int incl_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&incl_state->common_attributes, true);
-                report_id =
-                        incl_state->incl[chan->scan_index].report_id;
+                report_id = incl_state->incl[chan->scan_index].report_id;
+                min = incl_state->incl[chan->scan_index].logical_minimum;
                 address = incl_3d_addresses[chan->scan_index];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                 incl_state->common_attributes.hsdev,
                                 HID_USAGE_SENSOR_INCLINOMETER_3D, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                 else {
                         hid_sensor_power_state(&incl_state->common_attributes,
                                                 false);
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 4c437918f1d2..d7b1c00ceb4d 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -77,6 +77,7 @@ static int press_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -85,8 +86,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
                 switch (chan->scan_index) {
                 case  CHANNEL_SCAN_INDEX_PRESSURE:
                         report_id = press_state->press_attr.report_id;
-                        address =
-                        HID_USAGE_SENSOR_ATMOSPHERIC_PRESSURE;
+                        min = press_state->press_attr.logical_minimum;
+                        address = HID_USAGE_SENSOR_ATMOSPHERIC_PRESSURE;
                         break;
                 default:
                         report_id = -1;
@@ -99,7 +100,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
                                 press_state->common_attributes.hsdev,
                                 HID_USAGE_SENSOR_PRESSURE, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                         hid_sensor_power_state(&press_state->common_attributes,
                                                 false);
                 } else {
diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index beaf6fd3e337..b592fc4f007e 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -76,7 +76,8 @@ static int temperature_read_raw(struct iio_dev *indio_dev,
                         HID_USAGE_SENSOR_TEMPERATURE,
                         HID_USAGE_SENSOR_DATA_ENVIRONMENTAL_TEMPERATURE,
                         temp_st->temperature_attr.report_id,
-                        SENSOR_HUB_SYNC);
+                        SENSOR_HUB_SYNC,
+                        temp_st->temperature_attr.logical_minimum < 0);
                 hid_sensor_power_state(
                                 &temp_st->common_attributes,
                                 false);
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index ee366199b169..25d43c8f1c2a 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -767,8 +767,10 @@ static int netdevice_event(struct notifier_block *this, unsigned long event,
 
         case NETDEV_CHANGEADDR:
                 cmds[0] = netdev_del_cmd;
-                cmds[1] = add_default_gid_cmd;
-                cmds[2] = add_cmd;
+                if (ndev->reg_state == NETREG_REGISTERED) {
+                        cmds[1] = add_default_gid_cmd;
+                        cmds[2] = add_cmd;
+                }
                 break;
 
         case NETDEV_CHANGEUPPER:
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 2b4c5e7dd5a1..676c1fd1119d 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -137,15 +137,6 @@ static void ib_umem_notifier_release(struct mmu_notifier *mn,
         up_read(&per_mm->umem_rwsem);
 }
 
-static int invalidate_page_trampoline(struct ib_umem_odp *item, u64 start,
-                                      u64 end, void *cookie)
-{
-        ib_umem_notifier_start_account(item);
-        item->umem.context->invalidate_range(item, start, start + PAGE_SIZE);
-        ib_umem_notifier_end_account(item);
-        return 0;
-}
-
 static int invalidate_range_start_trampoline(struct ib_umem_odp *item,
                                              u64 start, u64 end, void *cookie)
 {
@@ -553,12 +544,13 @@ out:
                 put_page(page);
 
         if (remove_existing_mapping && umem->context->invalidate_range) {
-                invalidate_page_trampoline(
+                ib_umem_notifier_start_account(umem_odp);
+                umem->context->invalidate_range(
                         umem_odp,
-                        ib_umem_start(umem) + (page_index >> umem->page_shift),
-                        ib_umem_start(umem) + ((page_index + 1) >>
-                                               umem->page_shift),
-                        NULL);
+                        ib_umem_start(umem) + (page_index << umem->page_shift),
+                        ib_umem_start(umem) +
+                                ((page_index + 1) << umem->page_shift));
+                ib_umem_notifier_end_account(umem_odp);
                 ret = -EAGAIN;
         }
 
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index cf2282654210..77f095e5fbe3 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1268,6 +1268,7 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
         /* Registered a new RoCE device instance to netdev */
         rc = bnxt_re_register_netdev(rdev);
         if (rc) {
+                rtnl_unlock();
                 pr_err("Failed to register with netedev: %#x\n", rc);
                 return -EINVAL;
         }
@@ -1466,6 +1467,7 @@ static void bnxt_re_task(struct work_struct *work)
                                 "Failed to register with IB: %#x", rc);
                         bnxt_re_remove_one(rdev);
                         bnxt_re_dev_unreg(rdev);
+                        goto exit;
                 }
                 break;
         case NETDEV_UP:
@@ -1489,6 +1491,7 @@ static void bnxt_re_task(struct work_struct *work)
         }
         smp_mb__before_atomic();
         atomic_dec(&rdev->sched_count);
+exit:
         kfree(re_work);
 }
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index a4c62ae23a9a..3beb1523e17c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -1756,10 +1756,9 @@ static int hns_roce_v2_set_mac(struct hns_roce_dev *hr_dev, u8 phy_port,
         return hns_roce_cmq_send(hr_dev, &desc, 1);
 }
 
-static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
-                                  unsigned long mtpt_idx)
+static int set_mtpt_pbl(struct hns_roce_v2_mpt_entry *mpt_entry,
+                        struct hns_roce_mr *mr)
 {
-        struct hns_roce_v2_mpt_entry *mpt_entry;
         struct scatterlist *sg;
         u64 page_addr;
         u64 *pages;
@@ -1767,6 +1766,53 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
         int len;
         int entry;
 
+        mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
+        mpt_entry->pbl_ba_l = cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
+        roce_set_field(mpt_entry->byte_48_mode_ba,
+                       V2_MPT_BYTE_48_PBL_BA_H_M, V2_MPT_BYTE_48_PBL_BA_H_S,
+                       upper_32_bits(mr->pbl_ba >> 3));
+
+        pages = (u64 *)__get_free_page(GFP_KERNEL);
+        if (!pages)
+                return -ENOMEM;
+
+        i = 0;
+        for_each_sg(mr->umem->sg_head.sgl, sg, mr->umem->nmap, entry) {
+                len = sg_dma_len(sg) >> PAGE_SHIFT;
+                for (j = 0; j < len; ++j) {
+                        page_addr = sg_dma_address(sg) +
+                                (j << mr->umem->page_shift);
+                        pages[i] = page_addr >> 6;
+                        /* Record the first 2 entry directly to MTPT table */
+                        if (i >= HNS_ROCE_V2_MAX_INNER_MTPT_NUM - 1)
+                                goto found;
+                        i++;
+                }
+        }
+found:
+        mpt_entry->pa0_l = cpu_to_le32(lower_32_bits(pages[0]));
+        roce_set_field(mpt_entry->byte_56_pa0_h, V2_MPT_BYTE_56_PA0_H_M,
+                       V2_MPT_BYTE_56_PA0_H_S, upper_32_bits(pages[0]));
+
+        mpt_entry->pa1_l = cpu_to_le32(lower_32_bits(pages[1]));
+        roce_set_field(mpt_entry->byte_64_buf_pa1, V2_MPT_BYTE_64_PA1_H_M,
+                       V2_MPT_BYTE_64_PA1_H_S, upper_32_bits(pages[1]));
+        roce_set_field(mpt_entry->byte_64_buf_pa1,
+                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_M,
+                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_S,
+                       mr->pbl_buf_pg_sz + PG_SHIFT_OFFSET);
+
+        free_page((unsigned long)pages);
+
+        return 0;
+}
+
+static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+                                  unsigned long mtpt_idx)
+{
+        struct hns_roce_v2_mpt_entry *mpt_entry;
+        int ret;
+
         mpt_entry = mb_buf;
         memset(mpt_entry, 0, sizeof(*mpt_entry));
 
@@ -1781,7 +1827,6 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
                        mr->pbl_ba_pg_sz + PG_SHIFT_OFFSET);
         roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
                        V2_MPT_BYTE_4_PD_S, mr->pd);
-        mpt_entry->byte_4_pd_hop_st = cpu_to_le32(mpt_entry->byte_4_pd_hop_st);
 
         roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RA_EN_S, 0);
         roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1);
@@ -1796,13 +1841,11 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
                      (mr->access & IB_ACCESS_REMOTE_WRITE ? 1 : 0));
         roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S,
                      (mr->access & IB_ACCESS_LOCAL_WRITE ? 1 : 0));
-        mpt_entry->byte_8_mw_cnt_en = cpu_to_le32(mpt_entry->byte_8_mw_cnt_en);
 
         roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S,
                      mr->type == MR_TYPE_MR ? 0 : 1);
         roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_INNER_PA_VLD_S,
                      1);
-        mpt_entry->byte_12_mw_pa = cpu_to_le32(mpt_entry->byte_12_mw_pa);
 
         mpt_entry->len_l = cpu_to_le32(lower_32_bits(mr->size));
         mpt_entry->len_h = cpu_to_le32(upper_32_bits(mr->size));
@@ -1813,53 +1856,9 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
         if (mr->type == MR_TYPE_DMA)
                 return 0;
 
-        mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
-
-        mpt_entry->pbl_ba_l = cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
-        roce_set_field(mpt_entry->byte_48_mode_ba, V2_MPT_BYTE_48_PBL_BA_H_M,
-                       V2_MPT_BYTE_48_PBL_BA_H_S,
-                       upper_32_bits(mr->pbl_ba >> 3));
-        mpt_entry->byte_48_mode_ba = cpu_to_le32(mpt_entry->byte_48_mode_ba);
-
-        pages = (u64 *)__get_free_page(GFP_KERNEL);
-        if (!pages)
-                return -ENOMEM;
-
-        i = 0;
-        for_each_sg(mr->umem->sg_head.sgl, sg, mr->umem->nmap, entry) {
-                len = sg_dma_len(sg) >> PAGE_SHIFT;
-                for (j = 0; j < len; ++j) {
-                        page_addr = sg_dma_address(sg) +
-                                    (j << mr->umem->page_shift);
-                        pages[i] = page_addr >> 6;
-
-                        /* Record the first 2 entry directly to MTPT table */
-                        if (i >= HNS_ROCE_V2_MAX_INNER_MTPT_NUM - 1)
-                                goto found;
-                        i++;
-                }
-        }
-
-found:
-        mpt_entry->pa0_l = cpu_to_le32(lower_32_bits(pages[0]));
-        roce_set_field(mpt_entry->byte_56_pa0_h, V2_MPT_BYTE_56_PA0_H_M,
-                       V2_MPT_BYTE_56_PA0_H_S,
-                       upper_32_bits(pages[0]));
-        mpt_entry->byte_56_pa0_h = cpu_to_le32(mpt_entry->byte_56_pa0_h);
-
-        mpt_entry->pa1_l = cpu_to_le32(lower_32_bits(pages[1]));
-        roce_set_field(mpt_entry->byte_64_buf_pa1, V2_MPT_BYTE_64_PA1_H_M,
-                       V2_MPT_BYTE_64_PA1_H_S, upper_32_bits(pages[1]));
+        ret = set_mtpt_pbl(mpt_entry, mr);
 
-        free_page((unsigned long)pages);
-
-        roce_set_field(mpt_entry->byte_64_buf_pa1,
-                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_M,
-                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_S,
-                       mr->pbl_buf_pg_sz + PG_SHIFT_OFFSET);
-        mpt_entry->byte_64_buf_pa1 = cpu_to_le32(mpt_entry->byte_64_buf_pa1);
-
-        return 0;
+        return ret;
 }
 
 static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
@@ -1868,6 +1867,7 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
                                         u64 size, void *mb_buf)
 {
         struct hns_roce_v2_mpt_entry *mpt_entry = mb_buf;
+        int ret = 0;
 
         if (flags & IB_MR_REREG_PD) {
                 roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
@@ -1880,14 +1880,14 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
                              V2_MPT_BYTE_8_BIND_EN_S,
                              (mr_access_flags & IB_ACCESS_MW_BIND ? 1 : 0));
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en,
-                           V2_MPT_BYTE_8_ATOMIC_EN_S,
-                           (mr_access_flags & IB_ACCESS_REMOTE_ATOMIC ? 1 : 0));
+                             V2_MPT_BYTE_8_ATOMIC_EN_S,
+                             mr_access_flags & IB_ACCESS_REMOTE_ATOMIC ? 1 : 0);
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RR_EN_S,
-                             (mr_access_flags & IB_ACCESS_REMOTE_READ ? 1 : 0));
+                             mr_access_flags & IB_ACCESS_REMOTE_READ ? 1 : 0);
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RW_EN_S,
-                            (mr_access_flags & IB_ACCESS_REMOTE_WRITE ? 1 : 0));
+                             mr_access_flags & IB_ACCESS_REMOTE_WRITE ? 1 : 0);
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S,
-                             (mr_access_flags & IB_ACCESS_LOCAL_WRITE ? 1 : 0));
+                             mr_access_flags & IB_ACCESS_LOCAL_WRITE ? 1 : 0);
         }
 
         if (flags & IB_MR_REREG_TRANS) {
@@ -1896,21 +1896,13 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
                 mpt_entry->len_l = cpu_to_le32(lower_32_bits(size));
                 mpt_entry->len_h = cpu_to_le32(upper_32_bits(size));
 
-                mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
-                mpt_entry->pbl_ba_l =
-                                cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
-                roce_set_field(mpt_entry->byte_48_mode_ba,
-                               V2_MPT_BYTE_48_PBL_BA_H_M,
-                               V2_MPT_BYTE_48_PBL_BA_H_S,
-                               upper_32_bits(mr->pbl_ba >> 3));
-                mpt_entry->byte_48_mode_ba =
-                                cpu_to_le32(mpt_entry->byte_48_mode_ba);
-
                 mr->iova = iova;
                 mr->size = size;
+
+                ret = set_mtpt_pbl(mpt_entry, mr);
         }
 
-        return 0;
+        return ret;
 }
 
 static int hns_roce_v2_frmr_write_mtpt(void *mb_buf, struct hns_roce_mr *mr)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e9c428071df3..3569fda07e07 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1094,31 +1094,26 @@ enum mlx5_ib_width {
         MLX5_IB_WIDTH_12X       = 1 << 4
 };
 
-static int translate_active_width(struct ib_device *ibdev, u8 active_width,
+static void translate_active_width(struct ib_device *ibdev, u8 active_width,
                                   u8 *ib_width)
 {
         struct mlx5_ib_dev *dev = to_mdev(ibdev);
-        int err = 0;
 
-        if (active_width & MLX5_IB_WIDTH_1X) {
+        if (active_width & MLX5_IB_WIDTH_1X)
                 *ib_width = IB_WIDTH_1X;
-        } else if (active_width & MLX5_IB_WIDTH_2X) {
-                mlx5_ib_dbg(dev, "active_width %d is not supported by IB spec\n",
-                            (int)active_width);
-                err = -EINVAL;
-        } else if (active_width & MLX5_IB_WIDTH_4X) {
+        else if (active_width & MLX5_IB_WIDTH_4X)
                 *ib_width = IB_WIDTH_4X;
-        } else if (active_width & MLX5_IB_WIDTH_8X) {
+        else if (active_width & MLX5_IB_WIDTH_8X)
                 *ib_width = IB_WIDTH_8X;
-        } else if (active_width & MLX5_IB_WIDTH_12X) {
+        else if (active_width & MLX5_IB_WIDTH_12X)
                 *ib_width = IB_WIDTH_12X;
-        } else {
-                mlx5_ib_dbg(dev, "Invalid active_width %d\n",
+        else {
+                mlx5_ib_dbg(dev, "Invalid active_width %d, setting width to default value: 4x\n",
                             (int)active_width);
-                err = -EINVAL;
+                *ib_width = IB_WIDTH_4X;
         }
 
-        return err;
+        return;
 }
 
 static int mlx5_mtu_to_ib_mtu(int mtu)
@@ -1225,10 +1220,8 @@ static int mlx5_query_hca_port(struct ib_device *ibdev, u8 port,
         if (err)
                 goto out;
 
-        err = translate_active_width(ibdev, ib_link_width_oper,
-                                     &props->active_width);
-        if (err)
-                goto out;
+        translate_active_width(ibdev, ib_link_width_oper, &props->active_width);
+
         err = mlx5_query_port_ib_proto_oper(mdev, &props->active_speed, port);
         if (err)
                 goto out;
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index b04eb6775326..2cc3d69ab6f6 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -674,6 +674,15 @@ next_mr:
                         goto srcu_unlock;
                 }
 
+                if (!mr->umem->is_odp) {
+                        mlx5_ib_dbg(dev, "skipping non ODP MR (lkey=0x%06x) in page fault handler.\n",
+                                    key);
+                        if (bytes_mapped)
+                                *bytes_mapped += bcnt;
+                        ret = 0;
+                        goto srcu_unlock;
+                }
+
                 ret = pagefault_mr(dev, mr, io_virt, bcnt, bytes_mapped);
                 if (ret < 0)
                         goto srcu_unlock;
@@ -735,6 +744,7 @@ next_mr:
                         head = frame;
 
                         bcnt -= frame->bcnt;
+                        offset = 0;
                 }
                 break;
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 6841c0f9237f..3747cc681b18 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -2633,8 +2633,7 @@ static int to_mlx5_access_flags(struct mlx5_ib_qp *qp,
 
         if (access_flags & IB_ACCESS_REMOTE_READ)
                 *hw_access_flags |= MLX5_QP_BIT_RRE;
-        if ((access_flags & IB_ACCESS_REMOTE_ATOMIC) &&
-            qp->ibqp.qp_type == IB_QPT_RC) {
+        if (access_flags & IB_ACCESS_REMOTE_ATOMIC) {
                 int atomic_mode;
 
                 atomic_mode = get_atomic_mode(dev, qp->ibqp.qp_type);
@@ -4678,17 +4677,18 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (wr->opcode == IB_WR_LOCAL_INV ||
-                    wr->opcode == IB_WR_REG_MR) {
+                if (wr->opcode == IB_WR_REG_MR) {
                         fence = dev->umr_fence;
                         next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
-                } else if (wr->send_flags & IB_SEND_FENCE) {
-                        if (qp->next_fence)
-                                fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
-                        else
-                                fence = MLX5_FENCE_MODE_FENCE;
-                } else {
-                        fence = qp->next_fence;
+                } else  {
+                        if (wr->send_flags & IB_SEND_FENCE) {
+                                if (qp->next_fence)
+                                        fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
+                                else
+                                        fence = MLX5_FENCE_MODE_FENCE;
+                        } else {
+                                fence = qp->next_fence;
+                        }
                 }
 
                 switch (ibqp->qp_type) {
diff --git a/drivers/infiniband/sw/rdmavt/ah.c b/drivers/infiniband/sw/rdmavt/ah.c
index 89ec0f64abfc..084bb4baebb5 100644
--- a/drivers/infiniband/sw/rdmavt/ah.c
+++ b/drivers/infiniband/sw/rdmavt/ah.c
@@ -91,13 +91,15 @@ EXPORT_SYMBOL(rvt_check_ah);
  * rvt_create_ah - create an address handle
  * @pd: the protection domain
  * @ah_attr: the attributes of the AH
+ * @udata: pointer to user's input output buffer information.
  *
  * This may be called from interrupt context.
  *
  * Return: newly allocated ah
  */
 struct ib_ah *rvt_create_ah(struct ib_pd *pd,
-                            struct rdma_ah_attr *ah_attr)
+                            struct rdma_ah_attr *ah_attr,
+                            struct ib_udata *udata)
 {
         struct rvt_ah *ah;
         struct rvt_dev_info *dev = ib_to_rvt(pd->device);
diff --git a/drivers/infiniband/sw/rdmavt/ah.h b/drivers/infiniband/sw/rdmavt/ah.h
index 16105af99189..25271b48a683 100644
--- a/drivers/infiniband/sw/rdmavt/ah.h
+++ b/drivers/infiniband/sw/rdmavt/ah.h
@@ -51,7 +51,8 @@
 #include <rdma/rdma_vt.h>
 
 struct ib_ah *rvt_create_ah(struct ib_pd *pd,
-                            struct rdma_ah_attr *ah_attr);
+                            struct rdma_ah_attr *ah_attr,
+                            struct ib_udata *udata);
 int rvt_destroy_ah(struct ib_ah *ibah);
 int rvt_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
 int rvt_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 946b623ba5eb..4ff3d98fa6a4 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -1124,7 +1124,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
                                          IB_MR_CHECK_SIG_STATUS, &mr_status);
                 if (ret) {
                         pr_err("ib_check_mr_status failed, ret %d\n", ret);
-                        goto err;
+                        /* Not a lot we can do, return ambiguous guard error */
+                        *sector = 0;
+                        return 0x1;
                 }
 
                 if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
@@ -1152,9 +1154,6 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
         }
 
         return 0;
-err:
-        /* Not alot we can do here, return ambiguous guard error */
-        return 0x1;
 }
 
 void iser_err_comp(struct ib_wc *wc, const char *type)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index d4b9db487b16..cfc8b94527b9 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -480,18 +480,18 @@ static const u8 xboxone_hori_init[] = {
 };
 
 /*
- * This packet is required for some of the PDP pads to start
+ * This packet is required for most (all?) of the PDP pads to start
  * sending input reports. These pads include: (0x0e6f:0x02ab),
- * (0x0e6f:0x02a4).
+ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
  */
 static const u8 xboxone_pdp_init1[] = {
         0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14
 };
 
 /*
- * This packet is required for some of the PDP pads to start
+ * This packet is required for most (all?) of the PDP pads to start
  * sending input reports. These pads include: (0x0e6f:0x02ab),
- * (0x0e6f:0x02a4).
+ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
  */
 static const u8 xboxone_pdp_init2[] = {
         0x06, 0x20, 0x00, 0x02, 0x01, 0x00
@@ -527,12 +527,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
         XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2),
+        XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
+        XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
         XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
         XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
         XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 7e75835e220f..850bb259c20e 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -841,7 +841,7 @@ static int atkbd_select_set(struct atkbd *atkbd, int target_set, int allow_extra
         if (param[0] != 3) {
                 param[0] = 2;
                 if (ps2_command(ps2dev, param, ATKBD_CMD_SSCANSET))
-                return 2;
+                        return 2;
         }
 
         ps2_command(ps2dev, param, ATKBD_CMD_SETALL_MBR);
diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index 81be6f781f0b..d56001181598 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -493,7 +493,8 @@ static int cros_ec_keyb_register_bs(struct cros_ec_keyb *ckdev)
         for (i = 0; i < ARRAY_SIZE(cros_ec_keyb_bs); i++) {
                 const struct cros_ec_bs_map *map = &cros_ec_keyb_bs[i];
 
-                if (buttons & BIT(map->bit))
+                if ((map->ev_type == EV_KEY && (buttons & BIT(map->bit))) ||
+                    (map->ev_type == EV_SW && (switches & BIT(map->bit))))
                         input_set_capability(idev, map->ev_type, map->code);
         }
 
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index f51ae09596ef..403452ef00e6 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -407,7 +407,7 @@ matrix_keypad_parse_dt(struct device *dev)
         struct matrix_keypad_platform_data *pdata;
         struct device_node *np = dev->of_node;
         unsigned int *gpios;
-        int i, nrow, ncol;
+        int ret, i, nrow, ncol;
 
         if (!np) {
                 dev_err(dev, "device lacks DT data\n");
@@ -452,12 +452,19 @@ matrix_keypad_parse_dt(struct device *dev)
                 return ERR_PTR(-ENOMEM);
         }
 
-        for (i = 0; i < pdata->num_row_gpios; i++)
-                gpios[i] = of_get_named_gpio(np, "row-gpios", i);
+        for (i = 0; i < nrow; i++) {
+                ret = of_get_named_gpio(np, "row-gpios", i);
+                if (ret < 0)
+                        return ERR_PTR(ret);
+                gpios[i] = ret;
+        }
 
-        for (i = 0; i < pdata->num_col_gpios; i++)
-                gpios[pdata->num_row_gpios + i] =
-                        of_get_named_gpio(np, "col-gpios", i);
+        for (i = 0; i < ncol; i++) {
+                ret = of_get_named_gpio(np, "col-gpios", i);
+                if (ret < 0)
+                        return ERR_PTR(ret);
+                gpios[nrow + i] = ret;
+        }
 
         pdata->row_gpios = gpios;
         pdata->col_gpios = &gpios[pdata->num_row_gpios];
@@ -484,10 +491,8 @@ static int matrix_keypad_probe(struct platform_device *pdev)
         pdata = dev_get_platdata(&pdev->dev);
         if (!pdata) {
                 pdata = matrix_keypad_parse_dt(&pdev->dev);
-                if (IS_ERR(pdata)) {
-                        dev_err(&pdev->dev, "no platform data defined\n");
+                if (IS_ERR(pdata))
                         return PTR_ERR(pdata);
-                }
         } else if (!pdata->keymap_data) {
                 dev_err(&pdev->dev, "no keymap data defined\n");
                 return -EINVAL;
diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index 46406345742b..a7dc286f406c 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -60,8 +60,18 @@
 
 /* OMAP4 values */
 #define OMAP4_VAL_IRQDISABLE            0x0
-#define OMAP4_VAL_DEBOUNCINGTIME        0x7
-#define OMAP4_VAL_PVT                   0x7
+
+/*
+ * Errata i689: If a key is released for a time shorter than debounce time,
+ * the keyboard will idle and never detect the key release. The workaround
+ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
+ * "26.4.6.2 Keyboard Controller Timer" for more information.
+ */
+#define OMAP4_KEYPAD_PTV_DIV_128        0x6
+#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv)     \
+        ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
+#define OMAP4_VAL_DEBOUNCINGTIME_16MS                                   \
+        OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
 
 enum {
         KBD_REVISION_OMAP4 = 0,
@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
 
         kbd_writel(keypad_data, OMAP4_KBD_CTRL,
                         OMAP4_DEF_CTRL_NOSOFTMODE |
-                        (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
+                        (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
         kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
-                        OMAP4_VAL_DEBOUNCINGTIME);
+                        OMAP4_VAL_DEBOUNCINGTIME_16MS);
         /* clear pending interrupts */
         kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
                          kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index b0f9d19b3410..a94b6494e71a 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1348,6 +1348,9 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0618", 0 },
         { "ELAN061C", 0 },
         { "ELAN061D", 0 },
+        { "ELAN061E", 0 },
+        { "ELAN0620", 0 },
+        { "ELAN0621", 0 },
         { "ELAN0622", 0 },
         { "ELAN1000", 0 },
         { }
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 5e85f3cca867..2bd5bb11c8ba 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -170,6 +170,7 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0048", /* X1 Carbon 3 */
         "LEN0046", /* X250 */
         "LEN004a", /* W541 */
+        "LEN005b", /* P50 */
         "LEN0071", /* T480 */
         "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
         "LEN0073", /* X1 Carbon G5 (Elantech) */
@@ -177,6 +178,7 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0096", /* X280 */
         "LEN0097", /* X280 -> ALPS trackpoint */
         "LEN200f", /* T450s */
+        "SYN3221", /* HP 15-ay000 */
         NULL
 };
 
diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c
index 47a0e81a2989..a8b9be3e28db 100644
--- a/drivers/input/serio/hyperv-keyboard.c
+++ b/drivers/input/serio/hyperv-keyboard.c
@@ -177,7 +177,7 @@ static void hv_kbd_on_receive(struct hv_device *hv_dev,
                  * state because the Enter-UP can trigger a wakeup at once.
                  */
                 if (!(info & IS_BREAK))
-                        pm_wakeup_event(&hv_dev->device, 0);
+                        pm_wakeup_hard_event(&hv_dev->device);
 
                 break;
 
diff --git a/drivers/input/touchscreen/migor_ts.c b/drivers/input/touchscreen/migor_ts.c
index 02fb11985819..42d3fd7e04d7 100644
--- a/drivers/input/touchscreen/migor_ts.c
+++ b/drivers/input/touchscreen/migor_ts.c
@@ -1,23 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Touch Screen driver for Renesas MIGO-R Platform
  *
  * Copyright (c) 2008 Magnus Damm
  * Copyright (c) 2007 Ujjwal Pande <ujjwal@kenati.com>,
  *  Kenati Technologies Pvt Ltd.
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU  General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
- * You should have received a copy of the GNU General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
index b71673911aac..11ff32c68025 100644
--- a/drivers/input/touchscreen/st1232.c
+++ b/drivers/input/touchscreen/st1232.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * ST1232 Touchscreen Controller Driver
  *
@@ -7,15 +8,6 @@
  * Using code from:
  *  - android.git.kernel.org: projects/kernel/common.git: synaptics_i2c_rmi.c
  *      Copyright (C) 2007 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/delay.h>
@@ -295,4 +287,4 @@ module_i2c_driver(st1232_ts_driver);
 
 MODULE_AUTHOR("Tony SIM <chinyeow.sim.xt@renesas.com>");
 MODULE_DESCRIPTION("SITRONIX ST1232 Touchscreen Controller Driver");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bb2cd29e1658..d8f7000a466a 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
         entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
                     &entry, sizeof(entry));
-        entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
+        entry = (iommu_virt_to_phys(iommu->ga_log_tail) &
+                 (BIT_ULL(52)-1)) & ~7ULL;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
                     &entry, sizeof(entry));
         writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f3ccf025108b..41a4b8808802 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3075,7 +3075,7 @@ static int copy_context_table(struct intel_iommu *iommu,
                         }
 
                         if (old_ce)
-                                iounmap(old_ce);
+                                memunmap(old_ce);
 
                         ret = 0;
                         if (devfn < 0x80)
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index db301efe126d..887150907526 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -595,7 +595,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                         pr_err("%s: Page request without PASID: %08llx %08llx\n",
                                iommu->name, ((unsigned long long *)req)[0],
                                ((unsigned long long *)req)[1]);
-                        goto bad_req;
+                        goto no_pasid;
                 }
 
                 if (!svm || svm->pasid != req->pasid) {
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index b98a03189580..ddf3a492e1d5 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -498,6 +498,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
 
 static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
 {
+        if (!domain->mmu)
+                return;
+
         /*
          * Disable the context. Flush the TLB as required when modifying the
          * context registers.
diff --git a/drivers/leds/trigger/ledtrig-pattern.c b/drivers/leds/trigger/ledtrig-pattern.c
index ce7acd115dd8..1870cf87afe1 100644
--- a/drivers/leds/trigger/ledtrig-pattern.c
+++ b/drivers/leds/trigger/ledtrig-pattern.c
@@ -75,8 +75,6 @@ static void pattern_trig_timer_function(struct timer_list *t)
 {
         struct pattern_trig_data *data = from_timer(data, t, timer);
 
-        mutex_lock(&data->lock);
-
         for (;;) {
                 if (!data->is_indefinite && !data->repeat)
                         break;
@@ -87,9 +85,10 @@ static void pattern_trig_timer_function(struct timer_list *t)
                                            data->curr->brightness);
                         mod_timer(&data->timer,
                                   jiffies + msecs_to_jiffies(data->curr->delta_t));
-
-                        /* Skip the tuple with zero duration */
-                        pattern_trig_update_patterns(data);
+                        if (!data->next->delta_t) {
+                                /* Skip the tuple with zero duration */
+                                pattern_trig_update_patterns(data);
+                        }
                         /* Select next tuple */
                         pattern_trig_update_patterns(data);
                 } else {
@@ -116,8 +115,6 @@ static void pattern_trig_timer_function(struct timer_list *t)
 
                 break;
         }
-
-        mutex_unlock(&data->lock);
 }
 
 static int pattern_trig_start_pattern(struct led_classdev *led_cdev)
@@ -176,14 +173,10 @@ static ssize_t repeat_store(struct device *dev, struct device_attribute *attr,
         if (res < -1 || res == 0)
                 return -EINVAL;
 
-        /*
-         * Clear previous patterns' performence firstly, and remove the timer
-         * without mutex lock to avoid dead lock.
-         */
-        del_timer_sync(&data->timer);
-
         mutex_lock(&data->lock);
 
+        del_timer_sync(&data->timer);
+
         if (data->is_hw_pattern)
                 led_cdev->pattern_clear(led_cdev);
 
@@ -234,14 +227,10 @@ static ssize_t pattern_trig_store_patterns(struct led_classdev *led_cdev,
         struct pattern_trig_data *data = led_cdev->trigger_data;
         int ccount, cr, offset = 0, err = 0;
 
-        /*
-         * Clear previous patterns' performence firstly, and remove the timer
-         * without mutex lock to avoid dead lock.
-         */
-        del_timer_sync(&data->timer);
-
         mutex_lock(&data->lock);
 
+        del_timer_sync(&data->timer);
+
         if (data->is_hw_pattern)
                 led_cdev->pattern_clear(led_cdev);
 
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 31d1f4ab915e..65a933a21e68 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -807,7 +807,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
         }
 
         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
-                dprintk(1, "%s: transmit queue full\n", __func__);
+                dprintk(2, "%s: transmit queue full\n", __func__);
                 return -EBUSY;
         }
 
@@ -1180,6 +1180,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,
 {
         struct cec_log_addrs *las = &adap->log_addrs;
         struct cec_msg msg = { };
+        const unsigned int max_retries = 2;
+        unsigned int i;
         int err;
 
         if (cec_has_log_addr(adap, log_addr))
@@ -1188,19 +1190,44 @@ static int cec_config_log_addr(struct cec_adapter *adap,
         /* Send poll message */
         msg.len = 1;
         msg.msg[0] = (log_addr << 4) | log_addr;
-        err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        /*
-         * While trying to poll the physical address was reset
-         * and the adapter was unconfigured, so bail out.
-         */
-        if (!adap->is_configuring)
-                return -EINTR;
+        for (i = 0; i < max_retries; i++) {
+                err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        if (err)
-                return err;
+                /*
+                 * While trying to poll the physical address was reset
+                 * and the adapter was unconfigured, so bail out.
+                 */
+                if (!adap->is_configuring)
+                        return -EINTR;
+
+                if (err)
+                        return err;
 
-        if (msg.tx_status & CEC_TX_STATUS_OK)
+                /*
+                 * The message was aborted due to a disconnect or
+                 * unconfigure, just bail out.
+                 */
+                if (msg.tx_status & CEC_TX_STATUS_ABORTED)
+                        return -EINTR;
+                if (msg.tx_status & CEC_TX_STATUS_OK)
+                        return 0;
+                if (msg.tx_status & CEC_TX_STATUS_NACK)
+                        break;
+                /*
+                 * Retry up to max_retries times if the message was neither
+                 * OKed or NACKed. This can happen due to e.g. a Lost
+                 * Arbitration condition.
+                 */
+        }
+
+        /*
+         * If we are unable to get an OK or a NACK after max_retries attempts
+         * (and note that each attempt already consists of four polls), then
+         * then we assume that something is really weird and that it is not a
+         * good idea to try and claim this logical address.
+         */
+        if (i == max_retries)
                 return 0;
 
         /*
diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
index 6d4b2eec67b4..29836c1a40e9 100644
--- a/drivers/media/dvb-frontends/dvb-pll.c
+++ b/drivers/media/dvb-frontends/dvb-pll.c
@@ -80,8 +80,8 @@ struct dvb_pll_desc {
 
 static const struct dvb_pll_desc dvb_pll_thomson_dtt7579 = {
         .name  = "Thomson dtt7579",
-        .min   = 177000000,
-        .max   = 858000000,
+        .min   = 177 * MHz,
+        .max   = 858 * MHz,
         .iffreq= 36166667,
         .sleepdata = (u8[]){ 2, 0xb4, 0x03 },
         .count = 4,
@@ -102,8 +102,8 @@ static void thomson_dtt759x_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_thomson_dtt759x = {
         .name  = "Thomson dtt759x",
-        .min   = 177000000,
-        .max   = 896000000,
+        .min   = 177 * MHz,
+        .max   = 896 * MHz,
         .set   = thomson_dtt759x_bw,
         .iffreq= 36166667,
         .sleepdata = (u8[]){ 2, 0x84, 0x03 },
@@ -126,8 +126,8 @@ static void thomson_dtt7520x_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_thomson_dtt7520x = {
         .name  = "Thomson dtt7520x",
-        .min   = 185000000,
-        .max   = 900000000,
+        .min   = 185 * MHz,
+        .max   = 900 * MHz,
         .set   = thomson_dtt7520x_bw,
         .iffreq = 36166667,
         .count = 7,
@@ -144,8 +144,8 @@ static const struct dvb_pll_desc dvb_pll_thomson_dtt7520x = {
 
 static const struct dvb_pll_desc dvb_pll_lg_z201 = {
         .name  = "LG z201",
-        .min   = 174000000,
-        .max   = 862000000,
+        .min   = 174 * MHz,
+        .max   = 862 * MHz,
         .iffreq= 36166667,
         .sleepdata = (u8[]){ 2, 0xbc, 0x03 },
         .count = 5,
@@ -160,8 +160,8 @@ static const struct dvb_pll_desc dvb_pll_lg_z201 = {
 
 static const struct dvb_pll_desc dvb_pll_unknown_1 = {
         .name  = "unknown 1", /* used by dntv live dvb-t */
-        .min   = 174000000,
-        .max   = 862000000,
+        .min   = 174 * MHz,
+        .max   = 862 * MHz,
         .iffreq= 36166667,
         .count = 9,
         .entries = {
@@ -182,8 +182,8 @@ static const struct dvb_pll_desc dvb_pll_unknown_1 = {
  */
 static const struct dvb_pll_desc dvb_pll_tua6010xs = {
         .name  = "Infineon TUA6010XS",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .iffreq= 36125000,
         .count = 3,
         .entries = {
@@ -196,8 +196,8 @@ static const struct dvb_pll_desc dvb_pll_tua6010xs = {
 /* Panasonic env57h1xd5 (some Philips PLL ?) */
 static const struct dvb_pll_desc dvb_pll_env57h1xd5 = {
         .name  = "Panasonic ENV57H1XD5",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .iffreq= 36125000,
         .count = 4,
         .entries = {
@@ -220,8 +220,8 @@ static void tda665x_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_tda665x = {
         .name  = "Philips TDA6650/TDA6651",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .set   = tda665x_bw,
         .iffreq= 36166667,
         .initdata = (u8[]){ 4, 0x0b, 0xf5, 0x85, 0xab },
@@ -254,8 +254,8 @@ static void tua6034_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_tua6034 = {
         .name  = "Infineon TUA6034",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .iffreq= 36166667,
         .count = 3,
         .set   = tua6034_bw,
@@ -278,8 +278,8 @@ static void tded4_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_tded4 = {
         .name = "ALPS TDED4",
-        .min = 47000000,
-        .max = 863000000,
+        .min =  47 * MHz,
+        .max = 863 * MHz,
         .iffreq= 36166667,
         .set   = tded4_bw,
         .count = 4,
@@ -296,8 +296,8 @@ static const struct dvb_pll_desc dvb_pll_tded4 = {
  */
 static const struct dvb_pll_desc dvb_pll_tdhu2 = {
         .name = "ALPS TDHU2",
-        .min = 54000000,
-        .max = 864000000,
+        .min =  54 * MHz,
+        .max = 864 * MHz,
         .iffreq= 44000000,
         .count = 4,
         .entries = {
@@ -313,8 +313,8 @@ static const struct dvb_pll_desc dvb_pll_tdhu2 = {
  */
 static const struct dvb_pll_desc dvb_pll_samsung_tbmv = {
         .name = "Samsung TBMV30111IN / TBMV30712IN1",
-        .min = 54000000,
-        .max = 860000000,
+        .min =  54 * MHz,
+        .max = 860 * MHz,
         .iffreq= 44000000,
         .count = 6,
         .entries = {
@@ -332,8 +332,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbmv = {
  */
 static const struct dvb_pll_desc dvb_pll_philips_sd1878_tda8261 = {
         .name  = "Philips SD1878",
-        .min   =  950000,
-        .max   = 2150000,
+        .min   =  950 * MHz,
+        .max   = 2150 * MHz,
         .iffreq= 249, /* zero-IF, offset 249 is to round up */
         .count = 4,
         .entries = {
@@ -398,8 +398,8 @@ static void opera1_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_opera1 = {
         .name  = "Opera Tuner",
-        .min   =  900000,
-        .max   = 2250000,
+        .min   =  900 * MHz,
+        .max   = 2250 * MHz,
         .initdata = (u8[]){ 4, 0x08, 0xe5, 0xe1, 0x00 },
         .initdata2 = (u8[]){ 4, 0x08, 0xe5, 0xe5, 0x00 },
         .iffreq= 0,
@@ -445,8 +445,8 @@ static void samsung_dtos403ih102a_set(struct dvb_frontend *fe, u8 *buf)
 /* unknown pll used in Samsung DTOS403IH102A DVB-C tuner */
 static const struct dvb_pll_desc dvb_pll_samsung_dtos403ih102a = {
         .name   = "Samsung DTOS403IH102A",
-        .min    =  44250000,
-        .max    = 858000000,
+        .min    = 44250 * kHz,
+        .max    = 858 * MHz,
         .iffreq =  36125000,
         .count  = 8,
         .set    = samsung_dtos403ih102a_set,
@@ -465,8 +465,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_dtos403ih102a = {
 /* Samsung TDTC9251DH0 DVB-T NIM, as used on AirStar 2 */
 static const struct dvb_pll_desc dvb_pll_samsung_tdtc9251dh0 = {
         .name   = "Samsung TDTC9251DH0",
-        .min    =  48000000,
-        .max    = 863000000,
+        .min    =  48 * MHz,
+        .max    = 863 * MHz,
         .iffreq =  36166667,
         .count  = 3,
         .entries = {
@@ -479,8 +479,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tdtc9251dh0 = {
 /* Samsung TBDU18132 DVB-S NIM with TSA5059 PLL, used in SkyStar2 DVB-S 2.3 */
 static const struct dvb_pll_desc dvb_pll_samsung_tbdu18132 = {
         .name = "Samsung TBDU18132",
-        .min    =  950000,
-        .max    = 2150000, /* guesses */
+        .min    =  950 * MHz,
+        .max    = 2150 * MHz, /* guesses */
         .iffreq = 0,
         .count = 2,
         .entries = {
@@ -500,8 +500,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbdu18132 = {
 /* Samsung TBMU24112 DVB-S NIM with SL1935 zero-IF tuner */
 static const struct dvb_pll_desc dvb_pll_samsung_tbmu24112 = {
         .name = "Samsung TBMU24112",
-        .min    =  950000,
-        .max    = 2150000, /* guesses */
+        .min    =  950 * MHz,
+        .max    = 2150 * MHz, /* guesses */
         .iffreq = 0,
         .count = 2,
         .entries = {
@@ -521,8 +521,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbmu24112 = {
  * 822 - 862   1  *  0   0   1   0   0   0   0x88 */
 static const struct dvb_pll_desc dvb_pll_alps_tdee4 = {
         .name = "ALPS TDEE4",
-        .min    =  47000000,
-        .max    = 862000000,
+        .min    =  47 * MHz,
+        .max    = 862 * MHz,
         .iffreq =  36125000,
         .count = 4,
         .entries = {
@@ -537,8 +537,8 @@ static const struct dvb_pll_desc dvb_pll_alps_tdee4 = {
 /* CP cur. 50uA, AGC takeover: 103dBuV, PORT3 on */
 static const struct dvb_pll_desc dvb_pll_tua6034_friio = {
         .name   = "Infineon TUA6034 ISDB-T (Friio)",
-        .min    =  90000000,
-        .max    = 770000000,
+        .min    =  90 * MHz,
+        .max    = 770 * MHz,
         .iffreq =  57000000,
         .initdata = (u8[]){ 4, 0x9a, 0x50, 0xb2, 0x08 },
         .sleepdata = (u8[]){ 4, 0x9a, 0x70, 0xb3, 0x0b },
@@ -553,8 +553,8 @@ static const struct dvb_pll_desc dvb_pll_tua6034_friio = {
 /* Philips TDA6651 ISDB-T, used in Earthsoft PT1 */
 static const struct dvb_pll_desc dvb_pll_tda665x_earth_pt1 = {
         .name   = "Philips TDA6651 ISDB-T (EarthSoft PT1)",
-        .min    =  90000000,
-        .max    = 770000000,
+        .min    =  90 * MHz,
+        .max    = 770 * MHz,
         .iffreq =  57000000,
         .initdata = (u8[]){ 5, 0x0e, 0x7f, 0xc1, 0x80, 0x80 },
         .count = 10,
@@ -610,9 +610,6 @@ static int dvb_pll_configure(struct dvb_frontend *fe, u8 *buf,
         u32 div;
         int i;
 
-        if (frequency && (frequency < desc->min || frequency > desc->max))
-                return -EINVAL;
-
         for (i = 0; i < desc->count; i++) {
                 if (frequency > desc->entries[i].limit)
                         continue;
@@ -799,7 +796,6 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
         struct dvb_pll_priv *priv = NULL;
         int ret;
         const struct dvb_pll_desc *desc;
-        struct dtv_frontend_properties *c = &fe->dtv_property_cache;
 
         b1 = kmalloc(1, GFP_KERNEL);
         if (!b1)
@@ -845,18 +841,12 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
 
         strncpy(fe->ops.tuner_ops.info.name, desc->name,
                 sizeof(fe->ops.tuner_ops.info.name));
-        switch (c->delivery_system) {
-        case SYS_DVBS:
-        case SYS_DVBS2:
-        case SYS_TURBO:
-        case SYS_ISDBS:
-                fe->ops.tuner_ops.info.frequency_min_hz = desc->min * kHz;
-                fe->ops.tuner_ops.info.frequency_max_hz = desc->max * kHz;
-                break;
-        default:
-                fe->ops.tuner_ops.info.frequency_min_hz = desc->min;
-                fe->ops.tuner_ops.info.frequency_max_hz = desc->max;
-        }
+
+        fe->ops.tuner_ops.info.frequency_min_hz = desc->min;
+        fe->ops.tuner_ops.info.frequency_max_hz = desc->max;
+
+        dprintk("%s tuner, frequency range: %u...%u\n",
+                desc->name, desc->min, desc->max);
 
         if (!desc->initdata)
                 fe->ops.tuner_ops.init = NULL;
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index ca5d92942820..41d470d9ca94 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1918,7 +1918,6 @@ static int tc358743_probe_of(struct tc358743_state *state)
         ret = v4l2_fwnode_endpoint_alloc_parse(of_fwnode_handle(ep), &endpoint);
         if (ret) {
                 dev_err(dev, "failed to parse endpoint\n");
-                ret = ret;
                 goto put_node;
         }
 
diff --git a/drivers/media/media-request.c b/drivers/media/media-request.c
index 4e9db1fed697..c71a34ae6383 100644
--- a/drivers/media/media-request.c
+++ b/drivers/media/media-request.c
@@ -238,6 +238,9 @@ static const struct file_operations request_fops = {
         .owner = THIS_MODULE,
         .poll = media_request_poll,
         .unlocked_ioctl = media_request_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = media_request_ioctl,
+#endif /* CONFIG_COMPAT */
         .release = media_request_close,
 };
 
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 452eb9b42140..447baaebca44 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1844,14 +1844,12 @@ fail_mutex_destroy:
 static void cio2_pci_remove(struct pci_dev *pci_dev)
 {
         struct cio2_device *cio2 = pci_get_drvdata(pci_dev);
-        unsigned int i;
 
+        media_device_unregister(&cio2->media_dev);
         cio2_notifier_exit(cio2);
+        cio2_queues_exit(cio2);
         cio2_fbpt_exit_dummy(cio2);
-        for (i = 0; i < CIO2_QUEUES; i++)
-                cio2_queue_exit(cio2, &cio2->queue[i]);
         v4l2_device_unregister(&cio2->v4l2_dev);
-        media_device_unregister(&cio2->media_dev);
         media_device_cleanup(&cio2->media_dev);
         mutex_destroy(&cio2->lock);
 }
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 77fb7987b42f..13f2828d880d 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev)
 
 static void isp_unregister_entities(struct isp_device *isp)
 {
+        media_device_unregister(&isp->media_dev);
+
         omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
         omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
         omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp)
         omap3isp_stat_unregister_entities(&isp->isp_hist);
 
         v4l2_device_unregister(&isp->v4l2_dev);
-        media_device_unregister(&isp->media_dev);
         media_device_cleanup(&isp->media_dev);
 }
 
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 1eb9132bfc85..013cdebecbc4 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
 #define MAX_WIDTH               4096U
 #define MIN_WIDTH               640U
 #define MAX_HEIGHT              2160U
-#define MIN_HEIGHT              480U
+#define MIN_HEIGHT              360U
 
 #define dprintk(dev, fmt, arg...) \
         v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
@@ -304,7 +304,8 @@ restart:
                 for (; p < p_out + sz; p++) {
                         u32 copy;
 
-                        p = memchr(p, magic[ctx->comp_magic_cnt], sz);
+                        p = memchr(p, magic[ctx->comp_magic_cnt],
+                                   p_out + sz - p);
                         if (!p) {
                                 ctx->comp_magic_cnt = 0;
                                 break;
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index af150a0395df..d82db738f174 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1009,7 +1009,7 @@ static const struct v4l2_m2m_ops m2m_ops = {
 
 static const struct media_device_ops m2m_media_ops = {
         .req_validate = vb2_request_validate,
-        .req_queue = vb2_m2m_request_queue,
+        .req_queue = v4l2_m2m_request_queue,
 };
 
 static int vim2m_probe(struct platform_device *pdev)
diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index fce9d6f4b7c9..3137f5d89d80 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -426,10 +426,10 @@ void gspca_frame_add(struct gspca_dev *gspca_dev,
 
         /* append the packet to the frame buffer */
         if (len > 0) {
-                if (gspca_dev->image_len + len > gspca_dev->pixfmt.sizeimage) {
+                if (gspca_dev->image_len + len > PAGE_ALIGN(gspca_dev->pixfmt.sizeimage)) {
                         gspca_err(gspca_dev, "frame overflow %d > %d\n",
                                   gspca_dev->image_len + len,
-                                  gspca_dev->pixfmt.sizeimage);
+                                  PAGE_ALIGN(gspca_dev->pixfmt.sizeimage));
                         packet_type = DISCARD_PACKET;
                 } else {
 /* !! image is NULL only when last pkt is LAST or DISCARD
@@ -1297,18 +1297,19 @@ static int gspca_queue_setup(struct vb2_queue *vq,
                              unsigned int sizes[], struct device *alloc_devs[])
 {
         struct gspca_dev *gspca_dev = vb2_get_drv_priv(vq);
+        unsigned int size = PAGE_ALIGN(gspca_dev->pixfmt.sizeimage);
 
         if (*nplanes)
-                return sizes[0] < gspca_dev->pixfmt.sizeimage ? -EINVAL : 0;
+                return sizes[0] < size ? -EINVAL : 0;
         *nplanes = 1;
-        sizes[0] = gspca_dev->pixfmt.sizeimage;
+        sizes[0] = size;
         return 0;
 }
 
 static int gspca_buffer_prepare(struct vb2_buffer *vb)
 {
         struct gspca_dev *gspca_dev = vb2_get_drv_priv(vb->vb2_queue);
-        unsigned long size = gspca_dev->pixfmt.sizeimage;
+        unsigned long size = PAGE_ALIGN(gspca_dev->pixfmt.sizeimage);
 
         if (vb2_plane_size(vb, 0) < size) {
                 gspca_err(gspca_dev, "buffer too small (%lu < %lu)\n",
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 6e37950292cd..5f2b033a7a42 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1664,6 +1664,11 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
                     p_mpeg2_slice_params->forward_ref_index >= VIDEO_MAX_FRAME)
                         return -EINVAL;
 
+                if (p_mpeg2_slice_params->pad ||
+                    p_mpeg2_slice_params->picture.pad ||
+                    p_mpeg2_slice_params->sequence.pad)
+                        return -EINVAL;
+
                 return 0;
 
         case V4L2_CTRL_TYPE_MPEG2_QUANTIZATION:
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index a3ef1f50a4b3..481e3c65cf97 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
 }
 EXPORT_SYMBOL_GPL(v4l2_event_pending);
 
+static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
+{
+        struct v4l2_fh *fh = sev->fh;
+        unsigned int i;
+
+        lockdep_assert_held(&fh->subscribe_lock);
+        assert_spin_locked(&fh->vdev->fh_lock);
+
+        /* Remove any pending events for this subscription */
+        for (i = 0; i < sev->in_use; i++) {
+                list_del(&sev->events[sev_pos(sev, i)].list);
+                fh->navailable--;
+        }
+        list_del(&sev->list);
+}
+
 int v4l2_event_subscribe(struct v4l2_fh *fh,
                          const struct v4l2_event_subscription *sub, unsigned elems,
                          const struct v4l2_subscribed_event_ops *ops)
@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
         found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
+        if (!found_ev)
+                list_add(&sev->list, &fh->subscribed);
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
         if (found_ev) {
                 /* Already listening */
                 kvfree(sev);
-                goto out_unlock;
-        }
-
-        if (sev->ops && sev->ops->add) {
+        } else if (sev->ops && sev->ops->add) {
                 ret = sev->ops->add(sev, elems);
                 if (ret) {
+                        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+                        __v4l2_event_unsubscribe(sev);
+                        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
                         kvfree(sev);
-                        goto out_unlock;
                 }
         }
 
-        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-        list_add(&sev->list, &fh->subscribed);
-        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-
-out_unlock:
         mutex_unlock(&fh->subscribe_lock);
 
         return ret;
@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
 {
         struct v4l2_subscribed_event *sev;
         unsigned long flags;
-        int i;
 
         if (sub->type == V4L2_EVENT_ALL) {
                 v4l2_event_unsubscribe_all(fh);
@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
         sev = v4l2_event_subscribed(fh, sub->type, sub->id);
-        if (sev != NULL) {
-                /* Remove any pending events for this subscription */
-                for (i = 0; i < sev->in_use; i++) {
-                        list_del(&sev->events[sev_pos(sev, i)].list);
-                        fh->navailable--;
-                }
-                list_del(&sev->list);
-        }
+        if (sev != NULL)
+                __v4l2_event_unsubscribe(sev);
 
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index d7806db222d8..1ed2465972ac 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -953,7 +953,7 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_buf_queue);
 
-void vb2_m2m_request_queue(struct media_request *req)
+void v4l2_m2m_request_queue(struct media_request *req)
 {
         struct media_request_object *obj, *obj_safe;
         struct v4l2_m2m_ctx *m2m_ctx = NULL;
@@ -997,7 +997,7 @@ void vb2_m2m_request_queue(struct media_request *req)
         if (m2m_ctx)
                 v4l2_m2m_try_schedule(m2m_ctx);
 }
-EXPORT_SYMBOL_GPL(vb2_m2m_request_queue);
+EXPORT_SYMBOL_GPL(v4l2_m2m_request_queue);
 
 /* Videobuf2 ioctl helpers */
 
diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
index 8f9d6964173e..b99a194ce5a4 100644
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -263,6 +263,11 @@ static const struct file_operations fops = {
 #endif
 };
 
+static void cros_ec_class_release(struct device *dev)
+{
+        kfree(to_cros_ec_dev(dev));
+}
+
 static void cros_ec_sensors_register(struct cros_ec_dev *ec)
 {
         /*
@@ -395,7 +400,7 @@ static int ec_device_probe(struct platform_device *pdev)
         int retval = -ENOMEM;
         struct device *dev = &pdev->dev;
         struct cros_ec_platform *ec_platform = dev_get_platdata(dev);
-        struct cros_ec_dev *ec = devm_kzalloc(dev, sizeof(*ec), GFP_KERNEL);
+        struct cros_ec_dev *ec = kzalloc(sizeof(*ec), GFP_KERNEL);
 
         if (!ec)
                 return retval;
@@ -417,6 +422,7 @@ static int ec_device_probe(struct platform_device *pdev)
         ec->class_dev.devt = MKDEV(ec_major, pdev->id);
         ec->class_dev.class = &cros_class;
         ec->class_dev.parent = dev;
+        ec->class_dev.release = cros_ec_class_release;
 
         retval = dev_set_name(&ec->class_dev, "%s", ec_platform->ec_name);
         if (retval) {
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index b2a0340f277e..d8e3cc2dc747 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = {
 MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
 #endif
 
-static inline const struct atmel_ssc_platform_data * __init
+static inline const struct atmel_ssc_platform_data *
         atmel_ssc_get_driver_data(struct platform_device *pdev)
 {
         if (pdev->dev.of_node) {
diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
index c824329f7012..0e4193cb08cf 100644
--- a/drivers/misc/mic/scif/scif_rma.c
+++ b/drivers/misc/mic/scif/scif_rma.c
@@ -416,7 +416,7 @@ static int scif_create_remote_lookup(struct scif_dev *remote_dev,
                 if (err)
                         goto error_window;
                 err = scif_map_page(&window->num_pages_lookup.lookup[j],
-                                    vmalloc_dma_phys ?
+                                    vmalloc_num_pages ?
                                     vmalloc_to_page(&window->num_pages[i]) :
                                     virt_to_page(&window->num_pages[i]),
                                     remote_dev);
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 313da3150262..1540a7785e14 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -27,6 +27,9 @@
 #include <linux/delay.h>
 #include <linux/bitops.h>
 #include <asm/uv/uv_hub.h>
+
+#include <linux/nospec.h>
+
 #include "gru.h"
 #include "grutables.h"
 #include "gruhandles.h"
@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg)
         /* Currently, only dump by gid is implemented */
         if (req.gid >= gru_max_gids)
                 return -EINVAL;
+        req.gid = array_index_nospec(req.gid, gru_max_gids);
 
         gru = GID_TO_GRU(req.gid);
         ubuf = req.buf;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 7bfd366d970d..c4115bae5db1 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -12,6 +12,7 @@
  *     - JMicron (hardware and technical support)
  */
 
+#include <linux/bitfield.h>
 #include <linux/string.h>
 #include <linux/delay.h>
 #include <linux/highmem.h>
@@ -462,6 +463,9 @@ struct intel_host {
         u32     dsm_fns;
         int     drv_strength;
         bool    d3_retune;
+        bool    rpm_retune_ok;
+        u32     glk_rx_ctrl1;
+        u32     glk_tun_val;
 };
 
 static const guid_t intel_dsm_guid =
@@ -791,6 +795,77 @@ cleanup:
         return ret;
 }
 
+#ifdef CONFIG_PM
+#define GLK_RX_CTRL1    0x834
+#define GLK_TUN_VAL     0x840
+#define GLK_PATH_PLL    GENMASK(13, 8)
+#define GLK_DLY         GENMASK(6, 0)
+/* Workaround firmware failing to restore the tuning value */
+static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp)
+{
+        struct sdhci_pci_slot *slot = chip->slots[0];
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct sdhci_host *host = slot->host;
+        u32 glk_rx_ctrl1;
+        u32 glk_tun_val;
+        u32 dly;
+
+        if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc))
+                return;
+
+        glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1);
+        glk_tun_val = sdhci_readl(host, GLK_TUN_VAL);
+
+        if (susp) {
+                intel_host->glk_rx_ctrl1 = glk_rx_ctrl1;
+                intel_host->glk_tun_val = glk_tun_val;
+                return;
+        }
+
+        if (!intel_host->glk_tun_val)
+                return;
+
+        if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) {
+                intel_host->rpm_retune_ok = true;
+                return;
+        }
+
+        dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) +
+                                  (intel_host->glk_tun_val << 1));
+        if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1))
+                return;
+
+        glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly;
+        sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1);
+
+        intel_host->rpm_retune_ok = true;
+        chip->rpm_retune = true;
+        mmc_retune_needed(host->mmc);
+        pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc));
+}
+
+static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp)
+{
+        if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
+            !chip->rpm_retune)
+                glk_rpm_retune_wa(chip, susp);
+}
+
+static int glk_runtime_suspend(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, true);
+
+        return sdhci_cqhci_runtime_suspend(chip);
+}
+
+static int glk_runtime_resume(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, false);
+
+        return sdhci_cqhci_runtime_resume(chip);
+}
+#endif
+
 #ifdef CONFIG_ACPI
 static int ni_set_max_freq(struct sdhci_pci_slot *slot)
 {
@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = {
         .resume                 = sdhci_cqhci_resume,
 #endif
 #ifdef CONFIG_PM
-        .runtime_suspend        = sdhci_cqhci_runtime_suspend,
-        .runtime_resume         = sdhci_cqhci_runtime_resume,
+        .runtime_suspend        = glk_runtime_suspend,
+        .runtime_resume         = glk_runtime_resume,
 #endif
         .quirks                 = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC,
         .quirks2                = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
                 device_init_wakeup(&pdev->dev, true);
 
         if (slot->cd_idx >= 0) {
-                ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
+                ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
                                            slot->cd_override_level, 0, NULL);
+                if (ret && ret != -EPROBE_DEFER)
+                        ret = mmc_gpiod_request_cd(host->mmc, NULL,
+                                                   slot->cd_idx,
+                                                   slot->cd_override_level,
+                                                   0, NULL);
                 if (ret == -EPROBE_DEFER)
                         goto remove;
 
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index e514d57a0419..aa983422aa97 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers"
 config MTD_DOCG3
         tristate "M-Systems Disk-On-Chip G3"
         select BCH
-        select BCH_CONST_PARAMS
+        select BCH_CONST_PARAMS if !MTD_NAND_BCH
         select BITREVERSE
         help
           This provides an MTD device driver for the M-Systems DiskOnChip
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index 784c6e1a0391..fd5fe12d7461 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -221,7 +221,14 @@ static struct sa_info *sa1100_setup_mtd(struct platform_device *pdev,
                 info->mtd = info->subdev[0].mtd;
                 ret = 0;
         } else if (info->num_subdev > 1) {
-                struct mtd_info *cdev[nr];
+                struct mtd_info **cdev;
+
+                cdev = kmalloc_array(nr, sizeof(*cdev), GFP_KERNEL);
+                if (!cdev) {
+                        ret = -ENOMEM;
+                        goto err;
+                }
+
                 /*
                  * We detected multiple devices.  Concatenate them together.
                  */
@@ -230,6 +237,7 @@ static struct sa_info *sa1100_setup_mtd(struct platform_device *pdev,
 
                 info->mtd = mtd_concat_create(cdev, info->num_subdev,
                                               plat->name);
+                kfree(cdev);
                 if (info->mtd == NULL) {
                         ret = -ENXIO;
                         goto err;
diff --git a/drivers/mtd/nand/bbt.c b/drivers/mtd/nand/bbt.c
index 56cde38b92c0..044adf913854 100644
--- a/drivers/mtd/nand/bbt.c
+++ b/drivers/mtd/nand/bbt.c
@@ -27,7 +27,8 @@ int nanddev_bbt_init(struct nand_device *nand)
         unsigned int nwords = DIV_ROUND_UP(nblocks * bits_per_block,
                                            BITS_PER_LONG);
 
-        nand->bbt.cache = kzalloc(nwords, GFP_KERNEL);
+        nand->bbt.cache = kcalloc(nwords, sizeof(*nand->bbt.cache),
+                                  GFP_KERNEL);
         if (!nand->bbt.cache)
                 return -ENOMEM;
 
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index fb33f6be7c4f..ad720494e8f7 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2032,8 +2032,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
         int ret;
 
         nand_np = dev->of_node;
-        nfc_np = of_find_compatible_node(dev->of_node, NULL,
-                                         "atmel,sama5d3-nfc");
+        nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
         if (!nfc_np) {
                 dev_err(dev, "Could not find device node for sama5d3-nfc\n");
                 return -ENODEV;
@@ -2447,15 +2446,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
         }
 
         if (caps->legacy_of_bindings) {
+                struct device_node *nfc_node;
                 u32 ale_offs = 21;
 
                 /*
                  * If we are parsing legacy DT props and the DT contains a
                  * valid NFC node, forward the request to the sama5 logic.
                  */
-                if (of_find_compatible_node(pdev->dev.of_node, NULL,
-                                            "atmel,sama5d3-nfc"))
+                nfc_node = of_get_compatible_child(pdev->dev.of_node,
+                                                   "atmel,sama5d3-nfc");
+                if (nfc_node) {
                         caps = &atmel_sama5_nand_caps;
+                        of_node_put(nfc_node);
+                }
 
                 /*
                  * Even if the compatible says we are dealing with an
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index 05bd0779fe9b..71050a0b31df 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -590,7 +590,6 @@ retry:
 
 /**
  * panic_nand_wait - [GENERIC] wait until the command is done
- * @mtd: MTD device structure
  * @chip: NAND chip structure
  * @timeo: timeout
  *
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index ef75dfa62a4f..699d3cf49c6d 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -150,15 +150,15 @@
 #define NAND_VERSION_MINOR_SHIFT        16
 
 /* NAND OP_CMDs */
-#define PAGE_READ                       0x2
-#define PAGE_READ_WITH_ECC              0x3
-#define PAGE_READ_WITH_ECC_SPARE        0x4
-#define PROGRAM_PAGE                    0x6
-#define PAGE_PROGRAM_WITH_ECC           0x7
-#define PROGRAM_PAGE_SPARE              0x9
-#define BLOCK_ERASE                     0xa
-#define FETCH_ID                        0xb
-#define RESET_DEVICE                    0xd
+#define OP_PAGE_READ                    0x2
+#define OP_PAGE_READ_WITH_ECC           0x3
+#define OP_PAGE_READ_WITH_ECC_SPARE     0x4
+#define OP_PROGRAM_PAGE                 0x6
+#define OP_PAGE_PROGRAM_WITH_ECC        0x7
+#define OP_PROGRAM_PAGE_SPARE           0x9
+#define OP_BLOCK_ERASE                  0xa
+#define OP_FETCH_ID                     0xb
+#define OP_RESET_DEVICE                 0xd
 
 /* Default Value for NAND_DEV_CMD_VLD */
 #define NAND_DEV_CMD_VLD_VAL            (READ_START_VLD | WRITE_START_VLD | \
@@ -692,11 +692,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
 
         if (read) {
                 if (host->use_ecc)
-                        cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
                 else
-                        cmd = PAGE_READ | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE;
         } else {
-                        cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
+                cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
         }
 
         if (host->use_ecc) {
@@ -1170,7 +1170,7 @@ static int nandc_param(struct qcom_nand_host *host)
          * in use. we configure the controller to perform a raw read of 512
          * bytes to read onfi params
          */
-        nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, 0);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE
@@ -1224,7 +1224,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
         nandc_set_reg(nandc, NAND_FLASH_CMD,
-                      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
+                      OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, page_addr);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0,
@@ -1255,7 +1255,7 @@ static int read_id(struct qcom_nand_host *host, int column)
         if (column == -1)
                 return 0;
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID);
         nandc_set_reg(nandc, NAND_ADDR0, column);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT,
@@ -1276,7 +1276,7 @@ static int reset(struct qcom_nand_host *host)
         struct nand_chip *chip = &host->chip;
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE);
         nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
 
         write_reg_dma(nandc, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index e24db817154e..04cedd3a2bf6 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -644,9 +644,23 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                 ndelay(cqspi->wr_delay);
 
         while (remaining > 0) {
+                size_t write_words, mod_bytes;
+
                 write_bytes = remaining > page_size ? page_size : remaining;
-                iowrite32_rep(cqspi->ahb_base, txbuf,
-                              DIV_ROUND_UP(write_bytes, 4));
+                write_words = write_bytes / 4;
+                mod_bytes = write_bytes % 4;
+                /* Write 4 bytes at a time then single bytes. */
+                if (write_words) {
+                        iowrite32_rep(cqspi->ahb_base, txbuf, write_words);
+                        txbuf += (write_words * 4);
+                }
+                if (mod_bytes) {
+                        unsigned int temp = 0xFFFFFFFF;
+
+                        memcpy(&temp, txbuf, mod_bytes);
+                        iowrite32(temp, cqspi->ahb_base);
+                        txbuf += mod_bytes;
+                }
 
                 if (!wait_for_completion_timeout(&cqspi->transfer_complete,
                                         msecs_to_jiffies(CQSPI_TIMEOUT_MS))) {
@@ -655,7 +669,6 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                         goto failwr;
                 }
 
-                txbuf += write_bytes;
                 remaining -= write_bytes;
 
                 if (remaining > 0)
@@ -996,7 +1009,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf,
 err_unmap:
         dma_unmap_single(nor->dev, dma_dst, len, DMA_FROM_DEVICE);
 
-        return 0;
+        return ret;
 }
 
 static ssize_t cqspi_read(struct spi_nor *nor, loff_t from,
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 9407ca5f9443..1fdd2834fbcb 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -2156,7 +2156,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the serial flash memory
  * @len:        number of bytes to read
- * @buf:        buffer where the data is copied into
+ * @buf:        buffer where the data is copied into (dma-safe memory)
  *
  * Return: 0 on success, -errno otherwise.
  */
@@ -2522,6 +2522,34 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 }
 
 /**
+ * spi_nor_sort_erase_mask() - sort erase mask
+ * @map:        the erase map of the SPI NOR
+ * @erase_mask: the erase type mask to be sorted
+ *
+ * Replicate the sort done for the map's erase types in BFPT: sort the erase
+ * mask in ascending order with the smallest erase type size starting from
+ * BIT(0) in the sorted erase mask.
+ *
+ * Return: sorted erase mask.
+ */
+static u8 spi_nor_sort_erase_mask(struct spi_nor_erase_map *map, u8 erase_mask)
+{
+        struct spi_nor_erase_type *erase_type = map->erase_type;
+        int i;
+        u8 sorted_erase_mask = 0;
+
+        if (!erase_mask)
+                return 0;
+
+        /* Replicate the sort done for the map's erase types. */
+        for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
+                if (erase_type[i].size && erase_mask & BIT(erase_type[i].idx))
+                        sorted_erase_mask |= BIT(i);
+
+        return sorted_erase_mask;
+}
+
+/**
  * spi_nor_regions_sort_erase_types() - sort erase types in each region
  * @map:        the erase map of the SPI NOR
  *
@@ -2536,19 +2564,13 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 static void spi_nor_regions_sort_erase_types(struct spi_nor_erase_map *map)
 {
         struct spi_nor_erase_region *region = map->regions;
-        struct spi_nor_erase_type *erase_type = map->erase_type;
-        int i;
         u8 region_erase_mask, sorted_erase_mask;
 
         while (region) {
                 region_erase_mask = region->offset & SNOR_ERASE_TYPE_MASK;
 
-                /* Replicate the sort done for the map's erase types. */
-                sorted_erase_mask = 0;
-                for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
-                        if (erase_type[i].size &&
-                            region_erase_mask & BIT(erase_type[i].idx))
-                                sorted_erase_mask |= BIT(i);
+                sorted_erase_mask = spi_nor_sort_erase_mask(map,
+                                                            region_erase_mask);
 
                 /* Overwrite erase mask. */
                 region->offset = (region->offset & ~SNOR_ERASE_TYPE_MASK) |
@@ -2855,52 +2877,84 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings)
  * spi_nor_get_map_in_use() - get the configuration map in use
  * @nor:        pointer to a 'struct spi_nor'
  * @smpt:       pointer to the sector map parameter table
+ * @smpt_len:   sector map parameter table length
+ *
+ * Return: pointer to the map in use, ERR_PTR(-errno) otherwise.
  */
-static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt)
+static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
+                                         u8 smpt_len)
 {
-        const u32 *ret = NULL;
-        u32 i, addr;
+        const u32 *ret;
+        u8 *buf;
+        u32 addr;
         int err;
+        u8 i;
         u8 addr_width, read_opcode, read_dummy;
-        u8 read_data_mask, data_byte, map_id;
+        u8 read_data_mask, map_id;
+
+        /* Use a kmalloc'ed bounce buffer to guarantee it is DMA-able. */
+        buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return ERR_PTR(-ENOMEM);
 
         addr_width = nor->addr_width;
         read_dummy = nor->read_dummy;
         read_opcode = nor->read_opcode;
 
         map_id = 0;
-        i = 0;
         /* Determine if there are any optional Detection Command Descriptors */
-        while (!(smpt[i] & SMPT_DESC_TYPE_MAP)) {
+        for (i = 0; i < smpt_len; i += 2) {
+                if (smpt[i] & SMPT_DESC_TYPE_MAP)
+                        break;
+
                 read_data_mask = SMPT_CMD_READ_DATA(smpt[i]);
                 nor->addr_width = spi_nor_smpt_addr_width(nor, smpt[i]);
                 nor->read_dummy = spi_nor_smpt_read_dummy(nor, smpt[i]);
                 nor->read_opcode = SMPT_CMD_OPCODE(smpt[i]);
                 addr = smpt[i + 1];
 
-                err = spi_nor_read_raw(nor, addr, 1, &data_byte);
-                if (err)
+                err = spi_nor_read_raw(nor, addr, 1, buf);
+                if (err) {
+                        ret = ERR_PTR(err);
                         goto out;
+                }
 
                 /*
                  * Build an index value that is used to select the Sector Map
                  * Configuration that is currently in use.
                  */
-                map_id = map_id << 1 | !!(data_byte & read_data_mask);
-                i = i + 2;
+                map_id = map_id << 1 | !!(*buf & read_data_mask);
         }
 
-        /* Find the matching configuration map */
-        while (SMPT_MAP_ID(smpt[i]) != map_id) {
+        /*
+         * If command descriptors are provided, they always precede map
+         * descriptors in the table. There is no need to start the iteration
+         * over smpt array all over again.
+         *
+         * Find the matching configuration map.
+         */
+        ret = ERR_PTR(-EINVAL);
+        while (i < smpt_len) {
+                if (SMPT_MAP_ID(smpt[i]) == map_id) {
+                        ret = smpt + i;
+                        break;
+                }
+
+                /*
+                 * If there are no more configuration map descriptors and no
+                 * configuration ID matched the configuration identifier, the
+                 * sector address map is unknown.
+                 */
                 if (smpt[i] & SMPT_DESC_END)
-                        goto out;
+                        break;
+
                 /* increment the table index to the next map */
                 i += SMPT_MAP_REGION_COUNT(smpt[i]) + 1;
         }
 
-        ret = smpt + i;
         /* fall through */
 out:
+        kfree(buf);
         nor->addr_width = addr_width;
         nor->read_dummy = read_dummy;
         nor->read_opcode = read_opcode;
@@ -2941,12 +2995,13 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                                               const u32 *smpt)
 {
         struct spi_nor_erase_map *map = &nor->erase_map;
-        const struct spi_nor_erase_type *erase = map->erase_type;
+        struct spi_nor_erase_type *erase = map->erase_type;
         struct spi_nor_erase_region *region;
         u64 offset;
         u32 region_count;
         int i, j;
-        u8 erase_type;
+        u8 uniform_erase_type, save_uniform_erase_type;
+        u8 erase_type, regions_erase_type;
 
         region_count = SMPT_MAP_REGION_COUNT(*smpt);
         /*
@@ -2959,7 +3014,8 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                 return -ENOMEM;
         map->regions = region;
 
-        map->uniform_erase_type = 0xff;
+        uniform_erase_type = 0xff;
+        regions_erase_type = 0;
         offset = 0;
         /* Populate regions. */
         for (i = 0; i < region_count; i++) {
@@ -2974,12 +3030,40 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                  * Save the erase types that are supported in all regions and
                  * can erase the entire flash memory.
                  */
-                map->uniform_erase_type &= erase_type;
+                uniform_erase_type &= erase_type;
+
+                /*
+                 * regions_erase_type mask will indicate all the erase types
+                 * supported in this configuration map.
+                 */
+                regions_erase_type |= erase_type;
 
                 offset = (region[i].offset & ~SNOR_ERASE_FLAGS_MASK) +
                          region[i].size;
         }
 
+        save_uniform_erase_type = map->uniform_erase_type;
+        map->uniform_erase_type = spi_nor_sort_erase_mask(map,
+                                                          uniform_erase_type);
+
+        if (!regions_erase_type) {
+                /*
+                 * Roll back to the previous uniform_erase_type mask, SMPT is
+                 * broken.
+                 */
+                map->uniform_erase_type = save_uniform_erase_type;
+                return -EINVAL;
+        }
+
+        /*
+         * BFPT advertises all the erase types supported by all the possible
+         * map configurations. Mask out the erase types that are not supported
+         * by the current map configuration.
+         */
+        for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
+                if (!(regions_erase_type & BIT(erase[i].idx)))
+                        spi_nor_set_erase_type(&erase[i], 0, 0xFF);
+
         spi_nor_region_mark_end(&region[i - 1]);
 
         return 0;
@@ -3020,9 +3104,9 @@ static int spi_nor_parse_smpt(struct spi_nor *nor,
         for (i = 0; i < smpt_header->length; i++)
                 smpt[i] = le32_to_cpu(smpt[i]);
 
-        sector_map = spi_nor_get_map_in_use(nor, smpt);
-        if (!sector_map) {
-                ret = -EINVAL;
+        sector_map = spi_nor_get_map_in_use(nor, smpt, smpt_header->length);
+        if (IS_ERR(sector_map)) {
+                ret = PTR_ERR(sector_map);
                 goto out;
         }
 
@@ -3125,7 +3209,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         if (err)
                 goto exit;
 
-        /* Parse other parameter headers. */
+        /* Parse optional parameter tables. */
         for (i = 0; i < header.nph; i++) {
                 param_header = &param_headers[i];
 
@@ -3138,8 +3222,17 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
                         break;
                 }
 
-                if (err)
-                        goto exit;
+                if (err) {
+                        dev_warn(dev, "Failed to parse optional parameter table: %04x\n",
+                                 SFDP_PARAM_HEADER_ID(param_header));
+                        /*
+                         * Let's not drop all information we extracted so far
+                         * if optional table parsers fail. In case of failing,
+                         * each optional parser is responsible to roll back to
+                         * the previously known spi_nor data.
+                         */
+                        err = 0;
+                }
         }
 
 exit:
@@ -3250,12 +3343,14 @@ static int spi_nor_init_params(struct spi_nor *nor,
                 memcpy(&sfdp_params, params, sizeof(sfdp_params));
                 memcpy(&prev_map, &nor->erase_map, sizeof(prev_map));
 
-                if (spi_nor_parse_sfdp(nor, &sfdp_params))
+                if (spi_nor_parse_sfdp(nor, &sfdp_params)) {
+                        nor->addr_width = 0;
                         /* restore previous erase map */
                         memcpy(&nor->erase_map, &prev_map,
                                sizeof(nor->erase_map));
-                else
+                } else {
                         memcpy(params, &sfdp_params, sizeof(*params));
+                }
         }
 
         return 0;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index ffa37adb7681..333387f1f1fe 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3112,13 +3112,13 @@ static int bond_slave_netdev_event(unsigned long event,
         case NETDEV_CHANGE:
                 /* For 802.3ad mode only:
                  * Getting invalid Speed/Duplex values here will put slave
-                 * in weird state. So mark it as link-down for the time
+                 * in weird state. So mark it as link-fail for the time
                  * being and let link-monitoring (miimon) set it right when
                  * correct speeds/duplex are available.
                  */
                 if (bond_update_speed_duplex(slave) &&
                     BOND_MODE(bond) == BOND_MODE_8023AD)
-                        slave->link = BOND_LINK_DOWN;
+                        slave->link = BOND_LINK_FAIL;
 
                 if (BOND_MODE(bond) == BOND_MODE_8023AD)
                         bond_3ad_adapter_speed_duplex_changed(slave);
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 49163570a63a..3b3f88ffab53 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -477,6 +477,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(can_put_echo_skb);
 
+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
+{
+        struct can_priv *priv = netdev_priv(dev);
+        struct sk_buff *skb = priv->echo_skb[idx];
+        struct canfd_frame *cf;
+
+        if (idx >= priv->echo_skb_max) {
+                netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
+                           __func__, idx, priv->echo_skb_max);
+                return NULL;
+        }
+
+        if (!skb) {
+                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
+                           __func__, idx);
+                return NULL;
+        }
+
+        /* Using "struct canfd_frame::len" for the frame
+         * length is supported on both CAN and CANFD frames.
+         */
+        cf = (struct canfd_frame *)skb->data;
+        *len_ptr = cf->len;
+        priv->echo_skb[idx] = NULL;
+
+        return skb;
+}
+
 /*
  * Get the skb from the stack and loop it back locally
  *
@@ -486,22 +514,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
  */
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
 {
-        struct can_priv *priv = netdev_priv(dev);
-
-        BUG_ON(idx >= priv->echo_skb_max);
-
-        if (priv->echo_skb[idx]) {
-                struct sk_buff *skb = priv->echo_skb[idx];
-                struct can_frame *cf = (struct can_frame *)skb->data;
-                u8 dlc = cf->can_dlc;
+        struct sk_buff *skb;
+        u8 len;
 
-                netif_rx(priv->echo_skb[idx]);
-                priv->echo_skb[idx] = NULL;
+        skb = __can_get_echo_skb(dev, idx, &len);
+        if (!skb)
+                return 0;
 
-                return dlc;
-        }
+        netif_rx(skb);
 
-        return 0;
+        return len;
 }
 EXPORT_SYMBOL_GPL(can_get_echo_skb);
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 8e972ef08637..75ce11395ee8 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -135,13 +135,12 @@
 
 /* FLEXCAN interrupt flag register (IFLAG) bits */
 /* Errata ERR005829 step7: Reserve first valid MB */
-#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
-#define FLEXCAN_TX_MB_OFF_FIFO          9
+#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO         8
 #define FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP    0
-#define FLEXCAN_TX_MB_OFF_TIMESTAMP             1
-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST       (FLEXCAN_TX_MB_OFF_TIMESTAMP + 1)
-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST        63
-#define FLEXCAN_IFLAG_MB(x)             BIT(x)
+#define FLEXCAN_TX_MB                           63
+#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST       (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1)
+#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST        (FLEXCAN_TX_MB - 1)
+#define FLEXCAN_IFLAG_MB(x)             BIT(x & 0x1f)
 #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW  BIT(7)
 #define FLEXCAN_IFLAG_RX_FIFO_WARN      BIT(6)
 #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5)
@@ -259,9 +258,7 @@ struct flexcan_priv {
         struct can_rx_offload offload;
 
         struct flexcan_regs __iomem *regs;
-        struct flexcan_mb __iomem *tx_mb;
         struct flexcan_mb __iomem *tx_mb_reserved;
-        u8 tx_mb_idx;
         u32 reg_ctrl_default;
         u32 reg_imask1_default;
         u32 reg_imask2_default;
@@ -515,6 +512,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
 static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         const struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct can_frame *cf = (struct can_frame *)skb->data;
         u32 can_id;
         u32 data;
@@ -537,17 +535,17 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
 
         if (cf->can_dlc > 0) {
                 data = be32_to_cpup((__be32 *)&cf->data[0]);
-                priv->write(data, &priv->tx_mb->data[0]);
+                priv->write(data, &regs->mb[FLEXCAN_TX_MB].data[0]);
         }
         if (cf->can_dlc > 4) {
                 data = be32_to_cpup((__be32 *)&cf->data[4]);
-                priv->write(data, &priv->tx_mb->data[1]);
+                priv->write(data, &regs->mb[FLEXCAN_TX_MB].data[1]);
         }
 
         can_put_echo_skb(skb, dev, 0);
 
-        priv->write(can_id, &priv->tx_mb->can_id);
-        priv->write(ctrl, &priv->tx_mb->can_ctrl);
+        priv->write(can_id, &regs->mb[FLEXCAN_TX_MB].can_id);
+        priv->write(ctrl, &regs->mb[FLEXCAN_TX_MB].can_ctrl);
 
         /* Errata ERR005829 step8:
          * Write twice INACTIVE(0x8) code to first MB.
@@ -563,9 +561,13 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
 static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct sk_buff *skb;
         struct can_frame *cf;
         bool rx_errors = false, tx_errors = false;
+        u32 timestamp;
+
+        timestamp = priv->read(&regs->timer) << 16;
 
         skb = alloc_can_err_skb(dev, &cf);
         if (unlikely(!skb))
@@ -612,17 +614,21 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
         if (tx_errors)
                 dev->stats.tx_errors++;
 
-        can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
+        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
 }
 
 static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct sk_buff *skb;
         struct can_frame *cf;
         enum can_state new_state, rx_state, tx_state;
         int flt;
         struct can_berr_counter bec;
+        u32 timestamp;
+
+        timestamp = priv->read(&regs->timer) << 16;
 
         flt = reg_esr & FLEXCAN_ESR_FLT_CONF_MASK;
         if (likely(flt == FLEXCAN_ESR_FLT_CONF_ACTIVE)) {
@@ -652,7 +658,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
         if (unlikely(new_state == CAN_STATE_BUS_OFF))
                 can_bus_off(dev);
 
-        can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
+        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
 }
 
 static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
@@ -720,9 +726,14 @@ static unsigned int flexcan_mailbox_read(struct can_rx_offload *offload,
                         priv->write(BIT(n - 32), &regs->iflag2);
         } else {
                 priv->write(FLEXCAN_IFLAG_RX_FIFO_AVAILABLE, &regs->iflag1);
-                priv->read(&regs->timer);
         }
 
+        /* Read the Free Running Timer. It is optional but recommended
+         * to unlock Mailbox as soon as possible and make it available
+         * for reception.
+         */
+        priv->read(&regs->timer);
+
         return 1;
 }
 
@@ -732,9 +743,9 @@ static inline u64 flexcan_read_reg_iflag_rx(struct flexcan_priv *priv)
         struct flexcan_regs __iomem *regs = priv->regs;
         u32 iflag1, iflag2;
 
-        iflag2 = priv->read(&regs->iflag2) & priv->reg_imask2_default;
-        iflag1 = priv->read(&regs->iflag1) & priv->reg_imask1_default &
-                ~FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
+        iflag2 = priv->read(&regs->iflag2) & priv->reg_imask2_default &
+                ~FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
+        iflag1 = priv->read(&regs->iflag1) & priv->reg_imask1_default;
 
         return (u64)iflag2 << 32 | iflag1;
 }
@@ -746,11 +757,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->regs;
         irqreturn_t handled = IRQ_NONE;
-        u32 reg_iflag1, reg_esr;
+        u32 reg_iflag2, reg_esr;
         enum can_state last_state = priv->can.state;
 
-        reg_iflag1 = priv->read(&regs->iflag1);
-
         /* reception interrupt */
         if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
                 u64 reg_iflag;
@@ -764,6 +773,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                                 break;
                 }
         } else {
+                u32 reg_iflag1;
+
+                reg_iflag1 = priv->read(&regs->iflag1);
                 if (reg_iflag1 & FLEXCAN_IFLAG_RX_FIFO_AVAILABLE) {
                         handled = IRQ_HANDLED;
                         can_rx_offload_irq_offload_fifo(&priv->offload);
@@ -779,17 +791,22 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                 }
         }
 
+        reg_iflag2 = priv->read(&regs->iflag2);
+
         /* transmission complete interrupt */
-        if (reg_iflag1 & FLEXCAN_IFLAG_MB(priv->tx_mb_idx)) {
+        if (reg_iflag2 & FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB)) {
+                u32 reg_ctrl = priv->read(&regs->mb[FLEXCAN_TX_MB].can_ctrl);
+
                 handled = IRQ_HANDLED;
-                stats->tx_bytes += can_get_echo_skb(dev, 0);
+                stats->tx_bytes += can_rx_offload_get_echo_skb(&priv->offload,
+                                                               0, reg_ctrl << 16);
                 stats->tx_packets++;
                 can_led_event(dev, CAN_LED_EVENT_TX);
 
                 /* after sending a RTR frame MB is in RX mode */
                 priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
-                            &priv->tx_mb->can_ctrl);
-                priv->write(FLEXCAN_IFLAG_MB(priv->tx_mb_idx), &regs->iflag1);
+                            &regs->mb[FLEXCAN_TX_MB].can_ctrl);
+                priv->write(FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB), &regs->iflag2);
                 netif_wake_queue(dev);
         }
 
@@ -931,15 +948,13 @@ static int flexcan_chip_start(struct net_device *dev)
         reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
         reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV |
                 FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_SRX_DIS | FLEXCAN_MCR_IRMQ |
-                FLEXCAN_MCR_IDAM_C;
+                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(FLEXCAN_TX_MB);
 
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
                 reg_mcr &= ~FLEXCAN_MCR_FEN;
-                reg_mcr |= FLEXCAN_MCR_MAXMB(priv->offload.mb_last);
-        } else {
-                reg_mcr |= FLEXCAN_MCR_FEN |
-                        FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
-        }
+        else
+                reg_mcr |= FLEXCAN_MCR_FEN;
+
         netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
         priv->write(reg_mcr, &regs->mcr);
 
@@ -982,16 +997,17 @@ static int flexcan_chip_start(struct net_device *dev)
                 priv->write(reg_ctrl2, &regs->ctrl2);
         }
 
-        /* clear and invalidate all mailboxes first */
-        for (i = priv->tx_mb_idx; i < ARRAY_SIZE(regs->mb); i++) {
-                priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
-                            &regs->mb[i].can_ctrl);
-        }
-
         if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
-                for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++)
+                for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) {
                         priv->write(FLEXCAN_MB_CODE_RX_EMPTY,
                                     &regs->mb[i].can_ctrl);
+                }
+        } else {
+                /* clear and invalidate unused mailboxes first */
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) {
+                        priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
+                                    &regs->mb[i].can_ctrl);
+                }
         }
 
         /* Errata ERR005829: mark first TX mailbox as INACTIVE */
@@ -1000,7 +1016,7 @@ static int flexcan_chip_start(struct net_device *dev)
 
         /* mark TX mailbox as INACTIVE */
         priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
-                    &priv->tx_mb->can_ctrl);
+                    &regs->mb[FLEXCAN_TX_MB].can_ctrl);
 
         /* acceptance mask/acceptance code (accept everything) */
         priv->write(0x0, &regs->rxgmask);
@@ -1355,17 +1371,13 @@ static int flexcan_probe(struct platform_device *pdev)
         priv->devtype_data = devtype_data;
         priv->reg_xceiver = reg_xceiver;
 
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
-                priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_TIMESTAMP;
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
                 priv->tx_mb_reserved = &regs->mb[FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP];
-        } else {
-                priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_FIFO;
+        else
                 priv->tx_mb_reserved = &regs->mb[FLEXCAN_TX_MB_RESERVED_OFF_FIFO];
-        }
-        priv->tx_mb = &regs->mb[priv->tx_mb_idx];
 
-        priv->reg_imask1_default = FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
-        priv->reg_imask2_default = 0;
+        priv->reg_imask1_default = 0;
+        priv->reg_imask2_default = FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
 
         priv->offload.mailbox_read = flexcan_mailbox_read;
 
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index 11662f479e76..771a46083739 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -24,6 +24,9 @@
 
 #define RCAR_CAN_DRV_NAME       "rcar_can"
 
+#define RCAR_SUPPORTED_CLOCKS   (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
+                                 BIT(CLKR_CLKEXT))
+
 /* Mailbox configuration:
  * mailbox 60 - 63 - Rx FIFO mailboxes
  * mailbox 56 - 59 - Tx FIFO mailboxes
@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev)
                 goto fail_clk;
         }
 
-        if (clock_select >= ARRAY_SIZE(clock_names)) {
+        if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
                 err = -EINVAL;
                 dev_err(&pdev->dev, "invalid CAN clock selected\n");
                 goto fail_clk;
diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index c7d05027a7a0..2ce4fa8698c7 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -211,7 +211,54 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
 }
 EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo);
 
-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb)
+int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+                                struct sk_buff *skb, u32 timestamp)
+{
+        struct can_rx_offload_cb *cb;
+        unsigned long flags;
+
+        if (skb_queue_len(&offload->skb_queue) >
+            offload->skb_queue_len_max)
+                return -ENOMEM;
+
+        cb = can_rx_offload_get_cb(skb);
+        cb->timestamp = timestamp;
+
+        spin_lock_irqsave(&offload->skb_queue.lock, flags);
+        __skb_queue_add_sort(&offload->skb_queue, skb, can_rx_offload_compare);
+        spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
+
+        can_rx_offload_schedule(offload);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(can_rx_offload_queue_sorted);
+
+unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
+                                         unsigned int idx, u32 timestamp)
+{
+        struct net_device *dev = offload->dev;
+        struct net_device_stats *stats = &dev->stats;
+        struct sk_buff *skb;
+        u8 len;
+        int err;
+
+        skb = __can_get_echo_skb(dev, idx, &len);
+        if (!skb)
+                return 0;
+
+        err = can_rx_offload_queue_sorted(offload, skb, timestamp);
+        if (err) {
+                stats->rx_errors++;
+                stats->tx_fifo_errors++;
+        }
+
+        return len;
+}
+EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb);
+
+int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+                              struct sk_buff *skb)
 {
         if (skb_queue_len(&offload->skb_queue) >
             offload->skb_queue_len_max)
@@ -222,7 +269,7 @@ int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_b
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(can_rx_offload_irq_queue_err_skb);
+EXPORT_SYMBOL_GPL(can_rx_offload_queue_tail);
 
 static int can_rx_offload_init_queue(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight)
 {
diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
index 53e320c92a8b..ddaf46239e39 100644
--- a/drivers/net/can/spi/hi311x.c
+++ b/drivers/net/can/spi/hi311x.c
@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device *net)
 {
         struct hi3110_priv *priv = netdev_priv(net);
         struct spi_device *spi = priv->spi;
-        unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_RISING;
+        unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_HIGH;
         int ret;
 
         ret = open_candev(net);
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
index b939a4c10b84..c89c7d4900d7 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                         context = &priv->tx_contexts[i];
 
                         context->echo_index = i;
-                        can_put_echo_skb(skb, netdev, context->echo_index);
                         ++priv->active_tx_contexts;
                         if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)
                                 netif_stop_queue(netdev);
@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                 dev_kfree_skb(skb);
                 spin_lock_irqsave(&priv->tx_contexts_lock, flags);
 
-                can_free_echo_skb(netdev, context->echo_index);
                 context->echo_index = dev->max_tx_urbs;
                 --priv->active_tx_contexts;
                 netif_wake_queue(netdev);
@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
 
         context->priv = priv;
 
+        can_put_echo_skb(skb, netdev, context->echo_index);
+
         usb_fill_bulk_urb(urb, dev->udev,
                           usb_sndbulkpipe(dev->udev,
                                           dev->bulk_out->bEndpointAddress),
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
index c084bae5ec0a..5fc0be564274 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
@@ -1019,6 +1019,11 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
                                         new_state : CAN_STATE_ERROR_ACTIVE;
 
                         can_change_state(netdev, cf, tx_state, rx_state);
+
+                        if (priv->can.restart_ms &&
+                            old_state >= CAN_STATE_BUS_OFF &&
+                            new_state < CAN_STATE_BUS_OFF)
+                                cf->can_id |= CAN_ERR_RESTARTED;
                 }
 
                 if (new_state == CAN_STATE_BUS_OFF) {
@@ -1028,11 +1033,6 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
 
                         can_bus_off(netdev);
                 }
-
-                if (priv->can.restart_ms &&
-                    old_state >= CAN_STATE_BUS_OFF &&
-                    new_state < CAN_STATE_BUS_OFF)
-                        cf->can_id |= CAN_ERR_RESTARTED;
         }
 
         if (!skb) {
diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c
index 0678a38b1af4..f3d5bda012a1 100644
--- a/drivers/net/can/usb/ucan.c
+++ b/drivers/net/can/usb/ucan.c
@@ -35,10 +35,6 @@
 #include <linux/slab.h>
 #include <linux/usb.h>
 
-#include <linux/can.h>
-#include <linux/can/dev.h>
-#include <linux/can/error.h>
-
 #define UCAN_DRIVER_NAME "ucan"
 #define UCAN_MAX_RX_URBS 8
 /* the CAN controller needs a while to enable/disable the bus */
@@ -1575,11 +1571,8 @@ err_firmware_needs_update:
 /* disconnect the device */
 static void ucan_disconnect(struct usb_interface *intf)
 {
-        struct usb_device *udev;
         struct ucan_priv *up = usb_get_intfdata(intf);
 
-        udev = interface_to_usbdev(intf);
-
         usb_set_intfdata(intf, NULL);
 
         if (up) {
diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 54e0ca6ed730..86b6464b4525 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -1117,11 +1117,6 @@ static int ksz_switch_init(struct ksz_device *dev)
 {
         int i;
 
-        mutex_init(&dev->reg_mutex);
-        mutex_init(&dev->stats_mutex);
-        mutex_init(&dev->alu_mutex);
-        mutex_init(&dev->vlan_mutex);
-
         dev->ds->ops = &ksz_switch_ops;
 
         for (i = 0; i < ARRAY_SIZE(ksz_switch_chips); i++) {
@@ -1206,6 +1201,11 @@ int ksz_switch_register(struct ksz_device *dev)
         if (dev->pdata)
                 dev->chip_id = dev->pdata->chip_id;
 
+        mutex_init(&dev->reg_mutex);
+        mutex_init(&dev->stats_mutex);
+        mutex_init(&dev->alu_mutex);
+        mutex_init(&dev->vlan_mutex);
+
         if (ksz_switch_detect(dev))
                 return -EINVAL;
 
diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c
index d721ccf7d8be..38e399e0f30e 100644
--- a/drivers/net/dsa/mv88e6xxx/global1.c
+++ b/drivers/net/dsa/mv88e6xxx/global1.c
@@ -567,6 +567,8 @@ int mv88e6xxx_g1_stats_clear(struct mv88e6xxx_chip *chip)
         if (err)
                 return err;
 
+        /* Keep the histogram mode bits */
+        val &= MV88E6XXX_G1_STATS_OP_HIST_RX_TX;
         val |= MV88E6XXX_G1_STATS_OP_BUSY | MV88E6XXX_G1_STATS_OP_FLUSH_ALL;
 
         err = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_STATS_OP, val);
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 18956e7604a3..a70bb1bb90e7 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1848,6 +1848,8 @@ static void ena_down(struct ena_adapter *adapter)
                 rc = ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
                 if (rc)
                         dev_err(&adapter->pdev->dev, "Device reset failed\n");
+                /* stop submitting admin commands on a device that was reset */
+                ena_com_set_admin_running_state(adapter->ena_dev, false);
         }
 
         ena_destroy_all_io_queues(adapter);
@@ -1914,6 +1916,9 @@ static int ena_close(struct net_device *netdev)
 
         netif_dbg(adapter, ifdown, netdev, "%s\n", __func__);
 
+        if (!test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                return 0;
+
         if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                 ena_down(adapter);
 
@@ -2613,9 +2618,7 @@ static void ena_destroy_device(struct ena_adapter *adapter, bool graceful)
                 ena_down(adapter);
 
         /* Stop the device from sending AENQ events (in case reset flag is set
-         *  and device is up, ena_close already reset the device
-         * In case the reset flag is set and the device is up, ena_down()
-         * already perform the reset, so it can be skipped.
+         *  and device is up, ena_down() already reset the device.
          */
         if (!(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags) && dev_up))
                 ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
@@ -2694,8 +2697,8 @@ err_device_destroy:
         ena_com_abort_admin_commands(ena_dev);
         ena_com_wait_for_abort_completion(ena_dev);
         ena_com_admin_destroy(ena_dev);
-        ena_com_mmio_reg_read_request_destroy(ena_dev);
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_DRIVER_INVALID_STATE);
+        ena_com_mmio_reg_read_request_destroy(ena_dev);
 err:
         clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
         clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
@@ -3452,6 +3455,8 @@ err_rss:
         ena_com_rss_destroy(ena_dev);
 err_free_msix:
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_INIT_ERR);
+        /* stop submitting admin commands on a device that was reset */
+        ena_com_set_admin_running_state(ena_dev, false);
         ena_free_mgmnt_irq(adapter);
         ena_disable_msix(adapter);
 err_worker_destroy:
@@ -3498,18 +3503,12 @@ static void ena_remove(struct pci_dev *pdev)
 
         cancel_work_sync(&adapter->reset_task);
 
-        unregister_netdev(netdev);
-
-        /* If the device is running then we want to make sure the device will be
-         * reset to make sure no more events will be issued by the device.
-         */
-        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
-                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-
         rtnl_lock();
         ena_destroy_device(adapter, true);
         rtnl_unlock();
 
+        unregister_netdev(netdev);
+
         free_netdev(netdev);
 
         ena_com_rss_destroy(ena_dev);
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 521873642339..dc8b6173d8d8 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 1
+#define DRV_MODULE_VER_SUBMINOR 2
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
index b4fc0ed5bce8..9d4899826823 100644
--- a/drivers/net/ethernet/amd/sunlance.c
+++ b/drivers/net/ethernet/amd/sunlance.c
@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
 
                         prop = of_get_property(nd, "tpe-link-test?", NULL);
                         if (!prop)
-                                goto no_link_test;
+                                goto node_put;
 
                         if (strcmp(prop, "true")) {
                                 printk(KERN_NOTICE "SunLance: warning: overriding option "
@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
                                        "to ecd@skynet.be\n");
                                 auxio_set_lte(AUXIO_LTE_ON);
                         }
+node_put:
+                        of_node_put(nd);
 no_link_test:
                         lp->auto_select = 1;
                         lp->tpe = 0;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
index 6a633c70f603..99ef1daaa4d8 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
@@ -407,13 +407,13 @@ static void aq_ethtool_get_pauseparam(struct net_device *ndev,
                                       struct ethtool_pauseparam *pause)
 {
         struct aq_nic_s *aq_nic = netdev_priv(ndev);
+        u32 fc = aq_nic->aq_nic_cfg.flow_control;
 
         pause->autoneg = 0;
 
-        if (aq_nic->aq_hw->aq_nic_cfg->flow_control & AQ_NIC_FC_RX)
-                pause->rx_pause = 1;
-        if (aq_nic->aq_hw->aq_nic_cfg->flow_control & AQ_NIC_FC_TX)
-                pause->tx_pause = 1;
+        pause->rx_pause = !!(fc & AQ_NIC_FC_RX);
+        pause->tx_pause = !!(fc & AQ_NIC_FC_TX);
+
 }
 
 static int aq_ethtool_set_pauseparam(struct net_device *ndev,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index e8689241204e..a1e70da358ca 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -204,6 +204,10 @@ struct aq_hw_ops {
 
         int (*hw_get_fw_version)(struct aq_hw_s *self, u32 *fw_version);
 
+        int (*hw_set_offload)(struct aq_hw_s *self,
+                              struct aq_nic_cfg_s *aq_nic_cfg);
+
+        int (*hw_set_fc)(struct aq_hw_s *self, u32 fc, u32 tc);
 };
 
 struct aq_fw_ops {
@@ -226,6 +230,8 @@ struct aq_fw_ops {
 
         int (*update_stats)(struct aq_hw_s *self);
 
+        u32 (*get_flow_control)(struct aq_hw_s *self, u32 *fcmode);
+
         int (*set_flow_control)(struct aq_hw_s *self);
 
         int (*set_power)(struct aq_hw_s *self, unsigned int power_state,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index e3ae29e523f0..7c07eef275eb 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -99,8 +99,11 @@ static int aq_ndev_set_features(struct net_device *ndev,
         struct aq_nic_s *aq_nic = netdev_priv(ndev);
         struct aq_nic_cfg_s *aq_cfg = aq_nic_get_cfg(aq_nic);
         bool is_lro = false;
+        int err = 0;
+
+        aq_cfg->features = features;
 
-        if (aq_cfg->hw_features & NETIF_F_LRO) {
+        if (aq_cfg->aq_hw_caps->hw_features & NETIF_F_LRO) {
                 is_lro = features & NETIF_F_LRO;
 
                 if (aq_cfg->is_lro != is_lro) {
@@ -112,8 +115,11 @@ static int aq_ndev_set_features(struct net_device *ndev,
                         }
                 }
         }
+        if ((aq_nic->ndev->features ^ features) & NETIF_F_RXCSUM)
+                err = aq_nic->aq_hw_ops->hw_set_offload(aq_nic->aq_hw,
+                                                        aq_cfg);
 
-        return 0;
+        return err;
 }
 
 static int aq_ndev_set_mac_address(struct net_device *ndev, void *addr)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 5fed24446687..7abdc0952425 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -118,12 +118,13 @@ void aq_nic_cfg_start(struct aq_nic_s *self)
         }
 
         cfg->link_speed_msk &= cfg->aq_hw_caps->link_speed_msk;
-        cfg->hw_features = cfg->aq_hw_caps->hw_features;
+        cfg->features = cfg->aq_hw_caps->hw_features;
 }
 
 static int aq_nic_update_link_status(struct aq_nic_s *self)
 {
         int err = self->aq_fw_ops->update_link_status(self->aq_hw);
+        u32 fc = 0;
 
         if (err)
                 return err;
@@ -133,6 +134,15 @@ static int aq_nic_update_link_status(struct aq_nic_s *self)
                         AQ_CFG_DRV_NAME, self->link_status.mbps,
                         self->aq_hw->aq_link_status.mbps);
                 aq_nic_update_interrupt_moderation_settings(self);
+
+                /* Driver has to update flow control settings on RX block
+                 * on any link event.
+                 * We should query FW whether it negotiated FC.
+                 */
+                if (self->aq_fw_ops->get_flow_control)
+                        self->aq_fw_ops->get_flow_control(self->aq_hw, &fc);
+                if (self->aq_hw_ops->hw_set_fc)
+                        self->aq_hw_ops->hw_set_fc(self->aq_hw, fc, 0);
         }
 
         self->link_status = self->aq_hw->aq_link_status;
@@ -590,7 +600,7 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
                 }
         }
 
-        if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
+        if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) {
                 packet_filter |= IFF_MULTICAST;
                 self->mc_list.count = i;
                 self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
@@ -772,7 +782,9 @@ void aq_nic_get_link_ksettings(struct aq_nic_s *self,
                 ethtool_link_ksettings_add_link_mode(cmd, advertising,
                                                      Pause);
 
-        if (self->aq_nic_cfg.flow_control & AQ_NIC_FC_TX)
+        /* Asym is when either RX or TX, but not both */
+        if (!!(self->aq_nic_cfg.flow_control & AQ_NIC_FC_TX) ^
+            !!(self->aq_nic_cfg.flow_control & AQ_NIC_FC_RX))
                 ethtool_link_ksettings_add_link_mode(cmd, advertising,
                                                      Asym_Pause);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index c1582f4e8e1b..44ec47a3d60a 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -23,7 +23,7 @@ struct aq_vec_s;
 
 struct aq_nic_cfg_s {
         const struct aq_hw_caps_s *aq_hw_caps;
-        u64 hw_features;
+        u64 features;
         u32 rxds;               /* rx ring size, descriptors # */
         u32 txds;               /* tx ring size, descriptors # */
         u32 vecs;               /* vecs==allocated irqs */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 3db91446cc67..74550ccc7a20 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -172,6 +172,27 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
         return !!budget;
 }
 
+static void aq_rx_checksum(struct aq_ring_s *self,
+                           struct aq_ring_buff_s *buff,
+                           struct sk_buff *skb)
+{
+        if (!(self->aq_nic->ndev->features & NETIF_F_RXCSUM))
+                return;
+
+        if (unlikely(buff->is_cso_err)) {
+                ++self->stats.rx.errors;
+                skb->ip_summed = CHECKSUM_NONE;
+                return;
+        }
+        if (buff->is_ip_cso) {
+                __skb_incr_checksum_unnecessary(skb);
+                if (buff->is_udp_cso || buff->is_tcp_cso)
+                        __skb_incr_checksum_unnecessary(skb);
+        } else {
+                skb->ip_summed = CHECKSUM_NONE;
+        }
+}
+
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
 int aq_ring_rx_clean(struct aq_ring_s *self,
                      struct napi_struct *napi,
@@ -267,18 +288,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
                 }
 
                 skb->protocol = eth_type_trans(skb, ndev);
-                if (unlikely(buff->is_cso_err)) {
-                        ++self->stats.rx.errors;
-                        skb->ip_summed = CHECKSUM_NONE;
-                } else {
-                        if (buff->is_ip_cso) {
-                                __skb_incr_checksum_unnecessary(skb);
-                                if (buff->is_udp_cso || buff->is_tcp_cso)
-                                        __skb_incr_checksum_unnecessary(skb);
-                        } else {
-                                skb->ip_summed = CHECKSUM_NONE;
-                        }
-                }
+
+                aq_rx_checksum(self, buff, skb);
 
                 skb_set_hash(skb, buff->rss_hash,
                              buff->is_hash_l4 ? PKT_HASH_TYPE_L4 :
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 76d25d594a0f..f02592f43fe3 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -100,12 +100,17 @@ static int hw_atl_b0_hw_reset(struct aq_hw_s *self)
         return err;
 }
 
+static int hw_atl_b0_set_fc(struct aq_hw_s *self, u32 fc, u32 tc)
+{
+        hw_atl_rpb_rx_xoff_en_per_tc_set(self, !!(fc & AQ_NIC_FC_RX), tc);
+        return 0;
+}
+
 static int hw_atl_b0_hw_qos_set(struct aq_hw_s *self)
 {
         u32 tc = 0U;
         u32 buff_size = 0U;
         unsigned int i_priority = 0U;
-        bool is_rx_flow_control = false;
 
         /* TPS Descriptor rate init */
         hw_atl_tps_tx_pkt_shed_desc_rate_curr_time_res_set(self, 0x0U);
@@ -138,7 +143,6 @@ static int hw_atl_b0_hw_qos_set(struct aq_hw_s *self)
 
         /* QoS Rx buf size per TC */
         tc = 0;
-        is_rx_flow_control = (AQ_NIC_FC_RX & self->aq_nic_cfg->flow_control);
         buff_size = HW_ATL_B0_RXBUF_MAX;
 
         hw_atl_rpb_rx_pkt_buff_size_per_tc_set(self, buff_size, tc);
@@ -150,7 +154,8 @@ static int hw_atl_b0_hw_qos_set(struct aq_hw_s *self)
                                                    (buff_size *
                                                    (1024U / 32U) * 50U) /
                                                    100U, tc);
-        hw_atl_rpb_rx_xoff_en_per_tc_set(self, is_rx_flow_control ? 1U : 0U, tc);
+
+        hw_atl_b0_set_fc(self, self->aq_nic_cfg->flow_control, tc);
 
         /* QoS 802.1p priority -> TC mapping */
         for (i_priority = 8U; i_priority--;)
@@ -229,8 +234,10 @@ static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
         hw_atl_tpo_tcp_udp_crc_offload_en_set(self, 1);
 
         /* RX checksums offloads*/
-        hw_atl_rpo_ipv4header_crc_offload_en_set(self, 1);
-        hw_atl_rpo_tcp_udp_crc_offload_en_set(self, 1);
+        hw_atl_rpo_ipv4header_crc_offload_en_set(self, !!(aq_nic_cfg->features &
+                                                 NETIF_F_RXCSUM));
+        hw_atl_rpo_tcp_udp_crc_offload_en_set(self, !!(aq_nic_cfg->features &
+                                              NETIF_F_RXCSUM));
 
         /* LSO offloads*/
         hw_atl_tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
@@ -655,9 +662,9 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
                 struct hw_atl_rxd_wb_s *rxd_wb = (struct hw_atl_rxd_wb_s *)
                         &ring->dx_ring[ring->hw_head * HW_ATL_B0_RXD_SIZE];
 
-                unsigned int is_err = 1U;
                 unsigned int is_rx_check_sum_enabled = 0U;
                 unsigned int pkt_type = 0U;
+                u8 rx_stat = 0U;
 
                 if (!(rxd_wb->status & 0x1U)) { /* RxD is not done */
                         break;
@@ -665,35 +672,35 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
 
                 buff = &ring->buff_ring[ring->hw_head];
 
-                is_err = (0x0000003CU & rxd_wb->status);
+                rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
 
                 is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
-                is_err &= ~0x20U; /* exclude validity bit */
 
                 pkt_type = 0xFFU & (rxd_wb->type >> 4);
 
-                if (is_rx_check_sum_enabled) {
-                        if (0x0U == (pkt_type & 0x3U))
-                                buff->is_ip_cso = (is_err & 0x08U) ? 0U : 1U;
+                if (is_rx_check_sum_enabled & BIT(0) &&
+                    (0x0U == (pkt_type & 0x3U)))
+                        buff->is_ip_cso = (rx_stat & BIT(1)) ? 0U : 1U;
 
+                if (is_rx_check_sum_enabled & BIT(1)) {
                         if (0x4U == (pkt_type & 0x1CU))
-                                buff->is_udp_cso = buff->is_cso_err ? 0U : 1U;
+                                buff->is_udp_cso = (rx_stat & BIT(2)) ? 0U :
+                                                   !!(rx_stat & BIT(3));
                         else if (0x0U == (pkt_type & 0x1CU))
-                                buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U;
-
-                        /* Checksum offload workaround for small packets */
-                        if (rxd_wb->pkt_len <= 60) {
-                                buff->is_ip_cso = 0U;
-                                buff->is_cso_err = 0U;
-                        }
+                                buff->is_tcp_cso = (rx_stat & BIT(2)) ? 0U :
+                                                   !!(rx_stat & BIT(3));
+                }
+                buff->is_cso_err = !!(rx_stat & 0x6);
+                /* Checksum offload workaround for small packets */
+                if (unlikely(rxd_wb->pkt_len <= 60)) {
+                        buff->is_ip_cso = 0U;
+                        buff->is_cso_err = 0U;
                 }
-
-                is_err &= ~0x18U;
 
                 dma_unmap_page(ndev, buff->pa, buff->len, DMA_FROM_DEVICE);
 
-                if (is_err || rxd_wb->type & 0x1000U) {
-                        /* status error or DMA error */
+                if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) {
+                        /* MAC error or DMA error */
                         buff->is_error = 1U;
                 } else {
                         if (self->aq_nic_cfg->is_rss) {
@@ -915,6 +922,12 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
 static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
 {
         hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
+
+        /* Invalidate Descriptor Cache to prevent writing to the cached
+         * descriptors and to the data pointer of those descriptors
+         */
+        hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1);
+
         return aq_hw_err_from_flags(self);
 }
 
@@ -963,4 +976,6 @@ const struct aq_hw_ops hw_atl_ops_b0 = {
         .hw_get_regs                 = hw_atl_utils_hw_get_regs,
         .hw_get_hw_stats             = hw_atl_utils_get_hw_stats,
         .hw_get_fw_version           = hw_atl_utils_get_fw_version,
+        .hw_set_offload              = hw_atl_b0_hw_offload_set,
+        .hw_set_fc                   = hw_atl_b0_set_fc,
 };
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
index be0a3a90dfad..5502ec5f0f69 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
@@ -619,6 +619,14 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode
                             HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode);
 }
 
+void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init)
+{
+        aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
+                            HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
+                            HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT,
+                            init);
+}
+
 void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
                                             u32 rx_pkt_buff_size_per_tc, u32 buffer)
 {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
index 7056c7342afc..41f239928c15 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
@@ -325,6 +325,9 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
                                             u32 rx_pkt_buff_size_per_tc,
                                             u32 buffer);
 
+/* set rdm rx dma descriptor cache init */
+void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init);
+
 /* set rx xoff enable (per tc) */
 void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc,
                                       u32 buffer);
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
index 716674a9b729..a715fa317b1c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
@@ -293,6 +293,24 @@
 /* default value of bitfield desc{d}_reset */
 #define HW_ATL_RDM_DESCDRESET_DEFAULT 0x0
 
+/* rdm_desc_init_i bitfield definitions
+ * preprocessor definitions for the bitfield rdm_desc_init_i.
+ * port="pif_rdm_desc_init_i"
+ */
+
+/* register address for bitfield rdm_desc_init_i */
+#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR 0x00005a00
+/* bitmask for bitfield rdm_desc_init_i */
+#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK 0xffffffff
+/* inverted bitmask for bitfield rdm_desc_init_i */
+#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSKN 0x00000000
+/* lower bit position of bitfield  rdm_desc_init_i */
+#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT 0
+/* width of bitfield rdm_desc_init_i */
+#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_WIDTH 32
+/* default value of bitfield rdm_desc_init_i */
+#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0
+
 /* rx int_desc_wrb_en bitfield definitions
  * preprocessor definitions for the bitfield "int_desc_wrb_en".
  * port="pif_rdm_int_desc_wrb_en_i"
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
index 096ca5730887..7de3220d9cab 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
@@ -30,6 +30,8 @@
 #define HW_ATL_FW2X_MPI_STATE_ADDR      0x370
 #define HW_ATL_FW2X_MPI_STATE2_ADDR     0x374
 
+#define HW_ATL_FW2X_CAP_PAUSE            BIT(CAPS_HI_PAUSE)
+#define HW_ATL_FW2X_CAP_ASYM_PAUSE       BIT(CAPS_HI_ASYMMETRIC_PAUSE)
 #define HW_ATL_FW2X_CAP_SLEEP_PROXY      BIT(CAPS_HI_SLEEP_PROXY)
 #define HW_ATL_FW2X_CAP_WOL              BIT(CAPS_HI_WOL)
 
@@ -451,6 +453,24 @@ static int aq_fw2x_set_flow_control(struct aq_hw_s *self)
         return 0;
 }
 
+static u32 aq_fw2x_get_flow_control(struct aq_hw_s *self, u32 *fcmode)
+{
+        u32 mpi_state = aq_hw_read_reg(self, HW_ATL_FW2X_MPI_STATE2_ADDR);
+
+        if (mpi_state & HW_ATL_FW2X_CAP_PAUSE)
+                if (mpi_state & HW_ATL_FW2X_CAP_ASYM_PAUSE)
+                        *fcmode = AQ_NIC_FC_RX;
+                else
+                        *fcmode = AQ_NIC_FC_RX | AQ_NIC_FC_TX;
+        else
+                if (mpi_state & HW_ATL_FW2X_CAP_ASYM_PAUSE)
+                        *fcmode = AQ_NIC_FC_TX;
+                else
+                        *fcmode = 0;
+
+        return 0;
+}
+
 const struct aq_fw_ops aq_fw_2x_ops = {
         .init = aq_fw2x_init,
         .deinit = aq_fw2x_deinit,
@@ -465,4 +485,5 @@ const struct aq_fw_ops aq_fw_2x_ops = {
         .set_eee_rate = aq_fw2x_set_eee_rate,
         .get_eee_rate = aq_fw2x_get_eee_rate,
         .set_flow_control = aq_fw2x_set_flow_control,
+        .get_flow_control = aq_fw2x_get_flow_control
 };
diff --git a/drivers/net/ethernet/atheros/alx/alx.h b/drivers/net/ethernet/atheros/alx/alx.h
index 78c5de467426..9d0e74f6b089 100644
--- a/drivers/net/ethernet/atheros/alx/alx.h
+++ b/drivers/net/ethernet/atheros/alx/alx.h
@@ -140,6 +140,5 @@ struct alx_priv {
 };
 
 extern const struct ethtool_ops alx_ethtool_ops;
-extern const char alx_drv_name[];
 
 #endif
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 7968c644ad86..c131cfc1b79d 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -49,7 +49,7 @@
 #include "hw.h"
 #include "reg.h"
 
-const char alx_drv_name[] = "alx";
+static const char alx_drv_name[] = "alx";
 
 static void alx_free_txbuf(struct alx_tx_queue *txq, int entry)
 {
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 4122553e224b..0e2d99c737e3 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1902,9 +1902,6 @@ static void bcm_sysport_netif_start(struct net_device *dev)
                 intrl2_1_mask_clear(priv, 0xffffffff);
         else
                 intrl2_0_mask_clear(priv, INTRL2_0_TDMA_MBDONE_MASK);
-
-        /* Last call before we start the real business */
-        netif_tx_start_all_queues(dev);
 }
 
 static void rbuf_init(struct bcm_sysport_priv *priv)
@@ -2048,6 +2045,8 @@ static int bcm_sysport_open(struct net_device *dev)
 
         bcm_sysport_netif_start(dev);
 
+        netif_tx_start_all_queues(dev);
+
         return 0;
 
 out_clear_rx_int:
@@ -2071,7 +2070,7 @@ static void bcm_sysport_netif_stop(struct net_device *dev)
         struct bcm_sysport_priv *priv = netdev_priv(dev);
 
         /* stop all software from updating hardware */
-        netif_tx_stop_all_queues(dev);
+        netif_tx_disable(dev);
         napi_disable(&priv->napi);
         cancel_work_sync(&priv->dim.dim.work);
         phy_stop(dev->phydev);
@@ -2658,12 +2657,12 @@ static int __maybe_unused bcm_sysport_suspend(struct device *d)
         if (!netif_running(dev))
                 return 0;
 
+        netif_device_detach(dev);
+
         bcm_sysport_netif_stop(dev);
 
         phy_suspend(dev->phydev);
 
-        netif_device_detach(dev);
-
         /* Disable UniMAC RX */
         umac_enable_set(priv, CMD_RX_EN, 0);
 
@@ -2746,8 +2745,6 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)
                 goto out_free_rx_ring;
         }
 
-        netif_device_attach(dev);
-
         /* RX pipe enable */
         topctrl_writel(priv, 0, RX_FLUSH_CNTL);
 
@@ -2788,6 +2785,8 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)
 
         bcm_sysport_netif_start(dev);
 
+        netif_device_attach(dev);
+
         return 0;
 
 out_free_rx_ring:
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index be1506169076..0de487a8f0eb 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -2191,6 +2191,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                          E1HVN_MAX)
 
+/* Following is the DMAE channel number allocation for the clients.
+ *   MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively.
+ *   Driver: 0-3 and 8-11 (for PF dmae operations)
+ *           4 and 12 (for stats requests)
+ */
+#define BNX2X_FW_DMAE_C                 13 /* Channel for FW DMAE operations */
+
 /* PCIE link and speed */
 #define PCICFG_LINK_WIDTH               0x1f00000
 #define PCICFG_LINK_WIDTH_SHIFT         20
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 3f4d2c8da21a..a9eaaf3e73a4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
         rdata->sd_vlan_tag      = cpu_to_le16(start_params->sd_vlan_tag);
         rdata->path_id          = BP_PATH(bp);
         rdata->network_cos_mode = start_params->network_cos_mode;
+        rdata->dmae_cmd_id      = BNX2X_FW_DMAE_C;
 
         rdata->vxlan_dst_port   = cpu_to_le16(start_params->vxlan_dst_port);
         rdata->geneve_dst_port  = cpu_to_le16(start_params->geneve_dst_port);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index dd85d790f638..d4c300117529 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1675,7 +1675,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
         } else {
                 if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L4_CS_ERR_BITS) {
                         if (dev->features & NETIF_F_RXCSUM)
-                                cpr->rx_l4_csum_errors++;
+                                bnapi->cp_ring.rx_l4_csum_errors++;
                 }
         }
 
@@ -8714,6 +8714,26 @@ static int bnxt_set_features(struct net_device *dev, netdev_features_t features)
         return rc;
 }
 
+static int bnxt_dbg_hwrm_ring_info_get(struct bnxt *bp, u8 ring_type,
+                                       u32 ring_id, u32 *prod, u32 *cons)
+{
+        struct hwrm_dbg_ring_info_get_output *resp = bp->hwrm_cmd_resp_addr;
+        struct hwrm_dbg_ring_info_get_input req = {0};
+        int rc;
+
+        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_DBG_RING_INFO_GET, -1, -1);
+        req.ring_type = ring_type;
+        req.fw_ring_id = cpu_to_le32(ring_id);
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        if (!rc) {
+                *prod = le32_to_cpu(resp->producer_index);
+                *cons = le32_to_cpu(resp->consumer_index);
+        }
+        mutex_unlock(&bp->hwrm_cmd_lock);
+        return rc;
+}
+
 static void bnxt_dump_tx_sw_state(struct bnxt_napi *bnapi)
 {
         struct bnxt_tx_ring_info *txr = bnapi->tx_ring;
@@ -8821,6 +8841,11 @@ static void bnxt_timer(struct timer_list *t)
                         bnxt_queue_sp_work(bp);
                 }
         }
+
+        if ((bp->flags & BNXT_FLAG_CHIP_P5) && netif_carrier_ok(dev)) {
+                set_bit(BNXT_RING_COAL_NOW_SP_EVENT, &bp->sp_event);
+                bnxt_queue_sp_work(bp);
+        }
 bnxt_restart_timer:
         mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
@@ -8851,6 +8876,44 @@ static void bnxt_reset(struct bnxt *bp, bool silent)
         bnxt_rtnl_unlock_sp(bp);
 }
 
+static void bnxt_chk_missed_irq(struct bnxt *bp)
+{
+        int i;
+
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                return;
+
+        for (i = 0; i < bp->cp_nr_rings; i++) {
+                struct bnxt_napi *bnapi = bp->bnapi[i];
+                struct bnxt_cp_ring_info *cpr;
+                u32 fw_ring_id;
+                int j;
+
+                if (!bnapi)
+                        continue;
+
+                cpr = &bnapi->cp_ring;
+                for (j = 0; j < 2; j++) {
+                        struct bnxt_cp_ring_info *cpr2 = cpr->cp_ring_arr[j];
+                        u32 val[2];
+
+                        if (!cpr2 || cpr2->has_more_work ||
+                            !bnxt_has_work(bp, cpr2))
+                                continue;
+
+                        if (cpr2->cp_raw_cons != cpr2->last_cp_raw_cons) {
+                                cpr2->last_cp_raw_cons = cpr2->cp_raw_cons;
+                                continue;
+                        }
+                        fw_ring_id = cpr2->cp_ring_struct.fw_ring_id;
+                        bnxt_dbg_hwrm_ring_info_get(bp,
+                                DBG_RING_INFO_GET_REQ_RING_TYPE_L2_CMPL,
+                                fw_ring_id, &val[0], &val[1]);
+                        cpr->missed_irqs++;
+                }
+        }
+}
+
 static void bnxt_cfg_ntp_filters(struct bnxt *);
 
 static void bnxt_sp_task(struct work_struct *work)
@@ -8930,6 +8993,9 @@ static void bnxt_sp_task(struct work_struct *work)
         if (test_and_clear_bit(BNXT_FLOW_STATS_SP_EVENT, &bp->sp_event))
                 bnxt_tc_flow_stats_work(bp);
 
+        if (test_and_clear_bit(BNXT_RING_COAL_NOW_SP_EVENT, &bp->sp_event))
+                bnxt_chk_missed_irq(bp);
+
         /* These functions below will clear BNXT_STATE_IN_SP_TASK.  They
          * must be the last functions to be called before exiting.
          */
@@ -10087,6 +10153,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         bnxt_hwrm_func_qcfg(bp);
+        bnxt_hwrm_vnic_qcaps(bp);
         bnxt_hwrm_port_led_qcaps(bp);
         bnxt_ethtool_init(bp);
         bnxt_dcb_init(bp);
@@ -10120,7 +10187,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                                     VNIC_RSS_CFG_REQ_HASH_TYPE_UDP_IPV6;
         }
 
-        bnxt_hwrm_vnic_qcaps(bp);
         if (bnxt_rfs_supported(bp)) {
                 dev->hw_features |= NETIF_F_NTUPLE;
                 if (bnxt_rfs_capable(bp)) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 498b373c992d..9e99d4ab3e06 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -798,6 +798,8 @@ struct bnxt_cp_ring_info {
         u8                      had_work_done:1;
         u8                      has_more_work:1;
 
+        u32                     last_cp_raw_cons;
+
         struct bnxt_coal        rx_ring_coal;
         u64                     rx_packets;
         u64                     rx_bytes;
@@ -816,6 +818,7 @@ struct bnxt_cp_ring_info {
         dma_addr_t              hw_stats_map;
         u32                     hw_stats_ctx_id;
         u64                     rx_l4_csum_errors;
+        u64                     missed_irqs;
 
         struct bnxt_ring_struct cp_ring_struct;
 
@@ -1527,6 +1530,7 @@ struct bnxt {
 #define BNXT_LINK_SPEED_CHNG_SP_EVENT   14
 #define BNXT_FLOW_STATS_SP_EVENT        15
 #define BNXT_UPDATE_PHY_SP_EVENT        16
+#define BNXT_RING_COAL_NOW_SP_EVENT     17
 
         struct bnxt_hw_resc     hw_resc;
         struct bnxt_pf_info     pf;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 48078564f025..6cc69a58478a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -137,7 +137,7 @@ reset_coalesce:
         return rc;
 }
 
-#define BNXT_NUM_STATS  21
+#define BNXT_NUM_STATS  22
 
 #define BNXT_RX_STATS_ENTRY(counter)    \
         { BNXT_RX_STATS_OFFSET(counter), __stringify(counter) }
@@ -384,6 +384,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev,
                 for (k = 0; k < stat_fields; j++, k++)
                         buf[j] = le64_to_cpu(hw_stats[k]);
                 buf[j++] = cpr->rx_l4_csum_errors;
+                buf[j++] = cpr->missed_irqs;
 
                 bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter +=
                         le64_to_cpu(cpr->hw_stats->rx_discard_pkts);
@@ -468,6 +469,8 @@ static void bnxt_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
                         buf += ETH_GSTRING_LEN;
                         sprintf(buf, "[%d]: rx_l4_csum_errors", i);
                         buf += ETH_GSTRING_LEN;
+                        sprintf(buf, "[%d]: missed_irqs", i);
+                        buf += ETH_GSTRING_LEN;
                 }
                 for (i = 0; i < BNXT_NUM_SW_FUNC_STATS; i++) {
                         strcpy(buf, bnxt_sw_func_stats[i].string);
@@ -2942,8 +2945,8 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
         record->asic_state = 0;
         strlcpy(record->system_name, utsname()->nodename,
                 sizeof(record->system_name));
-        record->year = cpu_to_le16(tm.tm_year);
-        record->month = cpu_to_le16(tm.tm_mon);
+        record->year = cpu_to_le16(tm.tm_year + 1900);
+        record->month = cpu_to_le16(tm.tm_mon + 1);
         record->day = cpu_to_le16(tm.tm_mday);
         record->hour = cpu_to_le16(tm.tm_hour);
         record->minute = cpu_to_le16(tm.tm_min);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index beee61292d5e..b59b382d34f9 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -43,6 +43,9 @@ static int bnxt_register_dev(struct bnxt_en_dev *edev, int ulp_id,
         if (ulp_id == BNXT_ROCE_ULP) {
                 unsigned int max_stat_ctxs;
 
+                if (bp->flags & BNXT_FLAG_CHIP_P5)
+                        return -EOPNOTSUPP;
+
                 max_stat_ctxs = bnxt_get_max_func_stat_ctxs(bp);
                 if (max_stat_ctxs <= BNXT_MIN_ROCE_STAT_CTXS ||
                     bp->num_stat_ctxs == max_stat_ctxs)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 20c1681bb1af..2d6f090bf644 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2855,7 +2855,6 @@ static void bcmgenet_netif_start(struct net_device *dev)
 
         umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, true);
 
-        netif_tx_start_all_queues(dev);
         bcmgenet_enable_tx_napi(priv);
 
         /* Monitor link interrupts now */
@@ -2937,6 +2936,8 @@ static int bcmgenet_open(struct net_device *dev)
 
         bcmgenet_netif_start(dev);
 
+        netif_tx_start_all_queues(dev);
+
         return 0;
 
 err_irq1:
@@ -2958,7 +2959,7 @@ static void bcmgenet_netif_stop(struct net_device *dev)
         struct bcmgenet_priv *priv = netdev_priv(dev);
 
         bcmgenet_disable_tx_napi(priv);
-        netif_tx_stop_all_queues(dev);
+        netif_tx_disable(dev);
 
         /* Disable MAC receive */
         umac_enable_set(priv, CMD_RX_EN, false);
@@ -3620,13 +3621,13 @@ static int bcmgenet_suspend(struct device *d)
         if (!netif_running(dev))
                 return 0;
 
+        netif_device_detach(dev);
+
         bcmgenet_netif_stop(dev);
 
         if (!device_may_wakeup(d))
                 phy_suspend(dev->phydev);
 
-        netif_device_detach(dev);
-
         /* Prepare the device for Wake-on-LAN and switch to the slow clock */
         if (device_may_wakeup(d) && priv->wolopts) {
                 ret = bcmgenet_power_down(priv, GENET_POWER_WOL_MAGIC);
@@ -3700,8 +3701,6 @@ static int bcmgenet_resume(struct device *d)
         /* Always enable ring 16 - descriptor ring */
         bcmgenet_enable_dma(priv, dma_ctrl);
 
-        netif_device_attach(dev);
-
         if (!device_may_wakeup(d))
                 phy_resume(dev->phydev);
 
@@ -3710,6 +3709,8 @@ static int bcmgenet_resume(struct device *d)
 
         bcmgenet_netif_start(dev);
 
+        netif_device_attach(dev);
+
         return 0;
 
 out_clk_disable:
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 89295306f161..432c3b867084 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12422,6 +12422,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 {
         struct tg3 *tp = netdev_priv(dev);
         int i, irq_sync = 0, err = 0;
+        bool reset_phy = false;
 
         if ((ering->rx_pending > tp->rx_std_ring_mask) ||
             (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
@@ -12453,7 +12454,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                err = tg3_restart_hw(tp, false);
+                /* Reset PHY to avoid PHY lock up */
+                if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5720)
+                        reset_phy = true;
+
+                err = tg3_restart_hw(tp, reset_phy);
                 if (!err)
                         tg3_netif_start(tp);
         }
@@ -12487,6 +12494,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 {
         struct tg3 *tp = netdev_priv(dev);
         int err = 0;
+        bool reset_phy = false;
 
         if (tp->link_config.autoneg == AUTONEG_ENABLE)
                 tg3_warn_mgmt_link_flap(tp);
@@ -12556,7 +12564,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
                 if (netif_running(dev)) {
                         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                        err = tg3_restart_hw(tp, false);
+                        /* Reset PHY to avoid PHY lock up */
+                        if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5720)
+                                reset_phy = true;
+
+                        err = tg3_restart_hw(tp, reset_phy);
                         if (!err)
                                 tg3_netif_start(tp);
                 }
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 55af04fa03a7..6c8dcb65ff03 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1441,6 +1441,9 @@ static void nic_remove(struct pci_dev *pdev)
 {
         struct nicpf *nic = pci_get_drvdata(pdev);
 
+        if (!nic)
+                return;
+
         if (nic->flags & NIC_SRIOV_ENABLED)
                 pci_disable_sriov(pdev);
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 768f584f8392..88f8a8fa93cd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1784,6 +1784,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         bool if_up = netif_running(nic->netdev);
         struct bpf_prog *old_prog;
         bool bpf_attached = false;
+        int ret = 0;
 
         /* For now just support only the usual MTU sized frames */
         if (prog && (dev->mtu > 1500)) {
@@ -1817,8 +1818,12 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         if (nic->xdp_prog) {
                 /* Attach BPF program */
                 nic->xdp_prog = bpf_prog_add(nic->xdp_prog, nic->rx_queues - 1);
-                if (!IS_ERR(nic->xdp_prog))
+                if (!IS_ERR(nic->xdp_prog)) {
                         bpf_attached = true;
+                } else {
+                        ret = PTR_ERR(nic->xdp_prog);
+                        nic->xdp_prog = NULL;
+                }
         }
 
         /* Calculate Tx queues needed for XDP and network stack */
@@ -1830,7 +1835,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
                 netif_trans_update(nic->netdev);
         }
 
-        return 0;
+        return ret;
 }
 
 static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 187a249ff2d1..fcaf18fa3904 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -585,10 +585,12 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
         if (!sq->dmem.base)
                 return;
 
-        if (sq->tso_hdrs)
+        if (sq->tso_hdrs) {
                 dma_free_coherent(&nic->pdev->dev,
                                   sq->dmem.q_len * TSO_HEADER_SIZE,
                                   sq->tso_hdrs, sq->tso_hdrs_phys);
+                sq->tso_hdrs = NULL;
+        }
 
         /* Free pending skbs in the queue */
         smp_rmb();
diff --git a/drivers/net/ethernet/chelsio/Kconfig b/drivers/net/ethernet/chelsio/Kconfig
index 75c1c5ed2387..e2cdfa75673f 100644
--- a/drivers/net/ethernet/chelsio/Kconfig
+++ b/drivers/net/ethernet/chelsio/Kconfig
@@ -67,7 +67,6 @@ config CHELSIO_T3
 config CHELSIO_T4
         tristate "Chelsio Communications T4/T5/T6 Ethernet support"
         depends on PCI && (IPV6 || IPV6=n)
-        depends on THERMAL || !THERMAL
         select FW_LOADER
         select MDIO
         select ZLIB_DEFLATE
diff --git a/drivers/net/ethernet/chelsio/cxgb4/Makefile b/drivers/net/ethernet/chelsio/cxgb4/Makefile
index 78e5d17a1d5f..91d8a885deba 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/Makefile
+++ b/drivers/net/ethernet/chelsio/cxgb4/Makefile
@@ -12,6 +12,4 @@ cxgb4-objs := cxgb4_main.o l2t.o smt.o t4_hw.o sge.o clip_tbl.o cxgb4_ethtool.o
 cxgb4-$(CONFIG_CHELSIO_T4_DCB) +=  cxgb4_dcb.o
 cxgb4-$(CONFIG_CHELSIO_T4_FCOE) +=  cxgb4_fcoe.o
 cxgb4-$(CONFIG_DEBUG_FS) += cxgb4_debugfs.o
-ifdef CONFIG_THERMAL
-cxgb4-objs += cxgb4_thermal.o
-endif
+cxgb4-$(CONFIG_THERMAL) += cxgb4_thermal.o
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 05a46926016a..d49db46254cd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5863,7 +5863,7 @@ fw_attach_fail:
         if (!is_t4(adapter->params.chip))
                 cxgb4_ptp_init(adapter);
 
-        if (IS_ENABLED(CONFIG_THERMAL) &&
+        if (IS_REACHABLE(CONFIG_THERMAL) &&
             !is_t4(adapter->params.chip) && (adapter->flags & FW_OK))
                 cxgb4_thermal_init(adapter);
 
@@ -5932,7 +5932,7 @@ static void remove_one(struct pci_dev *pdev)
 
                 if (!is_t4(adapter->params.chip))
                         cxgb4_ptp_stop(adapter);
-                if (IS_ENABLED(CONFIG_THERMAL))
+                if (IS_REACHABLE(CONFIG_THERMAL))
                         cxgb4_thermal_remove(adapter);
 
                 /* If we allocated filters, free up state associated with any
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index ceec467f590d..949103db8a8a 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -660,7 +660,7 @@ static void gmac_clean_txq(struct net_device *netdev, struct gmac_txq *txq,
 
                         u64_stats_update_begin(&port->tx_stats_syncp);
                         port->tx_frag_stats[nfrags]++;
-                        u64_stats_update_end(&port->ir_stats_syncp);
+                        u64_stats_update_end(&port->tx_stats_syncp);
                 }
         }
 
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
index 570caeb8ee9e..084f24daf2b5 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -872,11 +872,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
         struct net_device *netdev = dev_id;
         struct ftmac100 *priv = netdev_priv(netdev);
 
-        if (likely(netif_running(netdev))) {
-                /* Disable interrupts for polling */
-                ftmac100_disable_all_int(priv);
+        /* Disable interrupts for polling */
+        ftmac100_disable_all_int(priv);
+        if (likely(netif_running(netdev)))
                 napi_schedule(&priv->napi);
-        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index be268dcde8fa..f9a4e76c5a8b 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -915,10 +915,8 @@ static int hip04_mac_probe(struct platform_device *pdev)
         }
 
         ret = register_netdev(ndev);
-        if (ret) {
-                free_netdev(ndev);
+        if (ret)
                 goto alloc_fail;
-        }
 
         return 0;
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 3f96aa30068e..20fcf0d1c2ce 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -3760,7 +3760,8 @@ static int hns3_reset_notify_init_enet(struct hnae3_handle *handle)
         /* Hardware table is only clear when pf resets */
         if (!(handle->flags & HNAE3_SUPPORT_VF)) {
                 ret = hns3_restore_vlan(netdev);
-                return ret;
+                if (ret)
+                        return ret;
         }
 
         ret = hns3_restore_fd_rules(netdev);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index aa5cb9834d73..494e562fe8c7 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -1168,14 +1168,14 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
  */
 static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
 {
-        struct hclge_vport *vport = hdev->vport;
-        u32 i, k, qs_bitmap;
-        int ret;
+        int i;
 
         for (i = 0; i < HCLGE_BP_GRP_NUM; i++) {
-                qs_bitmap = 0;
+                u32 qs_bitmap = 0;
+                int k, ret;
 
                 for (k = 0; k < hdev->num_alloc_vport; k++) {
+                        struct hclge_vport *vport = &hdev->vport[k];
                         u16 qs_id = vport->qs_offset + tc;
                         u8 grp, sub_grp;
 
@@ -1185,8 +1185,6 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
                                                   HCLGE_BP_SUB_GRP_ID_S);
                         if (i == grp)
                                 qs_bitmap |= (1 << sub_grp);
-
-                        vport++;
                 }
 
                 ret = hclge_tm_qs_bp_cfg(hdev, tc, i, qs_bitmap);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 7893beffcc71..c0203a0d5e3b 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -485,8 +485,8 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
                 for (j = 0; j < rx_pool->size; j++) {
                         if (rx_pool->rx_buff[j].skb) {
-                                dev_kfree_skb_any(rx_pool->rx_buff[i].skb);
-                                rx_pool->rx_buff[i].skb = NULL;
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
                         }
                 }
 
@@ -1103,20 +1103,15 @@ static int ibmvnic_open(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
-
         if (adapter->state != VNIC_CLOSED) {
                 rc = ibmvnic_login(netdev);
-                if (rc) {
-                        mutex_unlock(&adapter->reset_lock);
+                if (rc)
                         return rc;
-                }
 
                 rc = init_resources(adapter);
                 if (rc) {
                         netdev_err(netdev, "failed to initialize resources\n");
                         release_resources(adapter);
-                        mutex_unlock(&adapter->reset_lock);
                         return rc;
                 }
         }
@@ -1124,8 +1119,6 @@ static int ibmvnic_open(struct net_device *netdev)
         rc = __ibmvnic_open(netdev);
         netif_carrier_on(netdev);
 
-        mutex_unlock(&adapter->reset_lock);
-
         return rc;
 }
 
@@ -1269,10 +1262,8 @@ static int ibmvnic_close(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
         rc = __ibmvnic_close(netdev);
         ibmvnic_cleanup(netdev);
-        mutex_unlock(&adapter->reset_lock);
 
         return rc;
 }
@@ -1545,7 +1536,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         tx_crq.v1.sge_len = cpu_to_be32(skb->len);
         tx_crq.v1.ioba = cpu_to_be64(data_dma_addr);
 
-        if (adapter->vlan_header_insertion) {
+        if (adapter->vlan_header_insertion && skb_vlan_tag_present(skb)) {
                 tx_crq.v1.flags2 |= IBMVNIC_TX_VLAN_INSERT;
                 tx_crq.v1.vlan_id = cpu_to_be16(skb->vlan_tci);
         }
@@ -1746,6 +1737,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                     struct ibmvnic_rwi *rwi, u32 reset_state)
 {
         u64 old_num_rx_queues, old_num_tx_queues;
+        u64 old_num_rx_slots, old_num_tx_slots;
         struct net_device *netdev = adapter->netdev;
         int i, rc;
 
@@ -1757,6 +1749,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
+        old_num_rx_slots = adapter->req_rx_add_entries_per_subcrq;
+        old_num_tx_slots = adapter->req_tx_entries_per_subcrq;
 
         ibmvnic_cleanup(netdev);
 
@@ -1819,21 +1813,20 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         if (rc)
                                 return rc;
                 } else if (adapter->req_rx_queues != old_num_rx_queues ||
-                           adapter->req_tx_queues != old_num_tx_queues) {
-                        adapter->map_id = 1;
+                           adapter->req_tx_queues != old_num_tx_queues ||
+                           adapter->req_rx_add_entries_per_subcrq !=
+                                                        old_num_rx_slots ||
+                           adapter->req_tx_entries_per_subcrq !=
+                                                        old_num_tx_slots) {
                         release_rx_pools(adapter);
                         release_tx_pools(adapter);
-                        rc = init_rx_pools(netdev);
-                        if (rc)
-                                return rc;
-                        rc = init_tx_pools(netdev);
-                        if (rc)
-                                return rc;
-
                         release_napi(adapter);
-                        rc = init_napi(adapter);
+                        release_vpd_data(adapter);
+
+                        rc = init_resources(adapter);
                         if (rc)
                                 return rc;
+
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -1917,17 +1910,8 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
                 adapter->state = VNIC_PROBED;
                 return 0;
         }
-        /* netif_set_real_num_xx_queues needs to take rtnl lock here
-         * unless wait_for_reset is set, in which case the rtnl lock
-         * has already been taken before initializing the reset
-         */
-        if (!adapter->wait_for_reset) {
-                rtnl_lock();
-                rc = init_resources(adapter);
-                rtnl_unlock();
-        } else {
-                rc = init_resources(adapter);
-        }
+
+        rc = init_resources(adapter);
         if (rc)
                 return rc;
 
@@ -1986,13 +1970,21 @@ static void __ibmvnic_reset(struct work_struct *work)
         struct ibmvnic_rwi *rwi;
         struct ibmvnic_adapter *adapter;
         struct net_device *netdev;
+        bool we_lock_rtnl = false;
         u32 reset_state;
         int rc = 0;
 
         adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset);
         netdev = adapter->netdev;
 
-        mutex_lock(&adapter->reset_lock);
+        /* netif_set_real_num_xx_queues needs to take rtnl lock here
+         * unless wait_for_reset is set, in which case the rtnl lock
+         * has already been taken before initializing the reset
+         */
+        if (!adapter->wait_for_reset) {
+                rtnl_lock();
+                we_lock_rtnl = true;
+        }
         reset_state = adapter->state;
 
         rwi = get_next_rwi(adapter);
@@ -2020,12 +2012,11 @@ static void __ibmvnic_reset(struct work_struct *work)
         if (rc) {
                 netdev_dbg(adapter->netdev, "Reset failed\n");
                 free_all_rwi(adapter);
-                mutex_unlock(&adapter->reset_lock);
-                return;
         }
 
         adapter->resetting = false;
-        mutex_unlock(&adapter->reset_lock);
+        if (we_lock_rtnl)
+                rtnl_unlock();
 }
 
 static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
@@ -4768,7 +4759,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
-        mutex_init(&adapter->reset_lock);
         mutex_init(&adapter->rwi_lock);
         adapter->resetting = false;
 
@@ -4840,8 +4830,8 @@ static int ibmvnic_remove(struct vio_dev *dev)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
 
         adapter->state = VNIC_REMOVING;
-        unregister_netdev(netdev);
-        mutex_lock(&adapter->reset_lock);
+        rtnl_lock();
+        unregister_netdevice(netdev);
 
         release_resources(adapter);
         release_sub_crqs(adapter, 1);
@@ -4852,7 +4842,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
 
         adapter->state = VNIC_REMOVED;
 
-        mutex_unlock(&adapter->reset_lock);
+        rtnl_unlock();
         device_remove_file(&dev->dev, &dev_attr_failover);
         free_netdev(netdev);
         dev_set_drvdata(&dev->dev, NULL);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 18103b811d4d..99c4f8d331ce 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1075,7 +1075,7 @@ struct ibmvnic_adapter {
         struct tasklet_struct tasklet;
         enum vnic_state state;
         enum ibmvnic_reset_reason reset_reason;
-        struct mutex reset_lock, rwi_lock;
+        struct mutex rwi_lock;
         struct list_head rwi_list;
         struct work_struct ibmvnic_reset;
         bool resetting;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index bc71a21c1dc2..a3f45335437c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1413,7 +1413,7 @@ void __i40e_del_filter(struct i40e_vsi *vsi, struct i40e_mac_filter *f)
         }
 
         vsi->flags |= I40E_VSI_FLAG_FILTER_CHANGED;
-        set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->state);
+        set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->back->state);
 }
 
 /**
@@ -12249,6 +12249,8 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
                           NETIF_F_GSO_GRE               |
                           NETIF_F_GSO_GRE_CSUM          |
                           NETIF_F_GSO_PARTIAL           |
+                          NETIF_F_GSO_IPXIP4            |
+                          NETIF_F_GSO_IPXIP6            |
                           NETIF_F_GSO_UDP_TUNNEL        |
                           NETIF_F_GSO_UDP_TUNNEL_CSUM   |
                           NETIF_F_SCTP_CRC              |
@@ -12266,13 +12268,13 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
         /* record features VLANs can make use of */
         netdev->vlan_features |= hw_enc_features | NETIF_F_TSO_MANGLEID;
 
-        if (!(pf->flags & I40E_FLAG_MFP_ENABLED))
-                netdev->hw_features |= NETIF_F_NTUPLE | NETIF_F_HW_TC;
-
         hw_features = hw_enc_features           |
                       NETIF_F_HW_VLAN_CTAG_TX   |
                       NETIF_F_HW_VLAN_CTAG_RX;
 
+        if (!(pf->flags & I40E_FLAG_MFP_ENABLED))
+                hw_features |= NETIF_F_NTUPLE | NETIF_F_HW_TC;
+
         netdev->hw_features |= hw_features;
 
         netdev->features |= hw_features | NETIF_F_HW_VLAN_CTAG_FILTER;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index add1e457886d..433c8e688c78 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -33,7 +33,7 @@ static int i40e_alloc_xsk_umems(struct i40e_vsi *vsi)
 }
 
 /**
- * i40e_add_xsk_umem - Store an UMEM for a certain ring/qid
+ * i40e_add_xsk_umem - Store a UMEM for a certain ring/qid
  * @vsi: Current VSI
  * @umem: UMEM to store
  * @qid: Ring/qid to associate with the UMEM
@@ -56,7 +56,7 @@ static int i40e_add_xsk_umem(struct i40e_vsi *vsi, struct xdp_umem *umem,
 }
 
 /**
- * i40e_remove_xsk_umem - Remove an UMEM for a certain ring/qid
+ * i40e_remove_xsk_umem - Remove a UMEM for a certain ring/qid
  * @vsi: Current VSI
  * @qid: Ring/qid associated with the UMEM
  **/
@@ -130,7 +130,7 @@ static void i40e_xsk_umem_dma_unmap(struct i40e_vsi *vsi, struct xdp_umem *umem)
 }
 
 /**
- * i40e_xsk_umem_enable - Enable/associate an UMEM to a certain ring/qid
+ * i40e_xsk_umem_enable - Enable/associate a UMEM to a certain ring/qid
  * @vsi: Current VSI
  * @umem: UMEM
  * @qid: Rx ring to associate UMEM to
@@ -189,7 +189,7 @@ static int i40e_xsk_umem_enable(struct i40e_vsi *vsi, struct xdp_umem *umem,
 }
 
 /**
- * i40e_xsk_umem_disable - Diassociate an UMEM from a certain ring/qid
+ * i40e_xsk_umem_disable - Disassociate a UMEM from a certain ring/qid
  * @vsi: Current VSI
  * @qid: Rx ring to associate UMEM to
  *
@@ -255,12 +255,12 @@ int i40e_xsk_umem_query(struct i40e_vsi *vsi, struct xdp_umem **umem,
 }
 
 /**
- * i40e_xsk_umem_query - Queries a certain ring/qid for its UMEM
+ * i40e_xsk_umem_setup - Enable/disassociate a UMEM to/from a ring/qid
  * @vsi: Current VSI
  * @umem: UMEM to enable/associate to a ring, or NULL to disable
  * @qid: Rx ring to (dis)associate UMEM (from)to
  *
- * This function enables or disables an UMEM to a certain ring.
+ * This function enables or disables a UMEM to a certain ring.
  *
  * Returns 0 on success, <0 on failure
  **/
@@ -276,7 +276,7 @@ int i40e_xsk_umem_setup(struct i40e_vsi *vsi, struct xdp_umem *umem,
  * @rx_ring: Rx ring
  * @xdp: xdp_buff used as input to the XDP program
  *
- * This function enables or disables an UMEM to a certain ring.
+ * This function enables or disables a UMEM to a certain ring.
  *
  * Returns any of I40E_XDP_{PASS, CONSUMED, TX, REDIR}
  **/
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 4c4b5717a627..b8548370f1c7 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -76,6 +76,8 @@ extern const char ice_drv_ver[];
 #define ICE_MIN_INTR_PER_VF             (ICE_MIN_QS_PER_VF + 1)
 #define ICE_DFLT_INTR_PER_VF            (ICE_DFLT_QS_PER_VF + 1)
 
+#define ICE_MAX_RESET_WAIT              20
+
 #define ICE_VSIQF_HKEY_ARRAY_SIZE       ((VSIQF_HKEY_MAX_INDEX + 1) *   4)
 
 #define ICE_DFLT_NETIF_M (NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_LINK)
@@ -189,7 +191,6 @@ struct ice_vsi {
         u64 tx_linearize;
         DECLARE_BITMAP(state, __ICE_STATE_NBITS);
         DECLARE_BITMAP(flags, ICE_VSI_FLAG_NBITS);
-        unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
         unsigned int current_netdev_flags;
         u32 tx_restart;
         u32 tx_busy;
@@ -369,5 +370,6 @@ int ice_set_rss(struct ice_vsi *vsi, u8 *seed, u8 *lut, u16 lut_size);
 int ice_get_rss(struct ice_vsi *vsi, u8 *seed, u8 *lut, u16 lut_size);
 void ice_fill_rss_lut(u8 *lut, u16 rss_table_size, u16 rss_size);
 void ice_print_link_msg(struct ice_vsi *vsi, bool isup);
+void ice_napi_del(struct ice_vsi *vsi);
 
 #endif /* _ICE_H_ */
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 8cd6a2401fd9..554fd707a6d6 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -811,6 +811,9 @@ void ice_deinit_hw(struct ice_hw *hw)
         /* Attempt to disable FW logging before shutting down control queues */
         ice_cfg_fw_log(hw, false);
         ice_shutdown_all_ctrlq(hw);
+
+        /* Clear VSI contexts if not already cleared */
+        ice_clear_all_vsi_ctx(hw);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 96923580f2a6..648acdb4c644 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -1517,10 +1517,15 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
         }
 
         if (!test_bit(__ICE_DOWN, pf->state)) {
-                /* Give it a little more time to try to come back */
+                /* Give it a little more time to try to come back. If still
+                 * down, restart autoneg link or reinitialize the interface.
+                 */
                 msleep(75);
                 if (!test_bit(__ICE_DOWN, pf->state))
                         return ice_nway_reset(netdev);
+
+                ice_down(vsi);
+                ice_up(vsi);
         }
 
         return err;
diff --git a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
index 5fdea6ec7675..596b9fb1c510 100644
--- a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
+++ b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
@@ -242,6 +242,8 @@
 #define GLNVM_ULD                               0x000B6008
 #define GLNVM_ULD_CORER_DONE_M                  BIT(3)
 #define GLNVM_ULD_GLOBR_DONE_M                  BIT(4)
+#define GLPCI_CNF2                              0x000BE004
+#define GLPCI_CNF2_CACHELINE_SIZE_M             BIT(1)
 #define PF_FUNC_RID                             0x0009E880
 #define PF_FUNC_RID_FUNC_NUM_S                  0
 #define PF_FUNC_RID_FUNC_NUM_M                  ICE_M(0x7, 0)
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 5bacad01f0c9..1041fa2a7767 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -1997,7 +1997,7 @@ int ice_cfg_vlan_pruning(struct ice_vsi *vsi, bool ena)
         status = ice_update_vsi(&vsi->back->hw, vsi->idx, ctxt, NULL);
         if (status) {
                 netdev_err(vsi->netdev, "%sabling VLAN pruning on VSI handle: %d, VSI HW ID: %d failed, err = %d, aq_err = %d\n",
-                           ena ? "Ena" : "Dis", vsi->idx, vsi->vsi_num, status,
+                           ena ? "En" : "Dis", vsi->idx, vsi->vsi_num, status,
                            vsi->back->hw.adminq.sq_last_status);
                 goto err_out;
         }
@@ -2458,6 +2458,7 @@ int ice_vsi_release(struct ice_vsi *vsi)
          * on this wq
          */
         if (vsi->netdev && !ice_is_reset_in_progress(pf->state)) {
+                ice_napi_del(vsi);
                 unregister_netdev(vsi->netdev);
                 free_netdev(vsi->netdev);
                 vsi->netdev = NULL;
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 05993451147a..333312a1d595 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -1465,7 +1465,7 @@ skip_req_irq:
  * ice_napi_del - Remove NAPI handler for the VSI
  * @vsi: VSI for which NAPI handler is to be removed
  */
-static void ice_napi_del(struct ice_vsi *vsi)
+void ice_napi_del(struct ice_vsi *vsi)
 {
         int v_idx;
 
@@ -1622,7 +1622,6 @@ static int ice_vlan_rx_add_vid(struct net_device *netdev,
 {
         struct ice_netdev_priv *np = netdev_priv(netdev);
         struct ice_vsi *vsi = np->vsi;
-        int ret;
 
         if (vid >= VLAN_N_VID) {
                 netdev_err(netdev, "VLAN id requested %d is out of range %d\n",
@@ -1635,7 +1634,8 @@ static int ice_vlan_rx_add_vid(struct net_device *netdev,
 
         /* Enable VLAN pruning when VLAN 0 is added */
         if (unlikely(!vid)) {
-                ret = ice_cfg_vlan_pruning(vsi, true);
+                int ret = ice_cfg_vlan_pruning(vsi, true);
+
                 if (ret)
                         return ret;
         }
@@ -1644,12 +1644,7 @@ static int ice_vlan_rx_add_vid(struct net_device *netdev,
          * needed to continue allowing all untagged packets since VLAN prune
          * list is applied to all packets by the switch
          */
-        ret = ice_vsi_add_vlan(vsi, vid);
-
-        if (!ret)
-                set_bit(vid, vsi->active_vlans);
-
-        return ret;
+        return ice_vsi_add_vlan(vsi, vid);
 }
 
 /**
@@ -1677,8 +1672,6 @@ static int ice_vlan_rx_kill_vid(struct net_device *netdev,
         if (status)
                 return status;
 
-        clear_bit(vid, vsi->active_vlans);
-
         /* Disable VLAN pruning when VLAN 0 is removed */
         if (unlikely(!vid))
                 status = ice_cfg_vlan_pruning(vsi, false);
@@ -2002,6 +1995,22 @@ static int ice_init_interrupt_scheme(struct ice_pf *pf)
 }
 
 /**
+ * ice_verify_cacheline_size - verify driver's assumption of 64 Byte cache lines
+ * @pf: pointer to the PF structure
+ *
+ * There is no error returned here because the driver should be able to handle
+ * 128 Byte cache lines, so we only print a warning in case issues are seen,
+ * specifically with Tx.
+ */
+static void ice_verify_cacheline_size(struct ice_pf *pf)
+{
+        if (rd32(&pf->hw, GLPCI_CNF2) & GLPCI_CNF2_CACHELINE_SIZE_M)
+                dev_warn(&pf->pdev->dev,
+                         "%d Byte cache line assumption is invalid, driver may have Tx timeouts!\n",
+                         ICE_CACHE_LINE_BYTES);
+}
+
+/**
  * ice_probe - Device initialization routine
  * @pdev: PCI device information struct
  * @ent: entry in ice_pci_tbl
@@ -2151,6 +2160,8 @@ static int ice_probe(struct pci_dev *pdev,
         /* since everything is good, start the service timer */
         mod_timer(&pf->serv_tmr, round_jiffies(jiffies + pf->serv_tmr_period));
 
+        ice_verify_cacheline_size(pf);
+
         return 0;
 
 err_alloc_sw_unroll:
@@ -2182,6 +2193,12 @@ static void ice_remove(struct pci_dev *pdev)
         if (!pf)
                 return;
 
+        for (i = 0; i < ICE_MAX_RESET_WAIT; i++) {
+                if (!ice_is_reset_in_progress(pf->state))
+                        break;
+                msleep(100);
+        }
+
         set_bit(__ICE_DOWN, pf->state);
         ice_service_task_stop(pf);
 
@@ -2510,31 +2527,6 @@ static int ice_vsi_vlan_setup(struct ice_vsi *vsi)
 }
 
 /**
- * ice_restore_vlan - Reinstate VLANs when vsi/netdev comes back up
- * @vsi: the VSI being brought back up
- */
-static int ice_restore_vlan(struct ice_vsi *vsi)
-{
-        int err;
-        u16 vid;
-
-        if (!vsi->netdev)
-                return -EINVAL;
-
-        err = ice_vsi_vlan_setup(vsi);
-        if (err)
-                return err;
-
-        for_each_set_bit(vid, vsi->active_vlans, VLAN_N_VID) {
-                err = ice_vlan_rx_add_vid(vsi->netdev, htons(ETH_P_8021Q), vid);
-                if (err)
-                        break;
-        }
-
-        return err;
-}
-
-/**
  * ice_vsi_cfg - Setup the VSI
  * @vsi: the VSI being configured
  *
@@ -2546,7 +2538,9 @@ static int ice_vsi_cfg(struct ice_vsi *vsi)
 
         if (vsi->netdev) {
                 ice_set_rx_mode(vsi->netdev);
-                err = ice_restore_vlan(vsi);
+
+                err = ice_vsi_vlan_setup(vsi);
+
                 if (err)
                         return err;
         }
@@ -3296,7 +3290,7 @@ static void ice_rebuild(struct ice_pf *pf)
         struct device *dev = &pf->pdev->dev;
         struct ice_hw *hw = &pf->hw;
         enum ice_status ret;
-        int err;
+        int err, i;
 
         if (test_bit(__ICE_DOWN, pf->state))
                 goto clear_recovery;
@@ -3370,6 +3364,22 @@ static void ice_rebuild(struct ice_pf *pf)
         }
 
         ice_reset_all_vfs(pf, true);
+
+        for (i = 0; i < pf->num_alloc_vsi; i++) {
+                bool link_up;
+
+                if (!pf->vsi[i] || pf->vsi[i]->type != ICE_VSI_PF)
+                        continue;
+                ice_get_link_status(pf->vsi[i]->port_info, &link_up);
+                if (link_up) {
+                        netif_carrier_on(pf->vsi[i]->netdev);
+                        netif_tx_wake_all_queues(pf->vsi[i]->netdev);
+                } else {
+                        netif_carrier_off(pf->vsi[i]->netdev);
+                        netif_tx_stop_all_queues(pf->vsi[i]->netdev);
+                }
+        }
+
         /* if we get here, reset flow is successful */
         clear_bit(__ICE_RESET_FAILED, pf->state);
         return;
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
index 33403f39f1b3..40c9c6558956 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.c
+++ b/drivers/net/ethernet/intel/ice/ice_switch.c
@@ -348,6 +348,18 @@ static void ice_clear_vsi_ctx(struct ice_hw *hw, u16 vsi_handle)
 }
 
 /**
+ * ice_clear_all_vsi_ctx - clear all the VSI context entries
+ * @hw: pointer to the hw struct
+ */
+void ice_clear_all_vsi_ctx(struct ice_hw *hw)
+{
+        u16 i;
+
+        for (i = 0; i < ICE_MAX_VSI; i++)
+                ice_clear_vsi_ctx(hw, i);
+}
+
+/**
  * ice_add_vsi - add VSI context to the hardware and VSI handle list
  * @hw: pointer to the hw struct
  * @vsi_handle: unique VSI handle provided by drivers
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.h b/drivers/net/ethernet/intel/ice/ice_switch.h
index b88d96a1ef69..d5ef0bd58bf9 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.h
+++ b/drivers/net/ethernet/intel/ice/ice_switch.h
@@ -190,6 +190,8 @@ ice_update_vsi(struct ice_hw *hw, u16 vsi_handle, struct ice_vsi_ctx *vsi_ctx,
                struct ice_sq_cd *cd);
 bool ice_is_vsi_valid(struct ice_hw *hw, u16 vsi_handle);
 struct ice_vsi_ctx *ice_get_vsi_ctx(struct ice_hw *hw, u16 vsi_handle);
+void ice_clear_all_vsi_ctx(struct ice_hw *hw);
+/* Switch config */
 enum ice_status ice_get_initial_sw_cfg(struct ice_hw *hw);
 
 /* Switch/bridge related commands */
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index 5dae968d853e..fe5bbabbb41e 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -1520,7 +1520,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
 
         /* update gso_segs and bytecount */
         first->gso_segs = skb_shinfo(skb)->gso_segs;
-        first->bytecount = (first->gso_segs - 1) * off->header_len;
+        first->bytecount += (first->gso_segs - 1) * off->header_len;
 
         cd_tso_len = skb->len - off->header_len;
         cd_mss = skb_shinfo(skb)->gso_size;
@@ -1556,15 +1556,15 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
  * magnitude greater than our largest possible GSO size.
  *
  * This would then be implemented as:
- *     return (((size >> 12) * 85) >> 8) + 1;
+ *     return (((size >> 12) * 85) >> 8) + ICE_DESCS_FOR_SKB_DATA_PTR;
  *
  * Since multiplication and division are commutative, we can reorder
  * operations into:
- *     return ((size * 85) >> 20) + 1;
+ *     return ((size * 85) >> 20) + ICE_DESCS_FOR_SKB_DATA_PTR;
  */
 static unsigned int ice_txd_use_count(unsigned int size)
 {
-        return ((size * 85) >> 20) + 1;
+        return ((size * 85) >> 20) + ICE_DESCS_FOR_SKB_DATA_PTR;
 }
 
 /**
@@ -1706,7 +1706,8 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring)
          *       + 1 desc for context descriptor,
          * otherwise try next time
          */
-        if (ice_maybe_stop_tx(tx_ring, count + 4 + 1)) {
+        if (ice_maybe_stop_tx(tx_ring, count + ICE_DESCS_PER_CACHE_LINE +
+                              ICE_DESCS_FOR_CTX_DESC)) {
                 tx_ring->tx_stats.tx_busy++;
                 return NETDEV_TX_BUSY;
         }
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
index 1d0f58bd389b..75d0eaf6c9dd 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
@@ -22,8 +22,21 @@
 #define ICE_RX_BUF_WRITE        16      /* Must be power of 2 */
 #define ICE_MAX_TXQ_PER_TXQG    128
 
-/* Tx Descriptors needed, worst case */
-#define DESC_NEEDED (MAX_SKB_FRAGS + 4)
+/* We are assuming that the cache line is always 64 Bytes here for ice.
+ * In order to make sure that is a correct assumption there is a check in probe
+ * to print a warning if the read from GLPCI_CNF2 tells us that the cache line
+ * size is 128 bytes. We do it this way because we do not want to read the
+ * GLPCI_CNF2 register or a variable containing the value on every pass through
+ * the Tx path.
+ */
+#define ICE_CACHE_LINE_BYTES            64
+#define ICE_DESCS_PER_CACHE_LINE        (ICE_CACHE_LINE_BYTES / \
+                                         sizeof(struct ice_tx_desc))
+#define ICE_DESCS_FOR_CTX_DESC          1
+#define ICE_DESCS_FOR_SKB_DATA_PTR      1
+/* Tx descriptors needed, worst case */
+#define DESC_NEEDED (MAX_SKB_FRAGS + ICE_DESCS_FOR_CTX_DESC + \
+                     ICE_DESCS_PER_CACHE_LINE + ICE_DESCS_FOR_SKB_DATA_PTR)
 #define ICE_DESC_UNUSED(R)      \
         ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
         (R)->next_to_clean - (R)->next_to_use - 1)
diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
index 12f9432abf11..f4dbc81c1988 100644
--- a/drivers/net/ethernet/intel/ice/ice_type.h
+++ b/drivers/net/ethernet/intel/ice/ice_type.h
@@ -92,12 +92,12 @@ struct ice_link_status {
         u64 phy_type_low;
         u16 max_frame_size;
         u16 link_speed;
+        u16 req_speeds;
         u8 lse_ena;     /* Link Status Event notification */
         u8 link_info;
         u8 an_info;
         u8 ext_info;
         u8 pacing;
-        u8 req_speeds;
         /* Refer to #define from module_type[ICE_MODULE_TYPE_TOTAL_BYTE] of
          * ice_aqc_get_phy_caps structure
          */
diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
index 45f10f8f01dc..e71065f9d391 100644
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
@@ -348,7 +348,7 @@ static int ice_vsi_set_pvid(struct ice_vsi *vsi, u16 vid)
         struct ice_vsi_ctx ctxt = { 0 };
         enum ice_status status;
 
-        ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_TAGGED |
+        ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_UNTAGGED |
                                ICE_AQ_VSI_PVLAN_INSERT_PVID |
                                ICE_AQ_VSI_VLAN_EMOD_STR;
         ctxt.info.pvid = cpu_to_le16(vid);
@@ -2171,7 +2171,6 @@ static int ice_vc_process_vlan_msg(struct ice_vf *vf, u8 *msg, bool add_v)
 
                         if (!ice_vsi_add_vlan(vsi, vid)) {
                                 vf->num_vlan++;
-                                set_bit(vid, vsi->active_vlans);
 
                                 /* Enable VLAN pruning when VLAN 0 is added */
                                 if (unlikely(!vid))
@@ -2190,7 +2189,6 @@ static int ice_vc_process_vlan_msg(struct ice_vf *vf, u8 *msg, bool add_v)
                          */
                         if (!ice_vsi_kill_vlan(vsi, vid)) {
                                 vf->num_vlan--;
-                                clear_bit(vid, vsi->active_vlans);
 
                                 /* Disable VLAN pruning when removing VLAN 0 */
                                 if (unlikely(!vid))
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index c54ebedca6da..c393cb2c0f16 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -842,6 +842,7 @@ s32 igb_pll_workaround_i210(struct e1000_hw *hw)
                 nvm_word = E1000_INVM_DEFAULT_AL;
         tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL;
         igb_write_phy_reg_82580(hw, I347AT4_PAGE_SELECT, E1000_PHY_PLL_FREQ_PAGE);
+        phy_word = E1000_PHY_PLL_UNCONF;
         for (i = 0; i < E1000_MAX_PLL_TRIES; i++) {
                 /* check current state directly from internal PHY */
                 igb_read_phy_reg_82580(hw, E1000_PHY_PLL_FREQ_REG, &phy_word);
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 29ced6b74d36..2b95dc9c7a6a 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -53,13 +53,15 @@
  *   2^40 * 10^-9 /  60  = 18.3 minutes.
  *
  * SYSTIM is converted to real time using a timecounter. As
- * timecounter_cyc2time() allows old timestamps, the timecounter
- * needs to be updated at least once per half of the SYSTIM interval.
- * Scheduling of delayed work is not very accurate, so we aim for 8
- * minutes to be sure the actual interval is shorter than 9.16 minutes.
+ * timecounter_cyc2time() allows old timestamps, the timecounter needs
+ * to be updated at least once per half of the SYSTIM interval.
+ * Scheduling of delayed work is not very accurate, and also the NIC
+ * clock can be adjusted to run up to 6% faster and the system clock
+ * up to 10% slower, so we aim for 6 minutes to be sure the actual
+ * interval in the NIC time is shorter than 9.16 minutes.
  */
 
-#define IGB_SYSTIM_OVERFLOW_PERIOD      (HZ * 60 * 8)
+#define IGB_SYSTIM_OVERFLOW_PERIOD      (HZ * 60 * 6)
 #define IGB_PTP_TX_TIMEOUT              (HZ * 15)
 #define INCPERIOD_82576                 BIT(E1000_TIMINCA_16NS_SHIFT)
 #define INCVALUE_82576_MASK             GENMASK(E1000_TIMINCA_16NS_SHIFT - 1, 0)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
index 10dbaf4f6e80..9c42f741ed5e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
@@ -2262,7 +2262,9 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw,
                 *autoneg = false;
 
                 if (hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core0 ||
-                    hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1) {
+                    hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1 ||
+                    hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core0 ||
+                    hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core1) {
                         *speed = IXGBE_LINK_SPEED_1GB_FULL;
                         return 0;
                 }
diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c
index 8c5ba4b81fb7..2d4d10a017e5 100644
--- a/drivers/net/ethernet/lantiq_xrx200.c
+++ b/drivers/net/ethernet/lantiq_xrx200.c
@@ -512,7 +512,8 @@ static int xrx200_probe(struct platform_device *pdev)
         err = register_netdev(net_dev);
         if (err)
                 goto err_unprepare_clk;
-        return err;
+
+        return 0;
 
 err_unprepare_clk:
         clk_disable_unprepare(priv->clk);
@@ -520,7 +521,7 @@ err_unprepare_clk:
 err_uninit_dma:
         xrx200_hw_cleanup(priv);
 
-        return 0;
+        return err;
 }
 
 static int xrx200_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 5bfd349bf41a..e5397c8197b9 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -494,7 +494,7 @@ struct mvneta_port {
 #if defined(__LITTLE_ENDIAN)
 struct mvneta_tx_desc {
         u32  command;           /* Options used by HW for packet transmitting.*/
-        u16  reserverd1;        /* csum_l4 (for future use)             */
+        u16  reserved1;         /* csum_l4 (for future use)             */
         u16  data_size;         /* Data size of transmitted packet in bytes */
         u32  buf_phys_addr;     /* Physical addr of transmitted buffer  */
         u32  reserved2;         /* hw_cmd - (for future use, PMT)       */
@@ -519,7 +519,7 @@ struct mvneta_rx_desc {
 #else
 struct mvneta_tx_desc {
         u16  data_size;         /* Data size of transmitted packet in bytes */
-        u16  reserverd1;        /* csum_l4 (for future use)             */
+        u16  reserved1;         /* csum_l4 (for future use)             */
         u32  command;           /* Options used by HW for packet transmitting.*/
         u32  reserved2;         /* hw_cmd - (for future use, PMT)       */
         u32  buf_phys_addr;     /* Physical addr of transmitted buffer  */
@@ -3343,7 +3343,6 @@ static void mvneta_validate(struct net_device *ndev, unsigned long *supported,
         if (state->interface != PHY_INTERFACE_MODE_NA &&
             state->interface != PHY_INTERFACE_MODE_QSGMII &&
             state->interface != PHY_INTERFACE_MODE_SGMII &&
-            state->interface != PHY_INTERFACE_MODE_2500BASEX &&
             !phy_interface_mode_is_8023z(state->interface) &&
             !phy_interface_mode_is_rgmii(state->interface)) {
                 bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -3357,14 +3356,9 @@ static void mvneta_validate(struct net_device *ndev, unsigned long *supported,
         /* Asymmetric pause is unsupported */
         phylink_set(mask, Pause);
 
-        /* We cannot use 1Gbps when using the 2.5G interface. */
-        if (state->interface == PHY_INTERFACE_MODE_2500BASEX) {
-                phylink_set(mask, 2500baseT_Full);
-                phylink_set(mask, 2500baseX_Full);
-        } else {
-                phylink_set(mask, 1000baseT_Full);
-                phylink_set(mask, 1000baseX_Full);
-        }
+        /* Half-duplex at speeds higher than 100Mbit is unsupported */
+        phylink_set(mask, 1000baseT_Full);
+        phylink_set(mask, 1000baseX_Full);
 
         if (!phy_interface_mode_is_8023z(state->interface)) {
                 /* 10M and 100M are only supported in non-802.3z mode */
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index deef5a998985..9af34e03892c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -337,7 +337,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
 static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count,
                                   int align, u32 skip_mask, u32 *puid)
 {
-        u32 uid;
+        u32 uid = 0;
         u32 res;
         struct mlx4_zone_allocator *zone_alloc = zone->allocator;
         struct mlx4_zone_entry *curr_node;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 1857ee0f0871..6f5153afcab4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -1006,7 +1006,6 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                 ring->packets++;
         }
         ring->bytes += tx_info->nr_bytes;
-        netdev_tx_sent_queue(ring->tx_queue, tx_info->nr_bytes);
         AVG_PERF_COUNTER(priv->pstats.tx_pktsz_avg, skb->len);
 
         if (tx_info->inl)
@@ -1044,7 +1043,10 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                 netif_tx_stop_queue(ring->tx_queue);
                 ring->queue_stopped++;
         }
-        send_doorbell = !skb->xmit_more || netif_xmit_stopped(ring->tx_queue);
+
+        send_doorbell = __netdev_tx_sent_queue(ring->tx_queue,
+                                               tx_info->nr_bytes,
+                                               skb->xmit_more);
 
         real_size = (real_size / 16) & 0x3f;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index ebcd2778eeb3..23f1b5b512c2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -540,8 +540,8 @@ struct slave_list {
 struct resource_allocator {
         spinlock_t alloc_lock; /* protect quotas */
         union {
-                int res_reserved;
-                int res_port_rsvd[MLX4_MAX_PORTS];
+                unsigned int res_reserved;
+                unsigned int res_port_rsvd[MLX4_MAX_PORTS];
         };
         union {
                 int res_free;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 2e84f10f59ba..1a11bc0e1612 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -363,6 +363,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
                         container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
                                      buf);
 
+                (*mpt_entry)->lkey = 0;
                 err = mlx4_SW2HW_MPT(dev, mailbox, key);
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index d7fbd5b6ac95..118324802926 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -569,6 +569,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        unsigned int           hw_mtu;
 
         struct net_dim         dim; /* Dynamic Interrupt Moderation */
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 023dc4bccd28..4a37713023be 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -88,10 +88,8 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
 
         eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
         *speed = mlx5e_port_ptys2speed(eth_proto_oper);
-        if (!(*speed)) {
-                mlx5_core_warn(mdev, "cannot get port speed\n");
+        if (!(*speed))
                 err = -EINVAL;
-        }
 
         return err;
 }
@@ -258,7 +256,7 @@ static int mlx5e_fec_admin_field(u32 *pplm,
         case 40000:
                 if (!write)
                         *fec_policy = MLX5_GET(pplm_reg, pplm,
-                                               fec_override_cap_10g_40g);
+                                               fec_override_admin_10g_40g);
                 else
                         MLX5_SET(pplm_reg, pplm,
                                  fec_override_admin_10g_40g, *fec_policy);
@@ -310,7 +308,7 @@ static int mlx5e_get_fec_cap_field(u32 *pplm,
         case 10000:
         case 40000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
-                                    fec_override_admin_10g_40g);
+                                    fec_override_cap_10g_40g);
                 break;
         case 25000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
@@ -394,12 +392,12 @@ int mlx5e_get_fec_mode(struct mlx5_core_dev *dev, u32 *fec_mode_active,
 
 int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
 {
+        u8 fec_policy_nofec = BIT(MLX5E_FEC_NOFEC);
         bool fec_mode_not_supp_in_speed = false;
-        u8 no_fec_policy = BIT(MLX5E_FEC_NOFEC);
         u32 out[MLX5_ST_SZ_DW(pplm_reg)] = {};
         u32 in[MLX5_ST_SZ_DW(pplm_reg)] = {};
         int sz = MLX5_ST_SZ_BYTES(pplm_reg);
-        u32 current_fec_speed;
+        u8 fec_policy_auto = 0;
         u8 fec_caps = 0;
         int err;
         int i;
@@ -415,23 +413,19 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
         if (err)
                 return err;
 
-        err = mlx5e_port_linkspeed(dev, &current_fec_speed);
-        if (err)
-                return err;
+        MLX5_SET(pplm_reg, out, local_port, 1);
 
-        memset(in, 0, sz);
-        MLX5_SET(pplm_reg, in, local_port, 1);
-        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS && !!fec_policy; i++) {
+        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS; i++) {
                 mlx5e_get_fec_cap_field(out, &fec_caps, fec_supported_speeds[i]);
-                /* policy supported for link speed */
-                if (!!(fec_caps & fec_policy)) {
-                        mlx5e_fec_admin_field(in, &fec_policy, 1,
+                /* policy supported for link speed, or policy is auto */
+                if (fec_caps & fec_policy || fec_policy == fec_policy_auto) {
+                        mlx5e_fec_admin_field(out, &fec_policy, 1,
                                               fec_supported_speeds[i]);
                 } else {
-                        if (fec_supported_speeds[i] == current_fec_speed)
-                                return -EOPNOTSUPP;
-                        mlx5e_fec_admin_field(in, &no_fec_policy, 1,
-                                              fec_supported_speeds[i]);
+                        /* turn off FEC if supported. Else, leave it the same */
+                        if (fec_caps & fec_policy_nofec)
+                                mlx5e_fec_admin_field(out, &fec_policy_nofec, 1,
+                                                      fec_supported_speeds[i]);
                         fec_mode_not_supp_in_speed = true;
                 }
         }
@@ -441,5 +435,5 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
                               "FEC policy 0x%x is not supported for some speeds",
                               fec_policy);
 
-        return mlx5_core_access_reg(dev, in, sz, out, sz, MLX5_REG_PPLM, 0, 1);
+        return mlx5_core_access_reg(dev, out, sz, out, sz, MLX5_REG_PPLM, 0, 1);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index c047da8752da..eac245a93f91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -130,8 +130,10 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err)
+        if (err) {
+                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
                 return 0;
+        }
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3e770abfd802..25c1c4f96841 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -843,8 +843,7 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported,
                                              Autoneg);
 
-        err = get_fec_supported_advertised(mdev, link_ksettings);
-        if (err)
+        if (get_fec_supported_advertised(mdev, link_ksettings))
                 netdev_dbg(netdev, "%s: FEC caps query failed: %d\n",
                            __func__, err);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 1243edbedc9e..871313d6b34d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -502,6 +502,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         rq->channel = c;
         rq->ix      = c->ix;
         rq->mdev    = mdev;
+        rq->hw_mtu  = MLX5E_SW2HW_MTU(params, params->sw_mtu);
         rq->stats   = &c->priv->channel_stats[c->ix].rq;
 
         rq->xdp_prog = params->xdp_prog ? bpf_prog_inc(params->xdp_prog) : NULL;
@@ -1623,13 +1624,15 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev,
         int err;
         u32 i;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
+        if (err)
+                return err;
+
         err = mlx5_cqwq_create(mdev, &param->wq, param->cqc, &cq->wq,
                                &cq->wq_ctrl);
         if (err)
                 return err;
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
-
         mcq->cqe_sz     = 64;
         mcq->set_ci_db  = cq->wq_ctrl.db.db;
         mcq->arm_db     = cq->wq_ctrl.db.db + 1;
@@ -1687,6 +1690,10 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         int eqn;
         int err;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
+        if (err)
+                return err;
+
         inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
                 sizeof(u64) * cq->wq_ctrl.buf.npages;
         in = kvzalloc(inlen, GFP_KERNEL);
@@ -1700,8 +1707,6 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         mlx5_fill_page_frag_array(&cq->wq_ctrl.buf,
                                   (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas));
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
-
         MLX5_SET(cqc,   cqc, cq_period_mode, param->cq_period_mode);
         MLX5_SET(cqc,   cqc, c_eqn,         eqn);
         MLX5_SET(cqc,   cqc, uar_page,      mdev->priv.uar->index);
@@ -1921,6 +1926,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         int err;
         int eqn;
 
+        err = mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
+        if (err)
+                return err;
+
         c = kvzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
         if (!c)
                 return -ENOMEM;
@@ -1937,7 +1946,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->xdp      = !!params->xdp_prog;
         c->stats    = &priv->channel_stats[ix].ch;
 
-        mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
         c->irq_desc = irq_to_desc(irq);
 
         netif_napi_add(netdev, &c->napi, mlx5e_napi_poll, 64);
@@ -3574,6 +3582,7 @@ static int set_feature_cvlan_filter(struct net_device *netdev, bool enable)
         return 0;
 }
 
+#ifdef CONFIG_MLX5_ESWITCH
 static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -3586,6 +3595,7 @@ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 
         return 0;
 }
+#endif
 
 static int set_feature_rx_all(struct net_device *netdev, bool enable)
 {
@@ -3684,7 +3694,9 @@ static int mlx5e_set_features(struct net_device *netdev,
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER,
                                     set_feature_cvlan_filter);
+#ifdef CONFIG_MLX5_ESWITCH
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_TC, set_feature_tc_num_filters);
+#endif
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXALL, set_feature_rx_all);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXFCS, set_feature_rx_fcs);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan);
@@ -3755,10 +3767,11 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
         }
 
         if (params->rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
+                bool is_linear = mlx5e_rx_mpwqe_is_linear_skb(priv->mdev, &new_channels.params);
                 u8 ppw_old = mlx5e_mpwqe_log_pkts_per_wqe(params);
                 u8 ppw_new = mlx5e_mpwqe_log_pkts_per_wqe(&new_channels.params);
 
-                reset = reset && (ppw_old != ppw_new);
+                reset = reset && (is_linear || (ppw_old != ppw_new));
         }
 
         if (!reset) {
@@ -4678,7 +4691,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
             FT_CAP(modify_root) &&
             FT_CAP(identified_miss_table_mode) &&
             FT_CAP(flow_table_modify)) {
+#ifdef CONFIG_MLX5_ESWITCH
                 netdev->hw_features      |= NETIF_F_HW_TC;
+#endif
 #ifdef CONFIG_MLX5_EN_ARFS
                 netdev->hw_features      |= NETIF_F_NTUPLE;
 #endif
@@ -5004,11 +5019,21 @@ err_free_netdev:
 int mlx5e_attach_netdev(struct mlx5e_priv *priv)
 {
         const struct mlx5e_profile *profile;
+        int max_nch;
         int err;
 
         profile = priv->profile;
         clear_bit(MLX5E_STATE_DESTROYING, &priv->state);
 
+        /* max number of channels may have changed */
+        max_nch = mlx5e_get_max_num_channels(priv->mdev);
+        if (priv->channels.params.num_channels > max_nch) {
+                mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch);
+                priv->channels.params.num_channels = max_nch;
+                mlx5e_build_default_indir_rqt(priv->channels.params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, max_nch);
+        }
+
         err = profile->init_tx(priv);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 79638dcbae78..16985ca3248d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1104,6 +1104,12 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi,
         u32 frag_size;
         bool consumed;
 
+        /* Check packet size. Note LRO doesn't use linear SKB */
+        if (unlikely(cqe_bcnt > rq->hw_mtu)) {
+                rq->stats->oversize_pkts_sw_drop++;
+                return NULL;
+        }
+
         va             = page_address(di->page) + head_offset;
         data           = va + rx_headroom;
         frag_size      = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt32);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 35ded91203f5..4382ef85488c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -98,18 +98,17 @@ static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
         return 1;
 }
 
-#ifdef CONFIG_INET
-/* loopback test */
-#define MLX5E_TEST_PKT_SIZE (MLX5E_RX_MAX_HEAD - NET_IP_ALIGN)
-static const char mlx5e_test_text[ETH_GSTRING_LEN] = "MLX5E SELF TEST";
-#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
-
 struct mlx5ehdr {
         __be32 version;
         __be64 magic;
-        char   text[ETH_GSTRING_LEN];
 };
 
+#ifdef CONFIG_INET
+/* loopback test */
+#define MLX5E_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) +\
+                             sizeof(struct udphdr) + sizeof(struct mlx5ehdr))
+#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
+
 static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
 {
         struct sk_buff *skb = NULL;
@@ -117,10 +116,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         struct ethhdr *ethh;
         struct udphdr *udph;
         struct iphdr *iph;
-        int datalen, iplen;
-
-        datalen = MLX5E_TEST_PKT_SIZE -
-                  (sizeof(*ethh) + sizeof(*iph) + sizeof(*udph));
+        int    iplen;
 
         skb = netdev_alloc_skb(priv->netdev, MLX5E_TEST_PKT_SIZE);
         if (!skb) {
@@ -149,7 +145,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         /* Fill UDP header */
         udph->source = htons(9);
         udph->dest = htons(9); /* Discard Protocol */
-        udph->len = htons(datalen + sizeof(struct udphdr));
+        udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
         udph->check = 0;
 
         /* Fill IP header */
@@ -157,7 +153,8 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         iph->ttl = 32;
         iph->version = 4;
         iph->protocol = IPPROTO_UDP;
-        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen;
+        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) +
+                sizeof(struct mlx5ehdr);
         iph->tot_len = htons(iplen);
         iph->frag_off = 0;
         iph->saddr = 0;
@@ -170,9 +167,6 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         mlxh = skb_put(skb, sizeof(*mlxh));
         mlxh->version = 0;
         mlxh->magic = cpu_to_be64(MLX5E_TEST_MAGIC);
-        strlcpy(mlxh->text, mlx5e_test_text, sizeof(mlxh->text));
-        datalen -= sizeof(*mlxh);
-        skb_put_zero(skb, datalen);
 
         skb->csum = 0;
         skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 1e55b9c27ffc..3e99d0728b2f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -83,6 +83,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_cqes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_strides) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
@@ -161,6 +162,7 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                 s->rx_wqe_err   += rq_stats->wqe_err;
                 s->rx_mpwqe_filler_cqes    += rq_stats->mpwqe_filler_cqes;
                 s->rx_mpwqe_filler_strides += rq_stats->mpwqe_filler_strides;
+                s->rx_oversize_pkts_sw_drop += rq_stats->oversize_pkts_sw_drop;
                 s->rx_buff_alloc_err += rq_stats->buff_alloc_err;
                 s->rx_cqe_compress_blks += rq_stats->cqe_compress_blks;
                 s->rx_cqe_compress_pkts += rq_stats->cqe_compress_pkts;
@@ -1189,6 +1191,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_strides) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 77f74ce11280..3f8e870ef4c9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -96,6 +96,7 @@ struct mlx5e_sw_stats {
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler_cqes;
         u64 rx_mpwqe_filler_strides;
+        u64 rx_oversize_pkts_sw_drop;
         u64 rx_buff_alloc_err;
         u64 rx_cqe_compress_blks;
         u64 rx_cqe_compress_pkts;
@@ -193,6 +194,7 @@ struct mlx5e_rq_stats {
         u64 wqe_err;
         u64 mpwqe_filler_cqes;
         u64 mpwqe_filler_strides;
+        u64 oversize_pkts_sw_drop;
         u64 buff_alloc_err;
         u64 cqe_compress_blks;
         u64 cqe_compress_pkts;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 608025ca5c04..fca6f4132c91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1447,31 +1447,21 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                                          inner_headers);
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
-                struct flow_dissector_key_eth_addrs *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                struct flow_dissector_key_basic *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->key);
-                struct flow_dissector_key_eth_addrs *mask =
+                struct flow_dissector_key_basic *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->mask);
+                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
+                         ntohs(mask->n_proto));
+                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
+                         ntohs(key->n_proto));
 
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             dmac_47_16),
-                                mask->dst);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             dmac_47_16),
-                                key->dst);
-
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             smac_47_16),
-                                mask->src);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             smac_47_16),
-                                key->src);
-
-                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
+                if (mask->n_proto)
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1505,9 +1495,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         *match_level = MLX5_MATCH_L2;
                 }
-        } else {
+        } else if (*match_level != MLX5_MATCH_NONE) {
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1);
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1);
+                *match_level = MLX5_MATCH_L2;
         }
 
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {
@@ -1545,21 +1536,31 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
-                struct flow_dissector_key_basic *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+                struct flow_dissector_key_eth_addrs *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->key);
-                struct flow_dissector_key_basic *mask =
+                struct flow_dissector_key_eth_addrs *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->mask);
-                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
-                         ntohs(mask->n_proto));
-                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
-                         ntohs(key->n_proto));
 
-                if (mask->n_proto)
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             dmac_47_16),
+                                mask->dst);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             dmac_47_16),
+                                key->dst);
+
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             smac_47_16),
+                                mask->src);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             smac_47_16),
+                                key->src);
+
+                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1586,10 +1587,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         /* the HW doesn't need L3 inline to match on frag=no */
                         if (!(key->flags & FLOW_DIS_IS_FRAGMENT))
-                                *match_level = MLX5_INLINE_MODE_L2;
+                                *match_level = MLX5_MATCH_L2;
         /* ***  L2 attributes parsing up to here *** */
                         else
-                                *match_level = MLX5_INLINE_MODE_IP;
+                                *match_level = MLX5_MATCH_L3;
                 }
         }
 
@@ -2979,7 +2980,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         if (!actions_match_supported(priv, exts, parse_attr, flow, extack))
                 return -EOPNOTSUPP;
 
-        if (attr->out_count > 1 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
+        if (attr->mirror_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "current firmware doesn't support split rule for port mirroring");
                 netdev_warn_once(priv->netdev, "current firmware doesn't support split rule for port mirroring\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 515e3d6de051..5a22c5874f3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -83,8 +83,14 @@ struct mlx5_fpga_ipsec_rule {
 };
 
 static const struct rhashtable_params rhash_sa = {
-        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
-        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
+        /* Keep out "cmd" field from the key as it's
+         * value is not constant during the lifetime
+         * of the key object.
+         */
+        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) -
+                   FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
+        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) +
+                      FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
         .head_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hash),
         .automatic_shrinking = true,
         .min_size = 1,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index b59953daf8b4..11dabd62e2c7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -560,9 +560,9 @@ static int mlx5i_close(struct net_device *netdev)
 
         netif_carrier_off(epriv->netdev);
         mlx5_fs_remove_rx_underlay_qpn(mdev, ipriv->qp.qpn);
-        mlx5i_uninit_underlay_qp(epriv);
         mlx5e_deactivate_priv_channels(epriv);
         mlx5e_close_channels(&epriv->channels);
+        mlx5i_uninit_underlay_qp(epriv);
 unlock:
         mutex_unlock(&epriv->state_lock);
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index a2df12b79f8e..9bec940330a4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -3568,7 +3568,6 @@ static int mlxsw_sp_cpu_policers_set(struct mlxsw_core *mlxsw_core)
                         burst_size = 7;
                         break;
                 case MLXSW_REG_HTGT_TRAP_GROUP_SP_IP2ME:
-                        is_bytes = true;
                         rate = 4 * 1024;
                         burst_size = 4;
                         break;
diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 867cddba840f..e8ca98c070f6 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1672,7 +1672,7 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
                 netif_wake_queue(adapter->netdev);
         }
 
-        if (!napi_complete_done(napi, weight))
+        if (!napi_complete(napi))
                 goto done;
 
         /* enable isr */
@@ -1681,7 +1681,7 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
         lan743x_csr_read(adapter, INT_STS);
 
 done:
-        return weight;
+        return 0;
 }
 
 static void lan743x_tx_ring_cleanup(struct lan743x_tx *tx)
@@ -1870,9 +1870,9 @@ static int lan743x_tx_open(struct lan743x_tx *tx)
         tx->vector_flags = lan743x_intr_get_vector_flags(adapter,
                                                          INT_BIT_DMA_TX_
                                                          (tx->channel_number));
-        netif_napi_add(adapter->netdev,
-                       &tx->napi, lan743x_tx_napi_poll,
-                       tx->ring_size - 1);
+        netif_tx_napi_add(adapter->netdev,
+                          &tx->napi, lan743x_tx_napi_poll,
+                          tx->ring_size - 1);
         napi_enable(&tx->napi);
 
         data = 0;
@@ -3017,6 +3017,7 @@ static const struct dev_pm_ops lan743x_pm_ops = {
 
 static const struct pci_device_id lan743x_pcidev_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7430) },
+        { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7431) },
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h
index 0e82b6368798..2d6eea18973e 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.h
+++ b/drivers/net/ethernet/microchip/lan743x_main.h
@@ -548,6 +548,7 @@ struct lan743x_adapter;
 /* SMSC acquired EFAR late 1990's, MCHP acquired SMSC 2012 */
 #define PCI_VENDOR_ID_SMSC              PCI_VENDOR_ID_EFAR
 #define PCI_DEVICE_ID_SMSC_LAN7430      (0x7430)
+#define PCI_DEVICE_ID_SMSC_LAN7431      (0x7431)
 
 #define PCI_CONFIG_LENGTH               (0x1000)
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 8e8fa823d611..69966dfc6e3d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -191,7 +191,7 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data)
 static void
 qed_dcbx_set_params(struct qed_dcbx_results *p_data,
                     struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                    bool enable, u8 prio, u8 tc,
+                    bool app_tlv, bool enable, u8 prio, u8 tc,
                     enum dcbx_protocol_type type,
                     enum qed_pci_personality personality)
 {
@@ -210,7 +210,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
                 p_data->arr[type].dont_add_vlan0 = true;
 
         /* QM reconf data */
-        if (p_hwfn->hw_info.personality == personality)
+        if (app_tlv && p_hwfn->hw_info.personality == personality)
                 qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc);
 
         /* Configure dcbx vlan priority in doorbell block for roce EDPM */
@@ -225,7 +225,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
 static void
 qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
                          struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                         bool enable, u8 prio, u8 tc,
+                         bool app_tlv, bool enable, u8 prio, u8 tc,
                          enum dcbx_protocol_type type)
 {
         enum qed_pci_personality personality;
@@ -240,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 
                 personality = qed_dcbx_app_update[i].personality;
 
-                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable,
+                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, app_tlv, enable,
                                     prio, tc, type, personality);
         }
 }
@@ -319,8 +319,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                                 enable = true;
                         }
 
-                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
-                                                 priority, tc, type);
+                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, true,
+                                                 enable, priority, tc, type);
                 }
         }
 
@@ -341,7 +341,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                         continue;
 
                 enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version;
-                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
+                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, false, enable,
                                          priority, tc, type);
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 78a638ec7c0a..979f1e4bc18b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6071,7 +6071,7 @@ static const char * const s_igu_fifo_error_strs[] = {
         "no error",
         "length error",
         "function disabled",
-        "VF sent command to attnetion address",
+        "VF sent command to attention address",
         "host sent prod update command",
         "read of during interrupt register while in MIMD mode",
         "access to PXP BAR reserved address",
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 7ceb2b97538d..88a8576ca9ce 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -185,6 +185,10 @@ void qed_resc_free(struct qed_dev *cdev)
                         qed_iscsi_free(p_hwfn);
                         qed_ooo_free(p_hwfn);
                 }
+
+                if (QED_IS_RDMA_PERSONALITY(p_hwfn))
+                        qed_rdma_info_free(p_hwfn);
+
                 qed_iov_free(p_hwfn);
                 qed_l2_free(p_hwfn);
                 qed_dmae_info_free(p_hwfn);
@@ -481,8 +485,16 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags, sizeof(pq_flags)) > 1)
+        if (bitmap_weight((unsigned long *)&pq_flags,
+                          sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                goto err;
+        }
+
+        if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
+                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
                 goto err;
+        }
 
         switch (pq_flags) {
         case PQ_FLAGS_RLS:
@@ -506,8 +518,7 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         }
 
 err:
-        DP_ERR(p_hwfn, "BAD pq flags %d\n", pq_flags);
-        return NULL;
+        return &qm_info->start_pq;
 }
 
 /* save pq index in qm info */
@@ -531,20 +542,32 @@ u16 qed_get_cm_pq_idx_mcos(struct qed_hwfn *p_hwfn, u8 tc)
 {
         u8 max_tc = qed_init_qm_get_num_tcs(p_hwfn);
 
+        if (max_tc == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_MCOS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (tc > max_tc)
                 DP_ERR(p_hwfn, "tc %d must be smaller than %d\n", tc, max_tc);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + tc;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + (tc % max_tc);
 }
 
 u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf)
 {
         u16 max_vf = qed_init_qm_get_num_vfs(p_hwfn);
 
+        if (max_vf == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_VFS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (vf > max_vf)
                 DP_ERR(p_hwfn, "vf %d must be smaller than %d\n", vf, max_vf);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + vf;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + (vf % max_vf);
 }
 
 u16 qed_get_cm_pq_idx_ofld_mtc(struct qed_hwfn *p_hwfn, u8 tc)
@@ -1081,6 +1104,12 @@ int qed_resc_alloc(struct qed_dev *cdev)
                                 goto alloc_err;
                 }
 
+                if (QED_IS_RDMA_PERSONALITY(p_hwfn)) {
+                        rc = qed_rdma_info_alloc(p_hwfn);
+                        if (rc)
+                                goto alloc_err;
+                }
+
                 /* DMA info initialization */
                 rc = qed_dmae_info_alloc(p_hwfn);
                 if (rc)
@@ -2102,11 +2131,8 @@ int qed_hw_start_fastpath(struct qed_hwfn *p_hwfn)
         if (!p_ptt)
                 return -EAGAIN;
 
-        /* If roce info is allocated it means roce is initialized and should
-         * be enabled in searcher.
-         */
         if (p_hwfn->p_rdma_info &&
-            p_hwfn->b_rdma_enabled_in_prs)
+            p_hwfn->p_rdma_info->active && p_hwfn->b_rdma_enabled_in_prs)
                 qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0x1);
 
         /* Re-open incoming traffic */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
index cc1b373c0ace..46dc93d3b9b5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
@@ -147,7 +147,8 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
                        "Cannot satisfy CQ amount. CQs requested %d, CQs available %d. Aborting function start\n",
                        fcoe_pf_params->num_cqs,
                        p_hwfn->hw_info.feat_num[QED_FCOE_CQ]);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto err;
         }
 
         p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu);
@@ -156,14 +157,14 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
 
         rc = qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_FCOE, &dummy_cid);
         if (rc)
-                return rc;
+                goto err;
 
         cxt_info.iid = dummy_cid;
         rc = qed_cxt_get_cid_info(p_hwfn, &cxt_info);
         if (rc) {
                 DP_NOTICE(p_hwfn, "Cannot find context info for dummy cid=%d\n",
                           dummy_cid);
-                return rc;
+                goto err;
         }
         p_cxt = cxt_info.p_cxt;
         SET_FIELD(p_cxt->tstorm_ag_context.flags3,
@@ -240,6 +241,10 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
         rc = qed_spq_post(p_hwfn, p_ent, NULL);
 
         return rc;
+
+err:
+        qed_sp_destroy_request(p_hwfn, p_ent);
+        return rc;
 }
 
 static int
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index 0f0aba793352..b22f464ea3fa 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -992,6 +992,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
          */
         do {
                 index = p_sb_attn->sb_index;
+                /* finish reading index before the loop condition */
+                dma_rmb();
                 attn_bits = le32_to_cpu(p_sb_attn->atten_bits);
                 attn_acks = le32_to_cpu(p_sb_attn->atten_ack);
         } while (index != p_sb_attn->sb_index);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
index 1135387bd99d..4f8a685d1a55 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
@@ -200,6 +200,7 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
                        "Cannot satisfy CQ amount. Queues requested %d, CQs available %d. Aborting function start\n",
                        p_params->num_queues,
                        p_hwfn->hw_info.feat_num[QED_ISCSI_CQ]);
+                qed_sp_destroy_request(p_hwfn, p_ent);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 82a1bd1f8a8c..67c02ea93906 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -740,8 +740,7 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
 
         rc = qed_sp_vport_update_rss(p_hwfn, p_ramrod, p_rss_params);
         if (rc) {
-                /* Return spq entry which is taken in qed_sp_init_request()*/
-                qed_spq_return_entry(p_hwfn, p_ent);
+                qed_sp_destroy_request(p_hwfn, p_ent);
                 return rc;
         }
 
@@ -1355,6 +1354,7 @@ qed_filter_ucast_common(struct qed_hwfn *p_hwfn,
                         DP_NOTICE(p_hwfn,
                                   "%d is not supported yet\n",
                                   p_filter_cmd->opcode);
+                        qed_sp_destroy_request(p_hwfn, *pp_ent);
                         return -EINVAL;
                 }
 
@@ -2056,13 +2056,13 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
         } else {
                 rc = qed_fw_vport(p_hwfn, p_params->vport_id, &abs_vport_id);
                 if (rc)
-                        return rc;
+                        goto err;
 
                 if (p_params->qid != QED_RFS_NTUPLE_QID_RSS) {
                         rc = qed_fw_l2_queue(p_hwfn, p_params->qid,
                                              &abs_rx_q_id);
                         if (rc)
-                                return rc;
+                                goto err;
 
                         p_ramrod->rx_qid_valid = 1;
                         p_ramrod->rx_qid = cpu_to_le16(abs_rx_q_id);
@@ -2083,6 +2083,10 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
                    (u64)p_params->addr, p_params->length);
 
         return qed_spq_post(p_hwfn, p_ent, NULL);
+
+err:
+        qed_sp_destroy_request(p_hwfn, p_ent);
+        return rc;
 }
 
 int qed_get_rxq_coalesce(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 35fd0db6a677..fff7f04d4525 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1782,9 +1782,9 @@ static int qed_drain(struct qed_dev *cdev)
                         return -EBUSY;
                 }
                 rc = qed_mcp_drain(hwfn, ptt);
+                qed_ptt_release(hwfn, ptt);
                 if (rc)
                         return rc;
-                qed_ptt_release(hwfn, ptt);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index f40f654398a0..a96364df4320 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -1944,9 +1944,12 @@ int qed_mcp_trans_speed_mask(struct qed_hwfn *p_hwfn,
                              struct qed_ptt *p_ptt, u32 *p_speed_mask)
 {
         u32 transceiver_type, transceiver_state;
+        int ret;
 
-        qed_mcp_get_transceiver_data(p_hwfn, p_ptt, &transceiver_state,
-                                     &transceiver_type);
+        ret = qed_mcp_get_transceiver_data(p_hwfn, p_ptt, &transceiver_state,
+                                           &transceiver_type);
+        if (ret)
+                return ret;
 
         if (qed_is_transceiver_ready(transceiver_state, transceiver_type) ==
                                      false)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index c71391b9c757..7873d6dfd91f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -140,22 +140,34 @@ static u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id)
         return FEAT_NUM((struct qed_hwfn *)p_hwfn, QED_PF_L2_QUE) + rel_sb_id;
 }
 
-static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
-                          struct qed_ptt *p_ptt,
-                          struct qed_rdma_start_in_params *params)
+int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn)
 {
         struct qed_rdma_info *p_rdma_info;
-        u32 num_cons, num_tasks;
-        int rc = -ENOMEM;
 
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
-
-        /* Allocate a struct with current pf rdma info */
         p_rdma_info = kzalloc(sizeof(*p_rdma_info), GFP_KERNEL);
         if (!p_rdma_info)
-                return rc;
+                return -ENOMEM;
+
+        spin_lock_init(&p_rdma_info->lock);
 
         p_hwfn->p_rdma_info = p_rdma_info;
+        return 0;
+}
+
+void qed_rdma_info_free(struct qed_hwfn *p_hwfn)
+{
+        kfree(p_hwfn->p_rdma_info);
+        p_hwfn->p_rdma_info = NULL;
+}
+
+static int qed_rdma_alloc(struct qed_hwfn *p_hwfn)
+{
+        struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info;
+        u32 num_cons, num_tasks;
+        int rc = -ENOMEM;
+
+        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
+
         if (QED_IS_IWARP_PERSONALITY(p_hwfn))
                 p_rdma_info->proto = PROTOCOLID_IWARP;
         else
@@ -183,7 +195,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
         /* Allocate a struct with device params and fill it */
         p_rdma_info->dev = kzalloc(sizeof(*p_rdma_info->dev), GFP_KERNEL);
         if (!p_rdma_info->dev)
-                goto free_rdma_info;
+                return rc;
 
         /* Allocate a struct with port params and fill it */
         p_rdma_info->port = kzalloc(sizeof(*p_rdma_info->port), GFP_KERNEL);
@@ -298,8 +310,6 @@ free_rdma_port:
         kfree(p_rdma_info->port);
 free_rdma_dev:
         kfree(p_rdma_info->dev);
-free_rdma_info:
-        kfree(p_rdma_info);
 
         return rc;
 }
@@ -370,8 +380,6 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
 
         kfree(p_rdma_info->port);
         kfree(p_rdma_info->dev);
-
-        kfree(p_rdma_info);
 }
 
 static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
@@ -679,8 +687,6 @@ static int qed_rdma_setup(struct qed_hwfn *p_hwfn,
 
         DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "RDMA setup\n");
 
-        spin_lock_init(&p_hwfn->p_rdma_info->lock);
-
         qed_rdma_init_devinfo(p_hwfn, params);
         qed_rdma_init_port(p_hwfn);
         qed_rdma_init_events(p_hwfn, params);
@@ -727,7 +733,7 @@ static int qed_rdma_stop(void *rdma_cxt)
         /* Disable RoCE search */
         qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0);
         p_hwfn->b_rdma_enabled_in_prs = false;
-
+        p_hwfn->p_rdma_info->active = 0;
         qed_wr(p_hwfn, p_ptt, PRS_REG_ROCE_DEST_QP_MAX_PF, 0);
 
         ll2_ethertype_en = qed_rd(p_hwfn, p_ptt, PRS_REG_LIGHT_L2_ETHERTYPE_EN);
@@ -1236,7 +1242,8 @@ qed_rdma_create_qp(void *rdma_cxt,
         u8 max_stats_queues;
         int rc;
 
-        if (!rdma_cxt || !in_params || !out_params || !p_hwfn->p_rdma_info) {
+        if (!rdma_cxt || !in_params || !out_params ||
+            !p_hwfn->p_rdma_info->active) {
                 DP_ERR(p_hwfn->cdev,
                        "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
                        rdma_cxt, in_params, out_params);
@@ -1514,6 +1521,7 @@ qed_rdma_register_tid(void *rdma_cxt,
         default:
                 rc = -EINVAL;
                 DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "rc = %d\n", rc);
+                qed_sp_destroy_request(p_hwfn, p_ent);
                 return rc;
         }
         SET_FIELD(p_ramrod->flags1,
@@ -1801,8 +1809,8 @@ bool qed_rdma_allocated_qps(struct qed_hwfn *p_hwfn)
 {
         bool result;
 
-        /* if rdma info has not been allocated, naturally there are no qps */
-        if (!p_hwfn->p_rdma_info)
+        /* if rdma wasn't activated yet, naturally there are no qps */
+        if (!p_hwfn->p_rdma_info->active)
                 return false;
 
         spin_lock_bh(&p_hwfn->p_rdma_info->lock);
@@ -1848,7 +1856,7 @@ static int qed_rdma_start(void *rdma_cxt,
         if (!p_ptt)
                 goto err;
 
-        rc = qed_rdma_alloc(p_hwfn, p_ptt, params);
+        rc = qed_rdma_alloc(p_hwfn);
         if (rc)
                 goto err1;
 
@@ -1857,6 +1865,7 @@ static int qed_rdma_start(void *rdma_cxt,
                 goto err2;
 
         qed_ptt_release(p_hwfn, p_ptt);
+        p_hwfn->p_rdma_info->active = 1;
 
         return rc;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.h b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
index 6f722ee8ee94..3689fe3e5935 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
@@ -102,6 +102,7 @@ struct qed_rdma_info {
         u16 max_queue_zones;
         enum protocol_type proto;
         struct qed_iwarp_info iwarp;
+        u8 active:1;
 };
 
 struct qed_rdma_qp {
@@ -176,10 +177,14 @@ struct qed_rdma_qp {
 #if IS_ENABLED(CONFIG_QED_RDMA)
 void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
 void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
+int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn);
+void qed_rdma_info_free(struct qed_hwfn *p_hwfn);
 #else
 static inline void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {}
 static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn,
                                     struct qed_ptt *p_ptt) {}
+static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL;}
+static inline void qed_rdma_info_free(struct qed_hwfn *p_hwfn) {}
 #endif
 
 int
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index f9167d1354bb..e49fada85410 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -745,6 +745,7 @@ static int qed_roce_sp_destroy_qp_responder(struct qed_hwfn *p_hwfn,
                 DP_NOTICE(p_hwfn,
                           "qed destroy responder failed: cannot allocate memory (ramrod). rc = %d\n",
                           rc);
+                qed_sp_destroy_request(p_hwfn, p_ent);
                 return rc;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index e95431f6acd4..3157c0d99441 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -167,6 +167,9 @@ struct qed_spq_entry {
         enum spq_mode                   comp_mode;
         struct qed_spq_comp_cb          comp_cb;
         struct qed_spq_comp_done        comp_done; /* SPQ_MODE_EBLOCK */
+
+        /* Posted entry for unlimited list entry in EBLOCK mode */
+        struct qed_spq_entry            *post_ent;
 };
 
 struct qed_eq {
@@ -396,6 +399,17 @@ struct qed_sp_init_data {
         struct qed_spq_comp_cb *p_comp_data;
 };
 
+/**
+ * @brief Returns a SPQ entry to the pool / frees the entry if allocated.
+ *        Should be called on in error flows after initializing the SPQ entry
+ *        and before posting it.
+ *
+ * @param p_hwfn
+ * @param p_ent
+ */
+void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
+                            struct qed_spq_entry *p_ent);
+
 int qed_sp_init_request(struct qed_hwfn *p_hwfn,
                         struct qed_spq_entry **pp_ent,
                         u8 cmd,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 77b6248ad3b9..888274fa208b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -47,6 +47,19 @@
 #include "qed_sp.h"
 #include "qed_sriov.h"
 
+void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
+                            struct qed_spq_entry *p_ent)
+{
+        /* qed_spq_get_entry() can either get an entry from the free_pool,
+         * or, if no entries are left, allocate a new entry and add it to
+         * the unlimited_pending list.
+         */
+        if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
+                kfree(p_ent);
+        else
+                qed_spq_return_entry(p_hwfn, p_ent);
+}
+
 int qed_sp_init_request(struct qed_hwfn *p_hwfn,
                         struct qed_spq_entry **pp_ent,
                         u8 cmd, u8 protocol, struct qed_sp_init_data *p_data)
@@ -80,7 +93,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
 
         case QED_SPQ_MODE_BLOCK:
                 if (!p_data->p_comp_data)
-                        return -EINVAL;
+                        goto err;
 
                 p_ent->comp_cb.cookie = p_data->p_comp_data->cookie;
                 break;
@@ -95,7 +108,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
         default:
                 DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n",
                           p_ent->comp_mode);
-                return -EINVAL;
+                goto err;
         }
 
         DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
@@ -109,6 +122,11 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
         memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod));
 
         return 0;
+
+err:
+        qed_sp_destroy_request(p_hwfn, p_ent);
+
+        return -EINVAL;
 }
 
 static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index c4a6274dd625..0a9c5bb0fa48 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -142,6 +142,7 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
 
         DP_INFO(p_hwfn, "Ramrod is stuck, requesting MCP drain\n");
         rc = qed_mcp_drain(p_hwfn, p_ptt);
+        qed_ptt_release(p_hwfn, p_ptt);
         if (rc) {
                 DP_NOTICE(p_hwfn, "MCP drain failed\n");
                 goto err;
@@ -150,18 +151,15 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
         /* Retry after drain */
         rc = __qed_spq_block(p_hwfn, p_ent, p_fw_ret, true);
         if (!rc)
-                goto out;
+                return 0;
 
         comp_done = (struct qed_spq_comp_done *)p_ent->comp_cb.cookie;
-        if (comp_done->done == 1)
+        if (comp_done->done == 1) {
                 if (p_fw_ret)
                         *p_fw_ret = comp_done->fw_return_code;
-out:
-        qed_ptt_release(p_hwfn, p_ptt);
-        return 0;
-
+                return 0;
+        }
 err:
-        qed_ptt_release(p_hwfn, p_ptt);
         DP_NOTICE(p_hwfn,
                   "Ramrod is stuck [CID %08x cmd %02x protocol %02x echo %04x]\n",
                   le32_to_cpu(p_ent->elem.hdr.cid),
@@ -685,6 +683,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn,
                         /* EBLOCK responsible to free the allocated p_ent */
                         if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK)
                                 kfree(p_ent);
+                        else
+                                p_ent->post_ent = p_en2;
 
                         p_ent = p_en2;
                 }
@@ -767,6 +767,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
                                  SPQ_HIGH_PRI_RESERVE_DEFAULT);
 }
 
+/* Avoid overriding of SPQ entries when getting out-of-order completions, by
+ * marking the completions in a bitmap and increasing the chain consumer only
+ * for the first successive completed entries.
+ */
+static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo)
+{
+        u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
+        struct qed_spq *p_spq = p_hwfn->p_spq;
+
+        __set_bit(pos, p_spq->p_comp_bitmap);
+        while (test_bit(p_spq->comp_bitmap_idx,
+                        p_spq->p_comp_bitmap)) {
+                __clear_bit(p_spq->comp_bitmap_idx,
+                            p_spq->p_comp_bitmap);
+                p_spq->comp_bitmap_idx++;
+                qed_chain_return_produced(&p_spq->chain);
+        }
+}
+
 int qed_spq_post(struct qed_hwfn *p_hwfn,
                  struct qed_spq_entry *p_ent, u8 *fw_return_code)
 {
@@ -824,11 +843,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
                                    p_ent->queue == &p_spq->unlimited_pending);
 
                 if (p_ent->queue == &p_spq->unlimited_pending) {
-                        /* This is an allocated p_ent which does not need to
-                         * return to pool.
-                         */
+                        struct qed_spq_entry *p_post_ent = p_ent->post_ent;
+
                         kfree(p_ent);
-                        return rc;
+
+                        /* Return the entry which was actually posted */
+                        p_ent = p_post_ent;
                 }
 
                 if (rc)
@@ -842,7 +862,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
 spq_post_fail2:
         spin_lock_bh(&p_spq->lock);
         list_del(&p_ent->list);
-        qed_chain_return_produced(&p_spq->chain);
+        qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo);
 
 spq_post_fail:
         /* return to the free pool */
@@ -874,25 +894,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
         spin_lock_bh(&p_spq->lock);
         list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) {
                 if (p_ent->elem.hdr.echo == echo) {
-                        u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
-
                         list_del(&p_ent->list);
-
-                        /* Avoid overriding of SPQ entries when getting
-                         * out-of-order completions, by marking the completions
-                         * in a bitmap and increasing the chain consumer only
-                         * for the first successive completed entries.
-                         */
-                        __set_bit(pos, p_spq->p_comp_bitmap);
-
-                        while (test_bit(p_spq->comp_bitmap_idx,
-                                        p_spq->p_comp_bitmap)) {
-                                __clear_bit(p_spq->comp_bitmap_idx,
-                                            p_spq->p_comp_bitmap);
-                                p_spq->comp_bitmap_idx++;
-                                qed_chain_return_produced(&p_spq->chain);
-                        }
-
+                        qed_spq_comp_bmap_update(p_hwfn, echo);
                         p_spq->comp_count++;
                         found = p_ent;
                         break;
@@ -931,11 +934,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
                            QED_MSG_SPQ,
                            "Got a completion without a callback function\n");
 
-        if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) ||
-            (found->queue == &p_spq->unlimited_pending))
+        if (found->comp_mode != QED_SPQ_MODE_EBLOCK)
                 /* EBLOCK  is responsible for returning its own entry into the
-                 * free list, unless it originally added the entry into the
-                 * unlimited pending list.
+                 * free list.
                  */
                 qed_spq_return_entry(p_hwfn, found);
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index 9b08a9d9e151..ca6290fa0f30 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -101,6 +101,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf)
         default:
                 DP_NOTICE(p_hwfn, "Unknown VF personality %d\n",
                           p_hwfn->hw_info.personality);
+                qed_sp_destroy_request(p_hwfn, p_ent);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 9647578cbe6a..14f26bf3b388 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -459,7 +459,7 @@ static int qlcnic_tx_pkt(struct qlcnic_adapter *adapter,
                          struct cmd_desc_type0 *first_desc, struct sk_buff *skb,
                          struct qlcnic_host_tx_ring *tx_ring)
 {
-        u8 l4proto, opcode = 0, hdr_len = 0;
+        u8 l4proto, opcode = 0, hdr_len = 0, tag_vlan = 0;
         u16 flags = 0, vlan_tci = 0;
         int copied, offset, copy_len, size;
         struct cmd_desc_type0 *hwdesc;
@@ -472,14 +472,16 @@ static int qlcnic_tx_pkt(struct qlcnic_adapter *adapter,
                 flags = QLCNIC_FLAGS_VLAN_TAGGED;
                 vlan_tci = ntohs(vh->h_vlan_TCI);
                 protocol = ntohs(vh->h_vlan_encapsulated_proto);
+                tag_vlan = 1;
         } else if (skb_vlan_tag_present(skb)) {
                 flags = QLCNIC_FLAGS_VLAN_OOB;
                 vlan_tci = skb_vlan_tag_get(skb);
+                tag_vlan = 1;
         }
         if (unlikely(adapter->tx_pvid)) {
-                if (vlan_tci && !(adapter->flags & QLCNIC_TAGGING_ENABLED))
+                if (tag_vlan && !(adapter->flags & QLCNIC_TAGGING_ENABLED))
                         return -EIO;
-                if (vlan_tci && (adapter->flags & QLCNIC_TAGGING_ENABLED))
+                if (tag_vlan && (adapter->flags & QLCNIC_TAGGING_ENABLED))
                         goto set_flags;
 
                 flags = QLCNIC_FLAGS_VLAN_OOB;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 0afc3d335d56..d11c16aeb19a 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -234,7 +234,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
                       struct net_device *real_dev,
                       struct rmnet_endpoint *ep)
 {
-        struct rmnet_priv *priv;
+        struct rmnet_priv *priv = netdev_priv(rmnet_dev);
         int rc;
 
         if (ep->egress_dev)
@@ -247,6 +247,8 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
         rmnet_dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         rmnet_dev->hw_features |= NETIF_F_SG;
 
+        priv->real_dev = real_dev;
+
         rc = register_netdevice(rmnet_dev);
         if (!rc) {
                 ep->egress_dev = rmnet_dev;
@@ -255,9 +257,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
 
                 rmnet_dev->rtnl_link_ops = &rmnet_link_ops;
 
-                priv = netdev_priv(rmnet_dev);
                 priv->mux_id = id;
-                priv->real_dev = real_dev;
 
                 netdev_dbg(rmnet_dev, "rmnet dev created\n");
         }
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index b1b305f8f414..272b9ca66314 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -365,7 +365,8 @@ struct dma_features {
 
 /* GMAC TX FIFO is 8K, Rx FIFO is 16K */
 #define BUF_SIZE_16KiB 16384
-#define BUF_SIZE_8KiB 8192
+/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */
+#define BUF_SIZE_8KiB 8188
 #define BUF_SIZE_4KiB 4096
 #define BUF_SIZE_2KiB 2048
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
index ca9d7e48034c..40d6356a7e73 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
@@ -31,7 +31,7 @@
 /* Enhanced descriptors */
 static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
 {
-        p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1)
+        p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
                         << ERDES1_BUFFER2_SIZE_SHIFT)
                    & ERDES1_BUFFER2_SIZE_MASK);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 77914c89d749..5ef91a790f9d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -262,7 +262,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
                                   int mode, int end)
 {
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK);
+        p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ehn_desc_rx_set_on_chain(p);
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index abc3f85270cd..d8c5bc412219 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -140,7 +140,7 @@ static void clean_desc3(void *priv_ptr, struct dma_desc *p)
 static int set_16kib_bfsize(int mtu)
 {
         int ret = 0;
-        if (unlikely(mtu >= BUF_SIZE_8KiB))
+        if (unlikely(mtu > BUF_SIZE_8KiB))
                 ret = BUF_SIZE_16KiB;
         return ret;
 }
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index ef9538ee53d0..82412691ee66 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -3605,7 +3605,7 @@ static const char velocity_gstrings[][ETH_GSTRING_LEN] = {
         "tx_jumbo",
         "rx_mac_control_frames",
         "tx_mac_control_frames",
-        "rx_frame_alignement_errors",
+        "rx_frame_alignment_errors",
         "rx_long_ok",
         "rx_long_err",
         "tx_sqe_errors",
diff --git a/drivers/net/fddi/defza.c b/drivers/net/fddi/defza.c
index 3b7f10a5f06a..c5cae8e74dc4 100644
--- a/drivers/net/fddi/defza.c
+++ b/drivers/net/fddi/defza.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /*      FDDI network adapter driver for DEC FDDIcontroller 700/700-C devices.
  *
  *      Copyright (c) 2018  Maciej W. Rozycki
@@ -56,7 +56,7 @@
 #define DRV_VERSION "v.1.1.4"
 #define DRV_RELDATE "Oct  6 2018"
 
-static char version[] =
+static const char version[] =
         DRV_NAME ": " DRV_VERSION "  " DRV_RELDATE "  Maciej W. Rozycki\n";
 
 MODULE_AUTHOR("Maciej W. Rozycki <macro@linux-mips.org>");
@@ -784,7 +784,7 @@ err_rx:
 static void fza_tx_smt(struct net_device *dev)
 {
         struct fza_private *fp = netdev_priv(dev);
-        struct fza_buffer_tx __iomem *smt_tx_ptr, *skb_data_ptr;
+        struct fza_buffer_tx __iomem *smt_tx_ptr;
         int i, len;
         u32 own;
 
@@ -799,6 +799,7 @@ static void fza_tx_smt(struct net_device *dev)
 
                 if (!netif_queue_stopped(dev)) {
                         if (dev_nit_active(dev)) {
+                                struct fza_buffer_tx *skb_data_ptr;
                                 struct sk_buff *skb;
 
                                 /* Length must be a multiple of 4 as only word
diff --git a/drivers/net/fddi/defza.h b/drivers/net/fddi/defza.h
index b06acf32738e..93bda61be8e3 100644
--- a/drivers/net/fddi/defza.h
+++ b/drivers/net/fddi/defza.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*      FDDI network adapter driver for DEC FDDIcontroller 700/700-C devices.
  *
  *      Copyright (c) 2018  Maciej W. Rozycki
@@ -235,6 +235,7 @@ struct fza_ring_cmd {
 #define FZA_RING_CMD            0x200400        /* command ring address */
 #define FZA_RING_CMD_SIZE       0x40            /* command descriptor ring
                                                  * size
+                                                 */
 /* Command constants. */
 #define FZA_RING_CMD_MASK       0x7fffffff
 #define FZA_RING_CMD_NOP        0x00000000      /* nop */
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index e86ea105c802..704537010453 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -92,7 +92,7 @@ static int bcm54612e_config_init(struct phy_device *phydev)
         return 0;
 }
 
-static int bcm5481x_config(struct phy_device *phydev)
+static int bcm54xx_config_clock_delay(struct phy_device *phydev)
 {
         int rc, val;
 
@@ -429,7 +429,7 @@ static int bcm5481_config_aneg(struct phy_device *phydev)
         ret = genphy_config_aneg(phydev);
 
         /* Then we can set up the delay. */
-        bcm5481x_config(phydev);
+        bcm54xx_config_clock_delay(phydev);
 
         if (of_property_read_bool(np, "enet-phy-lane-swap")) {
                 /* Lane Swap - Undocumented register...magic! */
@@ -442,6 +442,19 @@ static int bcm5481_config_aneg(struct phy_device *phydev)
         return ret;
 }
 
+static int bcm54616s_config_aneg(struct phy_device *phydev)
+{
+        int ret;
+
+        /* Aneg firsly. */
+        ret = genphy_config_aneg(phydev);
+
+        /* Then we can set up the delay. */
+        bcm54xx_config_clock_delay(phydev);
+
+        return ret;
+}
+
 static int brcm_phy_setbits(struct phy_device *phydev, int reg, int set)
 {
         int val;
@@ -636,6 +649,7 @@ static struct phy_driver broadcom_drivers[] = {
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_INTERRUPT,
         .config_init    = bcm54xx_config_init,
+        .config_aneg    = bcm54616s_config_aneg,
         .ack_interrupt  = bcm_phy_ack_intr,
         .config_intr    = bcm_phy_config_intr,
 }, {
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33265747bf39..0fbcedcdf6e2 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -63,7 +63,7 @@ static void mdio_dir(struct mdiobb_ctrl *ctrl, int dir)
                  * assume the pin serves as pull-up. If direction is
                  * output, the default value is high.
                  */
-                gpiod_set_value(bitbang->mdo, 1);
+                gpiod_set_value_cansleep(bitbang->mdo, 1);
                 return;
         }
 
@@ -78,7 +78,7 @@ static int mdio_get(struct mdiobb_ctrl *ctrl)
         struct mdio_gpio_info *bitbang =
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
-        return gpiod_get_value(bitbang->mdio);
+        return gpiod_get_value_cansleep(bitbang->mdio);
 }
 
 static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
@@ -87,9 +87,9 @@ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
         if (bitbang->mdo)
-                gpiod_set_value(bitbang->mdo, what);
+                gpiod_set_value_cansleep(bitbang->mdo, what);
         else
-                gpiod_set_value(bitbang->mdio, what);
+                gpiod_set_value_cansleep(bitbang->mdio, what);
 }
 
 static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
@@ -97,7 +97,7 @@ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
         struct mdio_gpio_info *bitbang =
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
-        gpiod_set_value(bitbang->mdc, what);
+        gpiod_set_value_cansleep(bitbang->mdc, what);
 }
 
 static const struct mdiobb_ops mdio_gpio_ops = {
diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
index a2e59f4f6f01..7cae17517744 100644
--- a/drivers/net/phy/mscc.c
+++ b/drivers/net/phy/mscc.c
@@ -810,17 +810,13 @@ static int vsc85xx_default_config(struct phy_device *phydev)
 
         phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
         mutex_lock(&phydev->lock);
-        rc = phy_select_page(phydev, MSCC_PHY_PAGE_EXTENDED_2);
-        if (rc < 0)
-                goto out_unlock;
 
-        reg_val = phy_read(phydev, MSCC_PHY_RGMII_CNTL);
-        reg_val &= ~(RGMII_RX_CLK_DELAY_MASK);
-        reg_val |= (RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS);
-        phy_write(phydev, MSCC_PHY_RGMII_CNTL, reg_val);
+        reg_val = RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS;
+
+        rc = phy_modify_paged(phydev, MSCC_PHY_PAGE_EXTENDED_2,
+                              MSCC_PHY_RGMII_CNTL, RGMII_RX_CLK_DELAY_MASK,
+                              reg_val);
 
-out_unlock:
-        rc = phy_restore_page(phydev, rc, rc > 0 ? 0 : rc);
         mutex_unlock(&phydev->lock);
 
         return rc;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index ab33d1777132..23ee3967c166 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -2197,6 +2197,14 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner)
         new_driver->mdiodrv.driver.remove = phy_remove;
         new_driver->mdiodrv.driver.owner = owner;
 
+        /* The following works around an issue where the PHY driver doesn't bind
+         * to the device, resulting in the genphy driver being used instead of
+         * the dedicated driver. The root cause of the issue isn't known yet
+         * and seems to be in the base driver core. Once this is fixed we may
+         * remove this workaround.
+         */
+        new_driver->mdiodrv.driver.probe_type = PROBE_FORCE_SYNCHRONOUS;
+
         retval = driver_register(&new_driver->mdiodrv.driver);
         if (retval) {
                 pr_err("%s: Error %d in registering driver\n",
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index 7fc8508b5231..271e8adc39f1 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -220,7 +220,7 @@ static struct phy_driver realtek_drvs[] = {
                 .flags          = PHY_HAS_INTERRUPT,
         }, {
                 .phy_id         = 0x001cc816,
-                .name           = "RTL8201F 10/100Mbps Ethernet",
+                .name           = "RTL8201F Fast Ethernet",
                 .phy_id_mask    = 0x001fffff,
                 .features       = PHY_BASIC_FEATURES,
                 .flags          = PHY_HAS_INTERRUPT,
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index e9f101c9bae2..bfbb39f93554 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -216,9 +216,9 @@ static int rionet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                          * it just report sending a packet to the target
                          * (without actual packet transfer).
                          */
-                        dev_kfree_skb_any(skb);
                         ndev->stats.tx_packets++;
                         ndev->stats.tx_bytes += skb->len;
+                        dev_kfree_skb_any(skb);
                 }
         }
 
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index db633ae9f784..364f514d56d8 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -985,8 +985,6 @@ static void team_port_disable(struct team *team,
         team->en_port_count--;
         team_queue_override_port_del(team, port);
         team_adjust_ops(team);
-        team_notify_peers(team);
-        team_mcast_rejoin(team);
         team_lower_state_changed(port);
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 060135ceaf0e..e244f5d7512a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1536,6 +1536,7 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
 
         if (!rx_batched || (!more && skb_queue_empty(queue))) {
                 local_bh_disable();
+                skb_record_rx_queue(skb, tfile->queue_index);
                 netif_receive_skb(skb);
                 local_bh_enable();
                 return;
@@ -1555,8 +1556,11 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
                 struct sk_buff *nskb;
 
                 local_bh_disable();
-                while ((nskb = __skb_dequeue(&process_queue)))
+                while ((nskb = __skb_dequeue(&process_queue))) {
+                        skb_record_rx_queue(nskb, tfile->queue_index);
                         netif_receive_skb(nskb);
+                }
+                skb_record_rx_queue(skb, tfile->queue_index);
                 netif_receive_skb(skb);
                 local_bh_enable();
         }
@@ -2451,6 +2455,7 @@ build:
         if (!rcu_dereference(tun->steering_prog))
                 rxhash = __skb_get_hash_symmetric(skb);
 
+        skb_record_rx_queue(skb, tfile->queue_index);
         netif_receive_skb(skb);
 
         stats = get_cpu_ptr(tun->pcpu_stats);
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 7275761a1177..3d8a70d3ea9b 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -140,7 +140,6 @@ struct ipheth_device {
         struct usb_device *udev;
         struct usb_interface *intf;
         struct net_device *net;
-        struct sk_buff *tx_skb;
         struct urb *tx_urb;
         struct urb *rx_urb;
         unsigned char *tx_buf;
@@ -230,6 +229,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
         case -ENOENT:
         case -ECONNRESET:
         case -ESHUTDOWN:
+        case -EPROTO:
                 return;
         case 0:
                 break;
@@ -281,7 +281,6 @@ static void ipheth_sndbulk_callback(struct urb *urb)
                 dev_err(&dev->intf->dev, "%s: urb status: %d\n",
                 __func__, status);
 
-        dev_kfree_skb_irq(dev->tx_skb);
         if (status == 0)
                 netif_wake_queue(dev->net);
         else
@@ -423,7 +422,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
         if (skb->len > IPHETH_BUF_SIZE) {
                 WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
                 dev->net->stats.tx_dropped++;
-                dev_kfree_skb_irq(skb);
+                dev_kfree_skb_any(skb);
                 return NETDEV_TX_OK;
         }
 
@@ -443,12 +442,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
                 dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
                         __func__, retval);
                 dev->net->stats.tx_errors++;
-                dev_kfree_skb_irq(skb);
+                dev_kfree_skb_any(skb);
         } else {
-                dev->tx_skb = skb;
-
                 dev->net->stats.tx_packets++;
                 dev->net->stats.tx_bytes += skb->len;
+                dev_consume_skb_any(skb);
                 netif_stop_queue(net);
         }
 
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 262e7a3c23cb..f2d01cb6f958 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1321,6 +1321,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->ethtool_ops = &smsc95xx_ethtool_ops;
         dev->net->flags |= IFF_MULTICAST;
         dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
+        dev->net->min_mtu = ETH_MIN_MTU;
+        dev->net->max_mtu = ETH_DATA_LEN;
         dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
 
         pdata->dev = dev;
@@ -1598,6 +1600,8 @@ static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message)
                 return ret;
         }
 
+        cancel_delayed_work_sync(&pdata->carrier_check);
+
         if (pdata->suspend_flags) {
                 netdev_warn(dev->net, "error during last resume\n");
                 pdata->suspend_flags = 0;
@@ -1840,6 +1844,11 @@ done:
          */
         if (ret && PMSG_IS_AUTO(message))
                 usbnet_resume(intf);
+
+        if (ret)
+                schedule_delayed_work(&pdata->carrier_check,
+                                      CARRIER_CHECK_DELAY);
+
         return ret;
 }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2c041d76ac..cecfd77c9f3c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -70,7 +70,8 @@ static const unsigned long guest_offloads[] = {
         VIRTIO_NET_F_GUEST_TSO4,
         VIRTIO_NET_F_GUEST_TSO6,
         VIRTIO_NET_F_GUEST_ECN,
-        VIRTIO_NET_F_GUEST_UFO
+        VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_CSUM
 };
 
 struct virtnet_stat_desc {
@@ -2334,9 +2335,6 @@ static int virtnet_clear_guest_offloads(struct virtnet_info *vi)
         if (!vi->guest_offloads)
                 return 0;
 
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads = 1ULL << VIRTIO_NET_F_GUEST_CSUM;
-
         return virtnet_set_guest_offloads(vi, offloads);
 }
 
@@ -2346,8 +2344,6 @@ static int virtnet_restore_guest_offloads(struct virtnet_info *vi)
 
         if (!vi->guest_offloads)
                 return 0;
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads |= 1ULL << VIRTIO_NET_F_GUEST_CSUM;
 
         return virtnet_set_guest_offloads(vi, offloads);
 }
@@ -2365,8 +2361,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
             && (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
-                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO))) {
-                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO, disable LRO first");
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
+                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
                 return -EOPNOTSUPP;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a1c2801ded10..7e49342bae38 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6867,7 +6867,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         u32 bitmap;
 
         if (drop) {
-                if (vif->type == NL80211_IFTYPE_STATION) {
+                if (vif && vif->type == NL80211_IFTYPE_STATION) {
                         bitmap = ~(1 << WMI_MGMT_TID);
                         list_for_each_entry(arvif, &ar->arvifs, list) {
                                 if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1e3b5f4a4cf9..f23cb2f3d296 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1251,6 +1251,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         struct ath_vif *avp = (void *)vif->drv_priv;
         struct ath_node *an = &avp->mcast_node;
 
+        mutex_lock(&sc->mutex);
         if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
                 if (sc->cur_chan->nvifs >= 1) {
                         mutex_unlock(&sc->mutex);
@@ -1259,8 +1260,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 sc->tx99_vif = vif;
         }
 
-        mutex_lock(&sc->mutex);
-
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
         sc->cur_chan->nvifs++;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 230a378c26fc..7f0a5bade70a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6005,7 +6005,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
                          * for subsequent chanspecs.
                          */
                         channel->flags = IEEE80211_CHAN_NO_HT40 |
-                                         IEEE80211_CHAN_NO_80MHZ;
+                                         IEEE80211_CHAN_NO_80MHZ |
+                                         IEEE80211_CHAN_NO_160MHZ;
                         ch.bw = BRCMU_CHAN_BW_20;
                         cfg->d11inf.encchspec(&ch);
                         chaninfo = ch.chspec;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
index e7584b842dce..eb5db94f5745 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_160:
+                ch->bw = BRCMU_CHAN_BW_160;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
                 switch (ch->sb) {
                 case BRCMU_CHAN_SB_LLL:
                         ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 2439e98431ee..7492dfb6729b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,7 +83,7 @@
 #define ACPI_WRDS_WIFI_DATA_SIZE        (ACPI_SAR_TABLE_SIZE + 2)
 #define ACPI_EWRD_WIFI_DATA_SIZE        ((ACPI_SAR_PROFILE_NUM - 1) * \
                                          ACPI_SAR_TABLE_SIZE + 3)
-#define ACPI_WGDS_WIFI_DATA_SIZE        18
+#define ACPI_WGDS_WIFI_DATA_SIZE        19
 #define ACPI_WRDD_WIFI_DATA_SIZE        2
 #define ACPI_SPLC_WIFI_DATA_SIZE        2
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index 6b95d0e75889..2b8b50a77990 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -154,7 +154,11 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
                         const struct iwl_fw_runtime_ops *ops, void *ops_ctx,
                         struct dentry *dbgfs_dir);
 
-void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt);
+static inline void iwl_fw_runtime_free(struct iwl_fw_runtime *fwrt)
+{
+        kfree(fwrt->dump.d3_debug_data);
+        fwrt->dump.d3_debug_data = NULL;
+}
 
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index dade206d5511..2ba890445c35 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -893,7 +893,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
         IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
-                     ACPI_WGDS_TABLE_SIZE !=  ACPI_WGDS_WIFI_DATA_SIZE);
+                     ACPI_WGDS_TABLE_SIZE + 1 !=  ACPI_WGDS_WIFI_DATA_SIZE);
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES);
 
@@ -928,6 +928,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
         return -ENOENT;
 }
 
+static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
+{
+        return -ENOENT;
+}
+
 static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 {
         return 0;
@@ -954,8 +959,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
                 IWL_DEBUG_RADIO(mvm,
                                 "WRDS SAR BIOS table invalid or unavailable. (%d)\n",
                                 ret);
-                /* if not available, don't fail and don't bother with EWRD */
-                return 0;
+                /*
+                 * If not available, don't fail and don't bother with EWRD.
+                 * Return 1 to tell that we can't use WGDS either.
+                 */
+                return 1;
         }
 
         ret = iwl_mvm_sar_get_ewrd_table(mvm);
@@ -968,9 +976,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
         /* choose profile 1 (WRDS) as default for both chains */
         ret = iwl_mvm_sar_select_profile(mvm, 1, 1);
 
-        /* if we don't have profile 0 from BIOS, just skip it */
+        /*
+         * If we don't have profile 0 from BIOS, just skip it.  This
+         * means that SAR Geo will not be enabled either, even if we
+         * have other valid profiles.
+         */
         if (ret == -ENOENT)
-                return 0;
+                return 1;
 
         return ret;
 }
@@ -1168,11 +1180,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
         ret = iwl_mvm_sar_init(mvm);
-        if (ret)
-                goto error;
+        if (ret == 0) {
+                ret = iwl_mvm_sar_geo_init(mvm);
+        } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) {
+                /*
+                 * If basic SAR is not available, we check for WGDS,
+                 * which should *not* be available either.  If it is
+                 * available, issue an error, because we can't use SAR
+                 * Geo without basic SAR.
+                 */
+                IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n");
+        }
 
-        ret = iwl_mvm_sar_geo_init(mvm);
-        if (ret)
+        if (ret < 0)
                 goto error;
 
         iwl_mvm_leds_sync(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 505b0385d800..00f831d88366 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -301,8 +301,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
                 goto out;
         }
 
-        if (changed)
-                *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
+        if (changed) {
+                u32 status = le32_to_cpu(resp->status);
+
+                *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
+                            status == MCC_RESP_ILLEGAL);
+        }
 
         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                       __le32_to_cpu(resp->n_channels),
@@ -4444,10 +4448,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
         }
 
-        if (!fw_has_capa(&mvm->fw->ucode_capa,
-                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
-                return;
-
         /* if beacon filtering isn't on mac80211 does it anyway */
         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
index 3633f27d048a..6fc5cc1f2b5b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
@@ -539,9 +539,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
         }
 
         IWL_DEBUG_LAR(mvm,
-                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n",
-                      status, mcc, mcc >> 8, mcc & 0xff,
-                      !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels);
+                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n",
+                      status, mcc, mcc >> 8, mcc & 0xff, n_channels);
 
 exit:
         iwl_free_resp(&cmd);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 0e2092526fae..af3fba10abc1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -858,6 +858,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         iwl_mvm_thermal_exit(mvm);
  out_free:
         iwl_fw_flush_dump(&mvm->fwrt);
+        iwl_fw_runtime_free(&mvm->fwrt);
 
         if (iwlmvm_mod_params.init_dbg)
                 return op_mode;
@@ -910,6 +911,7 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_mvm_tof_clean(mvm);
 
+        iwl_fw_runtime_free(&mvm->fwrt);
         mutex_destroy(&mvm->mutex);
         mutex_destroy(&mvm->d0i3_suspend_mutex);
 
diff --git a/drivers/net/wireless/mediatek/mt76/Kconfig b/drivers/net/wireless/mediatek/mt76/Kconfig
index 0ccbcd7e887d..c30d8f5bbf2a 100644
--- a/drivers/net/wireless/mediatek/mt76/Kconfig
+++ b/drivers/net/wireless/mediatek/mt76/Kconfig
@@ -1,6 +1,12 @@
 config MT76_CORE
         tristate
 
+config MT76_LEDS
+        bool
+        depends on MT76_CORE
+        depends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS
+        default y
+
 config MT76_USB
         tristate
         depends on MT76_CORE
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 2a699e8b79bf..7d219ff2d480 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -345,9 +345,11 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
         mt76_check_sband(dev, NL80211_BAND_2GHZ);
         mt76_check_sband(dev, NL80211_BAND_5GHZ);
 
-        ret = mt76_led_init(dev);
-        if (ret)
-                return ret;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                ret = mt76_led_init(dev);
+                if (ret)
+                        return ret;
+        }
 
         return ieee80211_register_hw(hw);
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h
index 47c42c607964..7806963b1905 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h
@@ -71,7 +71,6 @@ struct mt76x02_dev {
         struct mac_address macaddr_list[8];
 
         struct mutex phy_mutex;
-        struct mutex mutex;
 
         u8 txdone_seq;
         DECLARE_KFIFO_PTR(txstatus_fifo, struct mt76x02_tx_status);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
index 3824290b219d..fd125722d1fb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
@@ -507,8 +507,10 @@ int mt76x2_register_device(struct mt76x02_dev *dev)
         mt76x2_dfs_init_detector(dev);
 
         /* init led callbacks */
-        dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
-        dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
+                dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        }
 
         ret = mt76_register_device(&dev->mt76, true, mt76x02_rates,
                                    ARRAY_SIZE(mt76x02_rates));
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
index 034a06295668..3f001bd6806c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
@@ -272,9 +272,9 @@ mt76x2_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
         if (val != ~0 && val > 0xffff)
                 return -EINVAL;
 
-        mutex_lock(&dev->mutex);
+        mutex_lock(&dev->mt76.mutex);
         mt76x2_mac_set_tx_protection(dev, val);
-        mutex_unlock(&dev->mutex);
+        mutex_unlock(&dev->mt76.mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 4c2154b9e6a3..bd10165d7eec 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -285,7 +285,7 @@ static int wl1271_probe(struct sdio_func *func,
         struct resource res[2];
         mmc_pm_flag_t mmcflags;
         int ret = -ENOMEM;
-        int irq, wakeirq;
+        int irq, wakeirq, num_irqs;
         const char *chip_family;
 
         /* We are only able to handle the wlan function */
@@ -353,12 +353,17 @@ static int wl1271_probe(struct sdio_func *func,
                        irqd_get_trigger_type(irq_get_irq_data(irq));
         res[0].name = "irq";
 
-        res[1].start = wakeirq;
-        res[1].flags = IORESOURCE_IRQ |
-                       irqd_get_trigger_type(irq_get_irq_data(wakeirq));
-        res[1].name = "wakeirq";
 
-        ret = platform_device_add_resources(glue->core, res, ARRAY_SIZE(res));
+        if (wakeirq > 0) {
+                res[1].start = wakeirq;
+                res[1].flags = IORESOURCE_IRQ |
+                               irqd_get_trigger_type(irq_get_irq_data(wakeirq));
+                res[1].name = "wakeirq";
+                num_irqs = 2;
+        } else {
+                num_irqs = 1;
+        }
+        ret = platform_device_add_resources(glue->core, res, num_irqs);
         if (ret) {
                 dev_err(glue->dev, "can't add resources\n");
                 goto out_dev_put;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 2e65be8b1387..3cf1b773158e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1519,8 +1519,10 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
         if (ns->ndev)
                 nvme_nvm_update_nvm_info(ns);
 #ifdef CONFIG_NVME_MULTIPATH
-        if (ns->head->disk)
+        if (ns->head->disk) {
                 nvme_update_disk_info(ns->head->disk, ns, id);
+                blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
+        }
 #endif
 }
 
@@ -3312,6 +3314,9 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns, *next;
         LIST_HEAD(ns_list);
 
+        /* prevent racing with ns scanning */
+        flush_work(&ctrl->scan_work);
+
         /*
          * The dead states indicates the controller was not gracefully
          * disconnected. In that case, we won't be able to flush any data while
@@ -3474,7 +3479,6 @@ void nvme_stop_ctrl(struct nvme_ctrl *ctrl)
         nvme_mpath_stop(ctrl);
         nvme_stop_keep_alive(ctrl);
         flush_work(&ctrl->async_event_work);
-        flush_work(&ctrl->scan_work);
         cancel_work_sync(&ctrl->fw_act_work);
         if (ctrl->ops->stop_ctrl)
                 ctrl->ops->stop_ctrl(ctrl);
@@ -3583,7 +3587,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
 
         return 0;
 out_free_name:
-        kfree_const(dev->kobj.name);
+        kfree_const(ctrl->device->kobj.name);
 out_release_instance:
         ida_simple_remove(&nvme_instance_ida, ctrl->instance);
 out:
@@ -3605,7 +3609,7 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         down_read(&ctrl->namespaces_rwsem);
 
         /* Forcibly unquiesce queues to avoid blocking dispatch */
-        if (ctrl->admin_q)
+        if (ctrl->admin_q && !blk_queue_dying(ctrl->admin_q))
                 blk_mq_unquiesce_queue(ctrl->admin_q);
 
         list_for_each_entry(ns, &ctrl->namespaces, list)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 0b70c8bab045..feb86b59170e 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -152,6 +152,7 @@ struct nvme_fc_ctrl {
 
         bool                    ioq_live;
         bool                    assoc_active;
+        atomic_t                err_work_active;
         u64                     association_id;
 
         struct list_head        ctrl_list;      /* rport->ctrl_list */
@@ -160,6 +161,7 @@ struct nvme_fc_ctrl {
         struct blk_mq_tag_set   tag_set;
 
         struct delayed_work     connect_work;
+        struct work_struct      err_work;
 
         struct kref             ref;
         u32                     flags;
@@ -1531,6 +1533,10 @@ nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
         int i;
 
+        /* ensure we've initialized the ops once */
+        if (!(aen_op->flags & FCOP_FLAGS_AEN))
+                return;
+
         for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
                 __nvme_fc_abort_op(ctrl, aen_op);
 }
@@ -1746,12 +1752,12 @@ nvme_fc_init_request(struct blk_mq_tag_set *set, struct request *rq,
         struct nvme_fc_queue *queue = &ctrl->queues[queue_idx];
         int res;
 
-        nvme_req(rq)->ctrl = &ctrl->ctrl;
         res = __nvme_fc_init_request(ctrl, queue, &op->op, rq, queue->rqcnt++);
         if (res)
                 return res;
         op->op.fcp_req.first_sgl = &op->sgl[0];
         op->op.fcp_req.private = &op->priv[0];
+        nvme_req(rq)->ctrl = &ctrl->ctrl;
         return res;
 }
 
@@ -2049,7 +2055,25 @@ nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl)
 static void
 nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
 {
-        /* only proceed if in LIVE state - e.g. on first error */
+        int active;
+
+        /*
+         * if an error (io timeout, etc) while (re)connecting,
+         * it's an error on creating the new association.
+         * Start the error recovery thread if it hasn't already
+         * been started. It is expected there could be multiple
+         * ios hitting this path before things are cleaned up.
+         */
+        if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+                active = atomic_xchg(&ctrl->err_work_active, 1);
+                if (!active && !schedule_work(&ctrl->err_work)) {
+                        atomic_set(&ctrl->err_work_active, 0);
+                        WARN_ON(1);
+                }
+                return;
+        }
+
+        /* Otherwise, only proceed if in LIVE state - e.g. on first error */
         if (ctrl->ctrl.state != NVME_CTRL_LIVE)
                 return;
 
@@ -2814,6 +2838,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
         /*
          * kill the association on the link side.  this will block
@@ -2866,23 +2891,30 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
 }
 
 static void
-nvme_fc_reset_ctrl_work(struct work_struct *work)
+__nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
 {
-        struct nvme_fc_ctrl *ctrl =
-                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
-        int ret;
-
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
+            !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
                         "to CONNECTING\n", ctrl->cnum);
-                return;
-        }
+}
+
+static void
+nvme_fc_reset_ctrl_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
+        int ret;
+
+        __nvme_fc_terminate_io(ctrl);
+
+        nvme_stop_ctrl(&ctrl->ctrl);
 
         if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE)
                 ret = nvme_fc_create_association(ctrl);
@@ -2897,6 +2929,24 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
                         ctrl->cnum);
 }
 
+static void
+nvme_fc_connect_err_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                        container_of(work, struct nvme_fc_ctrl, err_work);
+
+        __nvme_fc_terminate_io(ctrl);
+
+        atomic_set(&ctrl->err_work_active, 0);
+
+        /*
+         * Rescheduling the connection after recovering
+         * from the io error is left to the reconnect work
+         * item, which is what should have stalled waiting on
+         * the io that had the error that scheduled this work.
+         */
+}
+
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
@@ -3007,6 +3057,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         ctrl->cnum = idx;
         ctrl->ioq_live = false;
         ctrl->assoc_active = false;
+        atomic_set(&ctrl->err_work_active, 0);
         init_waitqueue_head(&ctrl->ioabort_wait);
 
         get_device(ctrl->dev);
@@ -3014,6 +3065,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
         INIT_WORK(&ctrl->ctrl.reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
+        INIT_WORK(&ctrl->err_work, nvme_fc_connect_err_work);
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -3103,6 +3155,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 fail_ctrl:
         nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING);
         cancel_work_sync(&ctrl->ctrl.reset_work);
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
 
         ctrl->ctrl.opts = NULL;
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 5e3cc8c59a39..9901afd804ce 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -285,6 +285,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
         blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
         /* set to a default value for 512 until disk is validated */
         blk_queue_logical_block_size(q, 512);
+        blk_set_stacking_limits(&q->limits);
 
         /* we need to propagate up the VMC settings */
         if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index cee79cb388af..081cbdcce880 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -531,6 +531,9 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
 static inline int nvme_mpath_init(struct nvme_ctrl *ctrl,
                 struct nvme_id_ctrl *id)
 {
+        if (ctrl->subsys->cmic & (1 << 3))
+                dev_warn(ctrl->device,
+"Please enable CONFIG_NVME_MULTIPATH for full support of multi-port devices.\n");
         return 0;
 }
 static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index d181cafedc58..ab6ec7295bf9 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
         qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
         if (ib_dma_mapping_error(ibdev, qe->dma)) {
                 kfree(qe->data);
+                qe->data = NULL;
                 return -ENOMEM;
         }
 
@@ -823,6 +824,7 @@ out_free_tagset:
 out_free_async_qe:
         nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
                 sizeof(struct nvme_command), DMA_TO_DEVICE);
+        ctrl->async_event_sqe.data = NULL;
 out_free_queue:
         nvme_rdma_free_queue(&ctrl->queues[0]);
         return error;
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index f4efe289dc7b..a5f9bbce863f 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -420,7 +420,7 @@ static void nvmet_p2pmem_ns_add_p2p(struct nvmet_ctrl *ctrl,
         struct pci_dev *p2p_dev;
         int ret;
 
-        if (!ctrl->p2p_client)
+        if (!ctrl->p2p_client || !ns->use_p2pmem)
                 return;
 
         if (ns->p2p_dev) {
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index ddce100be57a..3f7971d3706d 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -122,7 +122,6 @@ struct nvmet_rdma_device {
         int                     inline_page_count;
 };
 
-static struct workqueue_struct *nvmet_rdma_delete_wq;
 static bool nvmet_rdma_use_srq;
 module_param_named(use_srq, nvmet_rdma_use_srq, bool, 0444);
 MODULE_PARM_DESC(use_srq, "Use shared receive queue.");
@@ -1274,12 +1273,12 @@ static int nvmet_rdma_queue_connect(struct rdma_cm_id *cm_id,
 
         if (queue->host_qid == 0) {
                 /* Let inflight controller teardown complete */
-                flush_workqueue(nvmet_rdma_delete_wq);
+                flush_scheduled_work();
         }
 
         ret = nvmet_rdma_cm_accept(cm_id, queue, &event->param.conn);
         if (ret) {
-                queue_work(nvmet_rdma_delete_wq, &queue->release_work);
+                schedule_work(&queue->release_work);
                 /* Destroying rdma_cm id is not needed here */
                 return 0;
         }
@@ -1344,7 +1343,7 @@ static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
 
         if (disconnect) {
                 rdma_disconnect(queue->cm_id);
-                queue_work(nvmet_rdma_delete_wq, &queue->release_work);
+                schedule_work(&queue->release_work);
         }
 }
 
@@ -1374,7 +1373,7 @@ static void nvmet_rdma_queue_connect_fail(struct rdma_cm_id *cm_id,
         mutex_unlock(&nvmet_rdma_queue_mutex);
 
         pr_err("failed to connect queue %d\n", queue->idx);
-        queue_work(nvmet_rdma_delete_wq, &queue->release_work);
+        schedule_work(&queue->release_work);
 }
 
 /**
@@ -1656,17 +1655,8 @@ static int __init nvmet_rdma_init(void)
         if (ret)
                 goto err_ib_client;
 
-        nvmet_rdma_delete_wq = alloc_workqueue("nvmet-rdma-delete-wq",
-                        WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS, 0);
-        if (!nvmet_rdma_delete_wq) {
-                ret = -ENOMEM;
-                goto err_unreg_transport;
-        }
-
         return 0;
 
-err_unreg_transport:
-        nvmet_unregister_transport(&nvmet_rdma_ops);
 err_ib_client:
         ib_unregister_client(&nvmet_rdma_ib_client);
         return ret;
@@ -1674,7 +1664,6 @@ err_ib_client:
 
 static void __exit nvmet_rdma_exit(void)
 {
-        destroy_workqueue(nvmet_rdma_delete_wq);
         nvmet_unregister_transport(&nvmet_rdma_ops);
         ib_unregister_client(&nvmet_rdma_ib_client);
         WARN_ON_ONCE(!list_empty(&nvmet_rdma_queue_list));
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 9b18ce90f907..27f67dfa649d 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -44,6 +44,7 @@ struct nvmem_cell {
         int                     bytes;
         int                     bit_offset;
         int                     nbits;
+        struct device_node      *np;
         struct nvmem_device     *nvmem;
         struct list_head        node;
 };
@@ -298,6 +299,7 @@ static void nvmem_cell_drop(struct nvmem_cell *cell)
         mutex_lock(&nvmem_mutex);
         list_del(&cell->node);
         mutex_unlock(&nvmem_mutex);
+        of_node_put(cell->np);
         kfree(cell->name);
         kfree(cell);
 }
@@ -530,6 +532,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
                         return -ENOMEM;
 
                 cell->nvmem = nvmem;
+                cell->np = of_node_get(child);
                 cell->offset = be32_to_cpup(addr++);
                 cell->bytes = be32_to_cpup(addr);
                 cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
@@ -960,14 +963,13 @@ out:
 
 #if IS_ENABLED(CONFIG_OF)
 static struct nvmem_cell *
-nvmem_find_cell_by_index(struct nvmem_device *nvmem, int index)
+nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
 {
         struct nvmem_cell *cell = NULL;
-        int i = 0;
 
         mutex_lock(&nvmem_mutex);
         list_for_each_entry(cell, &nvmem->cells, node) {
-                if (index == i++)
+                if (np == cell->np)
                         break;
         }
         mutex_unlock(&nvmem_mutex);
@@ -1011,7 +1013,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
-        cell = nvmem_find_cell_by_index(nvmem, index);
+        cell = nvmem_find_cell_by_node(nvmem, cell_np);
         if (!cell) {
                 __nvmem_device_put(nvmem);
                 return ERR_PTR(-ENOENT);
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 0f27fad9fe94..5592437bb3d1 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -149,9 +149,11 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
          * set by the driver.
          */
         mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
-        dev->bus_dma_mask = mask;
         dev->coherent_dma_mask &= mask;
         *dev->dma_mask &= mask;
+        /* ...but only set bus mask if we found valid dma-ranges earlier */
+        if (!ret)
+                dev->bus_dma_mask = mask;
 
         coherent = of_dma_is_coherent(np);
         dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c
index 35c64a4295e0..fe6b13608e51 100644
--- a/drivers/of/of_numa.c
+++ b/drivers/of/of_numa.c
@@ -104,9 +104,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map)
                 distance = of_read_number(matrix, 1);
                 matrix++;
 
+                if ((nodea == nodeb && distance != LOCAL_DISTANCE) ||
+                    (nodea != nodeb && distance <= LOCAL_DISTANCE)) {
+                        pr_err("Invalid distance[node%d -> node%d] = %d\n",
+                               nodea, nodeb, distance);
+                        return -EINVAL;
+                }
+
                 numa_set_distance(nodea, nodeb, distance);
-                pr_debug("distance[node%d -> node%d] = %d\n",
-                         nodea, nodeb, distance);
 
                 /* Set default distance of node B->A same as A->B */
                 if (nodeb > nodea)
diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index 5a4b47958073..38a08805a30c 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -579,10 +579,8 @@ int dev_pm_opp_of_add_table_indexed(struct device *dev, int index)
                  */
                 count = of_count_phandle_with_args(dev->of_node,
                                                    "operating-points-v2", NULL);
-                if (count != 1)
-                        return -ENODEV;
-
-                index = 0;
+                if (count == 1)
+                        index = 0;
         }
 
         opp_table = dev_pm_opp_get_opp_table_indexed(dev, index);
diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
index 9e5a9a3112c9..1c69c404df11 100644
--- a/drivers/opp/ti-opp-supply.c
+++ b/drivers/opp/ti-opp-supply.c
@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data)
         int ret;
 
         vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data,
-                                          new_supply_vbb->u_volt);
+                                          new_supply_vdd->u_volt);
+
+        if (new_supply_vdd->u_volt_min < vdd_uv)
+                new_supply_vdd->u_volt_min = vdd_uv;
 
         /* Scaling up? Scale voltage before frequency */
         if (freq > old_freq) {
@@ -414,7 +417,6 @@ static struct platform_driver ti_opp_supply_driver = {
         .probe = ti_opp_supply_probe,
         .driver = {
                    .name = "ti_opp_supply",
-                   .owner = THIS_MODULE,
                    .of_match_table = of_match_ptr(ti_opp_supply_of_match),
                    },
 };
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 2cbef2d7c207..88af6bff945f 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -81,8 +81,6 @@ struct imx6_pcie {
 #define PCIE_PL_PFLR_FORCE_LINK                 (1 << 15)
 #define PCIE_PHY_DEBUG_R0 (PL_OFFSET + 0x28)
 #define PCIE_PHY_DEBUG_R1 (PL_OFFSET + 0x2c)
-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_IN_TRAINING (1 << 29)
-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_UP          (1 << 4)
 
 #define PCIE_PHY_CTRL (PL_OFFSET + 0x114)
 #define PCIE_PHY_CTRL_DATA_LOC 0
@@ -711,12 +709,6 @@ static int imx6_pcie_host_init(struct pcie_port *pp)
         return 0;
 }
 
-static int imx6_pcie_link_up(struct dw_pcie *pci)
-{
-        return dw_pcie_readl_dbi(pci, PCIE_PHY_DEBUG_R1) &
-                        PCIE_PHY_DEBUG_R1_XMLH_LINK_UP;
-}
-
 static const struct dw_pcie_host_ops imx6_pcie_host_ops = {
         .host_init = imx6_pcie_host_init,
 };
@@ -749,7 +741,7 @@ static int imx6_add_pcie_port(struct imx6_pcie *imx6_pcie,
 }
 
 static const struct dw_pcie_ops dw_pcie_ops = {
-        .link_up = imx6_pcie_link_up,
+        /* No special ops needed, but pcie-designware still expects this struct */
 };
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/pci/controller/dwc/pci-layerscape.c b/drivers/pci/controller/dwc/pci-layerscape.c
index 3724d3ef7008..7aa9a82b7ebd 100644
--- a/drivers/pci/controller/dwc/pci-layerscape.c
+++ b/drivers/pci/controller/dwc/pci-layerscape.c
@@ -88,7 +88,7 @@ static void ls_pcie_disable_outbound_atus(struct ls_pcie *pcie)
         int i;
 
         for (i = 0; i < PCIE_IATU_NUM; i++)
-                dw_pcie_disable_atu(pcie->pci, DW_PCIE_REGION_OUTBOUND, i);
+                dw_pcie_disable_atu(pcie->pci, i, DW_PCIE_REGION_OUTBOUND);
 }
 
 static int ls1021_pcie_link_up(struct dw_pcie *pci)
diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
index 1e7b02221eac..de8635af4cde 100644
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -440,7 +440,6 @@ int dw_pcie_ep_raise_msix_irq(struct dw_pcie_ep *ep, u8 func_no,
         tbl_offset = dw_pcie_readl_dbi(pci, reg);
         bir = (tbl_offset & PCI_MSIX_TABLE_BIR);
         tbl_offset &= PCI_MSIX_TABLE_OFFSET;
-        tbl_offset >>= 3;
 
         reg = PCI_BASE_ADDRESS_0 + (4 * bir);
         bar_addr_upper = 0;
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 2a4aa6468579..921db6f80340 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -793,15 +793,10 @@ static void pci_acpi_setup(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
         struct acpi_device *adev = ACPI_COMPANION(dev);
-        int node;
 
         if (!adev)
                 return;
 
-        node = acpi_get_node(adev->handle);
-        if (node != NUMA_NO_NODE)
-                set_dev_node(dev, node);
-
         pci_acpi_optimize_delay(pci_dev, adev->handle);
 
         pci_acpi_add_pm_notifier(adev, pci_dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index d068f11d08a7..c9d8e3c837de 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5556,9 +5556,13 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
         u32 lnkcap2, lnkcap;
 
         /*
-         * PCIe r4.0 sec 7.5.3.18 recommends using the Supported Link
-         * Speeds Vector in Link Capabilities 2 when supported, falling
-         * back to Max Link Speed in Link Capabilities otherwise.
+         * Link Capabilities 2 was added in PCIe r3.0, sec 7.8.18.  The
+         * implementation note there recommends using the Supported Link
+         * Speeds Vector in Link Capabilities 2 when supported.
+         *
+         * Without Link Capabilities 2, i.e., prior to PCIe r3.0, software
+         * should use the Supported Link Speeds field in Link Capabilities,
+         * where only 2.5 GT/s and 5.0 GT/s speeds were defined.
          */
         pcie_capability_read_dword(dev, PCI_EXP_LNKCAP2, &lnkcap2);
         if (lnkcap2) { /* PCIe r3.0-compliant */
@@ -5574,16 +5578,10 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
         }
 
         pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnkcap);
-        if (lnkcap) {
-                if (lnkcap & PCI_EXP_LNKCAP_SLS_16_0GB)
-                        return PCIE_SPEED_16_0GT;
-                else if (lnkcap & PCI_EXP_LNKCAP_SLS_8_0GB)
-                        return PCIE_SPEED_8_0GT;
-                else if (lnkcap & PCI_EXP_LNKCAP_SLS_5_0GB)
-                        return PCIE_SPEED_5_0GT;
-                else if (lnkcap & PCI_EXP_LNKCAP_SLS_2_5GB)
-                        return PCIE_SPEED_2_5GT;
-        }
+        if ((lnkcap & PCI_EXP_LNKCAP_SLS) == PCI_EXP_LNKCAP_SLS_5_0GB)
+                return PCIE_SPEED_5_0GT;
+        else if ((lnkcap & PCI_EXP_LNKCAP_SLS) == PCI_EXP_LNKCAP_SLS_2_5GB)
+                return PCIE_SPEED_2_5GT;
 
         return PCI_SPEED_UNKNOWN;
 }
diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
index 9ce531194f8a..6d4b44b569bc 100644
--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
+++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
@@ -231,6 +231,7 @@ static const struct qusb2_phy_cfg sdm845_phy_cfg = {
         .mask_core_ready = CORE_READY_STATUS,
         .has_pll_override = true,
         .autoresume_en    = BIT(0),
+        .update_tune1_with_efuse = true,
 };
 
 static const char * const qusb2_phy_vreg_names[] = {
@@ -402,10 +403,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 
         /*
          * Read efuse register having TUNE2/1 parameter's high nibble.
-         * If efuse register shows value as 0x0, or if we fail to find
-         * a valid efuse register settings, then use default value
-         * as 0xB for high nibble that we have already set while
-         * configuring phy.
+         * If efuse register shows value as 0x0 (indicating value is not
+         * fused), or if we fail to find a valid efuse register setting,
+         * then use default value for high nibble that we have already
+         * set while configuring the phy.
          */
         val = nvmem_cell_read(qphy->cell, NULL);
         if (IS_ERR(val) || !val[0]) {
@@ -415,12 +416,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 
         /* Fused TUNE1/2 value is the higher nibble only */
         if (cfg->update_tune1_with_efuse)
-                qusb2_setbits(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
-                              val[0] << 0x4);
+                qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
+                                 val[0] << HSTX_TRIM_SHIFT,
+                                 HSTX_TRIM_MASK);
         else
-                qusb2_setbits(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
-                              val[0] << 0x4);
-
+                qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
+                                 val[0] << HSTX_TRIM_SHIFT,
+                                 HSTX_TRIM_MASK);
 }
 
 static int qusb2_phy_set_mode(struct phy *phy, enum phy_mode mode)
diff --git a/drivers/phy/socionext/Kconfig b/drivers/phy/socionext/Kconfig
index 467e8147972b..9c85231a6dbc 100644
--- a/drivers/phy/socionext/Kconfig
+++ b/drivers/phy/socionext/Kconfig
@@ -26,7 +26,8 @@ config PHY_UNIPHIER_USB3
 
 config PHY_UNIPHIER_PCIE
         tristate "Uniphier PHY driver for PCIe controller"
-        depends on (ARCH_UNIPHIER || COMPILE_TEST) && OF
+        depends on ARCH_UNIPHIER || COMPILE_TEST
+        depends on OF && HAS_IOMEM
         default PCIE_UNIPHIER
         select GENERIC_PHY
         help
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index 4ceb06f8a33c..4edeb4cae72a 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = {
 
 static struct meson_bank meson_gxbb_aobus_banks[] = {
         /*   name    first      last       irq    pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0,  GPIOAO_13, 0, 13, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0,  GPIOAO_13, 0, 13, 0,  16, 0, 0,   0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 7dae1d7bf6b0..158f618f1695 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = {
 
 static struct meson_bank meson_gxl_aobus_banks[] = {
         /*   name    first      last      irq   pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0,  GPIOAO_9, 0, 9, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0,  GPIOAO_9, 0, 9, 0,  16, 0, 0,   0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index f8b778a7d471..53d449076dee 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
                         dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
 
                         meson_calc_reg_and_bit(bank, pin, REG_PULL, &reg, &bit);
-                        ret = regmap_update_bits(pc->reg_pull, reg,
+                        ret = regmap_update_bits(pc->reg_pullen, reg,
                                                  BIT(bit), 0);
                         if (ret)
                                 return ret;
diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
index c6d79315218f..86466173114d 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8.c
@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = {
 
 static struct meson_bank meson8_aobus_banks[] = {
         /*   name    first     last         irq    pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16,  0,  0,  0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson8_cbus_pinctrl_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
index bb2a30964fc6..647ad15d5c3c 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = {
 
 static struct meson_bank meson8b_aobus_banks[] = {
         /*   name    first     lastc        irq    pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0,  16, 0, 0,  0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = {
diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c
index e79f2a181ad2..b9ec4a16db1f 100644
--- a/drivers/rtc/hctosys.c
+++ b/drivers/rtc/hctosys.c
@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void)
         tv64.tv_sec = rtc_tm_to_time64(&tm);
 
 #if BITS_PER_LONG == 32
-        if (tv64.tv_sec > INT_MAX)
+        if (tv64.tv_sec > INT_MAX) {
+                err = -ERANGE;
                 goto err_read;
+        }
 #endif
 
         err = do_settimeofday64(&tv64);
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index df0c5776d49b..a5a19ff10535 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t)
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned char   rtc_control;
 
+        /* This not only a rtc_op, but also called directly */
         if (!is_valid_irq(cmos->irq))
                 return -EIO;
 
@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
         unsigned char mon, mday, hrs, min, sec, rtc_control;
         int ret;
 
+        /* This not only a rtc_op, but also called directly */
         if (!is_valid_irq(cmos->irq))
                 return -EIO;
 
@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned long   flags;
 
-        if (!is_valid_irq(cmos->irq))
-                return -EINVAL;
-
         spin_lock_irqsave(&rtc_lock, flags);
 
         if (enabled)
@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = {
         .alarm_irq_enable       = cmos_alarm_irq_enable,
 };
 
+static const struct rtc_class_ops cmos_rtc_ops_no_alarm = {
+        .read_time              = cmos_read_time,
+        .set_time               = cmos_set_time,
+        .proc                   = cmos_procfs,
+};
+
 /*----------------------------------------------------------------*/
 
 /*
@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
                         dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
                         goto cleanup1;
                 }
+
+                cmos_rtc.rtc->ops = &cmos_rtc_ops;
+        } else {
+                cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm;
         }
 
-        cmos_rtc.rtc->ops = &cmos_rtc_ops;
         cmos_rtc.rtc->nvram_old_abi = true;
         retval = rtc_register_device(cmos_rtc.rtc);
         if (retval)
diff --git a/drivers/rtc/rtc-hid-sensor-time.c b/drivers/rtc/rtc-hid-sensor-time.c
index 2751dba850c6..3e1abb455472 100644
--- a/drivers/rtc/rtc-hid-sensor-time.c
+++ b/drivers/rtc/rtc-hid-sensor-time.c
@@ -213,7 +213,7 @@ static int hid_rtc_read_time(struct device *dev, struct rtc_time *tm)
         /* get a report with all values through requesting one value */
         sensor_hub_input_attr_get_raw_value(time_state->common_attributes.hsdev,
                         HID_USAGE_SENSOR_TIME, hid_time_addresses[0],
-                        time_state->info[0].report_id, SENSOR_HUB_SYNC);
+                        time_state->info[0].report_id, SENSOR_HUB_SYNC, false);
         /* wait for all values (event) */
         ret = wait_for_completion_killable_timeout(
                         &time_state->comp_last_time, HZ*6);
diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 9f99a0966550..7cb786d76e3c 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context,
         memcpy(buf + 1, val, val_size);
 
         ret = i2c_master_send(client, buf, val_size + 1);
+
+        kfree(buf);
+
         if (ret != val_size + 1)
                 return ret < 0 ? ret : -EIO;
 
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index fd77e46eb3b2..70a006ba4d05 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -387,8 +387,10 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
                  * orb specified one of the unsupported formats, we defer
                  * checking for IDAWs in unsupported formats to here.
                  */
-                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw))
+                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw)) {
+                        kfree(p);
                         return -EOPNOTSUPP;
+                }
 
                 if ((!ccw_is_chain(ccw)) && (!ccw_is_tic(ccw)))
                         break;
@@ -528,7 +530,7 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
 
         ret = pfn_array_alloc_pin(pat->pat_pa, cp->mdev, ccw->cda, ccw->count);
         if (ret < 0)
-                goto out_init;
+                goto out_unpin;
 
         /* Translate this direct ccw to a idal ccw. */
         idaws = kcalloc(ret, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index f47d16b5810b..a10cec0e86eb 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -22,7 +22,7 @@
 #include "vfio_ccw_private.h"
 
 struct workqueue_struct *vfio_ccw_work_q;
-struct kmem_cache *vfio_ccw_io_region;
+static struct kmem_cache *vfio_ccw_io_region;
 
 /*
  * Helpers
@@ -134,14 +134,14 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
         if (ret)
                 goto out_free;
 
-        ret = vfio_ccw_mdev_reg(sch);
-        if (ret)
-                goto out_disable;
-
         INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo);
         atomic_set(&private->avail, 1);
         private->state = VFIO_CCW_STATE_STANDBY;
 
+        ret = vfio_ccw_mdev_reg(sch);
+        if (ret)
+                goto out_disable;
+
         return 0;
 
 out_disable:
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 048665e4f13d..9f5a201c4c87 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -775,6 +775,8 @@ static int ap_device_probe(struct device *dev)
                 drvres = ap_drv->flags & AP_DRIVER_FLAG_DEFAULT;
                 if (!!devres != !!drvres)
                         return -ENODEV;
+                /* (re-)init queue's state machine */
+                ap_queue_reinit_state(to_ap_queue(dev));
         }
 
         /* Add queue/card to list of active queues/cards */
@@ -807,6 +809,8 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (is_queue_dev(dev))
+                ap_queue_remove(to_ap_queue(dev));
         if (ap_drv->remove)
                 ap_drv->remove(ap_dev);
 
@@ -1444,10 +1448,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Start with a device reset */
-                        spin_lock_bh(&aq->lock);
-                        ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
-                        spin_unlock_bh(&aq->lock);
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 3eed1b36c876..bfc66e4a9de1 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -254,6 +254,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);
 void ap_queue_remove(struct ap_queue *aq);
 void ap_queue_suspend(struct ap_device *ap_dev);
 void ap_queue_resume(struct ap_device *ap_dev);
+void ap_queue_reinit_state(struct ap_queue *aq);
 
 struct ap_card *ap_card_create(int id, int queue_depth, int raw_device_type,
                                int comp_device_type, unsigned int functions);
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 66f7334bcb03..0aa4b3ccc948 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -718,5 +718,20 @@ void ap_queue_remove(struct ap_queue *aq)
 {
         ap_flush_queue(aq);
         del_timer_sync(&aq->timeout);
+
+        /* reset with zero, also clears irq registration */
+        spin_lock_bh(&aq->lock);
+        ap_zapq(aq->qid);
+        aq->state = AP_STATE_BORKED;
+        spin_unlock_bh(&aq->lock);
 }
 EXPORT_SYMBOL(ap_queue_remove);
+
+void ap_queue_reinit_state(struct ap_queue *aq)
+{
+        spin_lock_bh(&aq->lock);
+        aq->state = AP_STATE_RESET_START;
+        ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
+        spin_unlock_bh(&aq->lock);
+}
+EXPORT_SYMBOL(ap_queue_reinit_state);
diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
index 146f54f5cbb8..c50f3e86cc74 100644
--- a/drivers/s390/crypto/zcrypt_cex2a.c
+++ b/drivers/s390/crypto/zcrypt_cex2a.c
@@ -196,7 +196,6 @@ static void zcrypt_cex2a_queue_remove(struct ap_device *ap_dev)
         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
         struct zcrypt_queue *zq = aq->private;
 
-        ap_queue_remove(aq);
         if (zq)
                 zcrypt_queue_unregister(zq);
 }
diff --git a/drivers/s390/crypto/zcrypt_cex2c.c b/drivers/s390/crypto/zcrypt_cex2c.c
index 546f67676734..35c7c6672713 100644
--- a/drivers/s390/crypto/zcrypt_cex2c.c
+++ b/drivers/s390/crypto/zcrypt_cex2c.c
@@ -251,7 +251,6 @@ static void zcrypt_cex2c_queue_remove(struct ap_device *ap_dev)
         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
         struct zcrypt_queue *zq = aq->private;
 
-        ap_queue_remove(aq);
         if (zq)
                 zcrypt_queue_unregister(zq);
 }
diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
index f9d4c6c7521d..582ffa7e0f18 100644
--- a/drivers/s390/crypto/zcrypt_cex4.c
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -275,7 +275,6 @@ static void zcrypt_cex4_queue_remove(struct ap_device *ap_dev)
         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
         struct zcrypt_queue *zq = aq->private;
 
-        ap_queue_remove(aq);
         if (zq)
                 zcrypt_queue_unregister(zq);
 }
diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index f96ec68af2e5..dcbf5c857743 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -415,9 +415,9 @@ static irqreturn_t ism_handle_irq(int irq, void *data)
                         break;
 
                 clear_bit_inv(bit, bv);
+                ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
                 barrier();
                 smcd_handle_irq(ism->smcd, bit + ISM_DMB_BIT_OFFSET);
-                ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
         }
 
         if (ism->sba->e) {
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 6843bc7ee9f2..04e294d1d16d 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -87,6 +87,18 @@ struct qeth_dbf_info {
 #define SENSE_RESETTING_EVENT_BYTE 1
 #define SENSE_RESETTING_EVENT_FLAG 0x80
 
+static inline u32 qeth_get_device_id(struct ccw_device *cdev)
+{
+        struct ccw_dev_id dev_id;
+        u32 id;
+
+        ccw_device_get_id(cdev, &dev_id);
+        id = dev_id.devno;
+        id |= (u32) (dev_id.ssid << 16);
+
+        return id;
+}
+
 /*
  * Common IO related definitions
  */
@@ -97,7 +109,8 @@ struct qeth_dbf_info {
 #define CARD_RDEV_ID(card) dev_name(&card->read.ccwdev->dev)
 #define CARD_WDEV_ID(card) dev_name(&card->write.ccwdev->dev)
 #define CARD_DDEV_ID(card) dev_name(&card->data.ccwdev->dev)
-#define CHANNEL_ID(channel) dev_name(&channel->ccwdev->dev)
+#define CCW_DEVID(cdev)         (qeth_get_device_id(cdev))
+#define CARD_DEVID(card)        (CCW_DEVID(CARD_RDEV(card)))
 
 /**
  * card stuff
@@ -830,6 +843,11 @@ struct qeth_trap_id {
 /*some helper functions*/
 #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "")
 
+static inline bool qeth_netdev_is_registered(struct net_device *dev)
+{
+        return dev->netdev_ops != NULL;
+}
+
 static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf,
                                           unsigned int elements)
 {
@@ -973,7 +991,7 @@ int qeth_wait_for_threads(struct qeth_card *, unsigned long);
 int qeth_do_run_thread(struct qeth_card *, unsigned long);
 void qeth_clear_thread_start_bit(struct qeth_card *, unsigned long);
 void qeth_clear_thread_running_bit(struct qeth_card *, unsigned long);
-int qeth_core_hardsetup_card(struct qeth_card *);
+int qeth_core_hardsetup_card(struct qeth_card *card, bool *carrier_ok);
 void qeth_print_status_message(struct qeth_card *);
 int qeth_init_qdio_queues(struct qeth_card *);
 int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
@@ -1028,11 +1046,6 @@ int qeth_configure_cq(struct qeth_card *, enum qeth_cq);
 int qeth_hw_trap(struct qeth_card *, enum qeth_diags_trap_action);
 void qeth_trace_features(struct qeth_card *);
 void qeth_close_dev(struct qeth_card *);
-int qeth_send_setassparms(struct qeth_card *, struct qeth_cmd_buffer *, __u16,
-                          long,
-                          int (*reply_cb)(struct qeth_card *,
-                                          struct qeth_reply *, unsigned long),
-                          void *);
 int qeth_setassparms_cb(struct qeth_card *, struct qeth_reply *, unsigned long);
 struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
                                                  enum qeth_ipa_funcs,
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 3274f13aad57..254065271867 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -167,6 +167,8 @@ const char *qeth_get_cardname_short(struct qeth_card *card)
                                 return "OSD_1000";
                         case QETH_LINK_TYPE_10GBIT_ETH:
                                 return "OSD_10GIG";
+                        case QETH_LINK_TYPE_25GBIT_ETH:
+                                return "OSD_25GIG";
                         case QETH_LINK_TYPE_LANE_ETH100:
                                 return "OSD_FE_LANE";
                         case QETH_LINK_TYPE_LANE_TR:
@@ -554,8 +556,8 @@ static int __qeth_issue_next_read(struct qeth_card *card)
         if (!iob) {
                 dev_warn(&card->gdev->dev, "The qeth device driver "
                         "failed to recover an error on the device\n");
-                QETH_DBF_MESSAGE(2, "%s issue_next_read failed: no iob "
-                        "available\n", dev_name(&card->gdev->dev));
+                QETH_DBF_MESSAGE(2, "issue_next_read on device %x failed: no iob available\n",
+                                 CARD_DEVID(card));
                 return -ENOMEM;
         }
         qeth_setup_ccw(channel->ccw, CCW_CMD_READ, QETH_BUFSIZE, iob->data);
@@ -563,8 +565,8 @@ static int __qeth_issue_next_read(struct qeth_card *card)
         rc = ccw_device_start(channel->ccwdev, channel->ccw,
                               (addr_t) iob, 0, 0);
         if (rc) {
-                QETH_DBF_MESSAGE(2, "%s error in starting next read ccw! "
-                        "rc=%i\n", dev_name(&card->gdev->dev), rc);
+                QETH_DBF_MESSAGE(2, "error %i on device %x when starting next read ccw!\n",
+                                 rc, CARD_DEVID(card));
                 atomic_set(&channel->irq_pending, 0);
                 card->read_or_write_problem = 1;
                 qeth_schedule_recovery(card);
@@ -613,16 +615,14 @@ static void qeth_issue_ipa_msg(struct qeth_ipa_cmd *cmd, int rc,
         const char *ipa_name;
         int com = cmd->hdr.command;
         ipa_name = qeth_get_ipa_cmd_name(com);
+
         if (rc)
-                QETH_DBF_MESSAGE(2, "IPA: %s(x%X) for %s/%s returned "
-                                "x%X \"%s\"\n",
-                                ipa_name, com, dev_name(&card->gdev->dev),
-                                QETH_CARD_IFNAME(card), rc,
-                                qeth_get_ipa_msg(rc));
+                QETH_DBF_MESSAGE(2, "IPA: %s(%#x) for device %x returned %#x \"%s\"\n",
+                                 ipa_name, com, CARD_DEVID(card), rc,
+                                 qeth_get_ipa_msg(rc));
         else
-                QETH_DBF_MESSAGE(5, "IPA: %s(x%X) for %s/%s succeeded\n",
-                                ipa_name, com, dev_name(&card->gdev->dev),
-                                QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(5, "IPA: %s(%#x) for device %x succeeded\n",
+                                 ipa_name, com, CARD_DEVID(card));
 }
 
 static struct qeth_ipa_cmd *qeth_check_ipa_data(struct qeth_card *card,
@@ -711,7 +711,7 @@ static int qeth_check_idx_response(struct qeth_card *card,
 
         QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN);
         if ((buffer[2] & 0xc0) == 0xc0) {
-                QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#02x\n",
+                QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#04x\n",
                                  buffer[4]);
                 QETH_CARD_TEXT(card, 2, "ckidxres");
                 QETH_CARD_TEXT(card, 2, " idxterm");
@@ -972,8 +972,8 @@ static int qeth_get_problem(struct qeth_card *card, struct ccw_device *cdev,
                 QETH_CARD_TEXT(card, 2, "CGENCHK");
                 dev_warn(&cdev->dev, "The qeth device driver "
                         "failed to recover an error on the device\n");
-                QETH_DBF_MESSAGE(2, "%s check on device dstat=x%x, cstat=x%x\n",
-                        dev_name(&cdev->dev), dstat, cstat);
+                QETH_DBF_MESSAGE(2, "check on channel %x with dstat=%#x, cstat=%#x\n",
+                                 CCW_DEVID(cdev), dstat, cstat);
                 print_hex_dump(KERN_WARNING, "qeth: irb ", DUMP_PREFIX_OFFSET,
                                 16, 1, irb, 64, 1);
                 return 1;
@@ -1013,8 +1013,8 @@ static long qeth_check_irb_error(struct qeth_card *card,
 
         switch (PTR_ERR(irb)) {
         case -EIO:
-                QETH_DBF_MESSAGE(2, "%s i/o-error on device\n",
-                        dev_name(&cdev->dev));
+                QETH_DBF_MESSAGE(2, "i/o-error on channel %x\n",
+                                 CCW_DEVID(cdev));
                 QETH_CARD_TEXT(card, 2, "ckirberr");
                 QETH_CARD_TEXT_(card, 2, "  rc%d", -EIO);
                 break;
@@ -1031,8 +1031,8 @@ static long qeth_check_irb_error(struct qeth_card *card,
                 }
                 break;
         default:
-                QETH_DBF_MESSAGE(2, "%s unknown error %ld on device\n",
-                        dev_name(&cdev->dev), PTR_ERR(irb));
+                QETH_DBF_MESSAGE(2, "unknown error %ld on channel %x\n",
+                                 PTR_ERR(irb), CCW_DEVID(cdev));
                 QETH_CARD_TEXT(card, 2, "ckirberr");
                 QETH_CARD_TEXT(card, 2, "  rc???");
         }
@@ -1114,9 +1114,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                         dev_warn(&channel->ccwdev->dev,
                                 "The qeth device driver failed to recover "
                                 "an error on the device\n");
-                        QETH_DBF_MESSAGE(2, "%s sense data available. cstat "
-                                "0x%X dstat 0x%X\n",
-                                dev_name(&channel->ccwdev->dev), cstat, dstat);
+                        QETH_DBF_MESSAGE(2, "sense data available on channel %x: cstat %#X dstat %#X\n",
+                                         CCW_DEVID(channel->ccwdev), cstat,
+                                         dstat);
                         print_hex_dump(KERN_WARNING, "qeth: irb ",
                                 DUMP_PREFIX_OFFSET, 16, 1, irb, 32, 1);
                         print_hex_dump(KERN_WARNING, "qeth: sense data ",
@@ -1890,8 +1890,8 @@ static int qeth_idx_activate_channel(struct qeth_card *card,
         if (channel->state != CH_STATE_ACTIVATING) {
                 dev_warn(&channel->ccwdev->dev, "The qeth device driver"
                         " failed to recover an error on the device\n");
-                QETH_DBF_MESSAGE(2, "%s IDX activate timed out\n",
-                        dev_name(&channel->ccwdev->dev));
+                QETH_DBF_MESSAGE(2, "IDX activate timed out on channel %x\n",
+                                 CCW_DEVID(channel->ccwdev));
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", -ETIME);
                 return -ETIME;
         }
@@ -1926,17 +1926,15 @@ static void qeth_idx_write_cb(struct qeth_card *card,
                                 "The adapter is used exclusively by another "
                                 "host\n");
                 else
-                        QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on write channel:"
-                                " negative reply\n",
-                                dev_name(&channel->ccwdev->dev));
+                        QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: negative reply\n",
+                                         CCW_DEVID(channel->ccwdev));
                 goto out;
         }
         memcpy(&temp, QETH_IDX_ACT_FUNC_LEVEL(iob->data), 2);
         if ((temp & ~0x0100) != qeth_peer_func_level(card->info.func_level)) {
-                QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on write channel: "
-                        "function level mismatch (sent: 0x%x, received: "
-                        "0x%x)\n", dev_name(&channel->ccwdev->dev),
-                        card->info.func_level, temp);
+                QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: function level mismatch (sent: %#x, received: %#x)\n",
+                                 CCW_DEVID(channel->ccwdev),
+                                 card->info.func_level, temp);
                 goto out;
         }
         channel->state = CH_STATE_UP;
@@ -1973,9 +1971,8 @@ static void qeth_idx_read_cb(struct qeth_card *card,
                                 "insufficient authorization\n");
                         break;
                 default:
-                        QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on read channel:"
-                                " negative reply\n",
-                                dev_name(&channel->ccwdev->dev));
+                        QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: negative reply\n",
+                                         CCW_DEVID(channel->ccwdev));
                 }
                 QETH_CARD_TEXT_(card, 2, "idxread%c",
                         QETH_IDX_ACT_CAUSE_CODE(iob->data));
@@ -1984,10 +1981,9 @@ static void qeth_idx_read_cb(struct qeth_card *card,
 
         memcpy(&temp, QETH_IDX_ACT_FUNC_LEVEL(iob->data), 2);
         if (temp != qeth_peer_func_level(card->info.func_level)) {
-                QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on read channel: function "
-                        "level mismatch (sent: 0x%x, received: 0x%x)\n",
-                        dev_name(&channel->ccwdev->dev),
-                        card->info.func_level, temp);
+                QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: function level mismatch (sent: %#x, received: %#x)\n",
+                                 CCW_DEVID(channel->ccwdev),
+                                 card->info.func_level, temp);
                 goto out;
         }
         memcpy(&card->token.issuer_rm_r,
@@ -2096,9 +2092,8 @@ int qeth_send_control_data(struct qeth_card *card, int len,
                                       (addr_t) iob, 0, 0, event_timeout);
         spin_unlock_irq(get_ccwdev_lock(channel->ccwdev));
         if (rc) {
-                QETH_DBF_MESSAGE(2, "%s qeth_send_control_data: "
-                        "ccw_device_start rc = %i\n",
-                        dev_name(&channel->ccwdev->dev), rc);
+                QETH_DBF_MESSAGE(2, "qeth_send_control_data on device %x: ccw_device_start rc = %i\n",
+                                 CARD_DEVID(card), rc);
                 QETH_CARD_TEXT_(card, 2, " err%d", rc);
                 spin_lock_irq(&card->lock);
                 list_del_init(&reply->list);
@@ -2853,8 +2848,8 @@ struct qeth_cmd_buffer *qeth_get_ipacmd_buffer(struct qeth_card *card,
         } else {
                 dev_warn(&card->gdev->dev,
                          "The qeth driver ran out of channel command buffers\n");
-                QETH_DBF_MESSAGE(1, "%s The qeth driver ran out of channel command buffers",
-                                 dev_name(&card->gdev->dev));
+                QETH_DBF_MESSAGE(1, "device %x ran out of channel command buffers",
+                                 CARD_DEVID(card));
         }
 
         return iob;
@@ -2989,10 +2984,9 @@ static int qeth_query_ipassists_cb(struct qeth_card *card,
                 return 0;
         default:
                 if (cmd->hdr.return_code) {
-                        QETH_DBF_MESSAGE(1, "%s IPA_CMD_QIPASSIST: Unhandled "
-                                                "rc=%d\n",
-                                                dev_name(&card->gdev->dev),
-                                                cmd->hdr.return_code);
+                        QETH_DBF_MESSAGE(1, "IPA_CMD_QIPASSIST on device %x: Unhandled rc=%#x\n",
+                                         CARD_DEVID(card),
+                                         cmd->hdr.return_code);
                         return 0;
                 }
         }
@@ -3004,8 +2998,8 @@ static int qeth_query_ipassists_cb(struct qeth_card *card,
                 card->options.ipa6.supported_funcs = cmd->hdr.ipa_supported;
                 card->options.ipa6.enabled_funcs = cmd->hdr.ipa_enabled;
         } else
-                QETH_DBF_MESSAGE(1, "%s IPA_CMD_QIPASSIST: Flawed LIC detected"
-                                        "\n", dev_name(&card->gdev->dev));
+                QETH_DBF_MESSAGE(1, "IPA_CMD_QIPASSIST on device %x: Flawed LIC detected\n",
+                                 CARD_DEVID(card));
         return 0;
 }
 
@@ -4297,10 +4291,9 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
                 cmd->data.setadapterparms.hdr.return_code);
         if (cmd->data.setadapterparms.hdr.return_code !=
                                                 SET_ACCESS_CTRL_RC_SUCCESS)
-                QETH_DBF_MESSAGE(3, "ERR:SET_ACCESS_CTRL(%s,%d)==%d\n",
-                                card->gdev->dev.kobj.name,
-                                access_ctrl_req->subcmd_code,
-                                cmd->data.setadapterparms.hdr.return_code);
+                QETH_DBF_MESSAGE(3, "ERR:SET_ACCESS_CTRL(%#x) on device %x: %#x\n",
+                                 access_ctrl_req->subcmd_code, CARD_DEVID(card),
+                                 cmd->data.setadapterparms.hdr.return_code);
         switch (cmd->data.setadapterparms.hdr.return_code) {
         case SET_ACCESS_CTRL_RC_SUCCESS:
                 if (card->options.isolation == ISOLATION_MODE_NONE) {
@@ -4312,14 +4305,14 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
                 }
                 break;
         case SET_ACCESS_CTRL_RC_ALREADY_NOT_ISOLATED:
-                QETH_DBF_MESSAGE(2, "%s QDIO data connection isolation already "
-                                "deactivated\n", dev_name(&card->gdev->dev));
+                QETH_DBF_MESSAGE(2, "QDIO data connection isolation on device %x already deactivated\n",
+                                 CARD_DEVID(card));
                 if (fallback)
                         card->options.isolation = card->options.prev_isolation;
                 break;
         case SET_ACCESS_CTRL_RC_ALREADY_ISOLATED:
-                QETH_DBF_MESSAGE(2, "%s QDIO data connection isolation already"
-                                " activated\n", dev_name(&card->gdev->dev));
+                QETH_DBF_MESSAGE(2, "QDIO data connection isolation on device %x already activated\n",
+                                 CARD_DEVID(card));
                 if (fallback)
                         card->options.isolation = card->options.prev_isolation;
                 break;
@@ -4405,10 +4398,8 @@ int qeth_set_access_ctrl_online(struct qeth_card *card, int fallback)
                 rc = qeth_setadpparms_set_access_ctrl(card,
                         card->options.isolation, fallback);
                 if (rc) {
-                        QETH_DBF_MESSAGE(3,
-                                "IPA(SET_ACCESS_CTRL,%s,%d) sent failed\n",
-                                card->gdev->dev.kobj.name,
-                                rc);
+                        QETH_DBF_MESSAGE(3, "IPA(SET_ACCESS_CTRL(%d) on device %x: sent failed\n",
+                                         rc, CARD_DEVID(card));
                         rc = -EOPNOTSUPP;
                 }
         } else if (card->options.isolation != ISOLATION_MODE_NONE) {
@@ -4443,7 +4434,8 @@ static int qeth_mdio_read(struct net_device *dev, int phy_id, int regnum)
                 rc = BMCR_FULLDPLX;
                 if ((card->info.link_type != QETH_LINK_TYPE_GBIT_ETH) &&
                     (card->info.link_type != QETH_LINK_TYPE_OSN) &&
-                    (card->info.link_type != QETH_LINK_TYPE_10GBIT_ETH))
+                    (card->info.link_type != QETH_LINK_TYPE_10GBIT_ETH) &&
+                    (card->info.link_type != QETH_LINK_TYPE_25GBIT_ETH))
                         rc |= BMCR_SPEED100;
                 break;
         case MII_BMSR: /* Basic mode status register */
@@ -4526,8 +4518,8 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
 {
         struct qeth_ipa_cmd *cmd;
         struct qeth_arp_query_info *qinfo;
-        struct qeth_snmp_cmd *snmp;
         unsigned char *data;
+        void *snmp_data;
         __u16 data_len;
 
         QETH_CARD_TEXT(card, 3, "snpcmdcb");
@@ -4535,7 +4527,6 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
         cmd = (struct qeth_ipa_cmd *) sdata;
         data = (unsigned char *)((char *)cmd - reply->offset);
         qinfo = (struct qeth_arp_query_info *) reply->param;
-        snmp = &cmd->data.setadapterparms.data.snmp;
 
         if (cmd->hdr.return_code) {
                 QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code);
@@ -4548,10 +4539,15 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
                 return 0;
         }
         data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data));
-        if (cmd->data.setadapterparms.hdr.seq_no == 1)
-                data_len -= (__u16)((char *)&snmp->data - (char *)cmd);
-        else
-                data_len -= (__u16)((char *)&snmp->request - (char *)cmd);
+        if (cmd->data.setadapterparms.hdr.seq_no == 1) {
+                snmp_data = &cmd->data.setadapterparms.data.snmp;
+                data_len -= offsetof(struct qeth_ipa_cmd,
+                                     data.setadapterparms.data.snmp);
+        } else {
+                snmp_data = &cmd->data.setadapterparms.data.snmp.request;
+                data_len -= offsetof(struct qeth_ipa_cmd,
+                                     data.setadapterparms.data.snmp.request);
+        }
 
         /* check if there is enough room in userspace */
         if ((qinfo->udata_len - qinfo->udata_offset) < data_len) {
@@ -4564,16 +4560,9 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
         QETH_CARD_TEXT_(card, 4, "sseqn%i",
                 cmd->data.setadapterparms.hdr.seq_no);
         /*copy entries to user buffer*/
-        if (cmd->data.setadapterparms.hdr.seq_no == 1) {
-                memcpy(qinfo->udata + qinfo->udata_offset,
-                       (char *)snmp,
-                       data_len + offsetof(struct qeth_snmp_cmd, data));
-                qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data);
-        } else {
-                memcpy(qinfo->udata + qinfo->udata_offset,
-                       (char *)&snmp->request, data_len);
-        }
+        memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len);
         qinfo->udata_offset += data_len;
+
         /* check if all replies received ... */
                 QETH_CARD_TEXT_(card, 4, "srtot%i",
                                cmd->data.setadapterparms.hdr.used_total);
@@ -4634,8 +4623,8 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
         rc = qeth_send_ipa_snmp_cmd(card, iob, QETH_SETADP_BASE_LEN + req_len,
                                     qeth_snmp_command_cb, (void *)&qinfo);
         if (rc)
-                QETH_DBF_MESSAGE(2, "SNMP command failed on %s: (0x%x)\n",
-                           QETH_CARD_IFNAME(card), rc);
+                QETH_DBF_MESSAGE(2, "SNMP command failed on device %x: (%#x)\n",
+                                 CARD_DEVID(card), rc);
         else {
                 if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
                         rc = -EFAULT;
@@ -4869,8 +4858,8 @@ static void qeth_determine_capabilities(struct qeth_card *card)
 
         rc = qeth_read_conf_data(card, (void **) &prcd, &length);
         if (rc) {
-                QETH_DBF_MESSAGE(2, "%s qeth_read_conf_data returned %i\n",
-                        dev_name(&card->gdev->dev), rc);
+                QETH_DBF_MESSAGE(2, "qeth_read_conf_data on device %x returned %i\n",
+                                 CARD_DEVID(card), rc);
                 QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
                 goto out_offline;
         }
@@ -5086,7 +5075,7 @@ static struct ccw_driver qeth_ccw_driver = {
         .remove = ccwgroup_remove_ccwdev,
 };
 
-int qeth_core_hardsetup_card(struct qeth_card *card)
+int qeth_core_hardsetup_card(struct qeth_card *card, bool *carrier_ok)
 {
         int retries = 3;
         int rc;
@@ -5096,8 +5085,8 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
         qeth_update_from_chp_desc(card);
 retry:
         if (retries < 3)
-                QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
-                        dev_name(&card->gdev->dev));
+                QETH_DBF_MESSAGE(2, "Retrying to do IDX activates on device %x.\n",
+                                 CARD_DEVID(card));
         rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
@@ -5161,13 +5150,20 @@ retriable:
                 if (rc == IPA_RC_LAN_OFFLINE) {
                         dev_warn(&card->gdev->dev,
                                 "The LAN is offline\n");
-                        netif_carrier_off(card->dev);
+                        *carrier_ok = false;
                 } else {
                         rc = -ENODEV;
                         goto out;
                 }
         } else {
-                netif_carrier_on(card->dev);
+                *carrier_ok = true;
+        }
+
+        if (qeth_netdev_is_registered(card->dev)) {
+                if (*carrier_ok)
+                        netif_carrier_on(card->dev);
+                else
+                        netif_carrier_off(card->dev);
         }
 
         card->options.ipa4.supported_funcs = 0;
@@ -5201,8 +5197,8 @@ retriable:
 out:
         dev_warn(&card->gdev->dev, "The qeth device driver failed to recover "
                 "an error on the device\n");
-        QETH_DBF_MESSAGE(2, "%s Initialization in hardsetup failed! rc=%d\n",
-                dev_name(&card->gdev->dev), rc);
+        QETH_DBF_MESSAGE(2, "Initialization for device %x failed in hardsetup! rc=%d\n",
+                         CARD_DEVID(card), rc);
         return rc;
 }
 EXPORT_SYMBOL_GPL(qeth_core_hardsetup_card);
@@ -5481,11 +5477,12 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *card,
 }
 EXPORT_SYMBOL_GPL(qeth_get_setassparms_cmd);
 
-int qeth_send_setassparms(struct qeth_card *card,
-                          struct qeth_cmd_buffer *iob, __u16 len, long data,
-                          int (*reply_cb)(struct qeth_card *,
-                                          struct qeth_reply *, unsigned long),
-                          void *reply_param)
+static int qeth_send_setassparms(struct qeth_card *card,
+                                 struct qeth_cmd_buffer *iob, u16 len,
+                                 long data, int (*reply_cb)(struct qeth_card *,
+                                                            struct qeth_reply *,
+                                                            unsigned long),
+                                 void *reply_param)
 {
         int rc;
         struct qeth_ipa_cmd *cmd;
@@ -5501,7 +5498,6 @@ int qeth_send_setassparms(struct qeth_card *card,
         rc = qeth_send_ipa_cmd(card, iob, reply_cb, reply_param);
         return rc;
 }
-EXPORT_SYMBOL_GPL(qeth_send_setassparms);
 
 int qeth_send_simple_setassparms_prot(struct qeth_card *card,
                                       enum qeth_ipa_funcs ipa_func,
@@ -6170,8 +6166,14 @@ static void qeth_set_cmd_adv_sup(struct ethtool_link_ksettings *cmd,
                 WARN_ON_ONCE(1);
         }
 
-        /* fallthrough from high to low, to select all legal speeds: */
+        /* partially does fall through, to also select lower speeds */
         switch (maxspeed) {
+        case SPEED_25000:
+                ethtool_link_ksettings_add_link_mode(cmd, supported,
+                                                     25000baseSR_Full);
+                ethtool_link_ksettings_add_link_mode(cmd, advertising,
+                                                     25000baseSR_Full);
+                break;
         case SPEED_10000:
                 ethtool_link_ksettings_add_link_mode(cmd, supported,
                                                      10000baseT_Full);
@@ -6254,6 +6256,10 @@ int qeth_core_ethtool_get_link_ksettings(struct net_device *netdev,
                 cmd->base.speed = SPEED_10000;
                 cmd->base.port = PORT_FIBRE;
                 break;
+        case QETH_LINK_TYPE_25GBIT_ETH:
+                cmd->base.speed = SPEED_25000;
+                cmd->base.port = PORT_FIBRE;
+                break;
         default:
                 cmd->base.speed = SPEED_10;
                 cmd->base.port = PORT_TP;
@@ -6320,6 +6326,9 @@ int qeth_core_ethtool_get_link_ksettings(struct net_device *netdev,
         case CARD_INFO_PORTS_10G:
                 cmd->base.speed = SPEED_10000;
                 break;
+        case CARD_INFO_PORTS_25G:
+                cmd->base.speed = SPEED_25000;
+                break;
         }
 
         return 0;
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index e85090467afe..3e54be201b27 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -90,6 +90,7 @@ enum qeth_link_types {
         QETH_LINK_TYPE_GBIT_ETH     = 0x03,
         QETH_LINK_TYPE_OSN          = 0x04,
         QETH_LINK_TYPE_10GBIT_ETH   = 0x10,
+        QETH_LINK_TYPE_25GBIT_ETH   = 0x12,
         QETH_LINK_TYPE_LANE_ETH100  = 0x81,
         QETH_LINK_TYPE_LANE_TR      = 0x82,
         QETH_LINK_TYPE_LANE_ETH1000 = 0x83,
@@ -347,6 +348,7 @@ enum qeth_card_info_port_speed {
         CARD_INFO_PORTS_100M            = 0x00000006,
         CARD_INFO_PORTS_1G              = 0x00000007,
         CARD_INFO_PORTS_10G             = 0x00000008,
+        CARD_INFO_PORTS_25G             = 0x0000000A,
 };
 
 /* (SET)DELIP(M) IPA stuff ***************************************************/
@@ -436,7 +438,7 @@ struct qeth_ipacmd_setassparms {
                 __u32 flags_32bit;
                 struct qeth_ipa_caps caps;
                 struct qeth_checksum_cmd chksum;
-                struct qeth_arp_cache_entry add_arp_entry;
+                struct qeth_arp_cache_entry arp_entry;
                 struct qeth_arp_query_data query_arp;
                 struct qeth_tso_start_data tso;
                 __u8 ip[16];
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 23aaf373f631..2914a1a69f83 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -146,11 +146,11 @@ static int qeth_l2_write_mac(struct qeth_card *card, u8 *mac)
         QETH_CARD_TEXT(card, 2, "L2Wmac");
         rc = qeth_l2_send_setdelmac(card, mac, cmd);
         if (rc == -EEXIST)
-                QETH_DBF_MESSAGE(2, "MAC %pM already registered on %s\n",
-                                 mac, QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(2, "MAC already registered on device %x\n",
+                                 CARD_DEVID(card));
         else if (rc)
-                QETH_DBF_MESSAGE(2, "Failed to register MAC %pM on %s: %d\n",
-                                 mac, QETH_CARD_IFNAME(card), rc);
+                QETH_DBF_MESSAGE(2, "Failed to register MAC on device %x: %d\n",
+                                 CARD_DEVID(card), rc);
         return rc;
 }
 
@@ -163,8 +163,8 @@ static int qeth_l2_remove_mac(struct qeth_card *card, u8 *mac)
         QETH_CARD_TEXT(card, 2, "L2Rmac");
         rc = qeth_l2_send_setdelmac(card, mac, cmd);
         if (rc)
-                QETH_DBF_MESSAGE(2, "Failed to delete MAC %pM on %s: %d\n",
-                                 mac, QETH_CARD_IFNAME(card), rc);
+                QETH_DBF_MESSAGE(2, "Failed to delete MAC on device %u: %d\n",
+                                 CARD_DEVID(card), rc);
         return rc;
 }
 
@@ -260,9 +260,9 @@ static int qeth_l2_send_setdelvlan_cb(struct qeth_card *card,
 
         QETH_CARD_TEXT(card, 2, "L2sdvcb");
         if (cmd->hdr.return_code) {
-                QETH_DBF_MESSAGE(2, "Error in processing VLAN %i on %s: 0x%x.\n",
+                QETH_DBF_MESSAGE(2, "Error in processing VLAN %u on device %x: %#x.\n",
                                  cmd->data.setdelvlan.vlan_id,
-                                 QETH_CARD_IFNAME(card), cmd->hdr.return_code);
+                                 CARD_DEVID(card), cmd->hdr.return_code);
                 QETH_CARD_TEXT_(card, 2, "L2VL%4x", cmd->hdr.command);
                 QETH_CARD_TEXT_(card, 2, "err%d", cmd->hdr.return_code);
         }
@@ -455,8 +455,8 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
                 rc = qeth_vm_request_mac(card);
                 if (!rc)
                         goto out;
-                QETH_DBF_MESSAGE(2, "z/VM MAC Service failed on device %s: x%x\n",
-                                 CARD_BUS_ID(card), rc);
+                QETH_DBF_MESSAGE(2, "z/VM MAC Service failed on device %x: %#x\n",
+                                 CARD_DEVID(card), rc);
                 QETH_DBF_TEXT_(SETUP, 2, "err%04x", rc);
                 /* fall back to alternative mechanism: */
         }
@@ -468,8 +468,8 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
                 rc = qeth_setadpparms_change_macaddr(card);
                 if (!rc)
                         goto out;
-                QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %s: x%x\n",
-                                 CARD_BUS_ID(card), rc);
+                QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %x: %#x\n",
+                                 CARD_DEVID(card), rc);
                 QETH_DBF_TEXT_(SETUP, 2, "1err%04x", rc);
                 /* fall back once more: */
         }
@@ -826,7 +826,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l2_set_offline(cgdev);
-        unregister_netdev(card->dev);
+        if (qeth_netdev_is_registered(card->dev))
+                unregister_netdev(card->dev);
 }
 
 static const struct ethtool_ops qeth_l2_ethtool_ops = {
@@ -862,11 +863,11 @@ static const struct net_device_ops qeth_l2_netdev_ops = {
         .ndo_set_features       = qeth_set_features
 };
 
-static int qeth_l2_setup_netdev(struct qeth_card *card)
+static int qeth_l2_setup_netdev(struct qeth_card *card, bool carrier_ok)
 {
         int rc;
 
-        if (card->dev->netdev_ops)
+        if (qeth_netdev_is_registered(card->dev))
                 return 0;
 
         card->dev->priv_flags |= IFF_UNICAST_FLT;
@@ -919,6 +920,9 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         qeth_l2_request_initial_mac(card);
         netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT);
         rc = register_netdev(card->dev);
+        if (!rc && carrier_ok)
+                netif_carrier_on(card->dev);
+
         if (rc)
                 card->dev->netdev_ops = NULL;
         return rc;
@@ -949,6 +953,7 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
         int rc = 0;
         enum qeth_card_states recover_flag;
+        bool carrier_ok;
 
         mutex_lock(&card->discipline_mutex);
         mutex_lock(&card->conf_mutex);
@@ -956,7 +961,7 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *));
 
         recover_flag = card->state;
-        rc = qeth_core_hardsetup_card(card);
+        rc = qeth_core_hardsetup_card(card, &carrier_ok);
         if (rc) {
                 QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
                 rc = -ENODEV;
@@ -967,7 +972,7 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 dev_info(&card->gdev->dev,
                 "The device represents a Bridge Capable Port\n");
 
-        rc = qeth_l2_setup_netdev(card);
+        rc = qeth_l2_setup_netdev(card, carrier_ok);
         if (rc)
                 goto out_remove;
 
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 0b161cc1fd2e..f08b745c2007 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -278,9 +278,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover)
 
         QETH_CARD_TEXT(card, 4, "clearip");
 
-        if (recover && card->options.sniffer)
-                return;
-
         spin_lock_bh(&card->ip_lock);
 
         hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
@@ -494,9 +491,8 @@ int qeth_l3_setrouting_v4(struct qeth_card *card)
                                   QETH_PROT_IPV4);
         if (rc) {
                 card->options.route4.type = NO_ROUTER;
-                QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
-                        " on %s. Type set to 'no router'.\n", rc,
-                        QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(2, "Error (%#06x) while setting routing type on device %x. Type set to 'no router'.\n",
+                                 rc, CARD_DEVID(card));
         }
         return rc;
 }
@@ -518,9 +514,8 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
                                   QETH_PROT_IPV6);
         if (rc) {
                 card->options.route6.type = NO_ROUTER;
-                QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
-                        " on %s. Type set to 'no router'.\n", rc,
-                        QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(2, "Error (%#06x) while setting routing type on device %x. Type set to 'no router'.\n",
+                                 rc, CARD_DEVID(card));
         }
         return rc;
 }
@@ -663,6 +658,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card,
         int rc = 0;
         int cnt = 3;
 
+        if (card->options.sniffer)
+                return 0;
 
         if (addr->proto == QETH_PROT_IPV4) {
                 QETH_CARD_TEXT(card, 2, "setaddr4");
@@ -697,6 +694,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card,
 {
         int rc = 0;
 
+        if (card->options.sniffer)
+                return 0;
+
         if (addr->proto == QETH_PROT_IPV4) {
                 QETH_CARD_TEXT(card, 2, "deladdr4");
                 QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int));
@@ -1070,8 +1070,8 @@ qeth_diags_trace_cb(struct qeth_card *card, struct qeth_reply *reply,
                 }
                 break;
         default:
-                QETH_DBF_MESSAGE(2, "Unknown sniffer action (0x%04x) on %s\n",
-                        cmd->data.diagass.action, QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(2, "Unknown sniffer action (%#06x) on device %x\n",
+                                 cmd->data.diagass.action, CARD_DEVID(card));
         }
 
         return 0;
@@ -1517,32 +1517,25 @@ static void qeth_l3_set_rx_mode(struct net_device *dev)
         qeth_l3_handle_promisc_mode(card);
 }
 
-static const char *qeth_l3_arp_get_error_cause(int *rc)
+static int qeth_l3_arp_makerc(int rc)
 {
-        switch (*rc) {
-        case QETH_IPA_ARP_RC_FAILED:
-                *rc = -EIO;
-                return "operation failed";
+        switch (rc) {
+        case IPA_RC_SUCCESS:
+                return 0;
         case QETH_IPA_ARP_RC_NOTSUPP:
-                *rc = -EOPNOTSUPP;
-                return "operation not supported";
-        case QETH_IPA_ARP_RC_OUT_OF_RANGE:
-                *rc = -EINVAL;
-                return "argument out of range";
         case QETH_IPA_ARP_RC_Q_NOTSUPP:
-                *rc = -EOPNOTSUPP;
-                return "query operation not supported";
+                return -EOPNOTSUPP;
+        case QETH_IPA_ARP_RC_OUT_OF_RANGE:
+                return -EINVAL;
         case QETH_IPA_ARP_RC_Q_NO_DATA:
-                *rc = -ENOENT;
-                return "no query data available";
+                return -ENOENT;
         default:
-                return "unknown error";
+                return -EIO;
         }
 }
 
 static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
 {
-        int tmp;
         int rc;
 
         QETH_CARD_TEXT(card, 3, "arpstnoe");
@@ -1560,13 +1553,10 @@ static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
         rc = qeth_send_simple_setassparms(card, IPA_ARP_PROCESSING,
                                           IPA_CMD_ASS_ARP_SET_NO_ENTRIES,
                                           no_entries);
-        if (rc) {
-                tmp = rc;
-                QETH_DBF_MESSAGE(2, "Could not set number of ARP entries on "
-                        "%s: %s (0x%x/%d)\n", QETH_CARD_IFNAME(card),
-                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-        }
-        return rc;
+        if (rc)
+                QETH_DBF_MESSAGE(2, "Could not set number of ARP entries on device %x: %#x\n",
+                                 CARD_DEVID(card), rc);
+        return qeth_l3_arp_makerc(rc);
 }
 
 static __u32 get_arp_entry_size(struct qeth_card *card,
@@ -1716,7 +1706,6 @@ static int qeth_l3_query_arp_cache_info(struct qeth_card *card,
 {
         struct qeth_cmd_buffer *iob;
         struct qeth_ipa_cmd *cmd;
-        int tmp;
         int rc;
 
         QETH_CARD_TEXT_(card, 3, "qarpipv%i", prot);
@@ -1735,15 +1724,10 @@ static int qeth_l3_query_arp_cache_info(struct qeth_card *card,
         rc = qeth_l3_send_ipa_arp_cmd(card, iob,
                            QETH_SETASS_BASE_LEN+QETH_ARP_CMD_LEN,
                            qeth_l3_arp_query_cb, (void *)qinfo);
-        if (rc) {
-                tmp = rc;
-                QETH_DBF_MESSAGE(2,
-                        "Error while querying ARP cache on %s: %s "
-                        "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
-                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-        }
-
-        return rc;
+        if (rc)
+                QETH_DBF_MESSAGE(2, "Error while querying ARP cache on device %x: %#x\n",
+                                 CARD_DEVID(card), rc);
+        return qeth_l3_arp_makerc(rc);
 }
 
 static int qeth_l3_arp_query(struct qeth_card *card, char __user *udata)
@@ -1793,15 +1777,18 @@ out:
         return rc;
 }
 
-static int qeth_l3_arp_add_entry(struct qeth_card *card,
-                                struct qeth_arp_cache_entry *entry)
+static int qeth_l3_arp_modify_entry(struct qeth_card *card,
+                                    struct qeth_arp_cache_entry *entry,
+                                    enum qeth_arp_process_subcmds arp_cmd)
 {
+        struct qeth_arp_cache_entry *cmd_entry;
         struct qeth_cmd_buffer *iob;
-        char buf[16];
-        int tmp;
         int rc;
 
-        QETH_CARD_TEXT(card, 3, "arpadent");
+        if (arp_cmd == IPA_CMD_ASS_ARP_ADD_ENTRY)
+                QETH_CARD_TEXT(card, 3, "arpadd");
+        else
+                QETH_CARD_TEXT(card, 3, "arpdel");
 
         /*
          * currently GuestLAN only supports the ARP assist function
@@ -1814,71 +1801,25 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
                 return -EOPNOTSUPP;
         }
 
-        iob = qeth_get_setassparms_cmd(card, IPA_ARP_PROCESSING,
-                                       IPA_CMD_ASS_ARP_ADD_ENTRY,
-                                       sizeof(struct qeth_arp_cache_entry),
-                                       QETH_PROT_IPV4);
+        iob = qeth_get_setassparms_cmd(card, IPA_ARP_PROCESSING, arp_cmd,
+                                       sizeof(*cmd_entry), QETH_PROT_IPV4);
         if (!iob)
                 return -ENOMEM;
-        rc = qeth_send_setassparms(card, iob,
-                                   sizeof(struct qeth_arp_cache_entry),
-                                   (unsigned long) entry,
-                                   qeth_setassparms_cb, NULL);
-        if (rc) {
-                tmp = rc;
-                qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
-                QETH_DBF_MESSAGE(2, "Could not add ARP entry for address %s "
-                        "on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
-                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-        }
-        return rc;
-}
-
-static int qeth_l3_arp_remove_entry(struct qeth_card *card,
-                                struct qeth_arp_cache_entry *entry)
-{
-        struct qeth_cmd_buffer *iob;
-        char buf[16] = {0, };
-        int tmp;
-        int rc;
 
-        QETH_CARD_TEXT(card, 3, "arprment");
+        cmd_entry = &__ipa_cmd(iob)->data.setassparms.data.arp_entry;
+        ether_addr_copy(cmd_entry->macaddr, entry->macaddr);
+        memcpy(cmd_entry->ipaddr, entry->ipaddr, 4);
+        rc = qeth_send_ipa_cmd(card, iob, qeth_setassparms_cb, NULL);
+        if (rc)
+                QETH_DBF_MESSAGE(2, "Could not modify (cmd: %#x) ARP entry on device %x: %#x\n",
+                                 arp_cmd, CARD_DEVID(card), rc);
 
-        /*
-         * currently GuestLAN only supports the ARP assist function
-         * IPA_CMD_ASS_ARP_QUERY_INFO, but not IPA_CMD_ASS_ARP_REMOVE_ENTRY;
-         * thus we say EOPNOTSUPP for this ARP function
-         */
-        if (card->info.guestlan)
-                return -EOPNOTSUPP;
-        if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                return -EOPNOTSUPP;
-        }
-        memcpy(buf, entry, 12);
-        iob = qeth_get_setassparms_cmd(card, IPA_ARP_PROCESSING,
-                                       IPA_CMD_ASS_ARP_REMOVE_ENTRY,
-                                       12,
-                                       QETH_PROT_IPV4);
-        if (!iob)
-                return -ENOMEM;
-        rc = qeth_send_setassparms(card, iob,
-                                   12, (unsigned long)buf,
-                                   qeth_setassparms_cb, NULL);
-        if (rc) {
-                tmp = rc;
-                memset(buf, 0, 16);
-                qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
-                QETH_DBF_MESSAGE(2, "Could not delete ARP entry for address %s"
-                        " on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
-                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-        }
-        return rc;
+        return qeth_l3_arp_makerc(rc);
 }
 
 static int qeth_l3_arp_flush_cache(struct qeth_card *card)
 {
         int rc;
-        int tmp;
 
         QETH_CARD_TEXT(card, 3, "arpflush");
 
@@ -1894,19 +1835,17 @@ static int qeth_l3_arp_flush_cache(struct qeth_card *card)
         }
         rc = qeth_send_simple_setassparms(card, IPA_ARP_PROCESSING,
                                           IPA_CMD_ASS_ARP_FLUSH_CACHE, 0);
-        if (rc) {
-                tmp = rc;
-                QETH_DBF_MESSAGE(2, "Could not flush ARP cache on %s: %s "
-                        "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
-                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-        }
-        return rc;
+        if (rc)
+                QETH_DBF_MESSAGE(2, "Could not flush ARP cache on device %x: %#x\n",
+                                 CARD_DEVID(card), rc);
+        return qeth_l3_arp_makerc(rc);
 }
 
 static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
         struct qeth_card *card = dev->ml_priv;
         struct qeth_arp_cache_entry arp_entry;
+        enum qeth_arp_process_subcmds arp_cmd;
         int rc = 0;
 
         switch (cmd) {
@@ -1925,27 +1864,16 @@ static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 rc = qeth_l3_arp_query(card, rq->ifr_ifru.ifru_data);
                 break;
         case SIOC_QETH_ARP_ADD_ENTRY:
-                if (!capable(CAP_NET_ADMIN)) {
-                        rc = -EPERM;
-                        break;
-                }
-                if (copy_from_user(&arp_entry, rq->ifr_ifru.ifru_data,
-                                   sizeof(struct qeth_arp_cache_entry)))
-                        rc = -EFAULT;
-                else
-                        rc = qeth_l3_arp_add_entry(card, &arp_entry);
-                break;
         case SIOC_QETH_ARP_REMOVE_ENTRY:
-                if (!capable(CAP_NET_ADMIN)) {
-                        rc = -EPERM;
-                        break;
-                }
-                if (copy_from_user(&arp_entry, rq->ifr_ifru.ifru_data,
-                                   sizeof(struct qeth_arp_cache_entry)))
-                        rc = -EFAULT;
-                else
-                        rc = qeth_l3_arp_remove_entry(card, &arp_entry);
-                break;
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                if (copy_from_user(&arp_entry, rq->ifr_data, sizeof(arp_entry)))
+                        return -EFAULT;
+
+                arp_cmd = (cmd == SIOC_QETH_ARP_ADD_ENTRY) ?
+                                IPA_CMD_ASS_ARP_ADD_ENTRY :
+                                IPA_CMD_ASS_ARP_REMOVE_ENTRY;
+                return qeth_l3_arp_modify_entry(card, &arp_entry, arp_cmd);
         case SIOC_QETH_ARP_FLUSH_CACHE:
                 if (!capable(CAP_NET_ADMIN)) {
                         rc = -EPERM;
@@ -2383,12 +2311,12 @@ static const struct net_device_ops qeth_l3_osa_netdev_ops = {
         .ndo_neigh_setup        = qeth_l3_neigh_setup,
 };
 
-static int qeth_l3_setup_netdev(struct qeth_card *card)
+static int qeth_l3_setup_netdev(struct qeth_card *card, bool carrier_ok)
 {
         unsigned int headroom;
         int rc;
 
-        if (card->dev->netdev_ops)
+        if (qeth_netdev_is_registered(card->dev))
                 return 0;
 
         if (card->info.type == QETH_CARD_TYPE_OSD ||
@@ -2457,6 +2385,9 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
 
         netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT);
         rc = register_netdev(card->dev);
+        if (!rc && carrier_ok)
+                netif_carrier_on(card->dev);
+
 out:
         if (rc)
                 card->dev->netdev_ops = NULL;
@@ -2497,7 +2428,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l3_set_offline(cgdev);
 
-        unregister_netdev(card->dev);
+        if (qeth_netdev_is_registered(card->dev))
+                unregister_netdev(card->dev);
         qeth_l3_clear_ip_htable(card, 0);
         qeth_l3_clear_ipato_list(card);
 }
@@ -2507,6 +2439,7 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
         int rc = 0;
         enum qeth_card_states recover_flag;
+        bool carrier_ok;
 
         mutex_lock(&card->discipline_mutex);
         mutex_lock(&card->conf_mutex);
@@ -2514,14 +2447,14 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *));
 
         recover_flag = card->state;
-        rc = qeth_core_hardsetup_card(card);
+        rc = qeth_core_hardsetup_card(card, &carrier_ok);
         if (rc) {
                 QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
                 rc = -ENODEV;
                 goto out_remove;
         }
 
-        rc = qeth_l3_setup_netdev(card);
+        rc = qeth_l3_setup_netdev(card, carrier_ok);
         if (rc)
                 goto out_remove;
 
diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
index 5c8ed7350a04..a36e4cf1841d 100644
--- a/drivers/sbus/char/display7seg.c
+++ b/drivers/sbus/char/display7seg.c
@@ -220,6 +220,7 @@ static int d7s_probe(struct platform_device *op)
         dev_set_drvdata(&op->dev, p);
         d7s_device = p;
         err = 0;
+        of_node_put(opts);
 
 out:
         return err;
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 56e962a01493..b8481927bfe4 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
                         for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
                                 pchild->mon_type[len] = ENVCTRL_NOMON;
                         }
+                        of_node_put(root_node);
                         return;
                 }
+                of_node_put(root_node);
         }
 
         /* Get the monitor channels. */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index c7fccbb8f554..fa6e0c3b3aa6 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -697,6 +697,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
                  */
                 scsi_mq_uninit_cmd(cmd);
 
+                /*
+                 * queue is still alive, so grab the ref for preventing it
+                 * from being cleaned up during running queue.
+                 */
+                percpu_ref_get(&q->q_usage_counter);
+
                 __blk_mq_end_request(req, error);
 
                 if (scsi_target(sdev)->single_lun ||
@@ -704,6 +710,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
                         kblockd_schedule_work(&sdev->requeue_work);
                 else
                         blk_mq_run_hw_queues(q, true);
+
+                percpu_ref_put(&q->q_usage_counter);
         } else {
                 unsigned long flags;
 
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 7218fb963d0a..1382a8df6c75 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -777,9 +777,6 @@ static int qcom_slim_ngd_xfer_msg(struct slim_controller *sctrl,
         u8 la = txn->la;
         bool usr_msg = false;
 
-        if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)
-                return -EPROTONOSUPPORT;
-
         if (txn->mt == SLIM_MSG_MT_CORE &&
                 (txn->mc >= SLIM_MSG_MC_BEGIN_RECONFIGURATION &&
                  txn->mc <= SLIM_MSG_MC_RECONFIGURE_NOW))
diff --git a/drivers/slimbus/slimbus.h b/drivers/slimbus/slimbus.h
index 4399d1873e2d..9be41089edde 100644
--- a/drivers/slimbus/slimbus.h
+++ b/drivers/slimbus/slimbus.h
@@ -61,12 +61,6 @@
 #define SLIM_MSG_MC_NEXT_REMOVE_CHANNEL          0x58
 #define SLIM_MSG_MC_RECONFIGURE_NOW              0x5F
 
-/*
- * Clock pause flag to indicate that the reconfig message
- * corresponds to clock pause sequence
- */
-#define SLIM_MSG_CLK_PAUSE_SEQ_FLG              (1U << 8)
-
 /* Clock pause values per SLIMbus spec */
 #define SLIM_CLK_FAST                           0
 #define SLIM_CLK_CONST_PHASE                    1
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 3dc31627c655..0c2867deb36f 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -522,11 +522,11 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
                 mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
                 mtk_spi_setup_packet(master);
 
-                cnt = len / 4;
+                cnt = mdata->xfer_len / 4;
                 iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
                                 trans->tx_buf + mdata->num_xfered, cnt);
 
-                remainder = len % 4;
+                remainder = mdata->xfer_len % 4;
                 if (remainder > 0) {
                         reg_val = 0;
                         memcpy(&reg_val,
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index f024c3fc3679..2fd8881fcd65 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -1540,13 +1540,26 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
 /* work with hotplug and coldplug */
 MODULE_ALIAS("platform:omap2_mcspi");
 
-#ifdef  CONFIG_SUSPEND
-static int omap2_mcspi_suspend_noirq(struct device *dev)
+static int __maybe_unused omap2_mcspi_suspend(struct device *dev)
 {
-        return pinctrl_pm_select_sleep_state(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
+        int error;
+
+        error = pinctrl_pm_select_sleep_state(dev);
+        if (error)
+                dev_warn(mcspi->dev, "%s: failed to set pins: %i\n",
+                         __func__, error);
+
+        error = spi_master_suspend(master);
+        if (error)
+                dev_warn(mcspi->dev, "%s: master suspend failed: %i\n",
+                         __func__, error);
+
+        return pm_runtime_force_suspend(dev);
 }
 
-static int omap2_mcspi_resume_noirq(struct device *dev)
+static int __maybe_unused omap2_mcspi_resume(struct device *dev)
 {
         struct spi_master *master = dev_get_drvdata(dev);
         struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
@@ -1557,17 +1570,17 @@ static int omap2_mcspi_resume_noirq(struct device *dev)
                 dev_warn(mcspi->dev, "%s: failed to set pins: %i\n",
                          __func__, error);
 
-        return 0;
-}
+        error = spi_master_resume(master);
+        if (error)
+                dev_warn(mcspi->dev, "%s: master resume failed: %i\n",
+                         __func__, error);
 
-#else
-#define omap2_mcspi_suspend_noirq       NULL
-#define omap2_mcspi_resume_noirq        NULL
-#endif
+        return pm_runtime_force_resume(dev);
+}
 
 static const struct dev_pm_ops omap2_mcspi_pm_ops = {
-        .suspend_noirq = omap2_mcspi_suspend_noirq,
-        .resume_noirq = omap2_mcspi_resume_noirq,
+        SET_SYSTEM_SLEEP_PM_OPS(omap2_mcspi_suspend,
+                                omap2_mcspi_resume)
         .runtime_resume = omap_mcspi_runtime_resume,
 };
 
diff --git a/drivers/staging/comedi/comedi.h b/drivers/staging/comedi/comedi.h
index e90b17775284..09a940066c0e 100644
--- a/drivers/staging/comedi/comedi.h
+++ b/drivers/staging/comedi/comedi.h
@@ -1005,35 +1005,38 @@ enum i8254_mode {
  * and INSN_DEVICE_CONFIG_GET_ROUTES.
  */
 #define NI_NAMES_BASE   0x8000u
+
+#define _TERM_N(base, n, x)     ((base) + ((x) & ((n) - 1)))
+
 /*
  * not necessarily all allowed 64 PFIs are valid--certainly not for all devices
  */
-#define NI_PFI(x)       (NI_NAMES_BASE        + ((x) & 0x3f))
+#define NI_PFI(x)               _TERM_N(NI_NAMES_BASE, 64, x)
 /* 8 trigger lines by standard, Some devices cannot talk to all eight. */
-#define TRIGGER_LINE(x) (NI_PFI(-1)       + 1 + ((x) & 0x7))
+#define TRIGGER_LINE(x)         _TERM_N(NI_PFI(-1) + 1, 8, x)
 /* 4 RTSI shared MUXes to route signals to/from TRIGGER_LINES on NI hardware */
-#define NI_RTSI_BRD(x)  (TRIGGER_LINE(-1) + 1 + ((x) & 0x3))
+#define NI_RTSI_BRD(x)          _TERM_N(TRIGGER_LINE(-1) + 1, 4, x)
 
 /* *** Counter/timer names : 8 counters max *** */
-#define NI_COUNTER_NAMES_BASE  (NI_RTSI_BRD(-1)  + 1)
-#define NI_MAX_COUNTERS        7
-#define NI_CtrSource(x)        (NI_COUNTER_NAMES_BASE + ((x) & NI_MAX_COUNTERS))
+#define NI_MAX_COUNTERS         8
+#define NI_COUNTER_NAMES_BASE   (NI_RTSI_BRD(-1)  + 1)
+#define NI_CtrSource(x)       _TERM_N(NI_COUNTER_NAMES_BASE, NI_MAX_COUNTERS, x)
 /* Gate, Aux, A,B,Z are all treated, at times as gates */
-#define NI_GATES_NAMES_BASE    (NI_CtrSource(-1) + 1)
-#define NI_CtrGate(x)          (NI_GATES_NAMES_BASE   + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrAux(x)           (NI_CtrGate(-1)   + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrA(x)             (NI_CtrAux(-1)    + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrB(x)             (NI_CtrA(-1)      + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrZ(x)             (NI_CtrB(-1)      + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_GATES_NAMES_MAX     NI_CtrZ(-1)
-#define NI_CtrArmStartTrigger(x) (NI_CtrZ(-1)    + 1  + ((x) & NI_MAX_COUNTERS))
+#define NI_GATES_NAMES_BASE     (NI_CtrSource(-1) + 1)
+#define NI_CtrGate(x)           _TERM_N(NI_GATES_NAMES_BASE, NI_MAX_COUNTERS, x)
+#define NI_CtrAux(x)            _TERM_N(NI_CtrGate(-1)  + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrA(x)              _TERM_N(NI_CtrAux(-1)   + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrB(x)              _TERM_N(NI_CtrA(-1)     + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrZ(x)              _TERM_N(NI_CtrB(-1)     + 1, NI_MAX_COUNTERS, x)
+#define NI_GATES_NAMES_MAX      NI_CtrZ(-1)
+#define NI_CtrArmStartTrigger(x) _TERM_N(NI_CtrZ(-1)    + 1, NI_MAX_COUNTERS, x)
 #define NI_CtrInternalOutput(x) \
-                     (NI_CtrArmStartTrigger(-1)  + 1  + ((x) & NI_MAX_COUNTERS))
+                      _TERM_N(NI_CtrArmStartTrigger(-1) + 1, NI_MAX_COUNTERS, x)
 /** external pin(s) labeled conveniently as Ctr<i>Out. */
-#define NI_CtrOut(x)  (NI_CtrInternalOutput(-1)  + 1  + ((x) & NI_MAX_COUNTERS))
+#define NI_CtrOut(x)   _TERM_N(NI_CtrInternalOutput(-1) + 1, NI_MAX_COUNTERS, x)
 /** For Buffered sampling of ctr -- x series capability. */
-#define NI_CtrSampleClock(x)    (NI_CtrOut(-1)   + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_COUNTER_NAMES_MAX   NI_CtrSampleClock(-1)
+#define NI_CtrSampleClock(x)    _TERM_N(NI_CtrOut(-1)   + 1, NI_MAX_COUNTERS, x)
+#define NI_COUNTER_NAMES_MAX    NI_CtrSampleClock(-1)
 
 enum ni_common_signal_names {
         /* PXI_Star: this is a non-NI-specific signal */
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 2d1e0325d04d..5edf59ac6706 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2843,7 +2843,8 @@ static int ni_ao_insn_config(struct comedi_device *dev,
                 return ni_ao_arm(dev, s);
         case INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS:
                 /* we don't care about actual channels */
-                data[1] = board->ao_speed;
+                /* data[3] : chanlist_len */
+                data[1] = board->ao_speed * data[3];
                 data[2] = 0;
                 return 0;
         default:
diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
index a53231b08d30..e3425bf082ae 100644
--- a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
+++ b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
@@ -310,6 +310,7 @@ static int ipipeif_hw_setup(struct v4l2_subdev *sd)
                         ipipeif_write(val, ipipeif_base_addr, IPIPEIF_CFG2);
                         break;
                 }
+                /* fall through */
 
         case IPIPEIF_SDRAM_YUV:
                 /* Set clock divider */
diff --git a/drivers/staging/media/sunxi/cedrus/TODO b/drivers/staging/media/sunxi/cedrus/TODO
index ec277ece47af..a951b3fd1ea1 100644
--- a/drivers/staging/media/sunxi/cedrus/TODO
+++ b/drivers/staging/media/sunxi/cedrus/TODO
@@ -5,3 +5,8 @@ Before this stateless decoder driver can leave the staging area:
 * Userspace support for the Request API needs to be reviewed;
 * Another stateless decoder driver should be submitted;
 * At least one stateless encoder driver should be submitted.
+* When queueing a request containing references to I frames, the
+  refcount of the memory for those I frames needs to be incremented
+  and decremented when the request is completed. This will likely
+  require some help from vb2. The driver should fail the request
+  if the memory/buffer is gone.
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index 82558455384a..c912c70b3ef7 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -108,17 +108,6 @@ static int cedrus_request_validate(struct media_request *req)
         unsigned int count;
         unsigned int i;
 
-        count = vb2_request_buffer_cnt(req);
-        if (!count) {
-                v4l2_info(&ctx->dev->v4l2_dev,
-                          "No buffer was provided with the request\n");
-                return -ENOENT;
-        } else if (count > 1) {
-                v4l2_info(&ctx->dev->v4l2_dev,
-                          "More than one buffer was provided with the request\n");
-                return -EINVAL;
-        }
-
         list_for_each_entry(obj, &req->objects, list) {
                 struct vb2_buffer *vb;
 
@@ -133,6 +122,17 @@ static int cedrus_request_validate(struct media_request *req)
         if (!ctx)
                 return -ENOENT;
 
+        count = vb2_request_buffer_cnt(req);
+        if (!count) {
+                v4l2_info(&ctx->dev->v4l2_dev,
+                          "No buffer was provided with the request\n");
+                return -ENOENT;
+        } else if (count > 1) {
+                v4l2_info(&ctx->dev->v4l2_dev,
+                          "More than one buffer was provided with the request\n");
+                return -EINVAL;
+        }
+
         parent_hdl = &ctx->hdl;
 
         hdl = v4l2_ctrl_request_hdl_find(req, parent_hdl);
@@ -253,7 +253,7 @@ static const struct v4l2_m2m_ops cedrus_m2m_ops = {
 
 static const struct media_device_ops cedrus_m2m_media_ops = {
         .req_validate   = cedrus_request_validate,
-        .req_queue      = vb2_m2m_request_queue,
+        .req_queue      = v4l2_m2m_request_queue,
 };
 
 static int cedrus_probe(struct platform_device *pdev)
diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
index 6a18cf73c85e..18936cdb1083 100644
--- a/drivers/staging/most/core.c
+++ b/drivers/staging/most/core.c
@@ -351,7 +351,7 @@ static ssize_t set_datatype_show(struct device *dev,
 
         for (i = 0; i < ARRAY_SIZE(ch_data_type); i++) {
                 if (c->cfg.data_type & ch_data_type[i].most_ch_data_type)
-                        return snprintf(buf, PAGE_SIZE, ch_data_type[i].name);
+                        return snprintf(buf, PAGE_SIZE, "%s", ch_data_type[i].name);
         }
         return snprintf(buf, PAGE_SIZE, "unconfigured\n");
 }
diff --git a/drivers/staging/mt7621-dma/mtk-hsdma.c b/drivers/staging/mt7621-dma/mtk-hsdma.c
index df6ebf41bdea..5831f816c17b 100644
--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
+++ b/drivers/staging/mt7621-dma/mtk-hsdma.c
@@ -335,6 +335,8 @@ static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
         /* tx desc */
         src = sg->src_addr;
         for (i = 0; i < chan->desc->num_sgs; i++) {
+                tx_desc = &chan->tx_ring[chan->tx_idx];
+
                 if (len > HSDMA_MAX_PLEN)
                         tlen = HSDMA_MAX_PLEN;
                 else
@@ -344,7 +346,6 @@ static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
                         tx_desc->addr1 = src;
                         tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
                 } else {
-                        tx_desc = &chan->tx_ring[chan->tx_idx];
                         tx_desc->addr0 = src;
                         tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
 
diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
index b8566ed898f1..aa98fbb17013 100644
--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
@@ -82,7 +82,7 @@ static int rt2880_pinctrl_dt_node_to_map(struct pinctrl_dev *pctrldev,
         struct property *prop;
         const char *function_name, *group_name;
         int ret;
-        int ngroups;
+        int ngroups = 0;
         unsigned int reserved_maps = 0;
 
         for_each_node_with_property(np_config, "group")
diff --git a/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c b/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
index 85077947b9b8..85aba8a503cd 100644
--- a/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
+++ b/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
@@ -109,12 +109,12 @@ static void update_recvframe_phyinfo(union recv_frame *precvframe,
         rx_bssid = get_hdr_bssid(wlanhdr);
         pkt_info.bssid_match = ((!IsFrameTypeCtrl(wlanhdr)) &&
                                 !pattrib->icv_err && !pattrib->crc_err &&
-                                !ether_addr_equal(rx_bssid, my_bssid));
+                                ether_addr_equal(rx_bssid, my_bssid));
 
         rx_ra = get_ra(wlanhdr);
         my_hwaddr = myid(&padapter->eeprompriv);
         pkt_info.to_self = pkt_info.bssid_match &&
-                !ether_addr_equal(rx_ra, my_hwaddr);
+                ether_addr_equal(rx_ra, my_hwaddr);
 
 
         pkt_info.is_beacon = pkt_info.bssid_match &&
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index af2234798fa8..db553f2e4c0b 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -1277,7 +1277,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy,
 
                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
                 sinfo->tx_packets = psta->sta_stats.tx_pkts;
-
+                sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
         }
 
         /* for Ad-Hoc/AP mode */
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 28bfdbdc6e76..b8631baf128d 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -2289,7 +2289,7 @@ static int rtw_wx_read32(struct net_device *dev,
 exit:
         kfree(ptmp);
 
-        return 0;
+        return ret;
 }
 
 static int rtw_wx_write32(struct net_device *dev,
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index ea789376de0f..45de21c210c1 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1795,6 +1795,7 @@ vchiq_compat_ioctl_await_completion(struct file *file,
         struct vchiq_await_completion32 args32;
         struct vchiq_completion_data32 completion32;
         unsigned int *msgbufcount32;
+        unsigned int msgbufcount_native;
         compat_uptr_t msgbuf32;
         void *msgbuf;
         void **msgbufptr;
@@ -1906,7 +1907,11 @@ vchiq_compat_ioctl_await_completion(struct file *file,
                          sizeof(completion32)))
                 return -EFAULT;
 
-        args32.msgbufcount--;
+        if (get_user(msgbufcount_native, &args->msgbufcount))
+                return -EFAULT;
+
+        if (!msgbufcount_native)
+                args32.msgbufcount--;
 
         msgbufcount32 =
                 &((struct vchiq_await_completion32 __user *)arg)->msgbufcount;
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 52ff854f0d6c..cd96994dc094 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -863,6 +863,30 @@ static ssize_t key_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR(key, 0600, key_show, key_store);
 
+static void nvm_authenticate_start(struct tb_switch *sw)
+{
+        struct pci_dev *root_port;
+
+        /*
+         * During host router NVM upgrade we should not allow root port to
+         * go into D3cold because some root ports cannot trigger PME
+         * itself. To be on the safe side keep the root port in D0 during
+         * the whole upgrade process.
+         */
+        root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
+        if (root_port)
+                pm_runtime_get_noresume(&root_port->dev);
+}
+
+static void nvm_authenticate_complete(struct tb_switch *sw)
+{
+        struct pci_dev *root_port;
+
+        root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
+        if (root_port)
+                pm_runtime_put(&root_port->dev);
+}
+
 static ssize_t nvm_authenticate_show(struct device *dev,
         struct device_attribute *attr, char *buf)
 {
@@ -912,10 +936,18 @@ static ssize_t nvm_authenticate_store(struct device *dev,
 
                 sw->nvm->authenticating = true;
 
-                if (!tb_route(sw))
+                if (!tb_route(sw)) {
+                        /*
+                         * Keep root port from suspending as long as the
+                         * NVM upgrade process is running.
+                         */
+                        nvm_authenticate_start(sw);
                         ret = nvm_authenticate_host(sw);
-                else
+                        if (ret)
+                                nvm_authenticate_complete(sw);
+                } else {
                         ret = nvm_authenticate_device(sw);
+                }
                 pm_runtime_mark_last_busy(&sw->dev);
                 pm_runtime_put_autosuspend(&sw->dev);
         }
@@ -1334,6 +1366,10 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
         if (ret <= 0)
                 return ret;
 
+        /* Now we can allow root port to suspend again */
+        if (!tb_route(sw))
+                nvm_authenticate_complete(sw);
+
         if (status) {
                 tb_sw_info(sw, "switch flash authentication failed\n");
                 tb_switch_set_uuid(sw);
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index ff6ba6d86cd8..cc56cb3b3eca 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1614,10 +1614,10 @@ static void sci_request_dma(struct uart_port *port)
                 hrtimer_init(&s->rx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
                 s->rx_timer.function = rx_timer_fn;
 
+                s->chan_rx_saved = s->chan_rx = chan;
+
                 if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
                         sci_submit_rx(s);
-
-                s->chan_rx_saved = s->chan_rx = chan;
         }
 }
 
@@ -3102,6 +3102,7 @@ static struct uart_driver sci_uart_driver = {
 static int sci_remove(struct platform_device *dev)
 {
         struct sci_port *port = platform_get_drvdata(dev);
+        unsigned int type = port->port.type;    /* uart_remove_... clears it */
 
         sci_ports_in_use &= ~BIT(port->port.line);
         uart_remove_one_port(&sci_uart_driver, &port->port);
@@ -3112,8 +3113,7 @@ static int sci_remove(struct platform_device *dev)
                 sysfs_remove_file(&dev->dev.kobj,
                                   &dev_attr_rx_fifo_trigger.attr);
         }
-        if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB ||
-            port->port.type == PORT_HSCIF) {
+        if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) {
                 sysfs_remove_file(&dev->dev.kobj,
                                   &dev_attr_rx_fifo_timeout.attr);
         }
diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
index 70a4ea4eaa6e..990376576970 100644
--- a/drivers/tty/serial/suncore.c
+++ b/drivers/tty/serial/suncore.c
@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
                 mode = of_get_property(dp, mode_prop, NULL);
                 if (!mode)
                         mode = "9600,8,n,1,-";
+                of_node_put(dp);
         }
 
         cflag = CREAD | HUPCL | CLOCAL;
diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c
index 7576ceace571..f438eaa68246 100644
--- a/drivers/tty/tty_baudrate.c
+++ b/drivers/tty/tty_baudrate.c
@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios)
                 else
                         cbaud += 15;
         }
-        return baud_table[cbaud];
+        return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
 }
 EXPORT_SYMBOL(tty_termios_baud_rate);
 
@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios)
                 else
                         cbaud += 15;
         }
-        return baud_table[cbaud];
+        return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
 #else   /* IBSHIFT */
         return tty_termios_baud_rate(termios);
 #endif  /* IBSHIFT */
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 55370e651db3..41ec8e5010f3 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1548,7 +1548,7 @@ static void csi_K(struct vc_data *vc, int vpar)
         scr_memsetw(start + offset, vc->vc_video_erase_char, 2 * count);
         vc->vc_need_wrap = 0;
         if (con_should_update(vc))
-                do_update_region(vc, (unsigned long) start, count);
+                do_update_region(vc, (unsigned long)(start + offset), count);
 }
 
 static void csi_X(struct vc_data *vc, int vpar) /* erase the following vpar positions */
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 85644669fbe7..0a357db4b31b 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -961,6 +961,8 @@ int __uio_register_device(struct module *owner,
         if (ret)
                 goto err_uio_dev_add_attributes;
 
+        info->uio_dev = idev;
+
         if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
                 /*
                  * Note that we deliberately don't use devm_request_irq
@@ -972,11 +974,12 @@ int __uio_register_device(struct module *owner,
                  */
                 ret = request_irq(info->irq, uio_interrupt,
                                   info->irq_flags, info->name, idev);
-                if (ret)
+                if (ret) {
+                        info->uio_dev = NULL;
                         goto err_request_irq;
+                }
         }
 
-        info->uio_dev = idev;
         return 0;
 
 err_request_irq:
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 47d75c20c211..1b68fed464cb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1696,6 +1696,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
         { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
         .driver_info = QUIRK_CONTROL_LINE_STATE, },
         { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index c6077d582d29..0f9381b69a3b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2794,6 +2794,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
         int i, status;
         u16 portchange, portstatus;
         struct usb_port *port_dev = hub->ports[port1 - 1];
+        int reset_recovery_time;
 
         if (!hub_is_superspeed(hub->hdev)) {
                 if (warm) {
@@ -2849,7 +2850,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
                                         USB_PORT_FEAT_C_BH_PORT_RESET);
                         usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_PORT_LINK_STATE);
-                        usb_clear_port_feature(hub->hdev, port1,
+
+                        if (udev)
+                                usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_CONNECTION);
 
                         /*
@@ -2885,11 +2888,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
 
 done:
         if (status == 0) {
-                /* TRSTRCY = 10 ms; plus some extra */
                 if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM)
                         usleep_range(10000, 12000);
-                else
-                        msleep(10 + 40);
+                else {
+                        /* TRSTRCY = 10 ms; plus some extra */
+                        reset_recovery_time = 10 + 40;
+
+                        /* Hub needs extra delay after resetting its port. */
+                        if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET)
+                                reset_recovery_time += 100;
+
+                        msleep(reset_recovery_time);
+                }
 
                 if (udev) {
                         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 178d6c6063c0..0690fcff0ea2 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
                         case 'n':
                                 flags |= USB_QUIRK_DELAY_CTRL_MSG;
                                 break;
+                        case 'o':
+                                flags |= USB_QUIRK_HUB_SLOW_RESET;
+                                break;
                         /* Ignore unrecognized flag characters */
                         }
                 }
@@ -206,6 +209,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+        { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
         { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
@@ -380,6 +386,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Terminus Technology Inc. Hub */
+        { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
+
         /* Corsair K70 RGB */
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -391,6 +400,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
           USB_QUIRK_DELAY_CTRL_MSG },
 
+        /* Corsair K70 LUX RGB */
+        { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Corsair K70 LUX */
         { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -411,6 +423,11 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x2040, 0x7200), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* Raydium Touchscreen */
+        { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
+
+        { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+
         /* DJI CineSSD */
         { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
index d257c541e51b..7afc10872f1f 100644
--- a/drivers/usb/dwc2/pci.c
+++ b/drivers/usb/dwc2/pci.c
@@ -120,6 +120,7 @@ static int dwc2_pci_probe(struct pci_dev *pci,
         dwc2 = platform_device_alloc("dwc2", PLATFORM_DEVID_AUTO);
         if (!dwc2) {
                 dev_err(dev, "couldn't allocate dwc2 device\n");
+                ret = -ENOMEM;
                 goto err;
         }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index becfbb87f791..2f2048aa5fde 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev)
 
 err5:
         dwc3_event_buffers_cleanup(dwc);
+        dwc3_ulpi_exit(dwc);
 
 err4:
         dwc3_free_scratch_buffers(dwc);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 1286076a8890..842795856bf4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -283,8 +283,10 @@ err:
 static void dwc3_pci_remove(struct pci_dev *pci)
 {
         struct dwc3_pci         *dwc = pci_get_drvdata(pci);
+        struct pci_dev          *pdev = dwc->pci;
 
-        gpiod_remove_lookup_table(&platform_bytcr_gpios);
+        if (pdev->device == PCI_DEVICE_ID_INTEL_BYT)
+                gpiod_remove_lookup_table(&platform_bytcr_gpios);
 #ifdef CONFIG_PM
         cancel_work_sync(&dwc->wakeup_work);
 #endif
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 679c12e14522..9f92ee03dde7 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1081,7 +1081,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
                         /* Now prepare one extra TRB to align transfer size */
                         trb = &dep->trb_pool[dep->trb_enqueue];
                         __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
-                                        maxp - rem, false, 0,
+                                        maxp - rem, false, 1,
                                         req->request.stream_id,
                                         req->request.short_not_ok,
                                         req->request.no_interrupt);
@@ -1125,7 +1125,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to align transfer size */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else if (req->request.zero && req->request.length &&
@@ -1141,7 +1141,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to handle ZLP */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else {
@@ -1470,9 +1470,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
                 unsigned transfer_in_flight;
                 unsigned started;
 
-                if (dep->flags & DWC3_EP_STALL)
-                        return 0;
-
                 if (dep->number > 1)
                         trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue);
                 else
@@ -1494,8 +1491,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
                 else
                         dep->flags |= DWC3_EP_STALL;
         } else {
-                if (!(dep->flags & DWC3_EP_STALL))
-                        return 0;
 
                 ret = dwc3_send_clear_stall_ep_cmd(dep);
                 if (ret)
@@ -2259,7 +2254,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
          * with one TRB pending in the ring. We need to manually clear HWO bit
          * from that TRB.
          */
-        if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) {
+        if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
                 trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                 return 1;
         }
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 3ada83d81bda..31e8bf3578c8 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -215,7 +215,6 @@ struct ffs_io_data {
 
         struct mm_struct *mm;
         struct work_struct work;
-        struct work_struct cancellation_work;
 
         struct usb_ep *ep;
         struct usb_request *req;
@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static void ffs_aio_cancel_worker(struct work_struct *work)
-{
-        struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
-                                                   cancellation_work);
-
-        ENTER();
-
-        usb_ep_dequeue(io_data->ep, io_data->req);
-}
-
 static int ffs_aio_cancel(struct kiocb *kiocb)
 {
         struct ffs_io_data *io_data = kiocb->private;
-        struct ffs_data *ffs = io_data->ffs;
+        struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
         int value;
 
         ENTER();
 
-        if (likely(io_data && io_data->ep && io_data->req)) {
-                INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
-                queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
-                value = -EINPROGRESS;
-        } else {
+        spin_lock_irq(&epfile->ffs->eps_lock);
+
+        if (likely(io_data && io_data->ep && io_data->req))
+                value = usb_ep_dequeue(io_data->ep, io_data->req);
+        else
                 value = -EINVAL;
-        }
+
+        spin_unlock_irq(&epfile->ffs->eps_lock);
 
         return value;
 }
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 1000d864929c..0f026d445e31 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -401,12 +401,12 @@ done:
 static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
 {
         struct usb_request      *req;
-        struct usb_request      *tmp;
         unsigned long           flags;
 
         /* fill unused rxq slots with some skb */
         spin_lock_irqsave(&dev->req_lock, flags);
-        list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) {
+        while (!list_empty(&dev->rx_reqs)) {
+                req = list_first_entry(&dev->rx_reqs, struct usb_request, list);
                 list_del_init(&req->list);
                 spin_unlock_irqrestore(&dev->req_lock, flags);
 
@@ -1125,7 +1125,6 @@ void gether_disconnect(struct gether *link)
 {
         struct eth_dev          *dev = link->ioport;
         struct usb_request      *req;
-        struct usb_request      *tmp;
 
         WARN_ON(!dev);
         if (!dev)
@@ -1142,7 +1141,8 @@ void gether_disconnect(struct gether *link)
          */
         usb_ep_disable(link->in_ep);
         spin_lock(&dev->req_lock);
-        list_for_each_entry_safe(req, tmp, &dev->tx_reqs, list) {
+        while (!list_empty(&dev->tx_reqs)) {
+                req = list_first_entry(&dev->tx_reqs, struct usb_request, list);
                 list_del(&req->list);
 
                 spin_unlock(&dev->req_lock);
@@ -1154,7 +1154,8 @@ void gether_disconnect(struct gether *link)
 
         usb_ep_disable(link->out_ep);
         spin_lock(&dev->req_lock);
-        list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) {
+        while (!list_empty(&dev->rx_reqs)) {
+                req = list_first_entry(&dev->rx_reqs, struct usb_request, list);
                 list_del(&req->list);
 
                 spin_unlock(&dev->req_lock);
diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
index 3a16431da321..fcf13ef33b31 100644
--- a/drivers/usb/gadget/udc/omap_udc.c
+++ b/drivers/usb/gadget/udc/omap_udc.c
@@ -2033,6 +2033,7 @@ static inline int machine_without_vbus_sense(void)
 {
         return machine_is_omap_innovator()
                 || machine_is_omap_osk()
+                || machine_is_omap_palmte()
                 || machine_is_sx1()
                 /* No known omap7xx boards with vbus sense */
                 || cpu_is_omap7xx();
@@ -2041,7 +2042,7 @@ static inline int machine_without_vbus_sense(void)
 static int omap_udc_start(struct usb_gadget *g,
                 struct usb_gadget_driver *driver)
 {
-        int             status = -ENODEV;
+        int             status;
         struct omap_ep  *ep;
         unsigned long   flags;
 
@@ -2079,6 +2080,7 @@ static int omap_udc_start(struct usb_gadget *g,
                         goto done;
                 }
         } else {
+                status = 0;
                 if (can_pullup(udc))
                         pullup_enable(udc);
                 else
@@ -2593,9 +2595,22 @@ omap_ep_setup(char *name, u8 addr, u8 type,
 
 static void omap_udc_release(struct device *dev)
 {
-        complete(udc->done);
+        pullup_disable(udc);
+        if (!IS_ERR_OR_NULL(udc->transceiver)) {
+                usb_put_phy(udc->transceiver);
+                udc->transceiver = NULL;
+        }
+        omap_writew(0, UDC_SYSCON1);
+        remove_proc_file();
+        if (udc->dc_clk) {
+                if (udc->clk_requested)
+                        omap_udc_enable_clock(0);
+                clk_put(udc->hhc_clk);
+                clk_put(udc->dc_clk);
+        }
+        if (udc->done)
+                complete(udc->done);
         kfree(udc);
-        udc = NULL;
 }
 
 static int
@@ -2627,6 +2642,7 @@ omap_udc_setup(struct platform_device *odev, struct usb_phy *xceiv)
         udc->gadget.speed = USB_SPEED_UNKNOWN;
         udc->gadget.max_speed = USB_SPEED_FULL;
         udc->gadget.name = driver_name;
+        udc->gadget.quirk_ep_out_aligned_size = 1;
         udc->transceiver = xceiv;
 
         /* ep0 is special; put it right after the SETUP buffer */
@@ -2867,8 +2883,8 @@ bad_on_1710:
                 udc->clr_halt = UDC_RESET_EP;
 
         /* USB general purpose IRQ:  ep0, state changes, dma, etc */
-        status = request_irq(pdev->resource[1].start, omap_udc_irq,
-                        0, driver_name, udc);
+        status = devm_request_irq(&pdev->dev, pdev->resource[1].start,
+                                  omap_udc_irq, 0, driver_name, udc);
         if (status != 0) {
                 ERR("can't get irq %d, err %d\n",
                         (int) pdev->resource[1].start, status);
@@ -2876,20 +2892,20 @@ bad_on_1710:
         }
 
         /* USB "non-iso" IRQ (PIO for all but ep0) */
-        status = request_irq(pdev->resource[2].start, omap_udc_pio_irq,
-                        0, "omap_udc pio", udc);
+        status = devm_request_irq(&pdev->dev, pdev->resource[2].start,
+                                  omap_udc_pio_irq, 0, "omap_udc pio", udc);
         if (status != 0) {
                 ERR("can't get irq %d, err %d\n",
                         (int) pdev->resource[2].start, status);
-                goto cleanup2;
+                goto cleanup1;
         }
 #ifdef  USE_ISO
-        status = request_irq(pdev->resource[3].start, omap_udc_iso_irq,
-                        0, "omap_udc iso", udc);
+        status = devm_request_irq(&pdev->dev, pdev->resource[3].start,
+                                  omap_udc_iso_irq, 0, "omap_udc iso", udc);
         if (status != 0) {
                 ERR("can't get irq %d, err %d\n",
                         (int) pdev->resource[3].start, status);
-                goto cleanup3;
+                goto cleanup1;
         }
 #endif
         if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
@@ -2900,23 +2916,8 @@ bad_on_1710:
         }
 
         create_proc_file();
-        status = usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
-                        omap_udc_release);
-        if (status)
-                goto cleanup4;
-
-        return 0;
-
-cleanup4:
-        remove_proc_file();
-
-#ifdef  USE_ISO
-cleanup3:
-        free_irq(pdev->resource[2].start, udc);
-#endif
-
-cleanup2:
-        free_irq(pdev->resource[1].start, udc);
+        return usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
+                                          omap_udc_release);
 
 cleanup1:
         kfree(udc);
@@ -2943,42 +2944,15 @@ static int omap_udc_remove(struct platform_device *pdev)
 {
         DECLARE_COMPLETION_ONSTACK(done);
 
-        if (!udc)
-                return -ENODEV;
-
-        usb_del_gadget_udc(&udc->gadget);
-        if (udc->driver)
-                return -EBUSY;
-
         udc->done = &done;
 
-        pullup_disable(udc);
-        if (!IS_ERR_OR_NULL(udc->transceiver)) {
-                usb_put_phy(udc->transceiver);
-                udc->transceiver = NULL;
-        }
-        omap_writew(0, UDC_SYSCON1);
-
-        remove_proc_file();
-
-#ifdef  USE_ISO
-        free_irq(pdev->resource[3].start, udc);
-#endif
-        free_irq(pdev->resource[2].start, udc);
-        free_irq(pdev->resource[1].start, udc);
+        usb_del_gadget_udc(&udc->gadget);
 
-        if (udc->dc_clk) {
-                if (udc->clk_requested)
-                        omap_udc_enable_clock(0);
-                clk_put(udc->hhc_clk);
-                clk_put(udc->dc_clk);
-        }
+        wait_for_completion(&done);
 
         release_mem_region(pdev->resource[0].start,
                         pdev->resource[0].end - pdev->resource[0].start + 1);
 
-        wait_for_completion(&done);
-
         return 0;
 }
 
diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
index 27f00160332e..3c4abb5a1c3f 100644
--- a/drivers/usb/host/xhci-histb.c
+++ b/drivers/usb/host/xhci-histb.c
@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
         struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
         struct usb_hcd *hcd = histb->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_wakeup_disable(&dev->dev);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         xhci_histb_host_disable(histb);
         usb_put_hcd(hcd);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 12eea73d9f20..94aca1b5ac8a 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_SUSPEND;
         }
         if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME &&
-                !DEV_SUPERSPEED_ANY(raw_port_status)) {
+                !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) {
                 if ((raw_port_status & PORT_RESET) ||
                                 !(raw_port_status & PORT_PE))
                         return 0xffffffff;
@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         time_left = wait_for_completion_timeout(
                                         &bus_state->rexit_done[wIndex],
                                         msecs_to_jiffies(
-                                                XHCI_MAX_REXIT_TIMEOUT));
+                                                XHCI_MAX_REXIT_TIMEOUT_MS));
                         spin_lock_irqsave(&xhci->lock, flags);
 
                         if (time_left) {
@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         } else {
                                 int port_status = readl(port->addr);
                                 xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
-                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                XHCI_MAX_REXIT_TIMEOUT_MS,
                                                 port_status);
                                 status |= USB_PORT_STAT_SUSPEND;
                                 clear_bit(wIndex, &bus_state->rexit_ports);
@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
         unsigned long flags;
         struct xhci_hub *rhub;
         struct xhci_port **ports;
+        u32 portsc_buf[USB_MAXCHILDREN];
+        bool wake_enabled;
 
         rhub = xhci_get_rhub(hcd);
         ports = rhub->ports;
         max_ports = rhub->num_ports;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
+        wake_enabled = hcd->self.root_hub->do_remote_wakeup;
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        if (hcd->self.root_hub->do_remote_wakeup) {
+        if (wake_enabled) {
                 if (bus_state->resuming_ports ||        /* USB2 */
                     bus_state->port_remote_wakeup) {    /* USB3 */
                         spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                         return -EBUSY;
                 }
         }
-
-        port_index = max_ports;
+        /*
+         * Prepare ports for suspend, but don't write anything before all ports
+         * are checked and we know bus suspend can proceed
+         */
         bus_state->bus_suspended = 0;
+        port_index = max_ports;
         while (port_index--) {
-                /* suspend the port if the port is not suspended */
                 u32 t1, t2;
-                int slot_id;
 
                 t1 = readl(ports[port_index]->addr);
                 t2 = xhci_port_state_to_neutral(t1);
+                portsc_buf[port_index] = 0;
 
-                if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) {
-                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-                                        port_index + 1);
-                        if (slot_id) {
+                /* Bail out if a USB3 port has a new device in link training */
+                if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+                        bus_state->bus_suspended = 0;
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+                        return -EBUSY;
+                }
+
+                /* suspend ports in U0, or bail out for new connect changes */
+                if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+                        if ((t1 & PORT_CSC) && wake_enabled) {
+                                bus_state->bus_suspended = 0;
                                 spin_unlock_irqrestore(&xhci->lock, flags);
-                                xhci_stop_device(xhci, slot_id, 1);
-                                spin_lock_irqsave(&xhci->lock, flags);
+                                xhci_dbg(xhci, "Bus suspend bailout, port connect change\n");
+                                return -EBUSY;
                         }
+                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
                         t2 &= ~PORT_PLS_MASK;
                         t2 |= PORT_LINK_STROBE | XDEV_U3;
                         set_bit(port_index, &bus_state->bus_suspended);
@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup) {
+                if (wake_enabled) {
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
 
                 t1 = xhci_port_state_to_neutral(t1);
                 if (t1 != t2)
-                        writel(t2, ports[port_index]->addr);
+                        portsc_buf[port_index] = t2;
+        }
+
+        /* write port settings, stopping and suspending ports if needed */
+        port_index = max_ports;
+        while (port_index--) {
+                if (!portsc_buf[port_index])
+                        continue;
+                if (test_bit(port_index, &bus_state->bus_suspended)) {
+                        int slot_id;
+
+                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                                                            port_index + 1);
+                        if (slot_id) {
+                                spin_unlock_irqrestore(&xhci->lock, flags);
+                                xhci_stop_device(xhci, slot_id, 1);
+                                spin_lock_irqsave(&xhci->lock, flags);
+                        }
+                }
+                writel(portsc_buf[port_index], ports[port_index]->addr);
         }
         hcd->state = HC_STATE_SUSPENDED;
         bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 71d0d33c3286..60987c787e44 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
         struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
         struct usb_hcd  *hcd = mtk->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd  *shared_hcd = xhci->shared_hcd;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_init_wakeup(&dev->dev, false);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
         usb_put_hcd(hcd);
         xhci_mtk_sch_exit(mtk);
         xhci_mtk_clks_disable(mtk);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 01c57055c0c5..a9515265db4d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -248,6 +248,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
 
+        if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM ||
+             pdev->vendor == PCI_VENDOR_ID_CAVIUM) &&
+             pdev->device == 0x9026)
+                xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
@@ -380,6 +385,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
         if (xhci->shared_hcd) {
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
+                xhci->shared_hcd = NULL;
         }
 
         /* Workaround for spurious wakeups at shutdown with HSW */
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 32b5574ad5c5..ef09cb06212f 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -362,14 +362,16 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
         struct clk *reg_clk = xhci->reg_clk;
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_phy_shutdown(hcd->usb_phy);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         clk_disable_unprepare(clk);
         clk_disable_unprepare(reg_clk);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a8d92c90fb58..65750582133f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1521,6 +1521,35 @@ static void handle_device_notification(struct xhci_hcd *xhci,
                 usb_wakeup_notification(udev->parent, udev->portnum);
 }
 
+/*
+ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI
+ * Controller.
+ * As per ThunderX2errata-129 USB 2 device may come up as USB 1
+ * If a connection to a USB 1 device is followed by another connection
+ * to a USB 2 device.
+ *
+ * Reset the PHY after the USB device is disconnected if device speed
+ * is less than HCD_USB3.
+ * Retry the reset sequence max of 4 times checking the PLL lock status.
+ *
+ */
+static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
+{
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        u32 pll_lock_check;
+        u32 retry_count = 4;
+
+        do {
+                /* Assert PHY reset */
+                writel(0x6F, hcd->regs + 0x1048);
+                udelay(10);
+                /* De-assert the PHY reset */
+                writel(0x7F, hcd->regs + 0x1048);
+                udelay(200);
+                pll_lock_check = readl(hcd->regs + 0x1070);
+        } while (!(pll_lock_check & 0x1) && --retry_count);
+}
+
 static void handle_port_status(struct xhci_hcd *xhci,
                 union xhci_trb *event)
 {
@@ -1556,6 +1585,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
+        /* We might get interrupts after shared_hcd is removed */
+        if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
+                xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
+                bogus_port_status = true;
+                goto cleanup;
+        }
+
         hcd = port->rhub->hcd;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
         hcd_portnum = port->hcd_portnum;
@@ -1639,7 +1675,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
          * RExit to a disconnect state).  If so, let the the driver know it's
          * out of the RExit state.
          */
-        if (!DEV_SUPERSPEED_ANY(portsc) &&
+        if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
                         test_and_clear_bit(hcd_portnum,
                                 &bus_state->rexit_ports)) {
                 complete(&bus_state->rexit_done[hcd_portnum]);
@@ -1647,8 +1683,12 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
-        if (hcd->speed < HCD_USB3)
+        if (hcd->speed < HCD_USB3) {
                 xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+                if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) &&
+                    (portsc & PORT_CSC) && !(portsc & PORT_CONNECT))
+                        xhci_cavium_reset_phy_quirk(xhci);
+        }
 
 cleanup:
         /* Update event ring dequeue pointer before dropping the lock */
@@ -2266,6 +2306,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         goto cleanup;
                 case COMP_RING_UNDERRUN:
                 case COMP_RING_OVERRUN:
+                case COMP_STOPPED_LENGTH_INVALID:
                         goto cleanup;
                 default:
                         xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 6b5db344de30..938ff06c0349 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1303,6 +1303,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
 
         usb_remove_hcd(xhci->shared_hcd);
         usb_put_hcd(xhci->shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_remove_hcd(tegra->hcd);
         usb_put_hcd(tegra->hcd);
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0420eefa647a..c928dbbff881 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
 
         /* Only halt host and free memory after both hcds are removed */
         if (!usb_hcd_is_primary_hcd(hcd)) {
-                /* usb core will free this hcd shortly, unset pointer */
-                xhci->shared_hcd = NULL;
                 mutex_unlock(&xhci->mutex);
                 return;
         }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index bf0b3692dc9a..260b259b72bc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1680,7 +1680,7 @@ struct xhci_bus_state {
  * It can take up to 20 ms to transition from RExit to U0 on the
  * Intel Lynx Point LP xHCI host.
  */
-#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
+#define XHCI_MAX_REXIT_TIMEOUT_MS       20
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
@@ -1849,6 +1849,7 @@ struct xhci_hcd {
 #define XHCI_INTEL_USB_ROLE_SW  BIT_ULL(31)
 #define XHCI_ZERO_64B_REGS      BIT_ULL(32)
 #define XHCI_DEFAULT_PM_RUNTIME_ALLOW   BIT_ULL(33)
+#define XHCI_RESET_PLL_ON_DISCONNECT    BIT_ULL(34)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index bd539f3058bc..85b48c6ddc7e 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = {
         { APPLEDISPLAY_DEVICE(0x9219) },
         { APPLEDISPLAY_DEVICE(0x921c) },
         { APPLEDISPLAY_DEVICE(0x921d) },
+        { APPLEDISPLAY_DEVICE(0x9222) },
         { APPLEDISPLAY_DEVICE(0x9236) },
 
         /* Terminating entry */
diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
index d17cd95b55bb..6b2140f966ef 100644
--- a/drivers/usb/storage/unusual_realtek.h
+++ b/drivers/usb/storage/unusual_realtek.h
@@ -27,4 +27,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999,
                 "USB Card Reader",
                 USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
 
+UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
+                "Realtek",
+                "USB Card Reader",
+                USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
+UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
+                "Realtek",
+                "USB Card Reader",
+                USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
 #endif  /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
diff --git a/drivers/usb/typec/ucsi/Kconfig b/drivers/usb/typec/ucsi/Kconfig
index e36d6c73c4a4..78118883f96c 100644
--- a/drivers/usb/typec/ucsi/Kconfig
+++ b/drivers/usb/typec/ucsi/Kconfig
@@ -23,6 +23,16 @@ config TYPEC_UCSI
 
 if TYPEC_UCSI
 
+config UCSI_CCG
+        tristate "UCSI Interface Driver for Cypress CCGx"
+        depends on I2C
+        help
+          This driver enables UCSI support on platforms that expose a
+          Cypress CCGx Type-C controller over I2C interface.
+
+          To compile the driver as a module, choose M here: the module will be
+          called ucsi_ccg.
+
 config UCSI_ACPI
         tristate "UCSI ACPI Interface Driver"
         depends on ACPI
diff --git a/drivers/usb/typec/ucsi/Makefile b/drivers/usb/typec/ucsi/Makefile
index 7afbea512207..2f4900b26210 100644
--- a/drivers/usb/typec/ucsi/Makefile
+++ b/drivers/usb/typec/ucsi/Makefile
@@ -8,3 +8,5 @@ typec_ucsi-y			:= ucsi.o
 typec_ucsi-$(CONFIG_TRACING)    += trace.o
 
 obj-$(CONFIG_UCSI_ACPI)         += ucsi_acpi.o
+
+obj-$(CONFIG_UCSI_CCG)          += ucsi_ccg.o
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
new file mode 100644
index 000000000000..de8a43bdff68
--- /dev/null
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -0,0 +1,307 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * UCSI driver for Cypress CCGx Type-C controller
+ *
+ * Copyright (C) 2017-2018 NVIDIA Corporation. All rights reserved.
+ * Author: Ajay Gupta <ajayg@nvidia.com>
+ *
+ * Some code borrowed from drivers/usb/typec/ucsi/ucsi_acpi.c
+ */
+#include <linux/acpi.h>
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+
+#include <asm/unaligned.h>
+#include "ucsi.h"
+
+struct ucsi_ccg {
+        struct device *dev;
+        struct ucsi *ucsi;
+        struct ucsi_ppm ppm;
+        struct i2c_client *client;
+};
+
+#define CCGX_RAB_INTR_REG                       0x06
+#define CCGX_RAB_UCSI_CONTROL                   0x39
+#define CCGX_RAB_UCSI_CONTROL_START             BIT(0)
+#define CCGX_RAB_UCSI_CONTROL_STOP              BIT(1)
+#define CCGX_RAB_UCSI_DATA_BLOCK(offset)        (0xf000 | ((offset) & 0xff))
+
+static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
+{
+        struct i2c_client *client = uc->client;
+        const struct i2c_adapter_quirks *quirks = client->adapter->quirks;
+        unsigned char buf[2];
+        struct i2c_msg msgs[] = {
+                {
+                        .addr   = client->addr,
+                        .flags  = 0x0,
+                        .len    = sizeof(buf),
+                        .buf    = buf,
+                },
+                {
+                        .addr   = client->addr,
+                        .flags  = I2C_M_RD,
+                        .buf    = data,
+                },
+        };
+        u32 rlen, rem_len = len, max_read_len = len;
+        int status;
+
+        /* check any max_read_len limitation on i2c adapter */
+        if (quirks && quirks->max_read_len)
+                max_read_len = quirks->max_read_len;
+
+        while (rem_len > 0) {
+                msgs[1].buf = &data[len - rem_len];
+                rlen = min_t(u16, rem_len, max_read_len);
+                msgs[1].len = rlen;
+                put_unaligned_le16(rab, buf);
+                status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+                if (status < 0) {
+                        dev_err(uc->dev, "i2c_transfer failed %d\n", status);
+                        return status;
+                }
+                rab += rlen;
+                rem_len -= rlen;
+        }
+
+        return 0;
+}
+
+static int ccg_write(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
+{
+        struct i2c_client *client = uc->client;
+        unsigned char *buf;
+        struct i2c_msg msgs[] = {
+                {
+                        .addr   = client->addr,
+                        .flags  = 0x0,
+                }
+        };
+        int status;
+
+        buf = kzalloc(len + sizeof(rab), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        put_unaligned_le16(rab, buf);
+        memcpy(buf + sizeof(rab), data, len);
+
+        msgs[0].len = len + sizeof(rab);
+        msgs[0].buf = buf;
+
+        status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+        if (status < 0) {
+                dev_err(uc->dev, "i2c_transfer failed %d\n", status);
+                kfree(buf);
+                return status;
+        }
+
+        kfree(buf);
+        return 0;
+}
+
+static int ucsi_ccg_init(struct ucsi_ccg *uc)
+{
+        unsigned int count = 10;
+        u8 data;
+        int status;
+
+        data = CCGX_RAB_UCSI_CONTROL_STOP;
+        status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data));
+        if (status < 0)
+                return status;
+
+        data = CCGX_RAB_UCSI_CONTROL_START;
+        status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data));
+        if (status < 0)
+                return status;
+
+        /*
+         * Flush CCGx RESPONSE queue by acking interrupts. Above ucsi control
+         * register write will push response which must be cleared.
+         */
+        do {
+                status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
+                if (status < 0)
+                        return status;
+
+                if (!data)
+                        return 0;
+
+                status = ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
+                if (status < 0)
+                        return status;
+
+                usleep_range(10000, 11000);
+        } while (--count);
+
+        return -ETIMEDOUT;
+}
+
+static int ucsi_ccg_send_data(struct ucsi_ccg *uc)
+{
+        u8 *ppm = (u8 *)uc->ppm.data;
+        int status;
+        u16 rab;
+
+        rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_out));
+        status = ccg_write(uc, rab, ppm +
+                           offsetof(struct ucsi_data, message_out),
+                           sizeof(uc->ppm.data->message_out));
+        if (status < 0)
+                return status;
+
+        rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, ctrl));
+        return ccg_write(uc, rab, ppm + offsetof(struct ucsi_data, ctrl),
+                         sizeof(uc->ppm.data->ctrl));
+}
+
+static int ucsi_ccg_recv_data(struct ucsi_ccg *uc)
+{
+        u8 *ppm = (u8 *)uc->ppm.data;
+        int status;
+        u16 rab;
+
+        rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, cci));
+        status = ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, cci),
+                          sizeof(uc->ppm.data->cci));
+        if (status < 0)
+                return status;
+
+        rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_in));
+        return ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, message_in),
+                        sizeof(uc->ppm.data->message_in));
+}
+
+static int ucsi_ccg_ack_interrupt(struct ucsi_ccg *uc)
+{
+        int status;
+        unsigned char data;
+
+        status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
+        if (status < 0)
+                return status;
+
+        return ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
+}
+
+static int ucsi_ccg_sync(struct ucsi_ppm *ppm)
+{
+        struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm);
+        int status;
+
+        status = ucsi_ccg_recv_data(uc);
+        if (status < 0)
+                return status;
+
+        /* ack interrupt to allow next command to run */
+        return ucsi_ccg_ack_interrupt(uc);
+}
+
+static int ucsi_ccg_cmd(struct ucsi_ppm *ppm, struct ucsi_control *ctrl)
+{
+        struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm);
+
+        ppm->data->ctrl.raw_cmd = ctrl->raw_cmd;
+        return ucsi_ccg_send_data(uc);
+}
+
+static irqreturn_t ccg_irq_handler(int irq, void *data)
+{
+        struct ucsi_ccg *uc = data;
+
+        ucsi_notify(uc->ucsi);
+
+        return IRQ_HANDLED;
+}
+
+static int ucsi_ccg_probe(struct i2c_client *client,
+                          const struct i2c_device_id *id)
+{
+        struct device *dev = &client->dev;
+        struct ucsi_ccg *uc;
+        int status;
+        u16 rab;
+
+        uc = devm_kzalloc(dev, sizeof(*uc), GFP_KERNEL);
+        if (!uc)
+                return -ENOMEM;
+
+        uc->ppm.data = devm_kzalloc(dev, sizeof(struct ucsi_data), GFP_KERNEL);
+        if (!uc->ppm.data)
+                return -ENOMEM;
+
+        uc->ppm.cmd = ucsi_ccg_cmd;
+        uc->ppm.sync = ucsi_ccg_sync;
+        uc->dev = dev;
+        uc->client = client;
+
+        /* reset ccg device and initialize ucsi */
+        status = ucsi_ccg_init(uc);
+        if (status < 0) {
+                dev_err(uc->dev, "ucsi_ccg_init failed - %d\n", status);
+                return status;
+        }
+
+        status = devm_request_threaded_irq(dev, client->irq, NULL,
+                                           ccg_irq_handler,
+                                           IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
+                                           dev_name(dev), uc);
+        if (status < 0) {
+                dev_err(uc->dev, "request_threaded_irq failed - %d\n", status);
+                return status;
+        }
+
+        uc->ucsi = ucsi_register_ppm(dev, &uc->ppm);
+        if (IS_ERR(uc->ucsi)) {
+                dev_err(uc->dev, "ucsi_register_ppm failed\n");
+                return PTR_ERR(uc->ucsi);
+        }
+
+        rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, version));
+        status = ccg_read(uc, rab, (u8 *)(uc->ppm.data) +
+                          offsetof(struct ucsi_data, version),
+                          sizeof(uc->ppm.data->version));
+        if (status < 0) {
+                ucsi_unregister_ppm(uc->ucsi);
+                return status;
+        }
+
+        i2c_set_clientdata(client, uc);
+        return 0;
+}
+
+static int ucsi_ccg_remove(struct i2c_client *client)
+{
+        struct ucsi_ccg *uc = i2c_get_clientdata(client);
+
+        ucsi_unregister_ppm(uc->ucsi);
+
+        return 0;
+}
+
+static const struct i2c_device_id ucsi_ccg_device_id[] = {
+        {"ccgx-ucsi", 0},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, ucsi_ccg_device_id);
+
+static struct i2c_driver ucsi_ccg_driver = {
+        .driver = {
+                .name = "ucsi_ccg",
+        },
+        .probe = ucsi_ccg_probe,
+        .remove = ucsi_ccg_remove,
+        .id_table = ucsi_ccg_device_id,
+};
+
+module_i2c_driver(ucsi_ccg_driver);
+
+MODULE_AUTHOR("Ajay Gupta <ajayg@nvidia.com>");
+MODULE_DESCRIPTION("UCSI driver for Cypress CCGx Type-C controller");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index fdfc64f5acea..221b7333d067 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -251,25 +251,10 @@ static void release_memory_resource(struct resource *resource)
         kfree(resource);
 }
 
-/*
- * Host memory not allocated to dom0. We can use this range for hotplug-based
- * ballooning.
- *
- * It's a type-less resource. Setting IORESOURCE_MEM will make resource
- * management algorithms (arch_remove_reservations()) look into guest e820,
- * which we don't want.
- */
-static struct resource hostmem_resource = {
-        .name   = "Host RAM",
-};
-
-void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
-{}
-
 static struct resource *additional_memory_resource(phys_addr_t size)
 {
-        struct resource *res, *res_hostmem;
-        int ret = -ENOMEM;
+        struct resource *res;
+        int ret;
 
         res = kzalloc(sizeof(*res), GFP_KERNEL);
         if (!res)
@@ -278,42 +263,13 @@ static struct resource *additional_memory_resource(phys_addr_t size)
         res->name = "System RAM";
         res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
 
-        res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
-        if (res_hostmem) {
-                /* Try to grab a range from hostmem */
-                res_hostmem->name = "Host memory";
-                ret = allocate_resource(&hostmem_resource, res_hostmem,
-                                        size, 0, -1,
-                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
-        }
-
-        if (!ret) {
-                /*
-                 * Insert this resource into iomem. Because hostmem_resource
-                 * tracks portion of guest e820 marked as UNUSABLE noone else
-                 * should try to use it.
-                 */
-                res->start = res_hostmem->start;
-                res->end = res_hostmem->end;
-                ret = insert_resource(&iomem_resource, res);
-                if (ret < 0) {
-                        pr_err("Can't insert iomem_resource [%llx - %llx]\n",
-                                res->start, res->end);
-                        release_memory_resource(res_hostmem);
-                        res_hostmem = NULL;
-                        res->start = res->end = 0;
-                }
-        }
-
-        if (ret) {
-                ret = allocate_resource(&iomem_resource, res,
-                                        size, 0, -1,
-                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
-                if (ret < 0) {
-                        pr_err("Cannot allocate new System RAM resource\n");
-                        kfree(res);
-                        return NULL;
-                }
+        ret = allocate_resource(&iomem_resource, res,
+                                size, 0, -1,
+                                PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+        if (ret < 0) {
+                pr_err("Cannot allocate new System RAM resource\n");
+                kfree(res);
+                return NULL;
         }
 
 #ifdef CONFIG_SPARSEMEM
@@ -325,7 +281,6 @@ static struct resource *additional_memory_resource(phys_addr_t size)
                         pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
                                pfn, limit);
                         release_memory_resource(res);
-                        release_memory_resource(res_hostmem);
                         return NULL;
                 }
         }
@@ -750,8 +705,6 @@ static int __init balloon_init(void)
         set_online_page_callback(&xen_online_page);
         register_memory_notifier(&xen_memory_nb);
         register_sysctl_table(xen_root);
-
-        arch_xen_balloon_init(&hostmem_resource);
 #endif
 
 #ifdef CONFIG_XEN_PV
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index f15f89df1f36..7ea6fb6a2e5d 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args)
 
         ret = xenmem_reservation_increase(args->nr_pages, args->frames);
         if (ret != args->nr_pages) {
-                pr_debug("Failed to decrease reservation for DMA buffer\n");
+                pr_debug("Failed to increase reservation for DMA buffer\n");
                 ret = -EFAULT;
         } else {
                 ret = 0;
diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
index df1ed37c3269..de01a6d0059d 100644
--- a/drivers/xen/privcmd-buf.c
+++ b/drivers/xen/privcmd-buf.c
@@ -21,15 +21,9 @@
 
 MODULE_LICENSE("GPL");
 
-static unsigned int limit = 64;
-module_param(limit, uint, 0644);
-MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
-                        "the privcmd-buf device per open file");
-
 struct privcmd_buf_private {
         struct mutex lock;
         struct list_head list;
-        unsigned int allocated;
 };
 
 struct privcmd_buf_vma_private {
@@ -60,13 +54,10 @@ static void privcmd_buf_vmapriv_free(struct privcmd_buf_vma_private *vma_priv)
 {
         unsigned int i;
 
-        vma_priv->file_priv->allocated -= vma_priv->n_pages;
-
         list_del(&vma_priv->list);
 
         for (i = 0; i < vma_priv->n_pages; i++)
-                if (vma_priv->pages[i])
-                        __free_page(vma_priv->pages[i]);
+                __free_page(vma_priv->pages[i]);
 
         kfree(vma_priv);
 }
@@ -146,8 +137,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
         unsigned int i;
         int ret = 0;
 
-        if (!(vma->vm_flags & VM_SHARED) || count > limit ||
-            file_priv->allocated + count > limit)
+        if (!(vma->vm_flags & VM_SHARED))
                 return -EINVAL;
 
         vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
@@ -155,19 +145,15 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
         if (!vma_priv)
                 return -ENOMEM;
 
-        vma_priv->n_pages = count;
-        count = 0;
-        for (i = 0; i < vma_priv->n_pages; i++) {
+        for (i = 0; i < count; i++) {
                 vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
                 if (!vma_priv->pages[i])
                         break;
-                count++;
+                vma_priv->n_pages++;
         }
 
         mutex_lock(&file_priv->lock);
 
-        file_priv->allocated += count;
-
         vma_priv->file_priv = file_priv;
         vma_priv->users = 1;
 
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 2f11ca72a281..77224d8f3e6f 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -385,8 +385,8 @@ static int create_active(struct sock_mapping *map, int *evtchn)
 out_error:
         if (*evtchn >= 0)
                 xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
-        kfree(map->active.data.in);
-        kfree(map->active.ring);
+        free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
+        free_page((unsigned long)map->active.ring);
         return ret;
 }
 
diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
index 23f1387b3ef7..e7df65d32c91 100644
--- a/drivers/xen/xlate_mmu.c
+++ b/drivers/xen/xlate_mmu.c
@@ -36,6 +36,7 @@
 #include <asm/xen/hypervisor.h>
 
 #include <xen/xen.h>
+#include <xen/xen-ops.h>
 #include <xen/page.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/memory.h>
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 43dea3b00c29..8a2562e3a316 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -1075,8 +1075,6 @@ static void afs_vnode_new_inode(struct afs_fs_cursor *fc,
         if (fc->ac.error < 0)
                 return;
 
-        d_drop(new_dentry);
-
         inode = afs_iget(fc->vnode->vfs_inode.i_sb, fc->key,
                          newfid, newstatus, newcb, fc->cbi);
         if (IS_ERR(inode)) {
@@ -1090,7 +1088,7 @@ static void afs_vnode_new_inode(struct afs_fs_cursor *fc,
         vnode = AFS_FS_I(inode);
         set_bit(AFS_VNODE_NEW_CONTENT, &vnode->flags);
         afs_vnode_commit_status(fc, vnode, 0);
-        d_add(new_dentry, inode);
+        d_instantiate(new_dentry, inode);
 }
 
 /*
diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c
index d049cb459742..fde6b4d4121e 100644
--- a/fs/afs/fs_probe.c
+++ b/fs/afs/fs_probe.c
@@ -61,8 +61,11 @@ void afs_fileserver_probe_result(struct afs_call *call)
                 afs_io_error(call, afs_io_error_fs_probe_fail);
                 goto out;
         case -ECONNRESET: /* Responded, but call expired. */
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -132,12 +135,14 @@ out:
 static int afs_do_probe_fileserver(struct afs_net *net,
                                    struct afs_server *server,
                                    struct key *key,
-                                   unsigned int server_index)
+                                   unsigned int server_index,
+                                   struct afs_error *_e)
 {
         struct afs_addr_cursor ac = {
                 .index = 0,
         };
-        int ret;
+        bool in_progress = false;
+        int err;
 
         _enter("%pU", &server->uuid);
 
@@ -151,15 +156,17 @@ static int afs_do_probe_fileserver(struct afs_net *net,
         server->probe.rtt = UINT_MAX;
 
         for (ac.index = 0; ac.index < ac.alist->nr_addrs; ac.index++) {
-                ret = afs_fs_get_capabilities(net, server, &ac, key, server_index,
+                err = afs_fs_get_capabilities(net, server, &ac, key, server_index,
                                               true);
-                if (ret != -EINPROGRESS) {
-                        afs_fs_probe_done(server);
-                        return ret;
-                }
+                if (err == -EINPROGRESS)
+                        in_progress = true;
+                else
+                        afs_prioritise_error(_e, err, ac.abort_code);
         }
 
-        return 0;
+        if (!in_progress)
+                afs_fs_probe_done(server);
+        return in_progress;
 }
 
 /*
@@ -169,21 +176,23 @@ int afs_probe_fileservers(struct afs_net *net, struct key *key,
                           struct afs_server_list *list)
 {
         struct afs_server *server;
-        int i, ret;
+        struct afs_error e;
+        bool in_progress = false;
+        int i;
 
+        e.error = 0;
+        e.responded = false;
         for (i = 0; i < list->nr_servers; i++) {
                 server = list->servers[i].server;
                 if (test_bit(AFS_SERVER_FL_PROBED, &server->flags))
                         continue;
 
-                if (!test_and_set_bit_lock(AFS_SERVER_FL_PROBING, &server->flags)) {
-                        ret = afs_do_probe_fileserver(net, server, key, i);
-                        if (ret)
-                                return ret;
-                }
+                if (!test_and_set_bit_lock(AFS_SERVER_FL_PROBING, &server->flags) &&
+                    afs_do_probe_fileserver(net, server, key, i, &e))
+                        in_progress = true;
         }
 
-        return 0;
+        return in_progress ? 0 : e.error;
 }
 
 /*
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 4c6d8e1112c2..6b17d3620414 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -382,7 +382,7 @@ void afs_zap_data(struct afs_vnode *vnode)
 int afs_validate(struct afs_vnode *vnode, struct key *key)
 {
         time64_t now = ktime_get_real_seconds();
-        bool valid = false;
+        bool valid;
         int ret;
 
         _enter("{v={%llx:%llu} fl=%lx},%x",
@@ -402,15 +402,21 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
                         vnode->cb_v_break = vnode->volume->cb_v_break;
                         valid = false;
                 } else if (vnode->status.type == AFS_FTYPE_DIR &&
-                           test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) &&
-                           vnode->cb_expires_at - 10 > now) {
-                        valid = true;
-                } else if (!test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) &&
-                           vnode->cb_expires_at - 10 > now) {
+                           (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) ||
+                            vnode->cb_expires_at - 10 <= now)) {
+                        valid = false;
+                } else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) ||
+                           vnode->cb_expires_at - 10 <= now) {
+                        valid = false;
+                } else {
                         valid = true;
                 }
         } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
                 valid = true;
+        } else {
+                vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+                vnode->cb_v_break = vnode->volume->cb_v_break;
+                valid = false;
         }
 
         read_sequnlock_excl(&vnode->cb_lock);
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 5da3b09b7518..8871b9e8645f 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -696,6 +696,14 @@ struct afs_interface {
 };
 
 /*
+ * Error prioritisation and accumulation.
+ */
+struct afs_error {
+        short   error;                  /* Accumulated error */
+        bool    responded;              /* T if server responded */
+};
+
+/*
  * Cursor for iterating over a server's address list.
  */
 struct afs_addr_cursor {
@@ -1015,6 +1023,7 @@ static inline void __afs_stat(atomic_t *s)
  * misc.c
  */
 extern int afs_abort_to_error(u32);
+extern void afs_prioritise_error(struct afs_error *, int, u32);
 
 /*
  * mntpt.c
diff --git a/fs/afs/misc.c b/fs/afs/misc.c
index 700a5fa7f4ec..bbb1fd51b019 100644
--- a/fs/afs/misc.c
+++ b/fs/afs/misc.c
@@ -118,3 +118,55 @@ int afs_abort_to_error(u32 abort_code)
         default:                return -EREMOTEIO;
         }
 }
+
+/*
+ * Select the error to report from a set of errors.
+ */
+void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code)
+{
+        switch (error) {
+        case 0:
+                return;
+        default:
+                if (e->error == -ETIMEDOUT ||
+                    e->error == -ETIME)
+                        return;
+        case -ETIMEDOUT:
+        case -ETIME:
+                if (e->error == -ENOMEM ||
+                    e->error == -ENONET)
+                        return;
+        case -ENOMEM:
+        case -ENONET:
+                if (e->error == -ERFKILL)
+                        return;
+        case -ERFKILL:
+                if (e->error == -EADDRNOTAVAIL)
+                        return;
+        case -EADDRNOTAVAIL:
+                if (e->error == -ENETUNREACH)
+                        return;
+        case -ENETUNREACH:
+                if (e->error == -EHOSTUNREACH)
+                        return;
+        case -EHOSTUNREACH:
+                if (e->error == -EHOSTDOWN)
+                        return;
+        case -EHOSTDOWN:
+                if (e->error == -ECONNREFUSED)
+                        return;
+        case -ECONNREFUSED:
+                if (e->error == -ECONNRESET)
+                        return;
+        case -ECONNRESET: /* Responded, but call expired. */
+                if (e->responded)
+                        return;
+                e->error = error;
+                return;
+
+        case -ECONNABORTED:
+                e->responded = true;
+                e->error = afs_abort_to_error(abort_code);
+                return;
+        }
+}
diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c
index 00504254c1c2..c3ae324781f8 100644
--- a/fs/afs/rotate.c
+++ b/fs/afs/rotate.c
@@ -136,7 +136,8 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc)
         struct afs_addr_list *alist;
         struct afs_server *server;
         struct afs_vnode *vnode = fc->vnode;
-        u32 rtt, abort_code;
+        struct afs_error e;
+        u32 rtt;
         int error = fc->ac.error, i;
 
         _enter("%lx[%d],%lx[%d],%d,%d",
@@ -306,8 +307,11 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc)
                 if (fc->error != -EDESTADDRREQ)
                         goto iterate_address;
                 /* Fall through */
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
                 _debug("no conn");
                 fc->error = error;
@@ -446,50 +450,15 @@ no_more_servers:
         if (fc->flags & AFS_FS_CURSOR_VBUSY)
                 goto restart_from_beginning;
 
-        abort_code = 0;
-        error = -EDESTADDRREQ;
+        e.error = -EDESTADDRREQ;
+        e.responded = false;
         for (i = 0; i < fc->server_list->nr_servers; i++) {
                 struct afs_server *s = fc->server_list->servers[i].server;
-                int probe_error = READ_ONCE(s->probe.error);
 
-                switch (probe_error) {
-                case 0:
-                        continue;
-                default:
-                        if (error == -ETIMEDOUT ||
-                            error == -ETIME)
-                                continue;
-                case -ETIMEDOUT:
-                case -ETIME:
-                        if (error == -ENOMEM ||
-                            error == -ENONET)
-                                continue;
-                case -ENOMEM:
-                case -ENONET:
-                        if (error == -ENETUNREACH)
-                                continue;
-                case -ENETUNREACH:
-                        if (error == -EHOSTUNREACH)
-                                continue;
-                case -EHOSTUNREACH:
-                        if (error == -ECONNREFUSED)
-                                continue;
-                case -ECONNREFUSED:
-                        if (error == -ECONNRESET)
-                                continue;
-                case -ECONNRESET: /* Responded, but call expired. */
-                        if (error == -ECONNABORTED)
-                                continue;
-                case -ECONNABORTED:
-                        abort_code = s->probe.abort_code;
-                        error = probe_error;
-                        continue;
-                }
+                afs_prioritise_error(&e, READ_ONCE(s->probe.error),
+                                     s->probe.abort_code);
         }
 
-        if (error == -ECONNABORTED)
-                error = afs_abort_to_error(abort_code);
-
 failed_set_error:
         fc->error = error;
 failed:
@@ -553,8 +522,11 @@ bool afs_select_current_fileserver(struct afs_fs_cursor *fc)
                 _leave(" = f [abort]");
                 return false;
 
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -633,6 +605,7 @@ int afs_end_vnode_operation(struct afs_fs_cursor *fc)
         struct afs_net *net = afs_v2net(fc->vnode);
 
         if (fc->error == -EDESTADDRREQ ||
+            fc->error == -EADDRNOTAVAIL ||
             fc->error == -ENETUNREACH ||
             fc->error == -EHOSTUNREACH)
                 afs_dump_edestaddrreq(fc);
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 59970886690f..a7b44863d502 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -576,6 +576,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 {
         signed long rtt2, timeout;
         long ret;
+        bool stalled = false;
         u64 rtt;
         u32 life, last_life;
 
@@ -609,12 +610,20 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 
                 life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
                 if (timeout == 0 &&
-                    life == last_life && signal_pending(current))
+                    life == last_life && signal_pending(current)) {
+                        if (stalled)
                                 break;
+                        __set_current_state(TASK_RUNNING);
+                        rxrpc_kernel_probe_life(call->net->socket, call->rxcall);
+                        timeout = rtt2;
+                        stalled = true;
+                        continue;
+                }
 
                 if (life != last_life) {
                         timeout = rtt2;
                         last_life = life;
+                        stalled = false;
                 }
 
                 timeout = schedule_timeout(timeout);
diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c
index c0f616bd70cb..f0b032976487 100644
--- a/fs/afs/vl_probe.c
+++ b/fs/afs/vl_probe.c
@@ -61,8 +61,11 @@ void afs_vlserver_probe_result(struct afs_call *call)
                 afs_io_error(call, afs_io_error_vl_probe_fail);
                 goto out;
         case -ECONNRESET: /* Responded, but call expired. */
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -129,15 +132,17 @@ out:
  * Probe all of a vlserver's addresses to find out the best route and to
  * query its capabilities.
  */
-static int afs_do_probe_vlserver(struct afs_net *net,
-                                 struct afs_vlserver *server,
-                                 struct key *key,
-                                 unsigned int server_index)
+static bool afs_do_probe_vlserver(struct afs_net *net,
+                                  struct afs_vlserver *server,
+                                  struct key *key,
+                                  unsigned int server_index,
+                                  struct afs_error *_e)
 {
         struct afs_addr_cursor ac = {
                 .index = 0,
         };
-        int ret;
+        bool in_progress = false;
+        int err;
 
         _enter("%s", server->name);
 
@@ -151,15 +156,17 @@ static int afs_do_probe_vlserver(struct afs_net *net,
         server->probe.rtt = UINT_MAX;
 
         for (ac.index = 0; ac.index < ac.alist->nr_addrs; ac.index++) {
-                ret = afs_vl_get_capabilities(net, &ac, key, server,
+                err = afs_vl_get_capabilities(net, &ac, key, server,
                                               server_index, true);
-                if (ret != -EINPROGRESS) {
-                        afs_vl_probe_done(server);
-                        return ret;
-                }
+                if (err == -EINPROGRESS)
+                        in_progress = true;
+                else
+                        afs_prioritise_error(_e, err, ac.abort_code);
         }
 
-        return 0;
+        if (!in_progress)
+                afs_vl_probe_done(server);
+        return in_progress;
 }
 
 /*
@@ -169,21 +176,23 @@ int afs_send_vl_probes(struct afs_net *net, struct key *key,
                        struct afs_vlserver_list *vllist)
 {
         struct afs_vlserver *server;
-        int i, ret;
+        struct afs_error e;
+        bool in_progress = false;
+        int i;
 
+        e.error = 0;
+        e.responded = false;
         for (i = 0; i < vllist->nr_servers; i++) {
                 server = vllist->servers[i].server;
                 if (test_bit(AFS_VLSERVER_FL_PROBED, &server->flags))
                         continue;
 
-                if (!test_and_set_bit_lock(AFS_VLSERVER_FL_PROBING, &server->flags)) {
-                        ret = afs_do_probe_vlserver(net, server, key, i);
-                        if (ret)
-                                return ret;
-                }
+                if (!test_and_set_bit_lock(AFS_VLSERVER_FL_PROBING, &server->flags) &&
+                    afs_do_probe_vlserver(net, server, key, i, &e))
+                        in_progress = true;
         }
 
-        return 0;
+        return in_progress ? 0 : e.error;
 }
 
 /*
diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c
index b64a284b99d2..7adde83a0648 100644
--- a/fs/afs/vl_rotate.c
+++ b/fs/afs/vl_rotate.c
@@ -71,8 +71,9 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc)
 {
         struct afs_addr_list *alist;
         struct afs_vlserver *vlserver;
+        struct afs_error e;
         u32 rtt;
-        int error = vc->ac.error, abort_code, i;
+        int error = vc->ac.error, i;
 
         _enter("%lx[%d],%lx[%d],%d,%d",
                vc->untried, vc->index,
@@ -119,8 +120,11 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc)
                         goto failed;
                 }
 
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -235,50 +239,15 @@ no_more_servers:
         if (vc->flags & AFS_VL_CURSOR_RETRY)
                 goto restart_from_beginning;
 
-        abort_code = 0;
-        error = -EDESTADDRREQ;
+        e.error = -EDESTADDRREQ;
+        e.responded = false;
         for (i = 0; i < vc->server_list->nr_servers; i++) {
                 struct afs_vlserver *s = vc->server_list->servers[i].server;
-                int probe_error = READ_ONCE(s->probe.error);
 
-                switch (probe_error) {
-                case 0:
-                        continue;
-                default:
-                        if (error == -ETIMEDOUT ||
-                            error == -ETIME)
-                                continue;
-                case -ETIMEDOUT:
-                case -ETIME:
-                        if (error == -ENOMEM ||
-                            error == -ENONET)
-                                continue;
-                case -ENOMEM:
-                case -ENONET:
-                        if (error == -ENETUNREACH)
-                                continue;
-                case -ENETUNREACH:
-                        if (error == -EHOSTUNREACH)
-                                continue;
-                case -EHOSTUNREACH:
-                        if (error == -ECONNREFUSED)
-                                continue;
-                case -ECONNREFUSED:
-                        if (error == -ECONNRESET)
-                                continue;
-                case -ECONNRESET: /* Responded, but call expired. */
-                        if (error == -ECONNABORTED)
-                                continue;
-                case -ECONNABORTED:
-                        abort_code = s->probe.abort_code;
-                        error = probe_error;
-                        continue;
-                }
+                afs_prioritise_error(&e, READ_ONCE(s->probe.error),
+                                     s->probe.abort_code);
         }
 
-        if (error == -ECONNABORTED)
-                error = afs_abort_to_error(abort_code);
-
 failed_set_error:
         vc->error = error;
 failed:
@@ -341,6 +310,7 @@ int afs_end_vlserver_operation(struct afs_vl_cursor *vc)
         struct afs_net *net = vc->cell->net;
 
         if (vc->error == -EDESTADDRREQ ||
+            vc->error == -EADDRNOTAVAIL ||
             vc->error == -ENETUNREACH ||
             vc->error == -EHOSTUNREACH)
                 afs_vl_dump_edestaddrreq(vc);
diff --git a/fs/aio.c b/fs/aio.c
index 301e6314183b..97f983592925 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1436,6 +1436,7 @@ static int aio_prep_rw(struct kiocb *req, struct iocb *iocb)
                 ret = ioprio_check_cap(iocb->aio_reqprio);
                 if (ret) {
                         pr_debug("aio ioprio check cap error: %d\n", ret);
+                        fput(req->ki_filp);
                         return ret;
                 }
 
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 80953528572d..68f322f600a0 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3163,6 +3163,9 @@ void btrfs_destroy_inode(struct inode *inode);
 int btrfs_drop_inode(struct inode *inode);
 int __init btrfs_init_cachep(void);
 void __cold btrfs_destroy_cachep(void);
+struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location,
+                              struct btrfs_root *root, int *new,
+                              struct btrfs_path *path);
 struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
                          struct btrfs_root *root, int *was_new);
 struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index b0ab41da91d1..6d776717d8b3 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -477,9 +477,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
         int mirror_num = 0;
         int failed_mirror = 0;
 
-        clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
         io_tree = &BTRFS_I(fs_info->btree_inode)->io_tree;
         while (1) {
+                clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
                 ret = read_extent_buffer_pages(io_tree, eb, WAIT_COMPLETE,
                                                mirror_num);
                 if (!ret) {
@@ -493,15 +493,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
                                 break;
                 }
 
-                /*
-                 * This buffer's crc is fine, but its contents are corrupted, so
-                 * there is no reason to read the other copies, they won't be
-                 * any less wrong.
-                 */
-                if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags) ||
-                    ret == -EUCLEAN)
-                        break;
-
                 num_copies = btrfs_num_copies(fs_info,
                                               eb->start, eb->len);
                 if (num_copies == 1)
@@ -1664,9 +1655,8 @@ static int cleaner_kthread(void *arg)
         struct btrfs_root *root = arg;
         struct btrfs_fs_info *fs_info = root->fs_info;
         int again;
-        struct btrfs_trans_handle *trans;
 
-        do {
+        while (1) {
                 again = 0;
 
                 /* Make the cleaner go to sleep early. */
@@ -1715,42 +1705,16 @@ static int cleaner_kthread(void *arg)
                  */
                 btrfs_delete_unused_bgs(fs_info);
 sleep:
+                if (kthread_should_park())
+                        kthread_parkme();
+                if (kthread_should_stop())
+                        return 0;
                 if (!again) {
                         set_current_state(TASK_INTERRUPTIBLE);
-                        if (!kthread_should_stop())
-                                schedule();
+                        schedule();
                         __set_current_state(TASK_RUNNING);
                 }
-        } while (!kthread_should_stop());
-
-        /*
-         * Transaction kthread is stopped before us and wakes us up.
-         * However we might have started a new transaction and COWed some
-         * tree blocks when deleting unused block groups for example. So
-         * make sure we commit the transaction we started to have a clean
-         * shutdown when evicting the btree inode - if it has dirty pages
-         * when we do the final iput() on it, eviction will trigger a
-         * writeback for it which will fail with null pointer dereferences
-         * since work queues and other resources were already released and
-         * destroyed by the time the iput/eviction/writeback is made.
-         */
-        trans = btrfs_attach_transaction(root);
-        if (IS_ERR(trans)) {
-                if (PTR_ERR(trans) != -ENOENT)
-                        btrfs_err(fs_info,
-                                  "cleaner transaction attach returned %ld",
-                                  PTR_ERR(trans));
-        } else {
-                int ret;
-
-                ret = btrfs_commit_transaction(trans);
-                if (ret)
-                        btrfs_err(fs_info,
-                                  "cleaner open transaction commit returned %d",
-                                  ret);
         }
-
-        return 0;
 }
 
 static int transaction_kthread(void *arg)
@@ -3931,6 +3895,13 @@ void close_ctree(struct btrfs_fs_info *fs_info)
         int ret;
 
         set_bit(BTRFS_FS_CLOSING_START, &fs_info->flags);
+        /*
+         * We don't want the cleaner to start new transactions, add more delayed
+         * iputs, etc. while we're closing. We can't use kthread_stop() yet
+         * because that frees the task_struct, and the transaction kthread might
+         * still try to wake up the cleaner.
+         */
+        kthread_park(fs_info->cleaner_kthread);
 
         /* wait for the qgroup rescan worker to stop */
         btrfs_qgroup_wait_for_completion(fs_info, false);
@@ -3958,9 +3929,8 @@ void close_ctree(struct btrfs_fs_info *fs_info)
 
         if (!sb_rdonly(fs_info->sb)) {
                 /*
-                 * If the cleaner thread is stopped and there are
-                 * block groups queued for removal, the deletion will be
-                 * skipped when we quit the cleaner thread.
+                 * The cleaner kthread is stopped, so do one final pass over
+                 * unused block groups.
                  */
                 btrfs_delete_unused_bgs(fs_info);
 
@@ -4359,13 +4329,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
         unpin = pinned_extents;
 again:
         while (1) {
+                /*
+                 * The btrfs_finish_extent_commit() may get the same range as
+                 * ours between find_first_extent_bit and clear_extent_dirty.
+                 * Hence, hold the unused_bg_unpin_mutex to avoid double unpin
+                 * the same extent range.
+                 */
+                mutex_lock(&fs_info->unused_bg_unpin_mutex);
                 ret = find_first_extent_bit(unpin, 0, &start, &end,
                                             EXTENT_DIRTY, NULL);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&fs_info->unused_bg_unpin_mutex);
                         break;
+                }
 
                 clear_extent_dirty(unpin, start, end);
                 btrfs_error_unpin_extent_range(fs_info, start, end);
+                mutex_unlock(&fs_info->unused_bg_unpin_mutex);
                 cond_resched();
         }
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a3c22e16509b..58e93bce3036 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2089,6 +2089,30 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         atomic_inc(&root->log_batch);
 
         /*
+         * Before we acquired the inode's lock, someone may have dirtied more
+         * pages in the target range. We need to make sure that writeback for
+         * any such pages does not start while we are logging the inode, because
+         * if it does, any of the following might happen when we are not doing a
+         * full inode sync:
+         *
+         * 1) We log an extent after its writeback finishes but before its
+         *    checksums are added to the csum tree, leading to -EIO errors
+         *    when attempting to read the extent after a log replay.
+         *
+         * 2) We can end up logging an extent before its writeback finishes.
+         *    Therefore after the log replay we will have a file extent item
+         *    pointing to an unwritten extent (and no data checksums as well).
+         *
+         * So trigger writeback for any eventual new dirty pages and then we
+         * wait for all ordered extents to complete below.
+         */
+        ret = start_ordered_ops(inode, start, end);
+        if (ret) {
+                inode_unlock(inode);
+                goto out;
+        }
+
+        /*
          * We have to do this here to avoid the priority inversion of waiting on
          * IO of a lower priority task while holding a transaciton open.
          */
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 4ba0aedc878b..74aa552f4793 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -75,7 +75,8 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
          * sure NOFS is set to keep us from deadlocking.
          */
         nofs_flag = memalloc_nofs_save();
-        inode = btrfs_iget(fs_info->sb, &location, root, NULL);
+        inode = btrfs_iget_path(fs_info->sb, &location, root, NULL, path);
+        btrfs_release_path(path);
         memalloc_nofs_restore(nofs_flag);
         if (IS_ERR(inode))
                 return inode;
@@ -838,6 +839,25 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         path->search_commit_root = 1;
         path->skip_locking = 1;
 
+        /*
+         * We must pass a path with search_commit_root set to btrfs_iget in
+         * order to avoid a deadlock when allocating extents for the tree root.
+         *
+         * When we are COWing an extent buffer from the tree root, when looking
+         * for a free extent, at extent-tree.c:find_free_extent(), we can find
+         * block group without its free space cache loaded. When we find one
+         * we must load its space cache which requires reading its free space
+         * cache's inode item from the root tree. If this inode item is located
+         * in the same leaf that we started COWing before, then we end up in
+         * deadlock on the extent buffer (trying to read lock it when we
+         * previously write locked it).
+         *
+         * It's safe to read the inode item using the commit root because
+         * block groups, once loaded, stay in memory forever (until they are
+         * removed) as well as their space caches once loaded. New block groups
+         * once created get their ->cached field set to BTRFS_CACHE_FINISHED so
+         * we will never try to read their inode item while the fs is mounted.
+         */
         inode = lookup_free_space_inode(fs_info, block_group, path);
         if (IS_ERR(inode)) {
                 btrfs_free_path(path);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d3df5b52278c..9ea4c6f0352f 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1531,12 +1531,11 @@ out_check:
         }
         btrfs_release_path(path);
 
-        if (cur_offset <= end && cow_start == (u64)-1) {
+        if (cur_offset <= end && cow_start == (u64)-1)
                 cow_start = cur_offset;
-                cur_offset = end;
-        }
 
         if (cow_start != (u64)-1) {
+                cur_offset = end;
                 ret = cow_file_range(inode, locked_page, cow_start, end, end,
                                      page_started, nr_written, 1, NULL);
                 if (ret)
@@ -3570,10 +3569,11 @@ static noinline int acls_after_inode_item(struct extent_buffer *leaf,
 /*
  * read an inode from the btree into the in-memory inode
  */
-static int btrfs_read_locked_inode(struct inode *inode)
+static int btrfs_read_locked_inode(struct inode *inode,
+                                   struct btrfs_path *in_path)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
-        struct btrfs_path *path;
+        struct btrfs_path *path = in_path;
         struct extent_buffer *leaf;
         struct btrfs_inode_item *inode_item;
         struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -3589,15 +3589,18 @@ static int btrfs_read_locked_inode(struct inode *inode)
         if (!ret)
                 filled = true;
 
-        path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                path = btrfs_alloc_path();
+                if (!path)
+                        return -ENOMEM;
+        }
 
         memcpy(&location, &BTRFS_I(inode)->location, sizeof(location));
 
         ret = btrfs_lookup_inode(NULL, root, path, &location, 0);
         if (ret) {
-                btrfs_free_path(path);
+                if (path != in_path)
+                        btrfs_free_path(path);
                 return ret;
         }
 
@@ -3722,7 +3725,8 @@ cache_acl:
                                   btrfs_ino(BTRFS_I(inode)),
                                   root->root_key.objectid, ret);
         }
-        btrfs_free_path(path);
+        if (path != in_path)
+                btrfs_free_path(path);
 
         if (!maybe_acls)
                 cache_no_acl(inode);
@@ -5644,8 +5648,9 @@ static struct inode *btrfs_iget_locked(struct super_block *s,
 /* Get an inode object given its location and corresponding root.
  * Returns in *is_new if the inode was read from disk
  */
-struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
-                         struct btrfs_root *root, int *new)
+struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location,
+                              struct btrfs_root *root, int *new,
+                              struct btrfs_path *path)
 {
         struct inode *inode;
 
@@ -5656,7 +5661,7 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
         if (inode->i_state & I_NEW) {
                 int ret;
 
-                ret = btrfs_read_locked_inode(inode);
+                ret = btrfs_read_locked_inode(inode, path);
                 if (!ret) {
                         inode_tree_add(inode);
                         unlock_new_inode(inode);
@@ -5678,6 +5683,12 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
         return inode;
 }
 
+struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+                         struct btrfs_root *root, int *new)
+{
+        return btrfs_iget_path(s, location, root, new, NULL);
+}
+
 static struct inode *new_simple_dir(struct super_block *s,
                                     struct btrfs_key *key,
                                     struct btrfs_root *root)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 3ca6943827ef..802a628e9f7d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3488,6 +3488,8 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen,
                         const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
 
                         len = round_down(i_size_read(src), sz) - loff;
+                        if (len == 0)
+                                return 0;
                         olen = len;
                 }
         }
@@ -4257,9 +4259,17 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
                 goto out_unlock;
         if (len == 0)
                 olen = len = src->i_size - off;
-        /* if we extend to eof, continue to block boundary */
-        if (off + len == src->i_size)
+        /*
+         * If we extend to eof, continue to block boundary if and only if the
+         * destination end offset matches the destination file's size, otherwise
+         * we would be corrupting data by placing the eof block into the middle
+         * of a file.
+         */
+        if (off + len == src->i_size) {
+                if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size)
+                        goto out_unlock;
                 len = ALIGN(src->i_size, bs) - off;
+        }
 
         if (len == 0) {
                 ret = 0;
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 45868fd76209..f70825af6438 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2659,7 +2659,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
         int i;
         u64 *i_qgroups;
         struct btrfs_fs_info *fs_info = trans->fs_info;
-        struct btrfs_root *quota_root = fs_info->quota_root;
+        struct btrfs_root *quota_root;
         struct btrfs_qgroup *srcgroup;
         struct btrfs_qgroup *dstgroup;
         u32 level_size = 0;
@@ -2669,6 +2669,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
         if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
                 goto out;
 
+        quota_root = fs_info->quota_root;
         if (!quota_root) {
                 ret = -EINVAL;
                 goto out;
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 924116f654a1..a3f75b8926d4 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3959,6 +3959,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 restart:
                 if (update_backref_cache(trans, &rc->backref_cache)) {
                         btrfs_end_transaction(trans);
+                        trans = NULL;
                         continue;
                 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 094cc1444a90..5be83b5a1b43 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -3340,7 +3340,8 @@ static void free_pending_move(struct send_ctx *sctx, struct pending_dir_move *m)
         kfree(m);
 }
 
-static void tail_append_pending_moves(struct pending_dir_move *moves,
+static void tail_append_pending_moves(struct send_ctx *sctx,
+                                      struct pending_dir_move *moves,
                                       struct list_head *stack)
 {
         if (list_empty(&moves->list)) {
@@ -3351,6 +3352,10 @@ static void tail_append_pending_moves(struct pending_dir_move *moves,
                 list_add_tail(&moves->list, stack);
                 list_splice_tail(&list, stack);
         }
+        if (!RB_EMPTY_NODE(&moves->node)) {
+                rb_erase(&moves->node, &sctx->pending_dir_moves);
+                RB_CLEAR_NODE(&moves->node);
+        }
 }
 
 static int apply_children_dir_moves(struct send_ctx *sctx)
@@ -3365,7 +3370,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
                 return 0;
 
         INIT_LIST_HEAD(&stack);
-        tail_append_pending_moves(pm, &stack);
+        tail_append_pending_moves(sctx, pm, &stack);
 
         while (!list_empty(&stack)) {
                 pm = list_first_entry(&stack, struct pending_dir_move, list);
@@ -3376,7 +3381,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
                         goto out;
                 pm = get_pending_dir_moves(sctx, parent_ino);
                 if (pm)
-                        tail_append_pending_moves(pm, &stack);
+                        tail_append_pending_moves(sctx, pm, &stack);
         }
         return 0;
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index b362b45dd757..645fc81e2a94 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1916,7 +1916,7 @@ restore:
 }
 
 /* Used to sort the devices by max_avail(descending sort) */
-static int btrfs_cmp_device_free_bytes(const void *dev_info1,
+static inline int btrfs_cmp_device_free_bytes(const void *dev_info1,
                                        const void *dev_info2)
 {
         if (((struct btrfs_device_info *)dev_info1)->max_avail >
@@ -1945,8 +1945,8 @@ static inline void btrfs_descending_sort_devices(
  * The helper to calc the free space on the devices that can be used to store
  * file data.
  */
-static int btrfs_calc_avail_data_space(struct btrfs_fs_info *fs_info,
-                                       u64 *free_bytes)
+static inline int btrfs_calc_avail_data_space(struct btrfs_fs_info *fs_info,
+                                              u64 *free_bytes)
 {
         struct btrfs_device_info *devices_info;
         struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
@@ -2237,6 +2237,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         vol = memdup_user((void __user *)arg, sizeof(*vol));
         if (IS_ERR(vol))
                 return PTR_ERR(vol);
+        vol->name[BTRFS_PATH_NAME_MAX] = '\0';
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index cab0b1f1f741..1a4e2b101ef2 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -389,13 +389,11 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
 
         /*
          * Here we don't really care about alignment since extent allocator can
-         * handle it.  We care more about the size, as if one block group is
-         * larger than maximum size, it's must be some obvious corruption.
+         * handle it.  We care more about the size.
          */
-        if (key->offset > BTRFS_MAX_DATA_CHUNK_SIZE || key->offset == 0) {
+        if (key->offset == 0) {
                 block_group_err(fs_info, leaf, slot,
-                        "invalid block group size, have %llu expect (0, %llu]",
-                                key->offset, BTRFS_MAX_DATA_CHUNK_SIZE);
+                                "invalid block group size 0");
                 return -EUCLEAN;
         }
 
@@ -440,7 +438,7 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
             type != (BTRFS_BLOCK_GROUP_METADATA |
                            BTRFS_BLOCK_GROUP_DATA)) {
                 block_group_err(fs_info, leaf, slot,
-"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llu or 0x%llx",
+"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx",
                         type, hweight64(type),
                         BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA,
                         BTRFS_BLOCK_GROUP_SYSTEM,
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index e07f3376b7df..a5ce99a6c936 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4396,6 +4396,23 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         logged_end = end;
 
         list_for_each_entry_safe(em, n, &tree->modified_extents, list) {
+                /*
+                 * Skip extents outside our logging range. It's important to do
+                 * it for correctness because if we don't ignore them, we may
+                 * log them before their ordered extent completes, and therefore
+                 * we could log them without logging their respective checksums
+                 * (the checksum items are added to the csum tree at the very
+                 * end of btrfs_finish_ordered_io()). Also leave such extents
+                 * outside of our range in the list, since we may have another
+                 * ranged fsync in the near future that needs them. If an extent
+                 * outside our range corresponds to a hole, log it to avoid
+                 * leaving gaps between extents (fsck will complain when we are
+                 * not using the NO_HOLES feature).
+                 */
+                if ((em->start > end || em->start + em->len <= start) &&
+                    em->block_start != EXTENT_MAP_HOLE)
+                        continue;
+
                 list_del_init(&em->list);
                 /*
                  * Just an arbitrary number, this can be really CPU intensive
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 95983c744164..1645fcfd9691 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -244,11 +244,13 @@ wait_for_old_object:
 
         ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
 
-        cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_retry);
+        cache->cache.ops->put_object(&xobject->fscache,
+                (enum fscache_obj_ref_trace)cachefiles_obj_put_wait_retry);
         goto try_again;
 
 requeue:
-        cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_timeo);
+        cache->cache.ops->put_object(&xobject->fscache,
+                (enum fscache_obj_ref_trace)cachefiles_obj_put_wait_timeo);
         _leave(" = -ETIMEDOUT");
         return -ETIMEDOUT;
 }
@@ -336,7 +338,7 @@ static int cachefiles_bury_object(struct cachefiles_cache *cache,
 try_again:
         /* first step is to make up a grave dentry in the graveyard */
         sprintf(nbuffer, "%08x%08x",
-                (uint32_t) get_seconds(),
+                (uint32_t) ktime_get_real_seconds(),
                 (uint32_t) atomic_inc_return(&cache->gravecounter));
 
         /* do the multiway lock magic */
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 40f7595aad10..8a577409d030 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -535,7 +535,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object,
                                             netpage->index, cachefiles_gfp);
                 if (ret < 0) {
                         if (ret == -EEXIST) {
+                                put_page(backpage);
+                                backpage = NULL;
                                 put_page(netpage);
+                                netpage = NULL;
                                 fscache_retrieval_complete(op, 1);
                                 continue;
                         }
@@ -608,7 +611,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object,
                                             netpage->index, cachefiles_gfp);
                 if (ret < 0) {
                         if (ret == -EEXIST) {
+                                put_page(backpage);
+                                backpage = NULL;
                                 put_page(netpage);
+                                netpage = NULL;
                                 fscache_retrieval_complete(op, 1);
                                 continue;
                         }
@@ -962,11 +968,8 @@ void cachefiles_uncache_page(struct fscache_object *_object, struct page *page)
         __releases(&object->fscache.cookie->lock)
 {
         struct cachefiles_object *object;
-        struct cachefiles_cache *cache;
 
         object = container_of(_object, struct cachefiles_object, fscache);
-        cache = container_of(object->fscache.cache,
-                             struct cachefiles_cache, cache);
 
         _enter("%p,{%lu}", object, page->index);
 
diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index 0a29a00aed2e..511e6c68156a 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -135,7 +135,8 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object,
         struct dentry *dentry = object->dentry;
         int ret;
 
-        ASSERT(dentry);
+        if (!dentry)
+                return -ESTALE;
 
         _enter("%p,#%d", object, auxdata->len);
 
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 27cad84dab23..189df668b6a0 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1931,10 +1931,17 @@ static ssize_t ceph_copy_file_range(struct file *src_file, loff_t src_off,
         if (!prealloc_cf)
                 return -ENOMEM;
 
-        /* Start by sync'ing the source file */
+        /* Start by sync'ing the source and destination files */
         ret = file_write_and_wait_range(src_file, src_off, (src_off + len));
-        if (ret < 0)
+        if (ret < 0) {
+                dout("failed to write src file (%zd)\n", ret);
+                goto out;
+        }
+        ret = file_write_and_wait_range(dst_file, dst_off, (dst_off + len));
+        if (ret < 0) {
+                dout("failed to write dst file (%zd)\n", ret);
                 goto out;
+        }
 
         /*
          * We need FILE_WR caps for dst_ci and FILE_RD for src_ci as other
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 67a9aeb2f4ec..bd13a3267ae0 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -80,12 +80,8 @@ static int parse_reply_info_in(void **p, void *end,
         info->symlink = *p;
         *p += info->symlink_len;
 
-        if (features & CEPH_FEATURE_DIRLAYOUTHASH)
-                ceph_decode_copy_safe(p, end, &info->dir_layout,
-                                      sizeof(info->dir_layout), bad);
-        else
-                memset(&info->dir_layout, 0, sizeof(info->dir_layout));
-
+        ceph_decode_copy_safe(p, end, &info->dir_layout,
+                              sizeof(info->dir_layout), bad);
         ceph_decode_32_safe(p, end, info->xattr_len, bad);
         ceph_decode_need(p, end, info->xattr_len, bad);
         info->xattr_data = *p;
@@ -3182,10 +3178,8 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
         recon_state.pagelist = pagelist;
         if (session->s_con.peer_features & CEPH_FEATURE_MDSENC)
                 recon_state.msg_version = 3;
-        else if (session->s_con.peer_features & CEPH_FEATURE_FLOCK)
-                recon_state.msg_version = 2;
         else
-                recon_state.msg_version = 1;
+                recon_state.msg_version = 2;
         err = iterate_session_caps(session, encode_caps_cb, &recon_state);
         if (err < 0)
                 goto fail;
diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
index 32d4f13784ba..03f4d24db8fe 100644
--- a/fs/ceph/quota.c
+++ b/fs/ceph/quota.c
@@ -237,7 +237,8 @@ static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op,
                 ceph_put_snap_realm(mdsc, realm);
                 realm = next;
         }
-        ceph_put_snap_realm(mdsc, realm);
+        if (realm)
+                ceph_put_snap_realm(mdsc, realm);
         up_read(&mdsc->snap_rwsem);
 
         return exceeded;
diff --git a/fs/dax.c b/fs/dax.c
index 616e36ea6aaa..9bcce89ea18e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -98,12 +98,6 @@ static void *dax_make_entry(pfn_t pfn, unsigned long flags)
         return xa_mk_value(flags | (pfn_t_to_pfn(pfn) << DAX_SHIFT));
 }
 
-static void *dax_make_page_entry(struct page *page)
-{
-        pfn_t pfn = page_to_pfn_t(page);
-        return dax_make_entry(pfn, PageHead(page) ? DAX_PMD : 0);
-}
-
 static bool dax_is_locked(void *entry)
 {
         return xa_to_value(entry) & DAX_LOCKED;
@@ -116,12 +110,12 @@ static unsigned int dax_entry_order(void *entry)
         return 0;
 }
 
-static int dax_is_pmd_entry(void *entry)
+static unsigned long dax_is_pmd_entry(void *entry)
 {
         return xa_to_value(entry) & DAX_PMD;
 }
 
-static int dax_is_pte_entry(void *entry)
+static bool dax_is_pte_entry(void *entry)
 {
         return !(xa_to_value(entry) & DAX_PMD);
 }
@@ -222,9 +216,8 @@ static void *get_unlocked_entry(struct xa_state *xas)
         ewait.wait.func = wake_exceptional_entry_func;
 
         for (;;) {
-                entry = xas_load(xas);
-                if (!entry || xa_is_internal(entry) ||
-                                WARN_ON_ONCE(!xa_is_value(entry)) ||
+                entry = xas_find_conflict(xas);
+                if (!entry || WARN_ON_ONCE(!xa_is_value(entry)) ||
                                 !dax_is_locked(entry))
                         return entry;
 
@@ -255,6 +248,7 @@ static void dax_unlock_entry(struct xa_state *xas, void *entry)
 {
         void *old;
 
+        BUG_ON(dax_is_locked(entry));
         xas_reset(xas);
         xas_lock_irq(xas);
         old = xas_store(xas, entry);
@@ -352,16 +346,27 @@ static struct page *dax_busy_page(void *entry)
         return NULL;
 }
 
+/*
+ * dax_lock_mapping_entry - Lock the DAX entry corresponding to a page
+ * @page: The page whose entry we want to lock
+ *
+ * Context: Process context.
+ * Return: %true if the entry was locked or does not need to be locked.
+ */
 bool dax_lock_mapping_entry(struct page *page)
 {
         XA_STATE(xas, NULL, 0);
         void *entry;
+        bool locked;
 
+        /* Ensure page->mapping isn't freed while we look at it */
+        rcu_read_lock();
         for (;;) {
                 struct address_space *mapping = READ_ONCE(page->mapping);
 
+                locked = false;
                 if (!dax_mapping(mapping))
-                        return false;
+                        break;
 
                 /*
                  * In the device-dax case there's no need to lock, a
@@ -370,8 +375,9 @@ bool dax_lock_mapping_entry(struct page *page)
                  * otherwise we would not have a valid pfn_to_page()
                  * translation.
                  */
+                locked = true;
                 if (S_ISCHR(mapping->host->i_mode))
-                        return true;
+                        break;
 
                 xas.xa = &mapping->i_pages;
                 xas_lock_irq(&xas);
@@ -382,28 +388,35 @@ bool dax_lock_mapping_entry(struct page *page)
                 xas_set(&xas, page->index);
                 entry = xas_load(&xas);
                 if (dax_is_locked(entry)) {
+                        rcu_read_unlock();
                         entry = get_unlocked_entry(&xas);
-                        /* Did the page move while we slept? */
-                        if (dax_to_pfn(entry) != page_to_pfn(page)) {
-                                xas_unlock_irq(&xas);
-                                continue;
-                        }
+                        xas_unlock_irq(&xas);
+                        put_unlocked_entry(&xas, entry);
+                        rcu_read_lock();
+                        continue;
                 }
                 dax_lock_entry(&xas, entry);
                 xas_unlock_irq(&xas);
-                return true;
+                break;
         }
+        rcu_read_unlock();
+        return locked;
 }
 
 void dax_unlock_mapping_entry(struct page *page)
 {
         struct address_space *mapping = page->mapping;
         XA_STATE(xas, &mapping->i_pages, page->index);
+        void *entry;
 
         if (S_ISCHR(mapping->host->i_mode))
                 return;
 
-        dax_unlock_entry(&xas, dax_make_page_entry(page));
+        rcu_read_lock();
+        entry = xas_load(&xas);
+        rcu_read_unlock();
+        entry = dax_make_entry(page_to_pfn_t(page), dax_is_pmd_entry(entry));
+        dax_unlock_entry(&xas, entry);
 }
 
 /*
@@ -445,11 +458,9 @@ static void *grab_mapping_entry(struct xa_state *xas,
 retry:
         xas_lock_irq(xas);
         entry = get_unlocked_entry(xas);
-        if (xa_is_internal(entry))
-                goto fallback;
 
         if (entry) {
-                if (WARN_ON_ONCE(!xa_is_value(entry))) {
+                if (!xa_is_value(entry)) {
                         xas_set_err(xas, EIO);
                         goto out_unlock;
                 }
@@ -1628,8 +1639,7 @@ dax_insert_pfn_mkwrite(struct vm_fault *vmf, pfn_t pfn, unsigned int order)
         /* Did we race with someone splitting entry or so? */
         if (!entry ||
             (order == 0 && !dax_is_pte_entry(entry)) ||
-            (order == PMD_ORDER && (xa_is_internal(entry) ||
-                                    !dax_is_pmd_entry(entry)))) {
+            (order == PMD_ORDER && !dax_is_pmd_entry(entry))) {
                 put_unlocked_entry(&xas, entry);
                 xas_unlock_irq(&xas);
                 trace_dax_insert_pfn_mkwrite_no_entry(mapping->host, vmf,
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 722d17c88edb..41a0e97252ae 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -325,8 +325,8 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, unsigned int flags)
                  */
                 dio->iocb->ki_pos += transferred;
 
-                if (dio->op == REQ_OP_WRITE)
-                        ret = generic_write_sync(dio->iocb,  transferred);
+                if (ret > 0 && dio->op == REQ_OP_WRITE)
+                        ret = generic_write_sync(dio->iocb, ret);
                 dio->iocb->ki_complete(dio->iocb, ret, 0);
         }
 
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 645158dc33f1..c69927bed4ef 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -77,7 +77,7 @@ static bool dentry_connected(struct dentry *dentry)
                 struct dentry *parent = dget_parent(dentry);
 
                 dput(dentry);
-                if (IS_ROOT(dentry)) {
+                if (dentry == parent) {
                         dput(parent);
                         return false;
                 }
@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
         tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
         if (IS_ERR(tmp)) {
                 dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
+                err = PTR_ERR(tmp);
                 goto out_err;
         }
         if (tmp != dentry) {
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index cb91baa4275d..eb11502e3fcd 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -892,6 +892,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
         if (sb->s_magic != EXT2_SUPER_MAGIC)
                 goto cantfind_ext2;
 
+        opts.s_mount_opt = 0;
         /* Set defaults before we parse the mount options */
         def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
         if (def_mount_opts & EXT2_DEFM_DEBUG)
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index 62d9a659a8ff..dd8f10db82e9 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -612,9 +612,9 @@ skip_replace:
         }
 
 cleanup:
-        brelse(bh);
         if (!(bh && header == HDR(bh)))
                 kfree(header);
+        brelse(bh);
         up_write(&EXT2_I(inode)->xattr_sem);
 
         return error;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 05f01fbd9c7f..22a9d8159720 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5835,9 +5835,10 @@ int ext4_mark_iloc_dirty(handle_t *handle,
 {
         int err = 0;
 
-        if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+        if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) {
+                put_bh(iloc->bh);
                 return -EIO;
-
+        }
         if (IS_I_VERSION(inode))
                 inode_inc_iversion(inode);
 
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 17adcb16a9c8..437f71fe83ae 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -126,6 +126,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode,
         if (!is_dx_block && type == INDEX) {
                 ext4_error_inode(inode, func, line, block,
                        "directory leaf block found instead of index block");
+                brelse(bh);
                 return ERR_PTR(-EFSCORRUPTED);
         }
         if (!ext4_has_metadata_csum(inode->i_sb) ||
@@ -2811,7 +2812,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
                         list_del_init(&EXT4_I(inode)->i_orphan);
                         mutex_unlock(&sbi->s_orphan_lock);
                 }
-        }
+        } else
+                brelse(iloc.bh);
+
         jbd_debug(4, "superblock will point to %lu\n", inode->i_ino);
         jbd_debug(4, "orphan inode %lu will point to %d\n",
                         inode->i_ino, NEXT_ORPHAN(inode));
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index ebbc663d0798..a5efee34415f 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -459,16 +459,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle,
 
                 BUFFER_TRACE(bh, "get_write_access");
                 err = ext4_journal_get_write_access(handle, bh);
-                if (err)
+                if (err) {
+                        brelse(bh);
                         return err;
+                }
                 ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n",
                            first_cluster, first_cluster - start, count2);
                 ext4_set_bits(bh->b_data, first_cluster - start, count2);
 
                 err = ext4_handle_dirty_metadata(handle, NULL, bh);
+                brelse(bh);
                 if (unlikely(err))
                         return err;
-                brelse(bh);
         }
 
         return 0;
@@ -605,7 +607,6 @@ handle_bb:
                 bh = bclean(handle, sb, block);
                 if (IS_ERR(bh)) {
                         err = PTR_ERR(bh);
-                        bh = NULL;
                         goto out;
                 }
                 overhead = ext4_group_overhead_blocks(sb, group);
@@ -618,9 +619,9 @@ handle_bb:
                 ext4_mark_bitmap_end(EXT4_B2C(sbi, group_data[i].blocks_count),
                                      sb->s_blocksize * 8, bh->b_data);
                 err = ext4_handle_dirty_metadata(handle, NULL, bh);
+                brelse(bh);
                 if (err)
                         goto out;
-                brelse(bh);
 
 handle_ib:
                 if (bg_flags[i] & EXT4_BG_INODE_UNINIT)
@@ -635,18 +636,16 @@ handle_ib:
                 bh = bclean(handle, sb, block);
                 if (IS_ERR(bh)) {
                         err = PTR_ERR(bh);
-                        bh = NULL;
                         goto out;
                 }
 
                 ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb),
                                      sb->s_blocksize * 8, bh->b_data);
                 err = ext4_handle_dirty_metadata(handle, NULL, bh);
+                brelse(bh);
                 if (err)
                         goto out;
-                brelse(bh);
         }
-        bh = NULL;
 
         /* Mark group tables in block bitmap */
         for (j = 0; j < GROUP_TABLE_COUNT; j++) {
@@ -685,7 +684,6 @@ handle_ib:
         }
 
 out:
-        brelse(bh);
         err2 = ext4_journal_stop(handle);
         if (err2 && !err)
                 err = err2;
@@ -873,6 +871,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
         err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh);
         if (unlikely(err)) {
                 ext4_std_error(sb, err);
+                iloc.bh = NULL;
                 goto exit_inode;
         }
         brelse(dind);
@@ -924,6 +923,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
                                      sizeof(struct buffer_head *),
                                      GFP_NOFS);
         if (!n_group_desc) {
+                brelse(gdb_bh);
                 err = -ENOMEM;
                 ext4_warning(sb, "not enough memory for %lu groups",
                              gdb_num + 1);
@@ -939,8 +939,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
         kvfree(o_group_desc);
         BUFFER_TRACE(gdb_bh, "get_write_access");
         err = ext4_journal_get_write_access(handle, gdb_bh);
-        if (unlikely(err))
-                brelse(gdb_bh);
         return err;
 }
 
@@ -1124,8 +1122,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data,
                            backup_block, backup_block -
                            ext4_group_first_block_no(sb, group));
                 BUFFER_TRACE(bh, "get_write_access");
-                if ((err = ext4_journal_get_write_access(handle, bh)))
+                if ((err = ext4_journal_get_write_access(handle, bh))) {
+                        brelse(bh);
                         break;
+                }
                 lock_buffer(bh);
                 memcpy(bh->b_data, data, size);
                 if (rest)
@@ -2023,7 +2023,7 @@ retry:
 
         err = ext4_alloc_flex_bg_array(sb, n_group + 1);
         if (err)
-                return err;
+                goto out;
 
         err = ext4_mb_alloc_groupinfo(sb, n_group + 1);
         if (err)
@@ -2059,6 +2059,10 @@ retry:
                 n_blocks_count_retry = 0;
                 free_flex_gd(flex_gd);
                 flex_gd = NULL;
+                if (resize_inode) {
+                        iput(resize_inode);
+                        resize_inode = NULL;
+                }
                 goto retry;
         }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index a221f1cdf704..53ff6c2a26ed 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4075,6 +4075,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         sbi->s_groups_count = blocks_count;
         sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
                         (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
+        if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
+            le32_to_cpu(es->s_inodes_count)) {
+                ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
+                         le32_to_cpu(es->s_inodes_count),
+                         ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
+                ret = -EINVAL;
+                goto failed_mount;
+        }
         db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
                    EXT4_DESC_PER_BLOCK(sb);
         if (ext4_has_feature_meta_bg(sb)) {
@@ -4094,14 +4102,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 ret = -ENOMEM;
                 goto failed_mount;
         }
-        if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
-            le32_to_cpu(es->s_inodes_count)) {
-                ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
-                         le32_to_cpu(es->s_inodes_count),
-                         ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
-                ret = -EINVAL;
-                goto failed_mount;
-        }
 
         bgl_lock_init(sbi->s_blockgroup_lock);
 
@@ -4510,6 +4510,7 @@ failed_mount6:
         percpu_counter_destroy(&sbi->s_freeinodes_counter);
         percpu_counter_destroy(&sbi->s_dirs_counter);
         percpu_counter_destroy(&sbi->s_dirtyclusters_counter);
+        percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
 failed_mount5:
         ext4_ext_release(sb);
         ext4_release_system_zone(sb);
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index f36fc5d5b257..7643d52c776c 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1031,10 +1031,8 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
         inode_lock(ea_inode);
 
         ret = ext4_reserve_inode_write(handle, ea_inode, &iloc);
-        if (ret) {
-                iloc.bh = NULL;
+        if (ret)
                 goto out;
-        }
 
         ref_count = ext4_xattr_inode_get_ref(ea_inode);
         ref_count += ref_change;
@@ -1080,12 +1078,10 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
         }
 
         ret = ext4_mark_iloc_dirty(handle, ea_inode, &iloc);
-        iloc.bh = NULL;
         if (ret)
                 ext4_warning_inode(ea_inode,
                                    "ext4_mark_iloc_dirty() failed ret=%d", ret);
 out:
-        brelse(iloc.bh);
         inode_unlock(ea_inode);
         return ret;
 }
@@ -1388,6 +1384,12 @@ retry:
                 bh = ext4_getblk(handle, ea_inode, block, 0);
                 if (IS_ERR(bh))
                         return PTR_ERR(bh);
+                if (!bh) {
+                        WARN_ON_ONCE(1);
+                        EXT4_ERROR_INODE(ea_inode,
+                                         "ext4_getblk() return bh = NULL");
+                        return -EFSCORRUPTED;
+                }
                 ret = ext4_journal_get_write_access(handle, bh);
                 if (ret)
                         goto out;
@@ -2276,8 +2278,10 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode)
         if (!bh)
                 return ERR_PTR(-EIO);
         error = ext4_xattr_check_block(inode, bh);
-        if (error)
+        if (error) {
+                brelse(bh);
                 return ERR_PTR(error);
+        }
         return bh;
 }
 
@@ -2397,6 +2401,8 @@ retry_inode:
                         error = ext4_xattr_block_set(handle, inode, &i, &bs);
                 } else if (error == -ENOSPC) {
                         if (EXT4_I(inode)->i_file_acl && !bs.s.base) {
+                                brelse(bs.bh);
+                                bs.bh = NULL;
                                 error = ext4_xattr_block_find(inode, &i, &bs);
                                 if (error)
                                         goto cleanup;
@@ -2617,6 +2623,8 @@ out:
         kfree(buffer);
         if (is)
                 brelse(is->iloc.bh);
+        if (bs)
+                brelse(bs->bh);
         kfree(is);
         kfree(bs);
 
@@ -2696,7 +2704,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
                                struct ext4_inode *raw_inode, handle_t *handle)
 {
         struct ext4_xattr_ibody_header *header;
-        struct buffer_head *bh;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         static unsigned int mnt_count;
         size_t min_offs;
@@ -2737,13 +2744,17 @@ retry:
          * EA block can hold new_extra_isize bytes.
          */
         if (EXT4_I(inode)->i_file_acl) {
+                struct buffer_head *bh;
+
                 bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
                 error = -EIO;
                 if (!bh)
                         goto cleanup;
                 error = ext4_xattr_check_block(inode, bh);
-                if (error)
+                if (error) {
+                        brelse(bh);
                         goto cleanup;
+                }
                 base = BHDR(bh);
                 end = bh->b_data + bh->b_size;
                 min_offs = end - base;
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 9edc920f651f..6d9cb1719de5 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -730,6 +730,9 @@ static const struct fscache_state *fscache_drop_object(struct fscache_object *ob
 
         if (awaken)
                 wake_up_bit(&cookie->flags, FSCACHE_COOKIE_INVALIDATING);
+        if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP, &cookie->flags))
+                wake_up_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP);
+
 
         /* Prevent a race with our last child, which has to signal EV_CLEARED
          * before dropping our spinlock.
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ae813e609932..a5e516a40e7a 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -165,9 +165,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
 
 static void fuse_drop_waiting(struct fuse_conn *fc)
 {
-        if (fc->connected) {
-                atomic_dec(&fc->num_waiting);
-        } else if (atomic_dec_and_test(&fc->num_waiting)) {
+        /*
+         * lockess check of fc->connected is okay, because atomic_dec_and_test()
+         * provides a memory barrier mached with the one in fuse_wait_aborted()
+         * to ensure no wake-up is missed.
+         */
+        if (atomic_dec_and_test(&fc->num_waiting) &&
+            !READ_ONCE(fc->connected)) {
                 /* wake up aborters */
                 wake_up_all(&fc->blocked_waitq);
         }
@@ -1768,8 +1772,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         req->in.args[1].size = total_len;
 
         err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
-        if (err)
+        if (err) {
                 fuse_retrieve_end(fc, req);
+                fuse_put_request(fc, req);
+        }
 
         return err;
 }
@@ -2219,6 +2225,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
 
 void fuse_wait_aborted(struct fuse_conn *fc)
 {
+        /* matches implicit memory barrier in fuse_drop_waiting() */
+        smp_mb();
         wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
 }
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index cc2121b37bf5..b52f9baaa3e7 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2924,10 +2924,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
         }
 
         if (io->async) {
+                bool blocking = io->blocking;
+
                 fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
 
                 /* we have a non-extending, async request, so return */
-                if (!io->blocking)
+                if (!blocking)
                         return -EIOCBQUEUED;
 
                 wait_for_completion(&wait);
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index a683d9b27d76..9a4a15d646eb 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -826,7 +826,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
         ret = gfs2_meta_inode_buffer(ip, &dibh);
         if (ret)
                 goto unlock;
-        iomap->private = dibh;
+        mp->mp_bh[0] = dibh;
 
         if (gfs2_is_stuffed(ip)) {
                 if (flags & IOMAP_WRITE) {
@@ -863,9 +863,6 @@ unstuff:
         len = lblock_stop - lblock + 1;
         iomap->length = len << inode->i_blkbits;
 
-        get_bh(dibh);
-        mp->mp_bh[0] = dibh;
-
         height = ip->i_height;
         while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height])
                 height++;
@@ -898,8 +895,6 @@ out:
         iomap->bdev = inode->i_sb->s_bdev;
 unlock:
         up_read(&ip->i_rw_mutex);
-        if (ret && dibh)
-                brelse(dibh);
         return ret;
 
 do_alloc:
@@ -980,9 +975,9 @@ static void gfs2_iomap_journaled_page_done(struct inode *inode, loff_t pos,
 
 static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
                                   loff_t length, unsigned flags,
-                                  struct iomap *iomap)
+                                  struct iomap *iomap,
+                                  struct metapath *mp)
 {
-        struct metapath mp = { .mp_aheight = 1, };
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
         unsigned int data_blocks = 0, ind_blocks = 0, rblocks;
@@ -996,9 +991,9 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
         unstuff = gfs2_is_stuffed(ip) &&
                   pos + length > gfs2_max_stuffed_size(ip);
 
-        ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
+        ret = gfs2_iomap_get(inode, pos, length, flags, iomap, mp);
         if (ret)
-                goto out_release;
+                goto out_unlock;
 
         alloc_required = unstuff || iomap->type == IOMAP_HOLE;
 
@@ -1013,7 +1008,7 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
 
                 ret = gfs2_quota_lock_check(ip, &ap);
                 if (ret)
-                        goto out_release;
+                        goto out_unlock;
 
                 ret = gfs2_inplace_reserve(ip, &ap);
                 if (ret)
@@ -1038,17 +1033,15 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
                 ret = gfs2_unstuff_dinode(ip, NULL);
                 if (ret)
                         goto out_trans_end;
-                release_metapath(&mp);
-                brelse(iomap->private);
-                iomap->private = NULL;
+                release_metapath(mp);
                 ret = gfs2_iomap_get(inode, iomap->offset, iomap->length,
-                                     flags, iomap, &mp);
+                                     flags, iomap, mp);
                 if (ret)
                         goto out_trans_end;
         }
 
         if (iomap->type == IOMAP_HOLE) {
-                ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
+                ret = gfs2_iomap_alloc(inode, iomap, flags, mp);
                 if (ret) {
                         gfs2_trans_end(sdp);
                         gfs2_inplace_release(ip);
@@ -1056,7 +1049,6 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
                         goto out_qunlock;
                 }
         }
-        release_metapath(&mp);
         if (!gfs2_is_stuffed(ip) && gfs2_is_jdata(ip))
                 iomap->page_done = gfs2_iomap_journaled_page_done;
         return 0;
@@ -1069,10 +1061,7 @@ out_trans_fail:
 out_qunlock:
         if (alloc_required)
                 gfs2_quota_unlock(ip);
-out_release:
-        if (iomap->private)
-                brelse(iomap->private);
-        release_metapath(&mp);
+out_unlock:
         gfs2_write_unlock(inode);
         return ret;
 }
@@ -1088,10 +1077,10 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
 
         trace_gfs2_iomap_start(ip, pos, length, flags);
         if ((flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)) {
-                ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap);
+                ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp);
         } else {
                 ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
-                release_metapath(&mp);
+
                 /*
                  * Silently fall back to buffered I/O for stuffed files or if
                  * we've hot a hole (see gfs2_file_direct_write).
@@ -1100,6 +1089,11 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                     iomap->type != IOMAP_MAPPED)
                         ret = -ENOTBLK;
         }
+        if (!ret) {
+                get_bh(mp.mp_bh[0]);
+                iomap->private = mp.mp_bh[0];
+        }
+        release_metapath(&mp);
         trace_gfs2_iomap_end(ip, iomap, ret);
         return ret;
 }
@@ -1908,10 +1902,16 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
                         if (ret < 0)
                                 goto out;
 
-                        /* issue read-ahead on metadata */
-                        if (mp.mp_aheight > 1) {
-                                for (; ret > 1; ret--) {
-                                        metapointer_range(&mp, mp.mp_aheight - ret,
+                        /* On the first pass, issue read-ahead on metadata. */
+                        if (mp.mp_aheight > 1 && strip_h == ip->i_height - 1) {
+                                unsigned int height = mp.mp_aheight - 1;
+
+                                /* No read-ahead for data blocks. */
+                                if (mp.mp_aheight - 1 == strip_h)
+                                        height--;
+
+                                for (; height >= mp.mp_aheight - ret; height--) {
+                                        metapointer_range(&mp, height,
                                                           start_list, start_aligned,
                                                           end_list, end_aligned,
                                                           &start, &end);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index ffe3032b1043..b08a530433ad 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -733,6 +733,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
 
                 if (gl) {
                         glock_clear_object(gl, rgd);
+                        gfs2_rgrp_brelse(rgd);
                         gfs2_glock_put(gl);
                 }
 
@@ -1174,7 +1175,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd)
  * @rgd: the struct gfs2_rgrpd describing the RG to read in
  *
  * Read in all of a Resource Group's header and bitmap blocks.
- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps.
+ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps.
  *
  * Returns: errno
  */
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 98b96ffb95ed..19017d296173 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -338,13 +338,14 @@ void hfs_bmap_free(struct hfs_bnode *node)
 
                 nidx -= len * 8;
                 i = node->next;
-                hfs_bnode_put(node);
                 if (!i) {
                         /* panic */;
                         pr_crit("unable to free bnode %u. bmap not found!\n",
                                 node->this);
+                        hfs_bnode_put(node);
                         return;
                 }
+                hfs_bnode_put(node);
                 node = hfs_bnode_find(tree, i);
                 if (IS_ERR(node))
                         return;
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 236efe51eca6..66774f4cb4fd 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -466,14 +466,15 @@ void hfs_bmap_free(struct hfs_bnode *node)
 
                 nidx -= len * 8;
                 i = node->next;
-                hfs_bnode_put(node);
                 if (!i) {
                         /* panic */;
                         pr_crit("unable to free bnode %u. "
                                         "bmap not found!\n",
                                 node->this);
+                        hfs_bnode_put(node);
                         return;
                 }
+                hfs_bnode_put(node);
                 node = hfs_bnode_find(tree, i);
                 if (IS_ERR(node))
                         return;
diff --git a/fs/inode.c b/fs/inode.c
index 9e198f00b64c..35d2108d567c 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -730,8 +730,11 @@ static enum lru_status inode_lru_isolate(struct list_head *item,
                 return LRU_REMOVED;
         }
 
-        /* recently referenced inodes get one more pass */
-        if (inode->i_state & I_REFERENCED) {
+        /*
+         * Recently referenced inodes and inodes with many attached pages
+         * get one more pass.
+         */
+        if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
                 inode->i_state &= ~I_REFERENCED;
                 spin_unlock(&inode->i_lock);
                 return LRU_ROTATE;
diff --git a/fs/iomap.c b/fs/iomap.c
index 64ce240217a1..3ffb776fbebe 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -142,13 +142,14 @@ static void
 iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
                 loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
 {
+        loff_t orig_pos = *pos;
+        loff_t isize = i_size_read(inode);
         unsigned block_bits = inode->i_blkbits;
         unsigned block_size = (1 << block_bits);
         unsigned poff = offset_in_page(*pos);
         unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
         unsigned first = poff >> block_bits;
         unsigned last = (poff + plen - 1) >> block_bits;
-        unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
 
         /*
          * If the block size is smaller than the page size we need to check the
@@ -183,8 +184,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
          * handle both halves separately so that we properly zero data in the
          * page cache for blocks that are entirely outside of i_size.
          */
-        if (first <= end && last > end)
-                plen -= (last - end) * block_size;
+        if (orig_pos <= isize && orig_pos + length > isize) {
+                unsigned end = offset_in_page(isize - 1) >> block_bits;
+
+                if (first <= end && last > end)
+                        plen -= (last - end) * block_size;
+        }
 
         *offp = poff;
         *lenp = plen;
@@ -1580,7 +1585,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
         struct bio *bio;
         bool need_zeroout = false;
         bool use_fua = false;
-        int nr_pages, ret;
+        int nr_pages, ret = 0;
         size_t copied = 0;
 
         if ((pos | length | align) & ((1 << blkbits) - 1))
@@ -1596,12 +1601,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
         if (iomap->flags & IOMAP_F_NEW) {
                 need_zeroout = true;
-        } else {
+        } else if (iomap->type == IOMAP_MAPPED) {
                 /*
-                 * Use a FUA write if we need datasync semantics, this
-                 * is a pure data IO that doesn't require any metadata
-                 * updates and the underlying device supports FUA. This
-                 * allows us to avoid cache flushes on IO completion.
+                 * Use a FUA write if we need datasync semantics, this is a pure
+                 * data IO that doesn't require any metadata updates (including
+                 * after IO completion such as unwritten extent conversion) and
+                 * the underlying device supports FUA. This allows us to avoid
+                 * cache flushes on IO completion.
                  */
                 if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
                     (dio->flags & IOMAP_DIO_WRITE_FUA) &&
@@ -1644,8 +1650,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
                 ret = bio_iov_iter_get_pages(bio, &iter);
                 if (unlikely(ret)) {
+                        /*
+                         * We have to stop part way through an IO. We must fall
+                         * through to the sub-block tail zeroing here, otherwise
+                         * this short IO may expose stale data in the tail of
+                         * the block we haven't written data to.
+                         */
                         bio_put(bio);
-                        return copied ? copied : ret;
+                        goto zero_tail;
                 }
 
                 n = bio->bi_iter.bi_size;
@@ -1676,13 +1688,21 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
                 dio->submit.cookie = submit_bio(bio);
         } while (nr_pages);
 
-        if (need_zeroout) {
+        /*
+         * We need to zeroout the tail of a sub-block write if the extent type
+         * requires zeroing or the write extends beyond EOF. If we don't zero
+         * the block tail in the latter case, we can expose stale data via mmap
+         * reads of the EOF block.
+         */
+zero_tail:
+        if (need_zeroout ||
+            ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
                 /* zero out from the end of the write to the end of the block */
                 pad = pos & (fs_block_size - 1);
                 if (pad)
                         iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
         }
-        return copied;
+        return copied ? copied : ret;
 }
 
 static loff_t
@@ -1857,6 +1877,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                                 dio->wait_for_completion = true;
                                 ret = 0;
                         }
+
+                        /*
+                         * Splicing to pipes can fail on a full pipe. We have to
+                         * swallow this to make it look like a short IO
+                         * otherwise the higher splice layers will completely
+                         * mishandle the error and stop moving data.
+                         */
+                        if (ret == -EFAULT)
+                                ret = 0;
                         break;
                 }
                 pos += ret;
diff --git a/fs/namespace.c b/fs/namespace.c
index 98d27da43304..a7f91265ea67 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -695,9 +695,6 @@ static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
 
         hlist_for_each_entry(mp, chain, m_hash) {
                 if (mp->m_dentry == dentry) {
-                        /* might be worth a WARN_ON() */
-                        if (d_unlinked(dentry))
-                                return ERR_PTR(-ENOENT);
                         mp->m_count++;
                         return mp;
                 }
@@ -711,6 +708,9 @@ static struct mountpoint *get_mountpoint(struct dentry *dentry)
         int ret;
 
         if (d_mountpoint(dentry)) {
+                /* might be worth a WARN_ON() */
+                if (d_unlinked(dentry))
+                        return ERR_PTR(-ENOENT);
 mountpoint:
                 read_seqlock_excl(&mount_lock);
                 mp = lookup_mountpoint(dentry);
@@ -1540,8 +1540,13 @@ static int do_umount(struct mount *mnt, int flags)
 
         namespace_lock();
         lock_mount_hash();
-        event++;
 
+        /* Recheck MNT_LOCKED with the locks held */
+        retval = -EINVAL;
+        if (mnt->mnt.mnt_flags & MNT_LOCKED)
+                goto out;
+
+        event++;
         if (flags & MNT_DETACH) {
                 if (!list_empty(&mnt->mnt_list))
                         umount_tree(mnt, UMOUNT_PROPAGATE);
@@ -1555,6 +1560,7 @@ static int do_umount(struct mount *mnt, int flags)
                         retval = 0;
                 }
         }
+out:
         unlock_mount_hash();
         namespace_unlock();
         return retval;
@@ -1645,7 +1651,7 @@ int ksys_umount(char __user *name, int flags)
                 goto dput_and_out;
         if (!check_mnt(mnt))
                 goto dput_and_out;
-        if (mnt->mnt.mnt_flags & MNT_LOCKED)
+        if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
                 goto dput_and_out;
         retval = -EPERM;
         if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
@@ -1728,8 +1734,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
                 for (s = r; s; s = next_mnt(s, r)) {
                         if (!(flag & CL_COPY_UNBINDABLE) &&
                             IS_MNT_UNBINDABLE(s)) {
-                                s = skip_mnt_tree(s);
-                                continue;
+                                if (s->mnt.mnt_flags & MNT_LOCKED) {
+                                        /* Both unbindable and locked. */
+                                        q = ERR_PTR(-EPERM);
+                                        goto out;
+                                } else {
+                                        s = skip_mnt_tree(s);
+                                        continue;
+                                }
                         }
                         if (!(flag & CL_COPY_MNT_NS_FILE) &&
                             is_mnt_ns_file(s->mnt.mnt_root)) {
@@ -1782,7 +1794,7 @@ void drop_collected_mounts(struct vfsmount *mnt)
 {
         namespace_lock();
         lock_mount_hash();
-        umount_tree(real_mount(mnt), UMOUNT_SYNC);
+        umount_tree(real_mount(mnt), 0);
         unlock_mount_hash();
         namespace_unlock();
 }
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index fa515d5ea5ba..315967354954 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp,
 out_iput:
         rcu_read_unlock();
         trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status));
-        iput(inode);
+        nfs_iput_and_deactive(inode);
 out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status));
         return res->status;
@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp,
         }
         trace_nfs4_cb_recall(cps->clp, &args->fh, inode,
                         &args->stateid, -ntohl(res));
-        iput(inode);
+        nfs_iput_and_deactive(inode);
 out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(res));
         return res;
@@ -686,20 +686,24 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
 {
         struct cb_offloadargs *args = data;
         struct nfs_server *server;
-        struct nfs4_copy_state *copy;
+        struct nfs4_copy_state *copy, *tmp_copy;
         bool found = false;
 
+        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+        if (!copy)
+                return htonl(NFS4ERR_SERVERFAULT);
+
         spin_lock(&cps->clp->cl_lock);
         rcu_read_lock();
         list_for_each_entry_rcu(server, &cps->clp->cl_superblocks,
                                 client_link) {
-                list_for_each_entry(copy, &server->ss_copies, copies) {
+                list_for_each_entry(tmp_copy, &server->ss_copies, copies) {
                         if (memcmp(args->coa_stateid.other,
-                                        copy->stateid.other,
+                                        tmp_copy->stateid.other,
                                         sizeof(args->coa_stateid.other)))
                                 continue;
-                        nfs4_copy_cb_args(copy, args);
-                        complete(&copy->completion);
+                        nfs4_copy_cb_args(tmp_copy, args);
+                        complete(&tmp_copy->completion);
                         found = true;
                         goto out;
                 }
@@ -707,15 +711,11 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
 out:
         rcu_read_unlock();
         if (!found) {
-                copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
-                if (!copy) {
-                        spin_unlock(&cps->clp->cl_lock);
-                        return htonl(NFS4ERR_SERVERFAULT);
-                }
                 memcpy(&copy->stateid, &args->coa_stateid, NFS4_STATEID_SIZE);
                 nfs4_copy_cb_args(copy, args);
                 list_add_tail(&copy->copies, &cps->clp->pending_cb_stateids);
-        }
+        } else
+                kfree(copy);
         spin_unlock(&cps->clp->cl_lock);
 
         return 0;
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 07b839560576..6ec2f78c1e19 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -850,16 +850,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server,
                                  const struct nfs_fh *fhandle)
 {
         struct nfs_delegation *delegation;
-        struct inode *res = NULL;
+        struct inode *freeme, *res = NULL;
 
         list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
                 spin_lock(&delegation->lock);
                 if (delegation->inode != NULL &&
                     nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) {
-                        res = igrab(delegation->inode);
+                        freeme = igrab(delegation->inode);
+                        if (freeme && nfs_sb_active(freeme->i_sb))
+                                res = freeme;
                         spin_unlock(&delegation->lock);
                         if (res != NULL)
                                 return res;
+                        if (freeme) {
+                                rcu_read_unlock();
+                                iput(freeme);
+                                rcu_read_lock();
+                        }
                         return ERR_PTR(-EAGAIN);
                 }
                 spin_unlock(&delegation->lock);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 86bcba40ca61..74b36ed883ca 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1361,12 +1361,7 @@ static void ff_layout_read_prepare_v4(struct rpc_task *task, void *data)
                                 task))
                 return;
 
-        if (ff_layout_read_prepare_common(task, hdr))
-                return;
-
-        if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
-                        hdr->args.lock_context, FMODE_READ) == -EIO)
-                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
+        ff_layout_read_prepare_common(task, hdr);
 }
 
 static void ff_layout_read_call_done(struct rpc_task *task, void *data)
@@ -1542,12 +1537,7 @@ static void ff_layout_write_prepare_v4(struct rpc_task *task, void *data)
                                 task))
                 return;
 
-        if (ff_layout_write_prepare_common(task, hdr))
-                return;
-
-        if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
-                        hdr->args.lock_context, FMODE_WRITE) == -EIO)
-                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
+        ff_layout_write_prepare_common(task, hdr);
 }
 
 static void ff_layout_write_call_done(struct rpc_task *task, void *data)
@@ -1742,6 +1732,10 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
         fh = nfs4_ff_layout_select_ds_fh(lseg, idx);
         if (fh)
                 hdr->args.fh = fh;
+
+        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+                goto out_failed;
+
         /*
          * Note that if we ever decide to split across DSes,
          * then we may need to handle dense-like offsets.
@@ -1804,6 +1798,9 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         if (fh)
                 hdr->args.fh = fh;
 
+        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+                goto out_failed;
+
         /*
          * Note that if we ever decide to split across DSes,
          * then we may need to handle dense-like offsets.
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 411798346e48..de50a342d5a5 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -215,6 +215,10 @@ unsigned int ff_layout_fetch_ds_ioerr(struct pnfs_layout_hdr *lo,
                 unsigned int maxnum);
 struct nfs_fh *
 nfs4_ff_layout_select_ds_fh(struct pnfs_layout_segment *lseg, u32 mirror_idx);
+int
+nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
+                                u32 mirror_idx,
+                                nfs4_stateid *stateid);
 
 struct nfs4_pnfs_ds *
 nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 74d8d5352438..d23347389626 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -370,6 +370,25 @@ out:
         return fh;
 }
 
+int
+nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
+                                u32 mirror_idx,
+                                nfs4_stateid *stateid)
+{
+        struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, mirror_idx);
+
+        if (!ff_layout_mirror_valid(lseg, mirror, false)) {
+                pr_err_ratelimited("NFS: %s: No data server for mirror offset index %d\n",
+                        __func__, mirror_idx);
+                goto out;
+        }
+
+        nfs4_stateid_copy(stateid, &mirror->stateid);
+        return 1;
+out:
+        return 0;
+}
+
 /**
  * nfs4_ff_layout_prepare_ds - prepare a DS connection for an RPC call
  * @lseg: the layout segment we're operating on
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index ac5b784a1de0..fed06fd9998d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -137,31 +137,32 @@ static int handle_async_copy(struct nfs42_copy_res *res,
                              struct file *dst,
                              nfs4_stateid *src_stateid)
 {
-        struct nfs4_copy_state *copy;
+        struct nfs4_copy_state *copy, *tmp_copy;
         int status = NFS4_OK;
         bool found_pending = false;
         struct nfs_open_context *ctx = nfs_file_open_context(dst);
 
+        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+        if (!copy)
+                return -ENOMEM;
+
         spin_lock(&server->nfs_client->cl_lock);
-        list_for_each_entry(copy, &server->nfs_client->pending_cb_stateids,
+        list_for_each_entry(tmp_copy, &server->nfs_client->pending_cb_stateids,
                                 copies) {
-                if (memcmp(&res->write_res.stateid, &copy->stateid,
+                if (memcmp(&res->write_res.stateid, &tmp_copy->stateid,
                                 NFS4_STATEID_SIZE))
                         continue;
                 found_pending = true;
-                list_del(&copy->copies);
+                list_del(&tmp_copy->copies);
                 break;
         }
         if (found_pending) {
                 spin_unlock(&server->nfs_client->cl_lock);
+                kfree(copy);
+                copy = tmp_copy;
                 goto out;
         }
 
-        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
-        if (!copy) {
-                spin_unlock(&server->nfs_client->cl_lock);
-                return -ENOMEM;
-        }
         memcpy(&copy->stateid, &res->write_res.stateid, NFS4_STATEID_SIZE);
         init_completion(&copy->completion);
         copy->parent_state = ctx->state;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 8d59c9655ec4..1b994b527518 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -41,6 +41,8 @@ enum nfs4_client_state {
         NFS4CLNT_MOVED,
         NFS4CLNT_LEASE_MOVED,
         NFS4CLNT_DELEGATION_EXPIRED,
+        NFS4CLNT_RUN_MANAGER,
+        NFS4CLNT_DELEGRETURN_RUNNING,
 };
 
 #define NFS4_RENEW_TIMEOUT              0x01
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 62ae0fd345ad..d8decf2ec48f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1210,6 +1210,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
         struct task_struct *task;
         char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1];
 
+        set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
         if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                 return;
         __module_get(THIS_MODULE);
@@ -2503,6 +2504,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
 
         /* Ensure exclusive access to NFSv4 state */
         do {
+                clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
                 if (test_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state)) {
                         section = "purge state";
                         status = nfs4_purge_lease(clp);
@@ -2593,19 +2595,24 @@ static void nfs4_state_manager(struct nfs_client *clp)
                 }
 
                 nfs4_end_drain_session(clp);
-                if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
-                        nfs_client_return_marked_delegations(clp);
-                        continue;
+                nfs4_clear_state_manager_bit(clp);
+
+                if (!test_and_set_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state)) {
+                        if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
+                                nfs_client_return_marked_delegations(clp);
+                                set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
+                        }
+                        clear_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state);
                 }
 
-                nfs4_clear_state_manager_bit(clp);
                 /* Did we race with an attempt to give us more work? */
-                if (clp->cl_state == 0)
-                        break;
+                if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state))
+                        return;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
-                        break;
-        } while (refcount_read(&clp->cl_count) > 1);
-        return;
+                        return;
+        } while (refcount_read(&clp->cl_count) > 1 && !signalled());
+        goto out_drain;
+
 out_error:
         if (strlen(section))
                 section_sep = ": ";
@@ -2613,6 +2620,7 @@ out_error:
                         " with error %d\n", section_sep, section,
                         clp->cl_hostname, -status);
         ssleep(1);
+out_drain:
         nfs4_end_drain_session(clp);
         nfs4_clear_state_manager_bit(clp);
 }
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index edff074d38c7..d505990dac7c 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1038,6 +1038,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 {
         __be32 status;
 
+        if (!cstate->save_fh.fh_dentry)
+                return nfserr_nofilehandle;
+
         status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh,
                                             src_stateid, RD_STATE, src, NULL);
         if (status) {
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index de99db518571..f2129a5d9f23 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -266,9 +266,7 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc,
                 return;
 
         if (nbh == NULL) {      /* blocksize == pagesize */
-                xa_lock_irq(&btnc->i_pages);
-                __xa_erase(&btnc->i_pages, newkey);
-                xa_unlock_irq(&btnc->i_pages);
+                xa_erase_irq(&btnc->i_pages, newkey);
                 unlock_page(ctxt->bh->b_page);
         } else
                 brelse(nbh);
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 5769cf3ff035..e08a6647267b 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -115,12 +115,12 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info,
                         continue;
                 mark = iter_info->marks[type];
                 /*
-                 * if the event is for a child and this inode doesn't care about
-                 * events on the child, don't send it!
+                 * If the event is for a child and this mark doesn't care about
+                 * events on a child, don't send it!
                  */
-                if (type == FSNOTIFY_OBJ_TYPE_INODE &&
-                    (event_mask & FS_EVENT_ON_CHILD) &&
-                    !(mark->mask & FS_EVENT_ON_CHILD))
+                if (event_mask & FS_EVENT_ON_CHILD &&
+                    (type != FSNOTIFY_OBJ_TYPE_INODE ||
+                     !(mark->mask & FS_EVENT_ON_CHILD)))
                         continue;
 
                 marks_mask |= mark->mask;
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 2172ba516c61..d2c34900ae05 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -167,9 +167,9 @@ int __fsnotify_parent(const struct path *path, struct dentry *dentry, __u32 mask
         parent = dget_parent(dentry);
         p_inode = parent->d_inode;
 
-        if (unlikely(!fsnotify_inode_watches_children(p_inode)))
+        if (unlikely(!fsnotify_inode_watches_children(p_inode))) {
                 __fsnotify_update_child_dentry_flags(p_inode);
-        else if (p_inode->i_fsnotify_mask & mask) {
+        } else if (p_inode->i_fsnotify_mask & mask & ALL_FSNOTIFY_EVENTS) {
                 struct name_snapshot name;
 
                 /* we are notifying a parent so come up with the new mask which
@@ -339,6 +339,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
                 sb = mnt->mnt.mnt_sb;
                 mnt_or_sb_mask = mnt->mnt_fsnotify_mask | sb->s_fsnotify_mask;
         }
+        /* An event "on child" is not intended for a mount/sb mark */
+        if (mask & FS_EVENT_ON_CHILD)
+                mnt_or_sb_mask = 0;
 
         /*
          * Optimization: srcu_read_lock() has a memory barrier which can
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index da578ad4c08f..eb1ce30412dc 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -2411,8 +2411,16 @@ static int ocfs2_dio_end_io(struct kiocb *iocb,
         /* this io's submitter should not have unlocked this before we could */
         BUG_ON(!ocfs2_iocb_is_rw_locked(iocb));
 
-        if (bytes > 0 && private)
-                ret = ocfs2_dio_end_io_write(inode, private, offset, bytes);
+        if (bytes <= 0)
+                mlog_ratelimited(ML_ERROR, "Direct IO failed, bytes = %lld",
+                                 (long long)bytes);
+        if (private) {
+                if (bytes > 0)
+                        ret = ocfs2_dio_end_io_write(inode, private, offset,
+                                                     bytes);
+                else
+                        ocfs2_dio_free_write_ctx(inode, private);
+        }
 
         ocfs2_iocb_clear_rw_locked(iocb);
 
diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
index 308ea0eb35fd..a396096a5099 100644
--- a/fs/ocfs2/cluster/masklog.h
+++ b/fs/ocfs2/cluster/masklog.h
@@ -178,6 +178,15 @@ do {									\
                               ##__VA_ARGS__);                           \
 } while (0)
 
+#define mlog_ratelimited(mask, fmt, ...)                                \
+do {                                                                    \
+        static DEFINE_RATELIMIT_STATE(_rs,                              \
+                                      DEFAULT_RATELIMIT_INTERVAL,       \
+                                      DEFAULT_RATELIMIT_BURST);         \
+        if (__ratelimit(&_rs))                                          \
+                mlog(mask, fmt, ##__VA_ARGS__);                         \
+} while (0)
+
 #define mlog_errno(st) ({                                               \
         int _st = (st);                                                 \
         if (_st != -ERESTARTSYS && _st != -EINTR &&                     \
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 9f88188060db..4bf8d5854b27 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -125,10 +125,10 @@ check_err:
 
 check_gen:
         if (handle->ih_generation != inode->i_generation) {
-                iput(inode);
                 trace_ocfs2_get_dentry_generation((unsigned long long)blkno,
                                                   handle->ih_generation,
                                                   inode->i_generation);
+                iput(inode);
                 result = ERR_PTR(-ESTALE);
                 goto bail;
         }
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 3f1685d7d43b..1565dd8e8856 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -157,18 +157,14 @@ out:
 }
 
 /*
- * lock allocators, and reserving appropriate number of bits for
- * meta blocks and data clusters.
- *
- * in some cases, we don't need to reserve clusters, just let data_ac
- * be NULL.
+ * lock allocator, and reserve appropriate number of bits for
+ * meta blocks.
  */
-static int ocfs2_lock_allocators_move_extents(struct inode *inode,
+static int ocfs2_lock_meta_allocator_move_extents(struct inode *inode,
                                         struct ocfs2_extent_tree *et,
                                         u32 clusters_to_move,
                                         u32 extents_to_split,
                                         struct ocfs2_alloc_context **meta_ac,
-                                        struct ocfs2_alloc_context **data_ac,
                                         int extra_blocks,
                                         int *credits)
 {
@@ -193,13 +189,6 @@ static int ocfs2_lock_allocators_move_extents(struct inode *inode,
                 goto out;
         }
 
-        if (data_ac) {
-                ret = ocfs2_reserve_clusters(osb, clusters_to_move, data_ac);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-        }
 
         *credits += ocfs2_calc_extend_credits(osb->sb, et->et_root_el);
 
@@ -259,10 +248,10 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
                 }
         }
 
-        ret = ocfs2_lock_allocators_move_extents(inode, &context->et, *len, 1,
-                                                 &context->meta_ac,
-                                                 &context->data_ac,
-                                                 extra_blocks, &credits);
+        ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et,
+                                                *len, 1,
+                                                &context->meta_ac,
+                                                extra_blocks, &credits);
         if (ret) {
                 mlog_errno(ret);
                 goto out;
@@ -285,6 +274,21 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
                 }
         }
 
+        /*
+         * Make sure ocfs2_reserve_cluster is called after
+         * __ocfs2_flush_truncate_log, otherwise, dead lock may happen.
+         *
+         * If ocfs2_reserve_cluster is called
+         * before __ocfs2_flush_truncate_log, dead lock on global bitmap
+         * may happen.
+         *
+         */
+        ret = ocfs2_reserve_clusters(osb, *len, &context->data_ac);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_unlock_mutex;
+        }
+
         handle = ocfs2_start_trans(osb, credits);
         if (IS_ERR(handle)) {
                 ret = PTR_ERR(handle);
@@ -617,9 +621,10 @@ static int ocfs2_move_extent(struct ocfs2_move_extents_context *context,
                 }
         }
 
-        ret = ocfs2_lock_allocators_move_extents(inode, &context->et, len, 1,
-                                                 &context->meta_ac,
-                                                 NULL, extra_blocks, &credits);
+        ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et,
+                                                len, 1,
+                                                &context->meta_ac,
+                                                extra_blocks, &credits);
         if (ret) {
                 mlog_errno(ret);
                 goto out;
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index ffcff6516e89..e02a9039b5ea 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -816,17 +816,14 @@ static int ramoops_probe(struct platform_device *pdev)
 
         cxt->pstore.data = cxt;
         /*
-         * Console can handle any buffer size, so prefer LOG_LINE_MAX. If we
-         * have to handle dumps, we must have at least record_size buffer. And
-         * for ftrace, bufsize is irrelevant (if bufsize is 0, buf will be
-         * ZERO_SIZE_PTR).
+         * Since bufsize is only used for dmesg crash dumps, it
+         * must match the size of the dprz record (after PRZ header
+         * and ECC bytes have been accounted for).
          */
-        if (cxt->console_size)
-                cxt->pstore.bufsize = 1024; /* LOG_LINE_MAX */
-        cxt->pstore.bufsize = max(cxt->record_size, cxt->pstore.bufsize);
-        cxt->pstore.buf = kmalloc(cxt->pstore.bufsize, GFP_KERNEL);
+        cxt->pstore.bufsize = cxt->dprzs[0]->buffer_size;
+        cxt->pstore.buf = kzalloc(cxt->pstore.bufsize, GFP_KERNEL);
         if (!cxt->pstore.buf) {
-                pr_err("cannot allocate pstore buffer\n");
+                pr_err("cannot allocate pstore crash dump buffer\n");
                 err = -ENOMEM;
                 goto fail_clear;
         }
diff --git a/fs/read_write.c b/fs/read_write.c
index bfcb4ced5664..4dae0399c75a 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -2094,17 +2094,18 @@ int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same)
         off = same->src_offset;
         len = same->src_length;
 
-        ret = -EISDIR;
         if (S_ISDIR(src->i_mode))
-                goto out;
+                return -EISDIR;
 
-        ret = -EINVAL;
         if (!S_ISREG(src->i_mode))
-                goto out;
+                return -EINVAL;
+
+        if (!file->f_op->remap_file_range)
+                return -EOPNOTSUPP;
 
         ret = remap_verify_area(file, off, len, false);
         if (ret < 0)
-                goto out;
+                return ret;
         ret = 0;
 
         if (off + len > i_size_read(src))
@@ -2147,10 +2148,8 @@ next_fdput:
                 fdput(dst_fd);
 next_loop:
                 if (fatal_signal_pending(current))
-                        goto out;
+                        break;
         }
-
-out:
         return ret;
 }
 EXPORT_SYMBOL(vfs_dedupe_file_range);
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 499a20a5a010..273736f41be3 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -275,7 +275,7 @@ static int __sysv_write_inode(struct inode *inode, int wait)
                 }
         }
         brelse(bh);
-        return 0;
+        return err;
 }
 
 int sysv_write_inode(struct inode *inode, struct writeback_control *wbc)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 8f2f56d9a1bb..e3d684ea3203 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -827,16 +827,20 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block)
 
 
         ret = udf_dstrCS0toChar(sb, outstr, 31, pvoldesc->volIdent, 32);
-        if (ret < 0)
-                goto out_bh;
-
-        strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
+        if (ret < 0) {
+                strcpy(UDF_SB(sb)->s_volume_ident, "InvalidName");
+                pr_warn("incorrect volume identification, setting to "
+                        "'InvalidName'\n");
+        } else {
+                strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
+        }
         udf_debug("volIdent[] = '%s'\n", UDF_SB(sb)->s_volume_ident);
 
         ret = udf_dstrCS0toChar(sb, outstr, 127, pvoldesc->volSetIdent, 128);
-        if (ret < 0)
+        if (ret < 0) {
+                ret = 0;
                 goto out_bh;
-
+        }
         outstr[ret] = 0;
         udf_debug("volSetIdent[] = '%s'\n", outstr);
 
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index 45234791fec2..5fcfa96463eb 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -351,6 +351,11 @@ try_again:
         return u_len;
 }
 
+/*
+ * Convert CS0 dstring to output charset. Warning: This function may truncate
+ * input string if it is too long as it is used for informational strings only
+ * and it is better to truncate the string than to refuse mounting a media.
+ */
 int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
                       const uint8_t *ocu_i, int i_len)
 {
@@ -359,9 +364,12 @@ int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
         if (i_len > 0) {
                 s_len = ocu_i[i_len - 1];
                 if (s_len >= i_len) {
-                        pr_err("incorrect dstring lengths (%d/%d)\n",
-                               s_len, i_len);
-                        return -EINVAL;
+                        pr_warn("incorrect dstring lengths (%d/%d),"
+                                " truncating\n", s_len, i_len);
+                        s_len = i_len - 1;
+                        /* 2-byte encoding? Need to round properly... */
+                        if (ocu_i[0] == 16)
+                                s_len -= (s_len - 1) & 2;
                 }
         }
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 356d2b8568c1..cd58939dc977 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1361,6 +1361,19 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
                 ret = -EINVAL;
                 if (!vma_can_userfault(cur))
                         goto out_unlock;
+
+                /*
+                 * UFFDIO_COPY will fill file holes even without
+                 * PROT_WRITE. This check enforces that if this is a
+                 * MAP_SHARED, the process has write permission to the backing
+                 * file. If VM_MAYWRITE is set it also enforces that on a
+                 * MAP_SHARED vma: there is no F_WRITE_SEAL and no further
+                 * F_WRITE_SEAL can be taken until the vma is destroyed.
+                 */
+                ret = -EPERM;
+                if (unlikely(!(cur->vm_flags & VM_MAYWRITE)))
+                        goto out_unlock;
+
                 /*
                  * If this vma contains ending address, and huge pages
                  * check alignment.
@@ -1406,6 +1419,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
                 BUG_ON(!vma_can_userfault(vma));
                 BUG_ON(vma->vm_userfaultfd_ctx.ctx &&
                        vma->vm_userfaultfd_ctx.ctx != ctx);
+                WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
 
                 /*
                  * Nothing to do: this vma is already registered into this
@@ -1552,6 +1566,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
                 cond_resched();
 
                 BUG_ON(!vma_can_userfault(vma));
+                WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
 
                 /*
                  * Nothing to do: this vma is already registered into this
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 6fc5425b1474..2652d00842d6 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -243,7 +243,7 @@ xfs_attr3_leaf_verify(
         struct xfs_mount                *mp = bp->b_target->bt_mount;
         struct xfs_attr_leafblock       *leaf = bp->b_addr;
         struct xfs_attr_leaf_entry      *entries;
-        uint16_t                        end;
+        uint32_t                        end;    /* must be 32bit - see below */
         int                             i;
 
         xfs_attr3_leaf_hdr_from_disk(mp->m_attr_geo, &ichdr, leaf);
@@ -293,6 +293,11 @@ xfs_attr3_leaf_verify(
         /*
          * Quickly check the freemap information.  Attribute data has to be
          * aligned to 4-byte boundaries, and likewise for the free space.
+         *
+         * Note that for 64k block size filesystems, the freemap entries cannot
+         * overflow as they are only be16 fields. However, when checking end
+         * pointer of the freemap, we have to be careful to detect overflows and
+         * so use uint32_t for those checks.
          */
         for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
                 if (ichdr.freemap[i].base > mp->m_attr_geo->blksize)
@@ -303,7 +308,9 @@ xfs_attr3_leaf_verify(
                         return __this_address;
                 if (ichdr.freemap[i].size & 0x3)
                         return __this_address;
-                end = ichdr.freemap[i].base + ichdr.freemap[i].size;
+
+                /* be care of 16 bit overflows here */
+                end = (uint32_t)ichdr.freemap[i].base + ichdr.freemap[i].size;
                 if (end < ichdr.freemap[i].base)
                         return __this_address;
                 if (end > mp->m_attr_geo->blksize)
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 74d7228e755b..19e921d1586f 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1694,10 +1694,13 @@ xfs_bmap_add_extent_delay_real(
         case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
                 /*
                  * Filling in all of a previously delayed allocation extent.
-                 * The right neighbor is contiguous, the left is not.
+                 * The right neighbor is contiguous, the left is not. Take care
+                 * with delay -> unwritten extent allocation here because the
+                 * delalloc record we are overwriting is always written.
                  */
                 PREV.br_startblock = new->br_startblock;
                 PREV.br_blockcount += RIGHT.br_blockcount;
+                PREV.br_state = new->br_state;
 
                 xfs_iext_next(ifp, &bma->icur);
                 xfs_iext_remove(bma->ip, &bma->icur, state);
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 86c50208a143..7fbf8af0b159 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -538,15 +538,18 @@ xfs_inobt_rec_check_count(
 
 static xfs_extlen_t
 xfs_inobt_max_size(
-        struct xfs_mount        *mp)
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          agno)
 {
+        xfs_agblock_t           agblocks = xfs_ag_block_count(mp, agno);
+
         /* Bail out if we're uninitialized, which can happen in mkfs. */
         if (mp->m_inobt_mxr[0] == 0)
                 return 0;
 
         return xfs_btree_calc_size(mp->m_inobt_mnr,
-                (uint64_t)mp->m_sb.sb_agblocks * mp->m_sb.sb_inopblock /
-                                XFS_INODES_PER_CHUNK);
+                                (uint64_t)agblocks * mp->m_sb.sb_inopblock /
+                                        XFS_INODES_PER_CHUNK);
 }
 
 static int
@@ -594,7 +597,7 @@ xfs_finobt_calc_reserves(
         if (error)
                 return error;
 
-        *ask += xfs_inobt_max_size(mp);
+        *ask += xfs_inobt_max_size(mp, agno);
         *used += tree_len;
         return 0;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 5d263dfdb3bc..404e581f1ea1 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1042,7 +1042,7 @@ out_trans_cancel:
         goto out_unlock;
 }
 
-static int
+int
 xfs_flush_unmap_range(
         struct xfs_inode        *ip,
         xfs_off_t               offset,
@@ -1195,13 +1195,7 @@ xfs_prepare_shift(
          * Writeback and invalidate cache for the remainder of the file as we're
          * about to shift down every extent from offset to EOF.
          */
-        error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
-        if (error)
-                return error;
-        error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
-                                        offset >> PAGE_SHIFT, -1);
-        if (error)
-                return error;
+        error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
 
         /*
          * Clean out anything hanging around in the cow fork now that
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 87363d136bb6..7a78229cf1a7 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -80,4 +80,7 @@ int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
                           int whichfork, xfs_extnum_t *nextents,
                           xfs_filblks_t *count);
 
+int     xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
+                              xfs_off_t len);
+
 #endif  /* __XFS_BMAP_UTIL_H__ */
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 12d8455bfbb2..010db5f8fb00 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1233,9 +1233,23 @@ xfs_buf_iodone(
 }
 
 /*
- * Requeue a failed buffer for writeback
+ * Requeue a failed buffer for writeback.
  *
- * Return true if the buffer has been re-queued properly, false otherwise
+ * We clear the log item failed state here as well, but we have to be careful
+ * about reference counts because the only active reference counts on the buffer
+ * may be the failed log items. Hence if we clear the log item failed state
+ * before queuing the buffer for IO we can release all active references to
+ * the buffer and free it, leading to use after free problems in
+ * xfs_buf_delwri_queue. It makes no difference to the buffer or log items which
+ * order we process them in - the buffer is locked, and we own the buffer list
+ * so nothing on them is going to change while we are performing this action.
+ *
+ * Hence we can safely queue the buffer for IO before we clear the failed log
+ * item state, therefore  always having an active reference to the buffer and
+ * avoiding the transient zero-reference state that leads to use-after-free.
+ *
+ * Return true if the buffer was added to the buffer list, false if it was
+ * already on the buffer list.
  */
 bool
 xfs_buf_resubmit_failed_buffers(
@@ -1243,16 +1257,16 @@ xfs_buf_resubmit_failed_buffers(
         struct list_head        *buffer_list)
 {
         struct xfs_log_item     *lip;
+        bool                    ret;
+
+        ret = xfs_buf_delwri_queue(bp, buffer_list);
 
         /*
-         * Clear XFS_LI_FAILED flag from all items before resubmit
-         *
-         * XFS_LI_FAILED set/clear is protected by ail_lock, caller  this
+         * XFS_LI_FAILED set/clear is protected by ail_lock, caller of this
          * function already have it acquired
          */
         list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
                 xfs_clear_li_failed(lip);
 
-        /* Add this buffer back to the delayed write list */
-        return xfs_buf_delwri_queue(bp, buffer_list);
+        return ret;
 }
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 53c9ab8fb777..e47425071e65 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -920,7 +920,7 @@ out_unlock:
 }
 
 
-loff_t
+STATIC loff_t
 xfs_file_remap_range(
         struct file             *file_in,
         loff_t                  pos_in,
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 6e2c08f30f60..6ecdbb3af7de 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1608,7 +1608,7 @@ xfs_ioc_getbmap(
         error = 0;
 out_free_buf:
         kmem_free(buf);
-        return 0;
+        return error;
 }
 
 struct getfsmap_info {
diff --git a/fs/xfs/xfs_message.c b/fs/xfs/xfs_message.c
index 576c375ce12a..6b736ea58d35 100644
--- a/fs/xfs/xfs_message.c
+++ b/fs/xfs/xfs_message.c
@@ -107,5 +107,5 @@ assfail(char *expr, char *file, int line)
 void
 xfs_hex_dump(void *p, int length)
 {
-        print_hex_dump(KERN_ALERT, "", DUMP_PREFIX_ADDRESS, 16, 1, p, length, 1);
+        print_hex_dump(KERN_ALERT, "", DUMP_PREFIX_OFFSET, 16, 1, p, length, 1);
 }
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index ecdb086bc23e..322a852ce284 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -296,6 +296,7 @@ xfs_reflink_reserve_cow(
         if (error)
                 return error;
 
+        xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
         trace_xfs_reflink_cow_alloc(ip, &got);
         return 0;
 }
@@ -1351,10 +1352,19 @@ xfs_reflink_remap_prep(
         if (ret)
                 goto out_unlock;
 
-        /* Zap any page cache for the destination file's range. */
-        truncate_inode_pages_range(&inode_out->i_data,
-                        round_down(pos_out, PAGE_SIZE),
-                        round_up(pos_out + *len, PAGE_SIZE) - 1);
+        /*
+         * If pos_out > EOF, we may have dirtied blocks between EOF and
+         * pos_out. In that case, we need to extend the flush and unmap to cover
+         * from EOF to the end of the copy length.
+         */
+        if (pos_out > XFS_ISIZE(dest)) {
+                loff_t  flen = *len + (pos_out - XFS_ISIZE(dest));
+                ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
+        } else {
+                ret = xfs_flush_unmap_range(dest, pos_out, *len);
+        }
+        if (ret)
+                goto out_unlock;
 
         return 1;
 out_unlock:
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 3043e5ed6495..8a6532aae779 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -280,7 +280,10 @@ DECLARE_EVENT_CLASS(xfs_buf_class,
         ),
         TP_fast_assign(
                 __entry->dev = bp->b_target->bt_dev;
-                __entry->bno = bp->b_bn;
+                if (bp->b_bn == XFS_BUF_DADDR_NULL)
+                        __entry->bno = bp->b_maps[0].bm_bn;
+                else
+                        __entry->bno = bp->b_bn;
                 __entry->nblks = bp->b_length;
                 __entry->hold = atomic_read(&bp->b_hold);
                 __entry->pincount = atomic_read(&bp->b_pin_count);
diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
index 89f3b03b1445..e3667c9a33a5 100644
--- a/include/asm-generic/4level-fixup.h
+++ b/include/asm-generic/4level-fixup.h
@@ -3,7 +3,7 @@
 #define _4LEVEL_FIXUP_H
 
 #define __ARCH_HAS_4LEVEL_HACK
-#define __PAGETABLE_PUD_FOLDED
+#define __PAGETABLE_PUD_FOLDED 1
 
 #define PUD_SHIFT                       PGDIR_SHIFT
 #define PUD_SIZE                        PGDIR_SIZE
diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
index 9c2e0708eb82..73474bb52344 100644
--- a/include/asm-generic/5level-fixup.h
+++ b/include/asm-generic/5level-fixup.h
@@ -3,7 +3,7 @@
 #define _5LEVEL_FIXUP_H
 
 #define __ARCH_HAS_5LEVEL_HACK
-#define __PAGETABLE_P4D_FOLDED
+#define __PAGETABLE_P4D_FOLDED 1
 
 #define P4D_SHIFT                       PGDIR_SHIFT
 #define P4D_SIZE                        PGDIR_SIZE
diff --git a/include/asm-generic/pgtable-nop4d-hack.h b/include/asm-generic/pgtable-nop4d-hack.h
index 0c34215263b8..1d6dd38c0e5e 100644
--- a/include/asm-generic/pgtable-nop4d-hack.h
+++ b/include/asm-generic/pgtable-nop4d-hack.h
@@ -5,7 +5,7 @@
 #ifndef __ASSEMBLY__
 #include <asm-generic/5level-fixup.h>
 
-#define __PAGETABLE_PUD_FOLDED
+#define __PAGETABLE_PUD_FOLDED 1
 
 /*
  * Having the pud type consist of a pgd gets the size right, and allows
diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h
index 1a29b2a0282b..04cb913797bc 100644
--- a/include/asm-generic/pgtable-nop4d.h
+++ b/include/asm-generic/pgtable-nop4d.h
@@ -4,7 +4,7 @@
 
 #ifndef __ASSEMBLY__
 
-#define __PAGETABLE_P4D_FOLDED
+#define __PAGETABLE_P4D_FOLDED 1
 
 typedef struct { pgd_t pgd; } p4d_t;
 
diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
index f35f6e8149e4..b85b8271a73d 100644
--- a/include/asm-generic/pgtable-nopmd.h
+++ b/include/asm-generic/pgtable-nopmd.h
@@ -8,7 +8,7 @@
 
 struct mm_struct;
 
-#define __PAGETABLE_PMD_FOLDED
+#define __PAGETABLE_PMD_FOLDED 1
 
 /*
  * Having the pmd type consist of a pud gets the size right, and allows
diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
index e950b9c50f34..9bef475db6fe 100644
--- a/include/asm-generic/pgtable-nopud.h
+++ b/include/asm-generic/pgtable-nopud.h
@@ -9,7 +9,7 @@
 #else
 #include <asm-generic/pgtable-nop4d.h>
 
-#define __PAGETABLE_PUD_FOLDED
+#define __PAGETABLE_PUD_FOLDED 1
 
 /*
  * Having the pud type consist of a p4d gets the size right, and allows
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 5657a20e0c59..359fb935ded6 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -1127,4 +1127,20 @@ static inline bool arch_has_pfn_modify_check(void)
 #endif
 #endif
 
+/*
+ * On some architectures it depends on the mm if the p4d/pud or pmd
+ * layer of the page table hierarchy is folded or not.
+ */
+#ifndef mm_p4d_folded
+#define mm_p4d_folded(mm)       __is_defined(__PAGETABLE_P4D_FOLDED)
+#endif
+
+#ifndef mm_pud_folded
+#define mm_pud_folded(mm)       __is_defined(__PAGETABLE_PUD_FOLDED)
+#endif
+
+#ifndef mm_pmd_folded
+#define mm_pmd_folded(mm)       __is_defined(__PAGETABLE_PMD_FOLDED)
+#endif
+
 #endif /* _ASM_GENERIC_PGTABLE_H */
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index a83e1f632eb7..f01623aef2f7 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -169,6 +169,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
 
 void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
                       unsigned int idx);
+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr);
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
 void can_free_echo_skb(struct net_device *dev, unsigned int idx);
 
diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h
index cb31683bbe15..8268811a697e 100644
--- a/include/linux/can/rx-offload.h
+++ b/include/linux/can/rx-offload.h
@@ -41,7 +41,12 @@ int can_rx_offload_add_timestamp(struct net_device *dev, struct can_rx_offload *
 int can_rx_offload_add_fifo(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight);
 int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 reg);
 int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload);
-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb);
+int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+                                struct sk_buff *skb, u32 timestamp);
+unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
+                                         unsigned int idx, u32 timestamp);
+int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+                              struct sk_buff *skb);
 void can_rx_offload_reset(struct can_rx_offload *offload);
 void can_rx_offload_del(struct can_rx_offload *offload);
 void can_rx_offload_enable(struct can_rx_offload *offload);
diff --git a/include/linux/ceph/ceph_features.h b/include/linux/ceph/ceph_features.h
index 6b92b3395fa9..65a38c4a02a1 100644
--- a/include/linux/ceph/ceph_features.h
+++ b/include/linux/ceph/ceph_features.h
@@ -213,12 +213,6 @@ DEFINE_CEPH_FEATURE_DEPRECATED(63, 1, RESERVED_BROKEN, LUMINOUS) // client-facin
          CEPH_FEATURE_NEW_OSDOPREPLY_ENCODING | \
          CEPH_FEATURE_CEPHX_V2)
 
-#define CEPH_FEATURES_REQUIRED_DEFAULT   \
-        (CEPH_FEATURE_NOSRCADDR |        \
-         CEPH_FEATURE_SUBSCRIBE2 |       \
-         CEPH_FEATURE_RECONNECT_SEQ |    \
-         CEPH_FEATURE_PGID64 |           \
-         CEPH_FEATURE_PGPOOL3 |          \
-         CEPH_FEATURE_OSDENC)
+#define CEPH_FEATURES_REQUIRED_DEFAULT  0
 
 #endif
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index c0f5db3a9621..2010493e1040 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -143,18 +143,6 @@
 #define KASAN_ABI_VERSION 3
 #endif
 
-/*
- * Because __no_sanitize_address conflicts with inlining:
- *   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368
- * we do one or the other. 
- */
-#ifdef CONFIG_KASAN
-#define __no_sanitize_address_or_inline                                 \
-        __no_sanitize_address __maybe_unused notrace
-#else
-#define __no_sanitize_address_or_inline inline
-#endif
-
 #if GCC_VERSION >= 50100
 #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
 #endif
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 18c80cfa4fc4..06396c1cf127 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -189,7 +189,7 @@ void __read_once_size(const volatile void *p, void *res, int size)
  *      https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368
  * '__maybe_unused' allows us to avoid defined-but-not-used warnings.
  */
-# define __no_kasan_or_inline __no_sanitize_address __maybe_unused
+# define __no_kasan_or_inline __no_sanitize_address notrace __maybe_unused
 #else
 # define __no_kasan_or_inline __always_inline
 #endif
diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h
index 6b28c1b7310c..f8c400ba1929 100644
--- a/include/linux/compiler_attributes.h
+++ b/include/linux/compiler_attributes.h
@@ -4,22 +4,26 @@
 
 /*
  * The attributes in this file are unconditionally defined and they directly
- * map to compiler attribute(s) -- except those that are optional.
+ * map to compiler attribute(s), unless one of the compilers does not support
+ * the attribute. In that case, __has_attribute is used to check for support
+ * and the reason is stated in its comment ("Optional: ...").
  *
  * Any other "attributes" (i.e. those that depend on a configuration option,
  * on a compiler, on an architecture, on plugins, on other attributes...)
  * should be defined elsewhere (e.g. compiler_types.h or compiler-*.h).
+ * The intention is to keep this file as simple as possible, as well as
+ * compiler- and version-agnostic (e.g. avoiding GCC_VERSION checks).
  *
  * This file is meant to be sorted (by actual attribute name,
  * not by #define identifier). Use the __attribute__((__name__)) syntax
  * (i.e. with underscores) to avoid future collisions with other macros.
- * If an attribute is optional, state the reason in the comment.
+ * Provide links to the documentation of each supported compiler, if it exists.
  */
 
 /*
- * To check for optional attributes, we use __has_attribute, which is supported
- * on gcc >= 5, clang >= 2.9 and icc >= 17. In the meantime, to support
- * 4.6 <= gcc < 5, we implement __has_attribute by hand.
+ * __has_attribute is supported on gcc >= 5, clang >= 2.9 and icc >= 17.
+ * In the meantime, to support 4.6 <= gcc < 5, we implement __has_attribute
+ * by hand.
  *
  * sparse does not support __has_attribute (yet) and defines __GNUC_MINOR__
  * depending on the compiler used to build it; however, these attributes have
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 3439d7d0249a..4a3f9c09c92d 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -130,6 +130,10 @@ struct ftrace_likely_data {
 # define randomized_struct_fields_end
 #endif
 
+#ifndef asm_volatile_goto
+#define asm_volatile_goto(x...) asm goto(x)
+#endif
+
 /* Are two types/vars the same type (ignoring qualifiers)? */
 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
 
diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h
index bd73e7a91410..9e66bfe369aa 100644
--- a/include/linux/dma-direct.h
+++ b/include/linux/dma-direct.h
@@ -5,7 +5,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mem_encrypt.h>
 
-#define DIRECT_MAPPING_ERROR            0
+#define DIRECT_MAPPING_ERROR            (~(dma_addr_t)0)
 
 #ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA
 #include <asm/dma-direct.h>
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 845174e113ce..100ce4a4aff6 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1167,6 +1167,8 @@ static inline bool efi_enabled(int feature)
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
 
 extern bool efi_is_table_address(unsigned long phys_addr);
+
+extern int efi_apply_persistent_mem_reservations(void);
 #else
 static inline bool efi_enabled(int feature)
 {
@@ -1185,6 +1187,11 @@ static inline bool efi_is_table_address(unsigned long phys_addr)
 {
         return false;
 }
+
+static inline int efi_apply_persistent_mem_reservations(void)
+{
+        return 0;
+}
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
diff --git a/include/linux/filter.h b/include/linux/filter.h
index de629b706d1d..448dcc448f1f 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -866,6 +866,10 @@ void bpf_jit_binary_free(struct bpf_binary_header *hdr);
 
 void bpf_jit_free(struct bpf_prog *fp);
 
+int bpf_jit_get_func_addr(const struct bpf_prog *prog,
+                          const struct bpf_insn *insn, bool extra_pass,
+                          u64 *func_addr, bool *func_addr_fixed);
+
 struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *fp);
 void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
 
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 34cf0fdd7dc7..610815e3f1aa 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -196,8 +196,7 @@ static inline void fscache_enqueue_retrieval(struct fscache_retrieval *op)
 static inline void fscache_retrieval_complete(struct fscache_retrieval *op,
                                               int n_pages)
 {
-        atomic_sub(n_pages, &op->n_pages);
-        if (atomic_read(&op->n_pages) <= 0)
+        if (atomic_sub_return_relaxed(n_pages, &op->n_pages) <= 0)
                 fscache_op_complete(&op->op, false);
 }
 
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index a397907e8d72..dd16e8218db3 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -777,8 +777,8 @@ struct ftrace_ret_stack {
 extern void return_to_handler(void);
 
 extern int
-ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
-                         unsigned long frame_pointer, unsigned long *retp);
+function_graph_enter(unsigned long ret, unsigned long func,
+                     unsigned long frame_pointer, unsigned long *retp);
 
 unsigned long ftrace_graph_ret_addr(struct task_struct *task, int *idx,
                                     unsigned long ret, unsigned long *retp);
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index 331dc377c275..dc12f5c4b076 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -177,6 +177,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
 * @attr_usage_id:       Attribute usage id as per spec
 * @report_id:   Report id to look for
 * @flag:      Synchronous or asynchronous read
+* @is_signed:   If true then fields < 32 bits will be sign-extended
 *
 * Issues a synchronous or asynchronous read request for an input attribute.
 * Returns data upto 32 bits.
@@ -190,7 +191,8 @@ enum sensor_hub_read_flags {
 int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                                         u32 usage_id,
                                         u32 attr_usage_id, u32 report_id,
-                                        enum sensor_hub_read_flags flag
+                                        enum sensor_hub_read_flags flag,
+                                        bool is_signed
 );
 
 /**
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 2827b87590d8..a355d61940f2 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -722,8 +722,8 @@ struct hid_usage_id {
  * input will not be passed to raw_event unless hid_device_io_start is
  * called.
  *
- * raw_event and event should return 0 on no action performed, 1 when no
- * further processing should be done and negative on error
+ * raw_event and event should return negative on error, any other value will
+ * pass the event on to .event() typically return 0 for success.
  *
  * input_mapping shall return a negative value to completely ignore this usage
  * (e.g. doubled or invalid usage), zero to continue with parsing of this
@@ -1139,34 +1139,6 @@ static inline u32 hid_report_len(struct hid_report *report)
 int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
                 int interrupt);
 
-
-/**
- * struct hid_scroll_counter - Utility class for processing high-resolution
- *                             scroll events.
- * @dev: the input device for which events should be reported.
- * @microns_per_hi_res_unit: the amount moved by the user's finger for each
- *                           high-resolution unit reported by the mouse, in
- *                           microns.
- * @resolution_multiplier: the wheel's resolution in high-resolution mode as a
- *                         multiple of its lower resolution. For example, if
- *                         moving the wheel by one "notch" would result in a
- *                         value of 1 in low-resolution mode but 8 in
- *                         high-resolution, the multiplier is 8.
- * @remainder: counts the number of high-resolution units moved since the last
- *             low-resolution event (REL_WHEEL or REL_HWHEEL) was sent. Should
- *             only be used by class methods.
- */
-struct hid_scroll_counter {
-        struct input_dev *dev;
-        int microns_per_hi_res_unit;
-        int resolution_multiplier;
-
-        int remainder;
-};
-
-void hid_scroll_counter_handle_scroll(struct hid_scroll_counter *counter,
-                                      int hi_res_value);
-
 /* HID quirks API */
 unsigned long hid_lookup_quirk(const struct hid_device *hdev);
 int hid_quirks_init(char **quirks_param, __u16 bus, int count);
diff --git a/include/linux/i8253.h b/include/linux/i8253.h
index e6bb36a97519..8336b2f6f834 100644
--- a/include/linux/i8253.h
+++ b/include/linux/i8253.h
@@ -21,6 +21,7 @@
 #define PIT_LATCH       ((PIT_TICK_RATE + HZ/2) / HZ)
 
 extern raw_spinlock_t i8253_lock;
+extern bool i8253_clear_counter_on_shutdown;
 extern struct clock_event_device i8253_clockevent;
 extern void clockevent_i8253_init(bool oneshot);
 
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index bac395f1d00a..5228c62af416 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -139,8 +139,6 @@ struct mempolicy *mpol_shared_policy_lookup(struct shared_policy *sp,
 struct mempolicy *get_task_policy(struct task_struct *p);
 struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
                 unsigned long addr);
-struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
-                                                unsigned long addr);
 bool vma_policy_mof(struct vm_area_struct *vma);
 
 extern void numa_default_policy(void);
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index dbff9ff28f2c..34e17e6f8942 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -2473,14 +2473,15 @@ struct mlx5_ifc_xrc_srqc_bits {
 
         u8         wq_signature[0x1];
         u8         cont_srq[0x1];
-        u8         dbr_umem_valid[0x1];
+        u8         reserved_at_22[0x1];
         u8         rlky[0x1];
         u8         basic_cyclic_rcv_wqe[0x1];
         u8         log_rq_stride[0x3];
         u8         xrcd[0x18];
 
         u8         page_offset[0x6];
-        u8         reserved_at_46[0x2];
+        u8         reserved_at_46[0x1];
+        u8         dbr_umem_valid[0x1];
         u8         cqn[0x18];
 
         u8         reserved_at_60[0x20];
@@ -6689,9 +6690,12 @@ struct mlx5_ifc_create_xrc_srq_in_bits {
 
         struct mlx5_ifc_xrc_srqc_bits xrc_srq_context_entry;
 
-        u8         reserved_at_280[0x40];
+        u8         reserved_at_280[0x60];
+
         u8         xrc_srq_umem_valid[0x1];
-        u8         reserved_at_2c1[0x5bf];
+        u8         reserved_at_2e1[0x1f];
+
+        u8         reserved_at_300[0x580];
 
         u8         pas[0][0x40];
 };
diff --git a/include/linux/mm.h b/include/linux/mm.h
index fcf9cc9d535f..5411de93a363 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1744,11 +1744,15 @@ int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address);
 
 static inline void mm_inc_nr_puds(struct mm_struct *mm)
 {
+        if (mm_pud_folded(mm))
+                return;
         atomic_long_add(PTRS_PER_PUD * sizeof(pud_t), &mm->pgtables_bytes);
 }
 
 static inline void mm_dec_nr_puds(struct mm_struct *mm)
 {
+        if (mm_pud_folded(mm))
+                return;
         atomic_long_sub(PTRS_PER_PUD * sizeof(pud_t), &mm->pgtables_bytes);
 }
 #endif
@@ -1768,11 +1772,15 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
 
 static inline void mm_inc_nr_pmds(struct mm_struct *mm)
 {
+        if (mm_pmd_folded(mm))
+                return;
         atomic_long_add(PTRS_PER_PMD * sizeof(pmd_t), &mm->pgtables_bytes);
 }
 
 static inline void mm_dec_nr_pmds(struct mm_struct *mm)
 {
+        if (mm_pmd_folded(mm))
+                return;
         atomic_long_sub(PTRS_PER_PMD * sizeof(pmd_t), &mm->pgtables_bytes);
 }
 #endif
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index abe975c87b90..7f53ece2c039 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -324,9 +324,8 @@ static inline unsigned int nanddev_ntargets(const struct nand_device *nand)
  */
 static inline unsigned int nanddev_neraseblocks(const struct nand_device *nand)
 {
-        return (u64)nand->memorg.luns_per_target *
-               nand->memorg.eraseblocks_per_lun *
-               nand->memorg.pages_per_eraseblock;
+        return nand->memorg.ntargets * nand->memorg.luns_per_target *
+               nand->memorg.eraseblocks_per_lun;
 }
 
 /**
@@ -569,7 +568,7 @@ static inline void nanddev_pos_next_eraseblock(struct nand_device *nand,
 }
 
 /**
- * nanddev_pos_next_eraseblock() - Move a position to the next page
+ * nanddev_pos_next_page() - Move a position to the next page
  * @nand: NAND device
  * @pos: the position to update
  *
diff --git a/include/linux/net_dim.h b/include/linux/net_dim.h
index c79e859408e6..fd458389f7d1 100644
--- a/include/linux/net_dim.h
+++ b/include/linux/net_dim.h
@@ -406,6 +406,8 @@ static inline void net_dim(struct net_dim *dim,
                 }
                 /* fall through */
         case NET_DIM_START_MEASURE:
+                net_dim_sample(end_sample.event_ctr, end_sample.pkt_ctr, end_sample.byte_ctr,
+                               &dim->start_sample);
                 dim->state = NET_DIM_MEASURE_IN_PROGRESS;
                 break;
         case NET_DIM_APPLY_NEW_PROFILE:
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index dc1d9ed33b31..857f8abf7b91 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3190,6 +3190,26 @@ static inline void netdev_tx_sent_queue(struct netdev_queue *dev_queue,
 #endif
 }
 
+/* Variant of netdev_tx_sent_queue() for drivers that are aware
+ * that they should not test BQL status themselves.
+ * We do want to change __QUEUE_STATE_STACK_XOFF only for the last
+ * skb of a batch.
+ * Returns true if the doorbell must be used to kick the NIC.
+ */
+static inline bool __netdev_tx_sent_queue(struct netdev_queue *dev_queue,
+                                          unsigned int bytes,
+                                          bool xmit_more)
+{
+        if (xmit_more) {
+#ifdef CONFIG_BQL
+                dql_queued(&dev_queue->dql, bytes);
+#endif
+                return netif_tx_queue_stopped(dev_queue);
+        }
+        netdev_tx_sent_queue(dev_queue, bytes);
+        return true;
+}
+
 /**
  *      netdev_sent_queue - report the number of bytes queued to hardware
  *      @dev: network device
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 34fc80f3eb90..1d100efe74ec 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -314,7 +314,7 @@ enum {
 extern ip_set_id_t ip_set_get_byname(struct net *net,
                                      const char *name, struct ip_set **set);
 extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
-extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index);
+extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
 extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
 extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
 
diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h
index 8e2bab1e8e90..70877f8de7e9 100644
--- a/include/linux/netfilter/ipset/ip_set_comment.h
+++ b/include/linux/netfilter/ipset/ip_set_comment.h
@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
         rcu_assign_pointer(comment->c, c);
 }
 
-/* Used only when dumping a set, protected by rcu_read_lock_bh() */
+/* Used only when dumping a set, protected by rcu_read_lock() */
 static inline int
 ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
 {
-        struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c);
+        struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
 
         if (!c)
                 return 0;
diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h
index b8d95564bd53..14edb795ab43 100644
--- a/include/linux/netfilter/nf_conntrack_proto_gre.h
+++ b/include/linux/netfilter/nf_conntrack_proto_gre.h
@@ -21,6 +21,19 @@ struct nf_ct_gre_keymap {
         struct nf_conntrack_tuple tuple;
 };
 
+enum grep_conntrack {
+        GRE_CT_UNREPLIED,
+        GRE_CT_REPLIED,
+        GRE_CT_MAX
+};
+
+struct netns_proto_gre {
+        struct nf_proto_net     nf;
+        rwlock_t                keymap_lock;
+        struct list_head        keymap_list;
+        unsigned int            gre_timeouts[GRE_CT_MAX];
+};
+
 /* add new tuple->key_reply pair to keymap */
 int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
                          struct nf_conntrack_tuple *t);
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 08f9247e9827..9003e29cde46 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -119,6 +119,8 @@ static inline int hardlockup_detector_perf_init(void) { return 0; }
 void watchdog_nmi_stop(void);
 void watchdog_nmi_start(void);
 int watchdog_nmi_probe(void);
+int watchdog_nmi_enable(unsigned int cpu);
+void watchdog_nmi_disable(unsigned int cpu);
 
 /**
  * touch_nmi_watchdog - restart NMI watchdog timeout.
diff --git a/include/linux/platform_data/gpio-davinci.h b/include/linux/platform_data/gpio-davinci.h
index f92a47e18034..a93841bfb9f7 100644
--- a/include/linux/platform_data/gpio-davinci.h
+++ b/include/linux/platform_data/gpio-davinci.h
@@ -17,6 +17,8 @@
 #define __DAVINCI_GPIO_PLATFORM_H
 
 struct davinci_gpio_platform_data {
+        bool    no_auto_base;
+        u32     base;
         u32     ngpio;
         u32     gpio_unbanked;
 };
diff --git a/include/linux/psi.h b/include/linux/psi.h
index 8e0725aac0aa..7006008d5b72 100644
--- a/include/linux/psi.h
+++ b/include/linux/psi.h
@@ -1,6 +1,7 @@
 #ifndef _LINUX_PSI_H
 #define _LINUX_PSI_H
 
+#include <linux/jump_label.h>
 #include <linux/psi_types.h>
 #include <linux/sched.h>
 
@@ -9,7 +10,7 @@ struct css_set;
 
 #ifdef CONFIG_PSI
 
-extern bool psi_disabled;
+extern struct static_key_false psi_disabled;
 
 void psi_init(void);
 
diff --git a/include/linux/pstore.h b/include/linux/pstore.h
index a15bc4d48752..30fcec375a3a 100644
--- a/include/linux/pstore.h
+++ b/include/linux/pstore.h
@@ -90,7 +90,10 @@ struct pstore_record {
  *
  * @buf_lock:   spinlock to serialize access to @buf
  * @buf:        preallocated crash dump buffer
- * @bufsize:    size of @buf available for crash dump writes
+ * @bufsize:    size of @buf available for crash dump bytes (must match
+ *              smallest number of bytes available for writing to a
+ *              backend entry, since compressed bytes don't take kindly
+ *              to being truncated)
  *
  * @read_mutex: serializes @open, @read, @close, and @erase callbacks
  * @flags:      bitfield of frontends the backend can accept writes for
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 6c2ffed907f5..de20ede2c5c8 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -64,15 +64,12 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
 #define PTRACE_MODE_NOAUDIT     0x04
 #define PTRACE_MODE_FSCREDS     0x08
 #define PTRACE_MODE_REALCREDS   0x10
-#define PTRACE_MODE_SCHED       0x20
-#define PTRACE_MODE_IBPB        0x40
 
 /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
 #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
 #define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS)
 #define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS)
 #define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS)
-#define PTRACE_MODE_SPEC_IBPB (PTRACE_MODE_ATTACH_REALCREDS | PTRACE_MODE_IBPB)
 
 /**
  * ptrace_may_access - check whether the caller is permitted to access
@@ -90,20 +87,6 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
  */
 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
 
-/**
- * ptrace_may_access - check whether the caller is permitted to access
- * a target task.
- * @task: target task
- * @mode: selects type of access and caller credentials
- *
- * Returns true on success, false on denial.
- *
- * Similar to ptrace_may_access(). Only to be called from context switch
- * code. Does not call into audit and the regular LSM hooks due to locking
- * constraints.
- */
-extern bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode);
-
 static inline int ptrace_reparented(struct task_struct *child)
 {
         return !same_thread_group(child->real_parent, child->parent);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a51c13c2b1a0..291a9bd5b97f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1116,6 +1116,7 @@ struct task_struct {
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         /* Index of current stored address in ret_stack: */
         int                             curr_ret_stack;
+        int                             curr_ret_depth;
 
         /* Stack of return addresses for return function tracing: */
         struct ftrace_ret_stack         *ret_stack;
@@ -1453,6 +1454,8 @@ static inline bool is_percpu_thread(void)
 #define PFA_SPREAD_SLAB                 2       /* Spread some slab caches over cpuset */
 #define PFA_SPEC_SSB_DISABLE            3       /* Speculative Store Bypass disabled */
 #define PFA_SPEC_SSB_FORCE_DISABLE      4       /* Speculative Store Bypass force disabled*/
+#define PFA_SPEC_IB_DISABLE             5       /* Indirect branch speculation restricted */
+#define PFA_SPEC_IB_FORCE_DISABLE       6       /* Indirect branch speculation permanently restricted */
 
 #define TASK_PFA_TEST(name, func)                                       \
         static inline bool task_##func(struct task_struct *p)           \
@@ -1484,6 +1487,13 @@ TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ssb_disable)
 TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
 TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
 
+TASK_PFA_TEST(SPEC_IB_DISABLE, spec_ib_disable)
+TASK_PFA_SET(SPEC_IB_DISABLE, spec_ib_disable)
+TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable)
+
+TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
+TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
+
 static inline void
 current_restore_flags(unsigned long orig_flags, unsigned long flags)
 {
diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h
new file mode 100644
index 000000000000..59d3736c454c
--- /dev/null
+++ b/include/linux/sched/smt.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_SCHED_SMT_H
+#define _LINUX_SCHED_SMT_H
+
+#include <linux/static_key.h>
+
+#ifdef CONFIG_SCHED_SMT
+extern struct static_key_false sched_smt_present;
+
+static __always_inline bool sched_smt_active(void)
+{
+        return static_branch_likely(&sched_smt_present);
+}
+#else
+static inline bool sched_smt_active(void) { return false; }
+#endif
+
+void arch_smt_update(void);
+
+#endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0ba687454267..0d1b2c3f127b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1326,6 +1326,22 @@ static inline void skb_zcopy_set(struct sk_buff *skb, struct ubuf_info *uarg)
         }
 }
 
+static inline void skb_zcopy_set_nouarg(struct sk_buff *skb, void *val)
+{
+        skb_shinfo(skb)->destructor_arg = (void *)((uintptr_t) val | 0x1UL);
+        skb_shinfo(skb)->tx_flags |= SKBTX_ZEROCOPY_FRAG;
+}
+
+static inline bool skb_zcopy_is_nouarg(struct sk_buff *skb)
+{
+        return (uintptr_t) skb_shinfo(skb)->destructor_arg & 0x1UL;
+}
+
+static inline void *skb_zcopy_get_nouarg(struct sk_buff *skb)
+{
+        return (void *)((uintptr_t) skb_shinfo(skb)->destructor_arg & ~0x1UL);
+}
+
 /* Release a reference on a zerocopy structure */
 static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
 {
@@ -1335,7 +1351,7 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
                 if (uarg->callback == sock_zerocopy_callback) {
                         uarg->zerocopy = uarg->zerocopy && zerocopy;
                         sock_zerocopy_put(uarg);
-                } else {
+                } else if (!skb_zcopy_is_nouarg(skb)) {
                         uarg->callback(uarg, zerocopy);
                 }
 
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 8ed77bb4ed86..a9b0280687d5 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -196,6 +196,7 @@ struct tcp_sock {
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
         u32     last_oow_ack_time;  /* timestamp of last out-of-window ACK */
+        u32     compressed_ack_rcv_nxt;
 
         u32     tsoffset;       /* timestamp offset */
 
diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
index 40b0b4c1bf7b..df20f8bdbfa3 100644
--- a/include/linux/tracehook.h
+++ b/include/linux/tracehook.h
@@ -83,8 +83,8 @@ static inline int ptrace_report_syscall(struct pt_regs *regs)
  * tracehook_report_syscall_entry - task is about to attempt a system call
  * @regs:               user register state of current task
  *
- * This will be called if %TIF_SYSCALL_TRACE has been set, when the
- * current task has just entered the kernel for a system call.
+ * This will be called if %TIF_SYSCALL_TRACE or %TIF_SYSCALL_EMU have been set,
+ * when the current task has just entered the kernel for a system call.
  * Full user register state is available here.  Changing the values
  * in @regs can affect the system call number and arguments to be tried.
  * It is safe to block here, preventing the system call from beginning.
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 538ba1a58f5b..e9de8ad0bad7 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -166,7 +166,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
                 struct tracepoint_func *it_func_ptr;                    \
                 void *it_func;                                          \
                 void *__data;                                           \
-                int __maybe_unused idx = 0;                             \
+                int __maybe_unused __idx = 0;                           \
                                                                         \
                 if (!(cond))                                            \
                         return;                                         \
@@ -182,7 +182,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
                  * doesn't work from the idle path.                     \
                  */                                                     \
                 if (rcuidle) {                                          \
-                        idx = srcu_read_lock_notrace(&tracepoint_srcu); \
+                        __idx = srcu_read_lock_notrace(&tracepoint_srcu);\
                         rcu_irq_enter_irqson();                         \
                 }                                                       \
                                                                         \
@@ -198,7 +198,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
                                                                         \
                 if (rcuidle) {                                          \
                         rcu_irq_exit_irqson();                          \
-                        srcu_read_unlock_notrace(&tracepoint_srcu, idx);\
+                        srcu_read_unlock_notrace(&tracepoint_srcu, __idx);\
                 }                                                       \
                                                                         \
                 preempt_enable_notrace();                               \
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index b7a99ce56bc9..a1be64c9940f 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -66,4 +66,7 @@
 /* Device needs a pause after every control message. */
 #define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
 
+/* Hub needs extra delay after resetting its port. */
+#define USB_QUIRK_HUB_SLOW_RESET                BIT(14)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index d9514928ddac..564892e19f8c 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -289,9 +289,7 @@ struct xarray {
 void xa_init_flags(struct xarray *, gfp_t flags);
 void *xa_load(struct xarray *, unsigned long index);
 void *xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
-void *xa_cmpxchg(struct xarray *, unsigned long index,
-                        void *old, void *entry, gfp_t);
-int xa_reserve(struct xarray *, unsigned long index, gfp_t);
+void *xa_erase(struct xarray *, unsigned long index);
 void *xa_store_range(struct xarray *, unsigned long first, unsigned long last,
                         void *entry, gfp_t);
 bool xa_get_mark(struct xarray *, unsigned long index, xa_mark_t);
@@ -344,65 +342,6 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 }
 
 /**
- * xa_erase() - Erase this entry from the XArray.
- * @xa: XArray.
- * @index: Index of entry.
- *
- * This function is the equivalent of calling xa_store() with %NULL as
- * the third argument.  The XArray does not need to allocate memory, so
- * the user does not need to provide GFP flags.
- *
- * Context: Process context.  Takes and releases the xa_lock.
- * Return: The entry which used to be at this index.
- */
-static inline void *xa_erase(struct xarray *xa, unsigned long index)
-{
-        return xa_store(xa, index, NULL, 0);
-}
-
-/**
- * xa_insert() - Store this entry in the XArray unless another entry is
- *                      already present.
- * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
- *
- * If you would rather see the existing entry in the array, use xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
- *
- * Context: Process context.  Takes and releases the xa_lock.
- *          May sleep if the @gfp flags permit.
- * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
- * -ENOMEM if memory could not be allocated.
- */
-static inline int xa_insert(struct xarray *xa, unsigned long index,
-                void *entry, gfp_t gfp)
-{
-        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
-}
-
-/**
- * xa_release() - Release a reserved entry.
- * @xa: XArray.
- * @index: Index of entry.
- *
- * After calling xa_reserve(), you can call this function to release the
- * reservation.  If the entry at @index has been stored to, this function
- * will do nothing.
- */
-static inline void xa_release(struct xarray *xa, unsigned long index)
-{
-        xa_cmpxchg(xa, index, NULL, NULL, 0);
-}
-
-/**
  * xa_for_each() - Iterate over a portion of an XArray.
  * @xa: XArray.
  * @entry: Entry retrieved from array.
@@ -455,6 +394,7 @@ void *__xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *__xa_cmpxchg(struct xarray *, unsigned long index, void *old,
                 void *entry, gfp_t);
 int __xa_alloc(struct xarray *, u32 *id, u32 max, void *entry, gfp_t);
+int __xa_reserve(struct xarray *, unsigned long index, gfp_t);
 void __xa_set_mark(struct xarray *, unsigned long index, xa_mark_t);
 void __xa_clear_mark(struct xarray *, unsigned long index, xa_mark_t);
 
@@ -487,6 +427,58 @@ static inline int __xa_insert(struct xarray *xa, unsigned long index,
 }
 
 /**
+ * xa_store_bh() - Store this entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_store() except it disables softirqs
+ * while holding the array lock.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.
+ * Return: The entry which used to be at this index.
+ */
+static inline void *xa_store_bh(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_bh(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock_bh(xa);
+
+        return curr;
+}
+
+/**
+ * xa_store_irq() - Erase this entry from the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_store() except it disables interrupts
+ * while holding the array lock.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.
+ * Return: The entry which used to be at this index.
+ */
+static inline void *xa_store_irq(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_irq(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock_irq(xa);
+
+        return curr;
+}
+
+/**
  * xa_erase_bh() - Erase this entry from the XArray.
  * @xa: XArray.
  * @index: Index of entry.
@@ -495,7 +487,7 @@ static inline int __xa_insert(struct xarray *xa, unsigned long index,
  * the third argument.  The XArray does not need to allocate memory, so
  * the user does not need to provide GFP flags.
  *
- * Context: Process context.  Takes and releases the xa_lock while
+ * Context: Any context.  Takes and releases the xa_lock while
  * disabling softirqs.
  * Return: The entry which used to be at this index.
  */
@@ -535,6 +527,61 @@ static inline void *xa_erase_irq(struct xarray *xa, unsigned long index)
 }
 
 /**
+ * xa_cmpxchg() - Conditionally replace an entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @old: Old value to test against.
+ * @entry: New value to place in array.
+ * @gfp: Memory allocation flags.
+ *
+ * If the entry at @index is the same as @old, replace it with @entry.
+ * If the return value is equal to @old, then the exchange was successful.
+ *
+ * Context: Any context.  Takes and releases the xa_lock.  May sleep
+ * if the @gfp flags permit.
+ * Return: The old value at this index or xa_err() if an error happened.
+ */
+static inline void *xa_cmpxchg(struct xarray *xa, unsigned long index,
+                        void *old, void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock(xa);
+        curr = __xa_cmpxchg(xa, index, old, entry, gfp);
+        xa_unlock(xa);
+
+        return curr;
+}
+
+/**
+ * xa_insert() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * If you would rather see the existing entry in the array, use xa_cmpxchg().
+ * This function is for users who don't care what the entry is, only that
+ * one is present.
+ *
+ * Context: Process context.  Takes and releases the xa_lock.
+ *          May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
+        if (!curr)
+                return 0;
+        if (xa_is_err(curr))
+                return xa_err(curr);
+        return -EEXIST;
+}
+
+/**
  * xa_alloc() - Find somewhere to store this entry in the XArray.
  * @xa: XArray.
  * @id: Pointer to ID.
@@ -575,7 +622,7 @@ static inline int xa_alloc(struct xarray *xa, u32 *id, u32 max, void *entry,
  * Updates the @id pointer with the index, then stores the entry at that
  * index.  A concurrent lookup will not see an uninitialised @id.
  *
- * Context: Process context.  Takes and releases the xa_lock while
+ * Context: Any context.  Takes and releases the xa_lock while
  * disabling softirqs.  May sleep if the @gfp flags permit.
  * Return: 0 on success, -ENOMEM if memory allocation fails or -ENOSPC if
  * there is no more space in the XArray.
@@ -621,6 +668,98 @@ static inline int xa_alloc_irq(struct xarray *xa, u32 *id, u32 max, void *entry,
         return err;
 }
 
+/**
+ * xa_reserve() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * Ensures there is somewhere to store an entry at @index in the array.
+ * If there is already something stored at @index, this function does
+ * nothing.  If there was nothing there, the entry is marked as reserved.
+ * Loading from a reserved entry returns a %NULL pointer.
+ *
+ * If you do not use the entry that you have reserved, call xa_release()
+ * or xa_erase() to free any unnecessary memory.
+ *
+ * Context: Any context.  Takes and releases the xa_lock.
+ * May sleep if the @gfp flags permit.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock(xa);
+
+        return ret;
+}
+
+/**
+ * xa_reserve_bh() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * A softirq-disabling version of xa_reserve().
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve_bh(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock_bh(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock_bh(xa);
+
+        return ret;
+}
+
+/**
+ * xa_reserve_irq() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * An interrupt-disabling version of xa_reserve().
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve_irq(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock_irq(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock_irq(xa);
+
+        return ret;
+}
+
+/**
+ * xa_release() - Release a reserved entry.
+ * @xa: XArray.
+ * @index: Index of entry.
+ *
+ * After calling xa_reserve(), you can call this function to release the
+ * reservation.  If the entry at @index has been stored to, this function
+ * will do nothing.
+ */
+static inline void xa_release(struct xarray *xa, unsigned long index)
+{
+        xa_cmpxchg(xa, index, NULL, NULL, 0);
+}
+
 /* Everything below here is the Advanced API.  Proceed with caution. */
 
 /*
diff --git a/include/media/media-request.h b/include/media/media-request.h
index 0ce75c35131f..bd36d7431698 100644
--- a/include/media/media-request.h
+++ b/include/media/media-request.h
@@ -68,7 +68,7 @@ struct media_request {
         unsigned int access_count;
         struct list_head objects;
         unsigned int num_incomplete_objects;
-        struct wait_queue_head poll_wait;
+        wait_queue_head_t poll_wait;
         spinlock_t lock;
 };
 
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index 58c1ecf3d648..5467264771ec 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -624,7 +624,7 @@ v4l2_m2m_dst_buf_remove_by_idx(struct v4l2_m2m_ctx *m2m_ctx, unsigned int idx)
 
 /* v4l2 request helper */
 
-void vb2_m2m_request_queue(struct media_request *req);
+void v4l2_m2m_request_queue(struct media_request *req);
 
 /* v4l2 ioctl helpers */
 
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 14b789a123e7..1656c5978498 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -317,6 +317,8 @@ bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
                          const struct in6_addr *addr);
 bool ipv6_chk_acast_addr_src(struct net *net, struct net_device *dev,
                              const struct in6_addr *addr);
+int ipv6_anycast_init(void);
+void ipv6_anycast_cleanup(void);
 
 /* Device notifier */
 int register_inet6addr_notifier(struct notifier_block *nb);
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index de587948042a..1adefe42c0a6 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -77,7 +77,8 @@ int rxrpc_kernel_retry_call(struct socket *, struct rxrpc_call *,
                             struct sockaddr_rxrpc *, struct key *);
 int rxrpc_kernel_check_call(struct socket *, struct rxrpc_call *,
                             enum rxrpc_call_completion *, u32 *);
-u32 rxrpc_kernel_check_life(struct socket *, struct rxrpc_call *);
+u32 rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
+void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
 u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
 bool rxrpc_kernel_get_reply_time(struct socket *, struct rxrpc_call *,
                                  ktime_t *);
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index d7578cf49c3a..c9c78c15bce0 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -146,10 +146,12 @@ struct ifacaddr6 {
         struct in6_addr         aca_addr;
         struct fib6_info        *aca_rt;
         struct ifacaddr6        *aca_next;
+        struct hlist_node       aca_addr_lst;
         int                     aca_users;
         refcount_t              aca_refcnt;
         unsigned long           aca_cstamp;
         unsigned long           aca_tstamp;
+        struct rcu_head         rcu;
 };
 
 #define IFA_HOST        IPV6_ADDR_LOOPBACK
diff --git a/include/net/netfilter/ipv4/nf_nat_masquerade.h b/include/net/netfilter/ipv4/nf_nat_masquerade.h
index cd24be4c4a99..13d55206bb9f 100644
--- a/include/net/netfilter/ipv4/nf_nat_masquerade.h
+++ b/include/net/netfilter/ipv4/nf_nat_masquerade.h
@@ -9,7 +9,7 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
                        const struct nf_nat_range2 *range,
                        const struct net_device *out);
 
-void nf_nat_masquerade_ipv4_register_notifier(void);
+int nf_nat_masquerade_ipv4_register_notifier(void);
 void nf_nat_masquerade_ipv4_unregister_notifier(void);
 
 #endif /*_NF_NAT_MASQUERADE_IPV4_H_ */
diff --git a/include/net/netfilter/ipv6/nf_nat_masquerade.h b/include/net/netfilter/ipv6/nf_nat_masquerade.h
index 0c3b5ebf0bb8..2917bf95c437 100644
--- a/include/net/netfilter/ipv6/nf_nat_masquerade.h
+++ b/include/net/netfilter/ipv6/nf_nat_masquerade.h
@@ -5,7 +5,7 @@
 unsigned int
 nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
                        const struct net_device *out);
-void nf_nat_masquerade_ipv6_register_notifier(void);
+int nf_nat_masquerade_ipv6_register_notifier(void);
 void nf_nat_masquerade_ipv6_unregister_notifier(void);
 
 #endif /* _NF_NAT_MASQUERADE_IPV6_H_ */
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index eed04af9b75e..ae7b86f587f2 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -153,4 +153,43 @@ void nf_ct_l4proto_log_invalid(const struct sk_buff *skb,
                                const char *fmt, ...) { }
 #endif /* CONFIG_SYSCTL */
 
+static inline struct nf_generic_net *nf_generic_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.generic;
+}
+
+static inline struct nf_tcp_net *nf_tcp_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.tcp;
+}
+
+static inline struct nf_udp_net *nf_udp_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.udp;
+}
+
+static inline struct nf_icmp_net *nf_icmp_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.icmp;
+}
+
+static inline struct nf_icmp_net *nf_icmpv6_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.icmpv6;
+}
+
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+static inline struct nf_dccp_net *nf_dccp_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.dccp;
+}
+#endif
+
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+static inline struct nf_sctp_net *nf_sctp_pernet(struct net *net)
+{
+       return &net->ct.nf_ct_proto.sctp;
+}
+#endif
+
 #endif /*_NF_CONNTRACK_PROTOCOL_H*/
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 8c2caa370e0f..ab9242e51d9e 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -608,4 +608,16 @@ static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
                                  SCTP_DEFAULT_MINSEGMENT));
 }
 
+static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+{
+        __u32 pmtu = sctp_dst_mtu(t->dst);
+
+        if (t->pathmtu == pmtu)
+                return true;
+
+        t->pathmtu = pmtu;
+
+        return false;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index f1dab1f4b194..70c10a8f3e90 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -1192,7 +1192,7 @@ struct snd_soc_pcm_runtime {
              ((i) < rtd->num_codecs) && ((dai) = rtd->codec_dais[i]); \
              (i)++)
 #define for_each_rtd_codec_dai_rollback(rtd, i, dai)            \
-        for (; ((i--) >= 0) && ((dai) = rtd->codec_dais[i]);)
+        for (; ((--i) >= 0) && ((dai) = rtd->codec_dais[i]);)
 
 
 /* mixer control */
diff --git a/include/trace/events/kyber.h b/include/trace/events/kyber.h
index a9834c37ac40..c0e7d24ca256 100644
--- a/include/trace/events/kyber.h
+++ b/include/trace/events/kyber.h
@@ -31,8 +31,8 @@ TRACE_EVENT(kyber_latency,
 
         TP_fast_assign(
                 __entry->dev            = disk_devt(dev_to_disk(kobj_to_dev(q->kobj.parent)));
-                strlcpy(__entry->domain, domain, DOMAIN_LEN);
-                strlcpy(__entry->type, type, DOMAIN_LEN);
+                strlcpy(__entry->domain, domain, sizeof(__entry->domain));
+                strlcpy(__entry->type, type, sizeof(__entry->type));
                 __entry->percentile     = percentile;
                 __entry->numerator      = numerator;
                 __entry->denominator    = denominator;
@@ -60,7 +60,7 @@ TRACE_EVENT(kyber_adjust,
 
         TP_fast_assign(
                 __entry->dev            = disk_devt(dev_to_disk(kobj_to_dev(q->kobj.parent)));
-                strlcpy(__entry->domain, domain, DOMAIN_LEN);
+                strlcpy(__entry->domain, domain, sizeof(__entry->domain));
                 __entry->depth          = depth;
         ),
 
@@ -82,7 +82,7 @@ TRACE_EVENT(kyber_throttled,
 
         TP_fast_assign(
                 __entry->dev            = disk_devt(dev_to_disk(kobj_to_dev(q->kobj.parent)));
-                strlcpy(__entry->domain, domain, DOMAIN_LEN);
+                strlcpy(__entry->domain, domain, sizeof(__entry->domain));
         ),
 
         TP_printk("%d,%d %s", MAJOR(__entry->dev), MINOR(__entry->dev),
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 573d5b901fb1..5b50fe4906d2 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -181,6 +181,7 @@ enum rxrpc_timer_trace {
 enum rxrpc_propose_ack_trace {
         rxrpc_propose_ack_client_tx_end,
         rxrpc_propose_ack_input_data,
+        rxrpc_propose_ack_ping_for_check_life,
         rxrpc_propose_ack_ping_for_keepalive,
         rxrpc_propose_ack_ping_for_lost_ack,
         rxrpc_propose_ack_ping_for_lost_reply,
@@ -380,6 +381,7 @@ enum rxrpc_tx_point {
 #define rxrpc_propose_ack_traces \
         EM(rxrpc_propose_ack_client_tx_end,     "ClTxEnd") \
         EM(rxrpc_propose_ack_input_data,        "DataIn ") \
+        EM(rxrpc_propose_ack_ping_for_check_life, "ChkLife") \
         EM(rxrpc_propose_ack_ping_for_keepalive, "KeepAlv") \
         EM(rxrpc_propose_ack_ping_for_lost_ack, "LostAck") \
         EM(rxrpc_propose_ack_ping_for_lost_reply, "LostRpl") \
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index f07b270d4fc4..9a4bdfadab07 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -107,6 +107,8 @@ DEFINE_EVENT(sched_wakeup_template, sched_wakeup_new,
 #ifdef CREATE_TRACE_POINTS
 static inline long __trace_sched_switch_state(bool preempt, struct task_struct *p)
 {
+        unsigned int state;
+
 #ifdef CONFIG_SCHED_DEBUG
         BUG_ON(p != current);
 #endif /* CONFIG_SCHED_DEBUG */
@@ -118,7 +120,15 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
         if (preempt)
                 return TASK_REPORT_MAX;
 
-        return 1 << task_state_index(p);
+        /*
+         * task_state_index() uses fls() and returns a value from 0-8 range.
+         * Decrement it by 1 (except TASK_RUNNING state i.e 0) before using
+         * it for left shift operation to get the correct task->state
+         * mapping.
+         */
+        state = task_state_index(p);
+
+        return state ? (1 << (state - 1)) : state;
 }
 #endif /* CREATE_TRACE_POINTS */
 
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 6d180cc60a5d..3eb5a4c3d60a 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -716,7 +716,6 @@
  * the situation described above.
  */
 #define REL_RESERVED            0x0a
-#define REL_WHEEL_HI_RES        0x0b
 #define REL_MAX                 0x0f
 #define REL_CNT                 (REL_MAX+1)
 
@@ -753,15 +752,6 @@
 
 #define ABS_MISC                0x28
 
-/*
- * 0x2e is reserved and should not be used in input drivers.
- * It was used by HID as ABS_MISC+6 and userspace needs to detect if
- * the next ABS_* event is correct or is just ABS_MISC + n.
- * We define here ABS_RESERVED so userspace can rely on it and detect
- * the situation described above.
- */
-#define ABS_RESERVED            0x2e
-
 #define ABS_MT_SLOT             0x2f    /* MT slot being modified */
 #define ABS_MT_TOUCH_MAJOR      0x30    /* Major axis of touching ellipse */
 #define ABS_MT_TOUCH_MINOR      0x31    /* Minor axis (omit if circular) */
diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
index f5ff8a76e208..b01eb502d49c 100644
--- a/include/uapi/linux/kfd_ioctl.h
+++ b/include/uapi/linux/kfd_ioctl.h
@@ -83,11 +83,11 @@ struct kfd_ioctl_set_cu_mask_args {
 };
 
 struct kfd_ioctl_get_queue_wave_state_args {
-        uint64_t ctl_stack_address;     /* to KFD */
-        uint32_t ctl_stack_used_size;   /* from KFD */
-        uint32_t save_area_used_size;   /* from KFD */
-        uint32_t queue_id;              /* to KFD */
-        uint32_t pad;
+        __u64 ctl_stack_address;        /* to KFD */
+        __u32 ctl_stack_used_size;      /* from KFD */
+        __u32 save_area_used_size;      /* from KFD */
+        __u32 queue_id;                 /* to KFD */
+        __u32 pad;
 };
 
 /* For kfd_ioctl_set_memory_policy_args.default_policy and alternate_policy */
@@ -255,10 +255,10 @@ struct kfd_hsa_memory_exception_data {
 
 /* hw exception data */
 struct kfd_hsa_hw_exception_data {
-        uint32_t reset_type;
-        uint32_t reset_cause;
-        uint32_t memory_lost;
-        uint32_t gpu_id;
+        __u32 reset_type;
+        __u32 reset_cause;
+        __u32 memory_lost;
+        __u32 gpu_id;
 };
 
 /* Event data */
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 579974b0bf0d..7de4f1bdaf06 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1635,8 +1635,8 @@ enum nft_ng_attributes {
         NFTA_NG_MODULUS,
         NFTA_NG_TYPE,
         NFTA_NG_OFFSET,
-        NFTA_NG_SET_NAME,
-        NFTA_NG_SET_ID,
+        NFTA_NG_SET_NAME,       /* deprecated */
+        NFTA_NG_SET_ID,         /* deprecated */
         __NFTA_NG_MAX
 };
 #define NFTA_NG_MAX     (__NFTA_NG_MAX - 1)
diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
index 156ccd089df1..1610fdbab98d 100644
--- a/include/uapi/linux/netfilter_bridge.h
+++ b/include/uapi/linux/netfilter_bridge.h
@@ -11,6 +11,10 @@
 #include <linux/if_vlan.h>
 #include <linux/if_pppox.h>
 
+#ifndef __KERNEL__
+#include <limits.h> /* for INT_MIN, INT_MAX */
+#endif
+
 /* Bridge Hooks */
 /* After promisc drops, checksum checks. */
 #define NF_BR_PRE_ROUTING       0
diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
index c0d7ea0bf5b6..b17201edfa09 100644
--- a/include/uapi/linux/prctl.h
+++ b/include/uapi/linux/prctl.h
@@ -212,6 +212,7 @@ struct prctl_mm_map {
 #define PR_SET_SPECULATION_CTRL         53
 /* Speculation control variants */
 # define PR_SPEC_STORE_BYPASS           0
+# define PR_SPEC_INDIRECT_BRANCH        1
 /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
 # define PR_SPEC_NOT_AFFECTED           0
 # define PR_SPEC_PRCTL                  (1UL << 0)
diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h
index 34dd3d497f2c..c81feb373d3e 100644
--- a/include/uapi/linux/sctp.h
+++ b/include/uapi/linux/sctp.h
@@ -568,6 +568,8 @@ struct sctp_assoc_reset_event {
 
 #define SCTP_ASSOC_CHANGE_DENIED        0x0004
 #define SCTP_ASSOC_CHANGE_FAILED        0x0008
+#define SCTP_STREAM_CHANGE_DENIED       SCTP_ASSOC_CHANGE_DENIED
+#define SCTP_STREAM_CHANGE_FAILED       SCTP_ASSOC_CHANGE_FAILED
 struct sctp_stream_change_event {
         __u16 strchange_type;
         __u16 strchange_flags;
@@ -1151,6 +1153,7 @@ struct sctp_add_streams {
 /* SCTP Stream schedulers */
 enum sctp_sched_type {
         SCTP_SS_FCFS,
+        SCTP_SS_DEFAULT = SCTP_SS_FCFS,
         SCTP_SS_PRIO,
         SCTP_SS_RR,
         SCTP_SS_MAX = SCTP_SS_RR
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 51b095898f4b..998983a6e6b7 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -50,6 +50,8 @@
 #ifndef __LINUX_V4L2_CONTROLS_H
 #define __LINUX_V4L2_CONTROLS_H
 
+#include <linux/types.h>
+
 /* Control classes */
 #define V4L2_CTRL_CLASS_USER            0x00980000      /* Old-style 'user' controls */
 #define V4L2_CTRL_CLASS_MPEG            0x00990000      /* MPEG-compression controls */
@@ -1110,6 +1112,7 @@ struct v4l2_mpeg2_sequence {
         __u8    profile_and_level_indication;
         __u8    progressive_sequence;
         __u8    chroma_format;
+        __u8    pad;
 };
 
 struct v4l2_mpeg2_picture {
@@ -1128,6 +1131,7 @@ struct v4l2_mpeg2_picture {
         __u8    alternate_scan;
         __u8    repeat_first_field;
         __u8    progressive_frame;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_slice_params {
@@ -1142,6 +1146,7 @@ struct v4l2_ctrl_mpeg2_slice_params {
 
         __u8    backward_ref_index;
         __u8    forward_ref_index;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_quantization {
diff --git a/include/xen/balloon.h b/include/xen/balloon.h
index 61f410fd74e4..4914b93a23f2 100644
--- a/include/xen/balloon.h
+++ b/include/xen/balloon.h
@@ -44,8 +44,3 @@ static inline void xen_balloon_init(void)
 {
 }
 #endif
-
-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
-struct resource;
-void arch_xen_balloon_init(struct resource *hostmem_resource);
-#endif
diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
index 18803ff76e27..4969817124a8 100644
--- a/include/xen/xen-ops.h
+++ b/include/xen/xen-ops.h
@@ -42,16 +42,12 @@ int xen_setup_shutdown_event(void);
 
 extern unsigned long *xen_contiguous_bitmap;
 
-#ifdef CONFIG_XEN_PV
+#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64)
 int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
                                 unsigned int address_bits,
                                 dma_addr_t *dma_handle);
 
 void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order);
-
-int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr,
-                  xen_pfn_t *pfn, int nr, int *err_ptr, pgprot_t prot,
-                  unsigned int domid, bool no_translate, struct page **pages);
 #else
 static inline int xen_create_contiguous_region(phys_addr_t pstart,
                                                unsigned int order,
@@ -63,7 +59,13 @@ static inline int xen_create_contiguous_region(phys_addr_t pstart,
 
 static inline void xen_destroy_contiguous_region(phys_addr_t pstart,
                                                  unsigned int order) { }
+#endif
 
+#if defined(CONFIG_XEN_PV)
+int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr,
+                  xen_pfn_t *pfn, int nr, int *err_ptr, pgprot_t prot,
+                  unsigned int domid, bool no_translate, struct page **pages);
+#else
 static inline int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr,
                                 xen_pfn_t *pfn, int nr, int *err_ptr,
                                 pgprot_t prot,  unsigned int domid,
diff --git a/init/Kconfig b/init/Kconfig
index a4112e95724a..cf5b5a0dcbc2 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -509,6 +509,15 @@ config PSI
 
           Say N if unsure.
 
+config PSI_DEFAULT_DISABLED
+        bool "Require boot parameter to enable pressure stall information tracking"
+        default n
+        depends on PSI
+        help
+          If set, pressure stall information tracking will be disabled
+          per default but can be enabled through passing psi_enable=1
+          on the kernel commandline during boot.
+
 endmenu # "CPU/Task time and stats accounting"
 
 config CPU_ISOLATION
diff --git a/init/initramfs.c b/init/initramfs.c
index 640557788026..f6f4a1e4cd54 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -291,16 +291,6 @@ static int __init do_reset(void)
         return 1;
 }
 
-static int __init maybe_link(void)
-{
-        if (nlink >= 2) {
-                char *old = find_link(major, minor, ino, mode, collected);
-                if (old)
-                        return (ksys_link(old, collected) < 0) ? -1 : 1;
-        }
-        return 0;
-}
-
 static void __init clean_path(char *path, umode_t fmode)
 {
         struct kstat st;
@@ -313,6 +303,18 @@ static void __init clean_path(char *path, umode_t fmode)
         }
 }
 
+static int __init maybe_link(void)
+{
+        if (nlink >= 2) {
+                char *old = find_link(major, minor, ino, mode, collected);
+                if (old) {
+                        clean_path(collected, 0);
+                        return (ksys_link(old, collected) < 0) ? -1 : 1;
+                }
+        }
+        return 0;
+}
+
 static __initdata int wfd;
 
 static int __init do_name(void)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 6377225b2082..b1a3545d0ec8 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -553,7 +553,6 @@ bool is_bpf_text_address(unsigned long addr)
 int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
                     char *sym)
 {
-        unsigned long symbol_start, symbol_end;
         struct bpf_prog_aux *aux;
         unsigned int it = 0;
         int ret = -ERANGE;
@@ -566,10 +565,9 @@ int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
                 if (it++ != symnum)
                         continue;
 
-                bpf_get_prog_addr_region(aux->prog, &symbol_start, &symbol_end);
                 bpf_get_prog_name(aux->prog, sym);
 
-                *value = symbol_start;
+                *value = (unsigned long)aux->prog->bpf_func;
                 *type  = BPF_SYM_ELF_TYPE;
 
                 ret = 0;
@@ -674,6 +672,40 @@ void __weak bpf_jit_free(struct bpf_prog *fp)
         bpf_prog_unlock_free(fp);
 }
 
+int bpf_jit_get_func_addr(const struct bpf_prog *prog,
+                          const struct bpf_insn *insn, bool extra_pass,
+                          u64 *func_addr, bool *func_addr_fixed)
+{
+        s16 off = insn->off;
+        s32 imm = insn->imm;
+        u8 *addr;
+
+        *func_addr_fixed = insn->src_reg != BPF_PSEUDO_CALL;
+        if (!*func_addr_fixed) {
+                /* Place-holder address till the last pass has collected
+                 * all addresses for JITed subprograms in which case we
+                 * can pick them up from prog->aux.
+                 */
+                if (!extra_pass)
+                        addr = NULL;
+                else if (prog->aux->func &&
+                         off >= 0 && off < prog->aux->func_cnt)
+                        addr = (u8 *)prog->aux->func[off]->bpf_func;
+                else
+                        return -EINVAL;
+        } else {
+                /* Address of a BPF helper call. Since part of the core
+                 * kernel, it's always at a fixed location. __bpf_call_base
+                 * and the helper with imm relative to it are both in core
+                 * kernel.
+                 */
+                addr = (u8 *)__bpf_call_base + imm;
+        }
+
+        *func_addr = (unsigned long)addr;
+        return 0;
+}
+
 static int bpf_jit_blind_insn(const struct bpf_insn *from,
                               const struct bpf_insn *aux,
                               struct bpf_insn *to_buff)
diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
index c97a8f968638..bed9d48a7ae9 100644
--- a/kernel/bpf/local_storage.c
+++ b/kernel/bpf/local_storage.c
@@ -139,7 +139,8 @@ static int cgroup_storage_update_elem(struct bpf_map *map, void *_key,
                 return -ENOENT;
 
         new = kmalloc_node(sizeof(struct bpf_storage_buffer) +
-                           map->value_size, __GFP_ZERO | GFP_USER,
+                           map->value_size,
+                           __GFP_ZERO | GFP_ATOMIC | __GFP_NOWARN,
                            map->numa_node);
         if (!new)
                 return -ENOMEM;
diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
index 8bbd72d3a121..b384ea9f3254 100644
--- a/kernel/bpf/queue_stack_maps.c
+++ b/kernel/bpf/queue_stack_maps.c
@@ -7,6 +7,7 @@
 #include <linux/bpf.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/capability.h>
 #include "percpu_freelist.h"
 
 #define QUEUE_STACK_CREATE_FLAG_MASK \
@@ -45,8 +46,12 @@ static bool queue_stack_map_is_full(struct bpf_queue_stack *qs)
 /* Called from syscall */
 static int queue_stack_map_alloc_check(union bpf_attr *attr)
 {
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 0 ||
+            attr->value_size == 0 ||
             attr->map_flags & ~QUEUE_STACK_CREATE_FLAG_MASK)
                 return -EINVAL;
 
@@ -63,15 +68,10 @@ static struct bpf_map *queue_stack_map_alloc(union bpf_attr *attr)
 {
         int ret, numa_node = bpf_map_attr_numa_node(attr);
         struct bpf_queue_stack *qs;
-        u32 size, value_size;
-        u64 queue_size, cost;
-
-        size = attr->max_entries + 1;
-        value_size = attr->value_size;
-
-        queue_size = sizeof(*qs) + (u64) value_size * size;
+        u64 size, queue_size, cost;
 
-        cost = queue_size;
+        size = (u64) attr->max_entries + 1;
+        cost = queue_size = sizeof(*qs) + size * attr->value_size;
         if (cost >= U32_MAX - PAGE_SIZE)
                 return ERR_PTR(-E2BIG);
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index ccb93277aae2..cf5040fd5434 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2078,6 +2078,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                 info.jited_prog_len = 0;
                 info.xlated_prog_len = 0;
                 info.nr_jited_ksyms = 0;
+                info.nr_jited_func_lens = 0;
                 goto done;
         }
 
@@ -2158,11 +2159,11 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
         }
 
         ulen = info.nr_jited_ksyms;
-        info.nr_jited_ksyms = prog->aux->func_cnt;
+        info.nr_jited_ksyms = prog->aux->func_cnt ? : 1;
         if (info.nr_jited_ksyms && ulen) {
                 if (bpf_dump_raw_ok()) {
+                        unsigned long ksym_addr;
                         u64 __user *user_ksyms;
-                        ulong ksym_addr;
                         u32 i;
 
                         /* copy the address of the kernel symbol
@@ -2170,10 +2171,17 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                          */
                         ulen = min_t(u32, info.nr_jited_ksyms, ulen);
                         user_ksyms = u64_to_user_ptr(info.jited_ksyms);
-                        for (i = 0; i < ulen; i++) {
-                                ksym_addr = (ulong) prog->aux->func[i]->bpf_func;
-                                ksym_addr &= PAGE_MASK;
-                                if (put_user((u64) ksym_addr, &user_ksyms[i]))
+                        if (prog->aux->func_cnt) {
+                                for (i = 0; i < ulen; i++) {
+                                        ksym_addr = (unsigned long)
+                                                prog->aux->func[i]->bpf_func;
+                                        if (put_user((u64) ksym_addr,
+                                                     &user_ksyms[i]))
+                                                return -EFAULT;
+                                }
+                        } else {
+                                ksym_addr = (unsigned long) prog->bpf_func;
+                                if (put_user((u64) ksym_addr, &user_ksyms[0]))
                                         return -EFAULT;
                         }
                 } else {
@@ -2182,7 +2190,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
         }
 
         ulen = info.nr_jited_func_lens;
-        info.nr_jited_func_lens = prog->aux->func_cnt;
+        info.nr_jited_func_lens = prog->aux->func_cnt ? : 1;
         if (info.nr_jited_func_lens && ulen) {
                 if (bpf_dump_raw_ok()) {
                         u32 __user *user_lens;
@@ -2191,9 +2199,16 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                         /* copy the JITed image lengths for each function */
                         ulen = min_t(u32, info.nr_jited_func_lens, ulen);
                         user_lens = u64_to_user_ptr(info.jited_func_lens);
-                        for (i = 0; i < ulen; i++) {
-                                func_len = prog->aux->func[i]->jited_len;
-                                if (put_user(func_len, &user_lens[i]))
+                        if (prog->aux->func_cnt) {
+                                for (i = 0; i < ulen; i++) {
+                                        func_len =
+                                                prog->aux->func[i]->jited_len;
+                                        if (put_user(func_len, &user_lens[i]))
+                                                return -EFAULT;
+                                }
+                        } else {
+                                func_len = prog->jited_len;
+                                if (put_user(func_len, &user_lens[0]))
                                         return -EFAULT;
                         }
                 } else {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1971ca325fb4..6dd419550aba 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5650,7 +5650,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len
                 return;
         /* NOTE: fake 'exit' subprog should be updated as well. */
         for (i = 0; i <= env->subprog_cnt; i++) {
-                if (env->subprog_info[i].start < off)
+                if (env->subprog_info[i].start <= off)
                         continue;
                 env->subprog_info[i].start += len - 1;
         }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 3c7f3b4c453c..91d5c38eb7e5 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -10,6 +10,7 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/hotplug.h>
 #include <linux/sched/task.h>
+#include <linux/sched/smt.h>
 #include <linux/unistd.h>
 #include <linux/cpu.h>
 #include <linux/oom.h>
@@ -367,6 +368,12 @@ static void lockdep_release_cpus_lock(void)
 
 #endif  /* CONFIG_HOTPLUG_CPU */
 
+/*
+ * Architectures that need SMT-specific errata handling during SMT hotplug
+ * should override this.
+ */
+void __weak arch_smt_update(void) { }
+
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
 EXPORT_SYMBOL_GPL(cpu_smt_control);
@@ -1011,6 +1018,7 @@ out:
          * concurrent CPU hotplug via cpu_add_remove_lock.
          */
         lockup_detector_cleanup();
+        arch_smt_update();
         return ret;
 }
 
@@ -1139,6 +1147,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target)
         ret = cpuhp_up_callbacks(cpu, st, target);
 out:
         cpus_write_unlock();
+        arch_smt_update();
         return ret;
 }
 
@@ -2055,12 +2064,6 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
         kobject_uevent(&dev->kobj, KOBJ_ONLINE);
 }
 
-/*
- * Architectures that need SMT-specific errata handling during SMT hotplug
- * should override this.
- */
-void __weak arch_smt_update(void) { };
-
 static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
 {
         int cpu, ret = 0;
diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
index 6ad4a9fcbd6f..7921ae4fca8d 100644
--- a/kernel/debug/kdb/kdb_bt.c
+++ b/kernel/debug/kdb/kdb_bt.c
@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv)
                                 kdb_printf("no process for cpu %ld\n", cpu);
                                 return 0;
                         }
-                        sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
+                        sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
                         kdb_parse(buf);
                         return 0;
                 }
                 kdb_printf("btc: cpu status: ");
                 kdb_parse("cpu\n");
                 for_each_online_cpu(cpu) {
-                        sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
+                        sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
                         kdb_parse(buf);
                         touch_nmi_watchdog();
                 }
diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index ed5d34925ad0..6a4b41484afe 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize)
         int count;
         int i;
         int diag, dtab_count;
-        int key;
+        int key, buf_size, ret;
 
 
         diag = kdbgetintenv("DTABCOUNT", &dtab_count);
@@ -336,9 +336,8 @@ poll_again:
                 else
                         p_tmp = tmpbuffer;
                 len = strlen(p_tmp);
-                count = kallsyms_symbol_complete(p_tmp,
-                                                 sizeof(tmpbuffer) -
-                                                 (p_tmp - tmpbuffer));
+                buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer);
+                count = kallsyms_symbol_complete(p_tmp, buf_size);
                 if (tab == 2 && count > 0) {
                         kdb_printf("\n%d symbols are found.", count);
                         if (count > dtab_count) {
@@ -350,9 +349,13 @@ poll_again:
                         }
                         kdb_printf("\n");
                         for (i = 0; i < count; i++) {
-                                if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
+                                ret = kallsyms_symbol_next(p_tmp, i, buf_size);
+                                if (WARN_ON(!ret))
                                         break;
-                                kdb_printf("%s ", p_tmp);
+                                if (ret != -E2BIG)
+                                        kdb_printf("%s ", p_tmp);
+                                else
+                                        kdb_printf("%s... ", p_tmp);
                                 *(p_tmp + len) = '\0';
                         }
                         if (i >= dtab_count)
diff --git a/kernel/debug/kdb/kdb_keyboard.c b/kernel/debug/kdb/kdb_keyboard.c
index 118527aa60ea..750497b0003a 100644
--- a/kernel/debug/kdb/kdb_keyboard.c
+++ b/kernel/debug/kdb/kdb_keyboard.c
@@ -173,11 +173,11 @@ int kdb_get_kbd_char(void)
         case KT_LATIN:
                 if (isprint(keychar))
                         break;          /* printable characters */
-                /* drop through */
+                /* fall through */
         case KT_SPEC:
                 if (keychar == K_ENTER)
                         break;
-                /* drop through */
+                /* fall through */
         default:
                 return -1;      /* ignore unprintables */
         }
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index bb4fe4e1a601..d72b32c66f7d 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
         if (reason == KDB_REASON_DEBUG) {
                 /* special case below */
         } else {
-                kdb_printf("\nEntering kdb (current=0x%p, pid %d) ",
+                kdb_printf("\nEntering kdb (current=0x%px, pid %d) ",
                            kdb_current, kdb_current ? kdb_current->pid : 0);
 #if defined(CONFIG_SMP)
                 kdb_printf("on processor %d ", raw_smp_processor_id());
@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
                  */
                 switch (db_result) {
                 case KDB_DB_BPT:
-                        kdb_printf("\nEntering kdb (0x%p, pid %d) ",
+                        kdb_printf("\nEntering kdb (0x%px, pid %d) ",
                                    kdb_current, kdb_current->pid);
 #if defined(CONFIG_SMP)
                         kdb_printf("on processor %d ", raw_smp_processor_id());
@@ -1493,6 +1493,7 @@ static void kdb_md_line(const char *fmtstr, unsigned long addr,
         char cbuf[32];
         char *c = cbuf;
         int i;
+        int j;
         unsigned long word;
 
         memset(cbuf, '\0', sizeof(cbuf));
@@ -1538,25 +1539,9 @@ static void kdb_md_line(const char *fmtstr, unsigned long addr,
                         wc.word = word;
 #define printable_char(c) \
         ({unsigned char __c = c; isascii(__c) && isprint(__c) ? __c : '.'; })
-                        switch (bytesperword) {
-                        case 8:
+                        for (j = 0; j < bytesperword; j++)
                                 *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                addr += 4;
-                        case 4:
-                                *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                addr += 2;
-                        case 2:
-                                *c++ = printable_char(*cp++);
-                                addr++;
-                        case 1:
-                                *c++ = printable_char(*cp++);
-                                addr++;
-                                break;
-                        }
+                        addr += bytesperword;
 #undef printable_char
                 }
         }
@@ -2048,7 +2033,7 @@ static int kdb_lsmod(int argc, const char **argv)
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
 
-                kdb_printf("%-20s%8u  0x%p ", mod->name,
+                kdb_printf("%-20s%8u  0x%px ", mod->name,
                            mod->core_layout.size, (void *)mod);
 #ifdef CONFIG_MODULE_UNLOAD
                 kdb_printf("%4d ", module_refcount(mod));
@@ -2059,7 +2044,7 @@ static int kdb_lsmod(int argc, const char **argv)
                         kdb_printf(" (Loading)");
                 else
                         kdb_printf(" (Live)");
-                kdb_printf(" 0x%p", mod->core_layout.base);
+                kdb_printf(" 0x%px", mod->core_layout.base);
 
 #ifdef CONFIG_MODULE_UNLOAD
                 {
@@ -2341,7 +2326,7 @@ void kdb_ps1(const struct task_struct *p)
                 return;
 
         cpu = kdb_process_cpu(p);
-        kdb_printf("0x%p %8d %8d  %d %4d   %c  0x%p %c%s\n",
+        kdb_printf("0x%px %8d %8d  %d %4d   %c  0x%px %c%s\n",
                    (void *)p, p->pid, p->parent->pid,
                    kdb_task_has_cpu(p), kdb_process_cpu(p),
                    kdb_task_state_char(p),
@@ -2354,7 +2339,7 @@ void kdb_ps1(const struct task_struct *p)
                 } else {
                         if (KDB_TSK(cpu) != p)
                                 kdb_printf("  Error: does not match running "
-                                   "process table (0x%p)\n", KDB_TSK(cpu));
+                                   "process table (0x%px)\n", KDB_TSK(cpu));
                 }
         }
 }
@@ -2687,7 +2672,7 @@ int kdb_register_flags(char *cmd,
         for_each_kdbcmd(kp, i) {
                 if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) {
                         kdb_printf("Duplicate kdb command registered: "
-                                "%s, func %p help %s\n", cmd, func, help);
+                                "%s, func %px help %s\n", cmd, func, help);
                         return 1;
                 }
         }
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 1e5a502ba4a7..2118d8258b7c 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -83,7 +83,7 @@ typedef struct __ksymtab {
                 unsigned long sym_start;
                 unsigned long sym_end;
                 } kdb_symtab_t;
-extern int kallsyms_symbol_next(char *prefix_name, int flag);
+extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size);
 extern int kallsyms_symbol_complete(char *prefix_name, int max_len);
 
 /* Exported Symbols for kernel loadable modules to use. */
diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
index 990b3cc526c8..50bf9b119bad 100644
--- a/kernel/debug/kdb/kdb_support.c
+++ b/kernel/debug/kdb/kdb_support.c
@@ -40,7 +40,7 @@
 int kdbgetsymval(const char *symname, kdb_symtab_t *symtab)
 {
         if (KDB_DEBUG(AR))
-                kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname,
+                kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname,
                            symtab);
         memset(symtab, 0, sizeof(*symtab));
         symtab->sym_start = kallsyms_lookup_name(symname);
@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
         char *knt1 = NULL;
 
         if (KDB_DEBUG(AR))
-                kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab);
+                kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab);
         memset(symtab, 0, sizeof(*symtab));
 
         if (addr < 4096)
@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
                 symtab->mod_name = "kernel";
         if (KDB_DEBUG(AR))
                 kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, "
-                   "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret,
+                   "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret,
                    symtab->sym_start, symtab->mod_name, symtab->sym_name,
                    symtab->sym_name);
 
@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len)
  * Parameters:
  *      prefix_name     prefix of a symbol name to lookup
  *      flag    0 means search from the head, 1 means continue search.
+ *      buf_size        maximum length that can be written to prefix_name
+ *                      buffer
  * Returns:
  *      1 if a symbol matches the given prefix.
  *      0 if no string found
  */
-int kallsyms_symbol_next(char *prefix_name, int flag)
+int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size)
 {
         int prefix_len = strlen(prefix_name);
         static loff_t pos;
@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag)
                 pos = 0;
 
         while ((name = kdb_walk_kallsyms(&pos))) {
-                if (strncmp(name, prefix_name, prefix_len) == 0) {
-                        strncpy(prefix_name, name, strlen(name)+1);
-                        return 1;
-                }
+                if (!strncmp(name, prefix_name, prefix_len))
+                        return strscpy(prefix_name, name, buf_size);
         }
         return 0;
 }
@@ -432,7 +432,7 @@ int kdb_getphysword(unsigned long *word, unsigned long addr, size_t size)
                                 *word = w8;
                         break;
                 }
-                /* drop through */
+                /* fall through */
         default:
                 diag = KDB_BADWIDTH;
                 kdb_printf("kdb_getphysword: bad width %ld\n", (long) size);
@@ -481,7 +481,7 @@ int kdb_getword(unsigned long *word, unsigned long addr, size_t size)
                                 *word = w8;
                         break;
                 }
-                /* drop through */
+                /* fall through */
         default:
                 diag = KDB_BADWIDTH;
                 kdb_printf("kdb_getword: bad width %ld\n", (long) size);
@@ -525,7 +525,7 @@ int kdb_putword(unsigned long addr, unsigned long word, size_t size)
                         diag = kdb_putarea(addr, w8);
                         break;
                 }
-                /* drop through */
+                /* fall through */
         default:
                 diag = KDB_BADWIDTH;
                 kdb_printf("kdb_putword: bad width %ld\n", (long) size);
@@ -887,13 +887,13 @@ void debug_kusage(void)
                    __func__, dah_first);
         if (dah_first) {
                 h_used = (struct debug_alloc_header *)debug_alloc_pool;
-                kdb_printf("%s: h_used %p size %d\n", __func__, h_used,
+                kdb_printf("%s: h_used %px size %d\n", __func__, h_used,
                            h_used->size);
         }
         do {
                 h_used = (struct debug_alloc_header *)
                           ((char *)h_free + dah_overhead + h_free->size);
-                kdb_printf("%s: h_used %p size %d caller %p\n",
+                kdb_printf("%s: h_used %px size %d caller %px\n",
                            __func__, h_used, h_used->size, h_used->caller);
                 h_free = (struct debug_alloc_header *)
                           (debug_alloc_pool + h_free->next);
@@ -902,7 +902,7 @@ void debug_kusage(void)
                   ((char *)h_free + dah_overhead + h_free->size);
         if ((char *)h_used - debug_alloc_pool !=
             sizeof(debug_alloc_pool_aligned))
-                kdb_printf("%s: h_used %p size %d caller %p\n",
+                kdb_printf("%s: h_used %px size %d caller %px\n",
                            __func__, h_used, h_used->size, h_used->caller);
 out:
         spin_unlock(&dap_lock);
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index 5731daa09a32..045930e32c0e 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -679,7 +679,8 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
         }
 
         if (!dev_is_dma_coherent(dev) &&
-            (attrs & DMA_ATTR_SKIP_CPU_SYNC) == 0)
+            (attrs & DMA_ATTR_SKIP_CPU_SYNC) == 0 &&
+            dev_addr != DIRECT_MAPPING_ERROR)
                 arch_sync_dma_for_device(dev, phys, size, dir);
 
         return dev_addr;
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 96d4bee83489..322e97bbb437 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -829,7 +829,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
         BUG_ON((uprobe->offset & ~PAGE_MASK) +
                         UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
 
-        smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
+        smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
         set_bit(UPROBE_COPY_INSN, &uprobe->flags);
 
  out:
@@ -2178,10 +2178,18 @@ static void handle_swbp(struct pt_regs *regs)
          * After we hit the bp, _unregister + _register can install the
          * new and not-yet-analyzed uprobe at the same address, restart.
          */
-        smp_rmb(); /* pairs with wmb() in install_breakpoint() */
         if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
                 goto out;
 
+        /*
+         * Pairs with the smp_wmb() in prepare_uprobe().
+         *
+         * Guarantees that if we see the UPROBE_COPY_INSN bit set, then
+         * we must also see the stores to &uprobe->arch performed by the
+         * prepare_uprobe() call.
+         */
+        smp_rmb();
+
         /* Tracing handlers use ->utask to communicate with fetch methods */
         if (!get_utask())
                 goto out;
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 3ebd09efe72a..97959d7b77e2 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -56,7 +56,7 @@ struct kcov {
         struct task_struct      *t;
 };
 
-static bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
+static notrace bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
 {
         unsigned int mode;
 
@@ -78,7 +78,7 @@ static bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
         return mode == needed_mode;
 }
 
-static unsigned long canonicalize_ip(unsigned long ip)
+static notrace unsigned long canonicalize_ip(unsigned long ip)
 {
 #ifdef CONFIG_RANDOMIZE_BASE
         ip -= kaslr_offset();
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 80b34dffdfb9..c2cee9db5204 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -261,9 +261,6 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
 
 static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 {
-        if (mode & PTRACE_MODE_SCHED)
-                return false;
-
         if (mode & PTRACE_MODE_NOAUDIT)
                 return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
         else
@@ -331,16 +328,9 @@ ok:
              !ptrace_has_cap(mm->user_ns, mode)))
             return -EPERM;
 
-        if (mode & PTRACE_MODE_SCHED)
-                return 0;
         return security_ptrace_access_check(task, mode);
 }
 
-bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode)
-{
-        return __ptrace_may_access(task, mode | PTRACE_MODE_SCHED);
-}
-
 bool ptrace_may_access(struct task_struct *task, unsigned int mode)
 {
         int err;
diff --git a/kernel/resource.c b/kernel/resource.c
index b3a3a1fc499e..b0fbf685c77a 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -319,16 +319,23 @@ int release_resource(struct resource *old)
 EXPORT_SYMBOL(release_resource);
 
 /**
- * Finds the lowest iomem resource that covers part of [start..end].  The
- * caller must specify start, end, flags, and desc (which may be
+ * Finds the lowest iomem resource that covers part of [@start..@end].  The
+ * caller must specify @start, @end, @flags, and @desc (which may be
  * IORES_DESC_NONE).
  *
- * If a resource is found, returns 0 and *res is overwritten with the part
- * of the resource that's within [start..end]; if none is found, returns
- * -1.
+ * If a resource is found, returns 0 and @*res is overwritten with the part
+ * of the resource that's within [@start..@end]; if none is found, returns
+ * -1 or -EINVAL for other invalid parameters.
  *
  * This function walks the whole tree and not just first level children
  * unless @first_lvl is true.
+ *
+ * @start:      start address of the resource searched for
+ * @end:        end address of same resource
+ * @flags:      flags which the resource must have
+ * @desc:       descriptor the resource must have
+ * @first_lvl:  walk only the first level children, if set
+ * @res:        return ptr, if resource found
  */
 static int find_next_iomem_res(resource_size_t start, resource_size_t end,
                                unsigned long flags, unsigned long desc,
@@ -399,6 +406,8 @@ static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end,
  * @flags: I/O resource flags
  * @start: start addr
  * @end: end addr
+ * @arg: function argument for the callback @func
+ * @func: callback function that is called for each qualifying resource area
  *
  * NOTE: For a new descriptor search, define a new IORES_DESC in
  * <linux/ioport.h> and set it in 'desc' of a target resource entry.
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index f12225f26b70..6fedf3a98581 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5738,15 +5738,10 @@ int sched_cpu_activate(unsigned int cpu)
 
 #ifdef CONFIG_SCHED_SMT
         /*
-         * The sched_smt_present static key needs to be evaluated on every
-         * hotplug event because at boot time SMT might be disabled when
-         * the number of booted CPUs is limited.
-         *
-         * If then later a sibling gets hotplugged, then the key would stay
-         * off and SMT scheduling would never be functional.
+         * When going up, increment the number of cores with SMT present.
          */
-        if (cpumask_weight(cpu_smt_mask(cpu)) > 1)
-                static_branch_enable_cpuslocked(&sched_smt_present);
+        if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
+                static_branch_inc_cpuslocked(&sched_smt_present);
 #endif
         set_cpu_active(cpu, true);
 
@@ -5790,6 +5785,14 @@ int sched_cpu_deactivate(unsigned int cpu)
          */
         synchronize_rcu_mult(call_rcu, call_rcu_sched);
 
+#ifdef CONFIG_SCHED_SMT
+        /*
+         * When going down, decrement the number of cores with SMT present.
+         */
+        if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
+                static_branch_dec_cpuslocked(&sched_smt_present);
+#endif
+
         if (!sched_smp_initialized)
                 return 0;
 
@@ -5851,11 +5854,14 @@ void __init sched_init_smp(void)
         /*
          * There's no userspace yet to cause hotplug operations; hence all the
          * CPU masks are stable and all blatant races in the below code cannot
-         * happen.
+         * happen. The hotplug lock is nevertheless taken to satisfy lockdep,
+         * but there won't be any contention on it.
          */
+        cpus_read_lock();
         mutex_lock(&sched_domains_mutex);
         sched_init_domains(cpu_active_mask);
         mutex_unlock(&sched_domains_mutex);
+        cpus_read_unlock();
 
         /* Move init over to a non-isolated CPU */
         if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ee271bb661cc..ac855b2f4774 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2400,8 +2400,8 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
                 local = 1;
 
         /*
-         * Retry task to preferred node migration periodically, in case it
-         * case it previously failed, or the scheduler moved us.
+         * Retry to migrate task to preferred node periodically, in case it
+         * previously failed, or the scheduler moved us.
          */
         if (time_after(jiffies, p->numa_migrate_retry)) {
                 task_numa_placement(p);
@@ -5674,11 +5674,11 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p,
         return target;
 }
 
-static unsigned long cpu_util_wake(int cpu, struct task_struct *p);
+static unsigned long cpu_util_without(int cpu, struct task_struct *p);
 
-static unsigned long capacity_spare_wake(int cpu, struct task_struct *p)
+static unsigned long capacity_spare_without(int cpu, struct task_struct *p)
 {
-        return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0);
+        return max_t(long, capacity_of(cpu) - cpu_util_without(cpu, p), 0);
 }
 
 /*
@@ -5738,7 +5738,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p,
 
                         avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs);
 
-                        spare_cap = capacity_spare_wake(i, p);
+                        spare_cap = capacity_spare_without(i, p);
 
                         if (spare_cap > max_spare_cap)
                                 max_spare_cap = spare_cap;
@@ -5889,8 +5889,8 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
                 return prev_cpu;
 
         /*
-         * We need task's util for capacity_spare_wake, sync it up to prev_cpu's
-         * last_update_time.
+         * We need task's util for capacity_spare_without, sync it up to
+         * prev_cpu's last_update_time.
          */
         if (!(sd_flag & SD_BALANCE_FORK))
                 sync_entity_load_avg(&p->se);
@@ -6216,10 +6216,19 @@ static inline unsigned long cpu_util(int cpu)
 }
 
 /*
- * cpu_util_wake: Compute CPU utilization with any contributions from
- * the waking task p removed.
+ * cpu_util_without: compute cpu utilization without any contributions from *p
+ * @cpu: the CPU which utilization is requested
+ * @p: the task which utilization should be discounted
+ *
+ * The utilization of a CPU is defined by the utilization of tasks currently
+ * enqueued on that CPU as well as tasks which are currently sleeping after an
+ * execution on that CPU.
+ *
+ * This method returns the utilization of the specified CPU by discounting the
+ * utilization of the specified task, whenever the task is currently
+ * contributing to the CPU utilization.
  */
-static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+static unsigned long cpu_util_without(int cpu, struct task_struct *p)
 {
         struct cfs_rq *cfs_rq;
         unsigned int util;
@@ -6231,7 +6240,7 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
         cfs_rq = &cpu_rq(cpu)->cfs;
         util = READ_ONCE(cfs_rq->avg.util_avg);
 
-        /* Discount task's blocked util from CPU's util */
+        /* Discount task's util from CPU's util */
         util -= min_t(unsigned int, util, task_util(p));
 
         /*
@@ -6240,14 +6249,14 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
          * a) if *p is the only task sleeping on this CPU, then:
          *      cpu_util (== task_util) > util_est (== 0)
          *    and thus we return:
-         *      cpu_util_wake = (cpu_util - task_util) = 0
+         *      cpu_util_without = (cpu_util - task_util) = 0
          *
          * b) if other tasks are SLEEPING on this CPU, which is now exiting
          *    IDLE, then:
          *      cpu_util >= task_util
          *      cpu_util > util_est (== 0)
          *    and thus we discount *p's blocked utilization to return:
-         *      cpu_util_wake = (cpu_util - task_util) >= 0
+         *      cpu_util_without = (cpu_util - task_util) >= 0
          *
          * c) if other tasks are RUNNABLE on that CPU and
          *      util_est > cpu_util
@@ -6260,8 +6269,33 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
          * covered by the following code when estimated utilization is
          * enabled.
          */
-        if (sched_feat(UTIL_EST))
-                util = max(util, READ_ONCE(cfs_rq->avg.util_est.enqueued));
+        if (sched_feat(UTIL_EST)) {
+                unsigned int estimated =
+                        READ_ONCE(cfs_rq->avg.util_est.enqueued);
+
+                /*
+                 * Despite the following checks we still have a small window
+                 * for a possible race, when an execl's select_task_rq_fair()
+                 * races with LB's detach_task():
+                 *
+                 *   detach_task()
+                 *     p->on_rq = TASK_ON_RQ_MIGRATING;
+                 *     ---------------------------------- A
+                 *     deactivate_task()                   \
+                 *       dequeue_task()                     + RaceTime
+                 *         util_est_dequeue()              /
+                 *     ---------------------------------- B
+                 *
+                 * The additional check on "current == p" it's required to
+                 * properly fix the execl regression and it helps in further
+                 * reducing the chances for the above race.
+                 */
+                if (unlikely(task_on_rq_queued(p) || current == p)) {
+                        estimated -= min_t(unsigned int, estimated,
+                                           (_task_util_est(p) | UTIL_AVG_UNCHANGED));
+                }
+                util = max(util, estimated);
+        }
 
         /*
          * Utilization (estimated) can exceed the CPU capacity, thus let's
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 7cdecfc010af..fe24de3fbc93 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -136,8 +136,18 @@
 
 static int psi_bug __read_mostly;
 
-bool psi_disabled __read_mostly;
-core_param(psi_disabled, psi_disabled, bool, 0644);
+DEFINE_STATIC_KEY_FALSE(psi_disabled);
+
+#ifdef CONFIG_PSI_DEFAULT_DISABLED
+bool psi_enable;
+#else
+bool psi_enable = true;
+#endif
+static int __init setup_psi(char *str)
+{
+        return kstrtobool(str, &psi_enable) == 0;
+}
+__setup("psi=", setup_psi);
 
 /* Running averages - we need to be higher-res than loadavg */
 #define PSI_FREQ        (2*HZ+1)        /* 2 sec intervals */
@@ -169,8 +179,10 @@ static void group_init(struct psi_group *group)
 
 void __init psi_init(void)
 {
-        if (psi_disabled)
+        if (!psi_enable) {
+                static_branch_enable(&psi_disabled);
                 return;
+        }
 
         psi_period = jiffies_to_nsecs(PSI_FREQ);
         group_init(&psi_system);
@@ -549,7 +561,7 @@ void psi_memstall_enter(unsigned long *flags)
         struct rq_flags rf;
         struct rq *rq;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         *flags = current->flags & PF_MEMSTALL;
@@ -579,7 +591,7 @@ void psi_memstall_leave(unsigned long *flags)
         struct rq_flags rf;
         struct rq *rq;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (*flags)
@@ -600,7 +612,7 @@ void psi_memstall_leave(unsigned long *flags)
 #ifdef CONFIG_CGROUPS
 int psi_cgroup_alloc(struct cgroup *cgroup)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return 0;
 
         cgroup->psi.pcpu = alloc_percpu(struct psi_group_cpu);
@@ -612,7 +624,7 @@ int psi_cgroup_alloc(struct cgroup *cgroup)
 
 void psi_cgroup_free(struct cgroup *cgroup)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         cancel_delayed_work_sync(&cgroup->psi.clock_work);
@@ -633,38 +645,39 @@ void psi_cgroup_free(struct cgroup *cgroup)
  */
 void cgroup_move_task(struct task_struct *task, struct css_set *to)
 {
-        bool move_psi = !psi_disabled;
         unsigned int task_flags = 0;
         struct rq_flags rf;
         struct rq *rq;
 
-        if (move_psi) {
-                rq = task_rq_lock(task, &rf);
+        if (static_branch_likely(&psi_disabled)) {
+                /*
+                 * Lame to do this here, but the scheduler cannot be locked
+                 * from the outside, so we move cgroups from inside sched/.
+                 */
+                rcu_assign_pointer(task->cgroups, to);
+                return;
+        }
 
-                if (task_on_rq_queued(task))
-                        task_flags = TSK_RUNNING;
-                else if (task->in_iowait)
-                        task_flags = TSK_IOWAIT;
+        rq = task_rq_lock(task, &rf);
 
-                if (task->flags & PF_MEMSTALL)
-                        task_flags |= TSK_MEMSTALL;
+        if (task_on_rq_queued(task))
+                task_flags = TSK_RUNNING;
+        else if (task->in_iowait)
+                task_flags = TSK_IOWAIT;
 
-                if (task_flags)
-                        psi_task_change(task, task_flags, 0);
-        }
+        if (task->flags & PF_MEMSTALL)
+                task_flags |= TSK_MEMSTALL;
 
-        /*
-         * Lame to do this here, but the scheduler cannot be locked
-         * from the outside, so we move cgroups from inside sched/.
-         */
+        if (task_flags)
+                psi_task_change(task, task_flags, 0);
+
+        /* See comment above */
         rcu_assign_pointer(task->cgroups, to);
 
-        if (move_psi) {
-                if (task_flags)
-                        psi_task_change(task, 0, task_flags);
+        if (task_flags)
+                psi_task_change(task, 0, task_flags);
 
-                task_rq_unlock(rq, task, &rf);
-        }
+        task_rq_unlock(rq, task, &rf);
 }
 #endif /* CONFIG_CGROUPS */
 
@@ -672,7 +685,7 @@ int psi_show(struct seq_file *m, struct psi_group *group, enum psi_res res)
 {
         int full;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return -EOPNOTSUPP;
 
         update_stats(group);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 618577fc9aa8..4e524ab589c9 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -23,6 +23,7 @@
 #include <linux/sched/prio.h>
 #include <linux/sched/rt.h>
 #include <linux/sched/signal.h>
+#include <linux/sched/smt.h>
 #include <linux/sched/stat.h>
 #include <linux/sched/sysctl.h>
 #include <linux/sched/task.h>
@@ -936,9 +937,6 @@ static inline int cpu_of(struct rq *rq)
 
 
 #ifdef CONFIG_SCHED_SMT
-
-extern struct static_key_false sched_smt_present;
-
 extern void __update_idle_core(struct rq *rq);
 
 static inline void update_idle_core(struct rq *rq)
diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
index 4904c4677000..aa0de240fb41 100644
--- a/kernel/sched/stats.h
+++ b/kernel/sched/stats.h
@@ -66,7 +66,7 @@ static inline void psi_enqueue(struct task_struct *p, bool wakeup)
 {
         int clear = 0, set = TSK_RUNNING;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (!wakeup || p->sched_psi_wake_requeue) {
@@ -86,7 +86,7 @@ static inline void psi_dequeue(struct task_struct *p, bool sleep)
 {
         int clear = TSK_RUNNING, set = 0;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (!sleep) {
@@ -102,7 +102,7 @@ static inline void psi_dequeue(struct task_struct *p, bool sleep)
 
 static inline void psi_ttwu_dequeue(struct task_struct *p)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
         /*
          * Is the task being migrated during a wakeup? Make sure to
@@ -128,7 +128,7 @@ static inline void psi_ttwu_dequeue(struct task_struct *p)
 
 static inline void psi_task_tick(struct rq *rq)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (unlikely(rq->curr->flags & PF_MEMSTALL))
diff --git a/kernel/stackleak.c b/kernel/stackleak.c
index e42892926244..08cb57eed389 100644
--- a/kernel/stackleak.c
+++ b/kernel/stackleak.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/stackleak.h>
+#include <linux/kprobes.h>
 
 #ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
 #include <linux/jump_label.h>
@@ -47,7 +48,7 @@ int stack_erasing_sysctl(struct ctl_table *table, int write,
 #define skip_erasing()  false
 #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
 
-asmlinkage void stackleak_erase(void)
+asmlinkage void notrace stackleak_erase(void)
 {
         /* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
         unsigned long kstack_ptr = current->lowest_stack;
@@ -101,6 +102,7 @@ asmlinkage void stackleak_erase(void)
         /* Reset the 'lowest_stack' value for the next syscall */
         current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64;
 }
+NOKPROBE_SYMBOL(stackleak_erase);
 
 void __used stackleak_track_stack(void)
 {
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index ce32cf741b25..8f0644af40be 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -917,9 +917,6 @@ static void check_process_timers(struct task_struct *tsk,
         struct task_cputime cputime;
         unsigned long soft;
 
-        if (dl_task(tsk))
-                check_dl_overrun(tsk);
-
         /*
          * If cputimer is not running, then there are no active
          * process wide timers (POSIX 1.b, itimers, RLIMIT_CPU).
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 08fcfe440c63..9864a35c8bb5 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -196,11 +196,13 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
                         i++;
                 } else if (fmt[i] == 'p' || fmt[i] == 's') {
                         mod[fmt_cnt]++;
-                        i++;
-                        if (!isspace(fmt[i]) && !ispunct(fmt[i]) && fmt[i] != 0)
+                        /* disallow any further format extensions */
+                        if (fmt[i + 1] != 0 &&
+                            !isspace(fmt[i + 1]) &&
+                            !ispunct(fmt[i + 1]))
                                 return -EINVAL;
                         fmt_cnt++;
-                        if (fmt[i - 1] == 's') {
+                        if (fmt[i] == 's') {
                                 if (str_seen)
                                         /* allow only one '%s' per fmt string */
                                         return -EINVAL;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f536f601bd46..77734451cb05 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -817,7 +817,7 @@ function_profile_call(unsigned long ip, unsigned long parent_ip,
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 static int profile_graph_entry(struct ftrace_graph_ent *trace)
 {
-        int index = trace->depth;
+        int index = current->curr_ret_stack;
 
         function_profile_call(trace->func, 0, NULL, NULL);
 
@@ -852,7 +852,7 @@ static void profile_graph_return(struct ftrace_graph_ret *trace)
         if (!fgraph_graph_time) {
                 int index;
 
-                index = trace->depth;
+                index = current->curr_ret_stack;
 
                 /* Append this call time to the parent time to subtract */
                 if (index)
@@ -6814,6 +6814,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
                         atomic_set(&t->tracing_graph_pause, 0);
                         atomic_set(&t->trace_overrun, 0);
                         t->curr_ret_stack = -1;
+                        t->curr_ret_depth = -1;
                         /* Make sure the tasks see the -1 first: */
                         smp_wmb();
                         t->ret_stack = ret_stack_list[start++];
@@ -7038,6 +7039,7 @@ graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
 void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
 {
         t->curr_ret_stack = -1;
+        t->curr_ret_depth = -1;
         /*
          * The idle task has no parent, it either has its own
          * stack or no stack at all.
@@ -7068,6 +7070,7 @@ void ftrace_graph_init_task(struct task_struct *t)
         /* Make sure we do not use the parent ret_stack */
         t->ret_stack = NULL;
         t->curr_ret_stack = -1;
+        t->curr_ret_depth = -1;
 
         if (ftrace_graph_active) {
                 struct ftrace_ret_stack *ret_stack;
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 3b8c0e24ab30..447bd96ee658 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -512,12 +512,44 @@ enum {
  * can only be modified by current, we can reuse trace_recursion.
  */
         TRACE_IRQ_BIT,
+
+        /* Set if the function is in the set_graph_function file */
+        TRACE_GRAPH_BIT,
+
+        /*
+         * In the very unlikely case that an interrupt came in
+         * at a start of graph tracing, and we want to trace
+         * the function in that interrupt, the depth can be greater
+         * than zero, because of the preempted start of a previous
+         * trace. In an even more unlikely case, depth could be 2
+         * if a softirq interrupted the start of graph tracing,
+         * followed by an interrupt preempting a start of graph
+         * tracing in the softirq, and depth can even be 3
+         * if an NMI came in at the start of an interrupt function
+         * that preempted a softirq start of a function that
+         * preempted normal context!!!! Luckily, it can't be
+         * greater than 3, so the next two bits are a mask
+         * of what the depth is when we set TRACE_GRAPH_BIT
+         */
+
+        TRACE_GRAPH_DEPTH_START_BIT,
+        TRACE_GRAPH_DEPTH_END_BIT,
 };
 
 #define trace_recursion_set(bit)        do { (current)->trace_recursion |= (1<<(bit)); } while (0)
 #define trace_recursion_clear(bit)      do { (current)->trace_recursion &= ~(1<<(bit)); } while (0)
 #define trace_recursion_test(bit)       ((current)->trace_recursion & (1<<(bit)))
 
+#define trace_recursion_depth() \
+        (((current)->trace_recursion >> TRACE_GRAPH_DEPTH_START_BIT) & 3)
+#define trace_recursion_set_depth(depth) \
+        do {                                                            \
+                current->trace_recursion &=                             \
+                        ~(3 << TRACE_GRAPH_DEPTH_START_BIT);            \
+                current->trace_recursion |=                             \
+                        ((depth) & 3) << TRACE_GRAPH_DEPTH_START_BIT;   \
+        } while (0)
+
 #define TRACE_CONTEXT_BITS      4
 
 #define TRACE_FTRACE_START      TRACE_FTRACE_BIT
@@ -843,8 +875,9 @@ extern void __trace_graph_return(struct trace_array *tr,
 extern struct ftrace_hash *ftrace_graph_hash;
 extern struct ftrace_hash *ftrace_graph_notrace_hash;
 
-static inline int ftrace_graph_addr(unsigned long addr)
+static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
 {
+        unsigned long addr = trace->func;
         int ret = 0;
 
         preempt_disable_notrace();
@@ -855,6 +888,14 @@ static inline int ftrace_graph_addr(unsigned long addr)
         }
 
         if (ftrace_lookup_ip(ftrace_graph_hash, addr)) {
+
+                /*
+                 * This needs to be cleared on the return functions
+                 * when the depth is zero.
+                 */
+                trace_recursion_set(TRACE_GRAPH_BIT);
+                trace_recursion_set_depth(trace->depth);
+
                 /*
                  * If no irqs are to be traced, but a set_graph_function
                  * is set, and called by an interrupt handler, we still
@@ -872,6 +913,13 @@ out:
         return ret;
 }
 
+static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
+{
+        if (trace_recursion_test(TRACE_GRAPH_BIT) &&
+            trace->depth == trace_recursion_depth())
+                trace_recursion_clear(TRACE_GRAPH_BIT);
+}
+
 static inline int ftrace_graph_notrace_addr(unsigned long addr)
 {
         int ret = 0;
@@ -885,7 +933,7 @@ static inline int ftrace_graph_notrace_addr(unsigned long addr)
         return ret;
 }
 #else
-static inline int ftrace_graph_addr(unsigned long addr)
+static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
 {
         return 1;
 }
@@ -894,6 +942,8 @@ static inline int ftrace_graph_notrace_addr(unsigned long addr)
 {
         return 0;
 }
+static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
+{ }
 #endif /* CONFIG_DYNAMIC_FTRACE */
 
 extern unsigned int fgraph_max_depth;
@@ -901,7 +951,8 @@ extern unsigned int fgraph_max_depth;
 static inline bool ftrace_graph_ignore_func(struct ftrace_graph_ent *trace)
 {
         /* trace it when it is-nested-in or is a function enabled. */
-        return !(trace->depth || ftrace_graph_addr(trace->func)) ||
+        return !(trace_recursion_test(TRACE_GRAPH_BIT) ||
+                 ftrace_graph_addr(trace)) ||
                 (trace->depth < 0) ||
                 (fgraph_max_depth && trace->depth >= fgraph_max_depth);
 }
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 169b3c44ee97..086af4f5c3e8 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -118,8 +118,8 @@ print_graph_duration(struct trace_array *tr, unsigned long long duration,
                      struct trace_seq *s, u32 flags);
 
 /* Add a function return address to the trace stack on thread info.*/
-int
-ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
+static int
+ftrace_push_return_trace(unsigned long ret, unsigned long func,
                          unsigned long frame_pointer, unsigned long *retp)
 {
         unsigned long long calltime;
@@ -177,9 +177,31 @@ ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
 #ifdef HAVE_FUNCTION_GRAPH_RET_ADDR_PTR
         current->ret_stack[index].retp = retp;
 #endif
-        *depth = current->curr_ret_stack;
+        return 0;
+}
+
+int function_graph_enter(unsigned long ret, unsigned long func,
+                         unsigned long frame_pointer, unsigned long *retp)
+{
+        struct ftrace_graph_ent trace;
+
+        trace.func = func;
+        trace.depth = ++current->curr_ret_depth;
+
+        if (ftrace_push_return_trace(ret, func,
+                                     frame_pointer, retp))
+                goto out;
+
+        /* Only trace if the calling function expects to */
+        if (!ftrace_graph_entry(&trace))
+                goto out_ret;
 
         return 0;
+ out_ret:
+        current->curr_ret_stack--;
+ out:
+        current->curr_ret_depth--;
+        return -EBUSY;
 }
 
 /* Retrieve a function return address to the trace stack on thread info.*/
@@ -241,7 +263,13 @@ ftrace_pop_return_trace(struct ftrace_graph_ret *trace, unsigned long *ret,
         trace->func = current->ret_stack[index].func;
         trace->calltime = current->ret_stack[index].calltime;
         trace->overrun = atomic_read(&current->trace_overrun);
-        trace->depth = index;
+        trace->depth = current->curr_ret_depth--;
+        /*
+         * We still want to trace interrupts coming in if
+         * max_depth is set to 1. Make sure the decrement is
+         * seen before ftrace_graph_return.
+         */
+        barrier();
 }
 
 /*
@@ -255,6 +283,12 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
 
         ftrace_pop_return_trace(&trace, &ret, frame_pointer);
         trace.rettime = trace_clock_local();
+        ftrace_graph_return(&trace);
+        /*
+         * The ftrace_graph_return() may still access the current
+         * ret_stack structure, we need to make sure the update of
+         * curr_ret_stack is after that.
+         */
         barrier();
         current->curr_ret_stack--;
         /*
@@ -267,13 +301,6 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
                 return ret;
         }
 
-        /*
-         * The trace should run after decrementing the ret counter
-         * in case an interrupt were to come in. We don't want to
-         * lose the interrupt if max_depth is set.
-         */
-        ftrace_graph_return(&trace);
-
         if (unlikely(!ret)) {
                 ftrace_graph_stop();
                 WARN_ON(1);
@@ -482,6 +509,8 @@ void trace_graph_return(struct ftrace_graph_ret *trace)
         int cpu;
         int pc;
 
+        ftrace_graph_addr_finish(trace);
+
         local_irq_save(flags);
         cpu = raw_smp_processor_id();
         data = per_cpu_ptr(tr->trace_buffer.data, cpu);
@@ -505,6 +534,8 @@ void set_graph_array(struct trace_array *tr)
 
 static void trace_graph_thresh_return(struct ftrace_graph_ret *trace)
 {
+        ftrace_graph_addr_finish(trace);
+
         if (tracing_thresh &&
             (trace->rettime - trace->calltime < tracing_thresh))
                 return;
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index b7357f9f82a3..98ea6d28df15 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -208,6 +208,8 @@ static void irqsoff_graph_return(struct ftrace_graph_ret *trace)
         unsigned long flags;
         int pc;
 
+        ftrace_graph_addr_finish(trace);
+
         if (!func_prolog_dec(tr, &data, &flags))
                 return;
 
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index 3ef15a6683c0..bd30e9398d2a 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -535,7 +535,7 @@ int traceprobe_update_arg(struct probe_arg *arg)
                         if (code[1].op != FETCH_OP_IMM)
                                 return -EINVAL;
 
-                        tmp = strpbrk("+-", code->data);
+                        tmp = strpbrk(code->data, "+-");
                         if (tmp)
                                 c = *tmp;
                         ret = traceprobe_split_symbol_offset(code->data,
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index a86b303e6c67..7d04b9890755 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -270,6 +270,8 @@ static void wakeup_graph_return(struct ftrace_graph_ret *trace)
         unsigned long flags;
         int pc;
 
+        ftrace_graph_addr_finish(trace);
+
         if (!func_prolog_preempt_disable(tr, &data, &pc))
                 return;
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index e5222b5fb4fe..923414a246e9 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -974,10 +974,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
         if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
                 goto out;
 
-        ret = sort_idmaps(&new_map);
-        if (ret < 0)
-                goto out;
-
         ret = -EPERM;
         /* Map the lower ids from the parent user namespace to the
          * kernel global id space.
@@ -1004,6 +1000,14 @@ static ssize_t map_write(struct file *file, const char __user *buf,
                 e->lower_first = lower_first;
         }
 
+        /*
+         * If we want to use binary search for lookup, this clones the extent
+         * array and sorts both copies.
+         */
+        ret = sort_idmaps(&new_map);
+        if (ret < 0)
+                goto out;
+
         /* Install the map */
         if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
                 memcpy(map->extent, new_map.extent,
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 70935ed91125..14afeeb7d6ef 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -135,7 +135,6 @@ static void fill_pool(void)
                 if (!new)
                         return;
 
-                kmemleak_ignore(new);
                 raw_spin_lock_irqsave(&pool_lock, flags);
                 hlist_add_head(&new->node, &obj_pool);
                 debug_objects_allocated++;
@@ -1128,7 +1127,6 @@ static int __init debug_objects_replace_static_objects(void)
                 obj = kmem_cache_zalloc(obj_cache, GFP_KERNEL);
                 if (!obj)
                         goto free;
-                kmemleak_ignore(obj);
                 hlist_add_head(&obj->node, &objects);
         }
 
@@ -1184,7 +1182,8 @@ void __init debug_objects_mem_init(void)
 
         obj_cache = kmem_cache_create("debug_objects_cache",
                                       sizeof (struct debug_obj), 0,
-                                      SLAB_DEBUG_OBJECTS, NULL);
+                                      SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE,
+                                      NULL);
 
         if (!obj_cache || debug_objects_replace_static_objects()) {
                 debug_objects_enabled = 0;
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 7ebccb5c1637..54c248526b55 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -560,6 +560,38 @@ static size_t copy_pipe_to_iter(const void *addr, size_t bytes,
         return bytes;
 }
 
+static size_t csum_and_copy_to_pipe_iter(const void *addr, size_t bytes,
+                                __wsum *csum, struct iov_iter *i)
+{
+        struct pipe_inode_info *pipe = i->pipe;
+        size_t n, r;
+        size_t off = 0;
+        __wsum sum = *csum, next;
+        int idx;
+
+        if (!sanity(i))
+                return 0;
+
+        bytes = n = push_pipe(i, bytes, &idx, &r);
+        if (unlikely(!n))
+                return 0;
+        for ( ; n; idx = next_idx(idx, pipe), r = 0) {
+                size_t chunk = min_t(size_t, n, PAGE_SIZE - r);
+                char *p = kmap_atomic(pipe->bufs[idx].page);
+                next = csum_partial_copy_nocheck(addr, p + r, chunk, 0);
+                sum = csum_block_add(sum, next, off);
+                kunmap_atomic(p);
+                i->idx = idx;
+                i->iov_offset = r + chunk;
+                n -= chunk;
+                off += chunk;
+                addr += chunk;
+        }
+        i->count -= bytes;
+        *csum = sum;
+        return bytes;
+}
+
 size_t _copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
 {
         const char *from = addr;
@@ -1438,8 +1470,12 @@ size_t csum_and_copy_to_iter(const void *addr, size_t bytes, __wsum *csum,
         const char *from = addr;
         __wsum sum, next;
         size_t off = 0;
+
+        if (unlikely(iov_iter_is_pipe(i)))
+                return csum_and_copy_to_pipe_iter(addr, bytes, csum, i);
+
         sum = *csum;
-        if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
+        if (unlikely(iov_iter_is_discard(i))) {
                 WARN_ON(1);     /* for now */
                 return 0;
         }
diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
index 5d73f5cb4d8a..79777645cac9 100644
--- a/lib/raid6/test/Makefile
+++ b/lib/raid6/test/Makefile
@@ -27,7 +27,7 @@ ifeq ($(ARCH),arm)
         CFLAGS += -I../../../arch/arm/include -mfpu=neon
         HAS_NEON = yes
 endif
-ifeq ($(ARCH),arm64)
+ifeq ($(ARCH),aarch64)
         CFLAGS += -I../../../arch/arm64/include
         HAS_NEON = yes
 endif
@@ -41,7 +41,7 @@ ifeq ($(IS_X86),yes)
                     gcc -c -x assembler - >&/dev/null &&        \
                     rm ./-.o && echo -DCONFIG_AS_AVX512=1)
 else ifeq ($(HAS_NEON),yes)
-        OBJS   += neon.o neon1.o neon2.o neon4.o neon8.o
+        OBJS   += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
         CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
 else
         HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index b984806d7d7b..7cab9a9869ac 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -837,6 +837,7 @@ static ssize_t read_firmware_show(struct device *dev,
         if (req->fw->size > PAGE_SIZE) {
                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
                 rc = -EINVAL;
+                goto out;
         }
         memcpy(buf, req->fw->data, req->fw->size);
 
diff --git a/lib/test_hexdump.c b/lib/test_hexdump.c
index 626f580b4ff7..5144899d3c6b 100644
--- a/lib/test_hexdump.c
+++ b/lib/test_hexdump.c
@@ -99,7 +99,7 @@ static void __init test_hexdump_prepare_test(size_t len, int rowsize,
                 const char *q = *result++;
                 size_t amount = strlen(q);
 
-                strncpy(p, q, amount);
+                memcpy(p, q, amount);
                 p += amount;
 
                 *p++ = ' ';
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index e3ddd836491f..d82d022111e0 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -1214,7 +1214,6 @@ void unregister_test_dev_kmod(struct kmod_test_device *test_dev)
 
         dev_info(test_dev->dev, "removing interface\n");
         misc_deregister(&test_dev->misc_dev);
-        kfree(&test_dev->misc_dev.name);
 
         mutex_unlock(&test_dev->config_mutex);
         mutex_unlock(&test_dev->trigger_mutex);
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index aa47754150ce..0598e86af8fc 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -208,15 +208,19 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                         XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_2));
 
                         /* We should see two elements in the array */
+                        rcu_read_lock();
                         xas_for_each(&xas, entry, ULONG_MAX)
                                 seen++;
+                        rcu_read_unlock();
                         XA_BUG_ON(xa, seen != 2);
 
                         /* One of which is marked */
                         xas_set(&xas, 0);
                         seen = 0;
+                        rcu_read_lock();
                         xas_for_each_marked(&xas, entry, ULONG_MAX, XA_MARK_0)
                                 seen++;
+                        rcu_read_unlock();
                         XA_BUG_ON(xa, seen != 1);
                 }
                 XA_BUG_ON(xa, xa_get_mark(xa, next, XA_MARK_0));
@@ -373,6 +377,12 @@ static noinline void check_reserve(struct xarray *xa)
         xa_erase_index(xa, 12345678);
         XA_BUG_ON(xa, !xa_empty(xa));
 
+        /* And so does xa_insert */
+        xa_reserve(xa, 12345678, GFP_KERNEL);
+        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) != 0);
+        xa_erase_index(xa, 12345678);
+        XA_BUG_ON(xa, !xa_empty(xa));
+
         /* Can iterate through a reserved entry */
         xa_store_index(xa, 5, GFP_KERNEL);
         xa_reserve(xa, 6, GFP_KERNEL);
@@ -436,7 +446,9 @@ static noinline void check_multi_store_1(struct xarray *xa, unsigned long index,
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
         XA_BUG_ON(xa, xa_load(xa, min - 1) != NULL);
 
+        xas_lock(&xas);
         XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(min)) != xa_mk_value(index));
+        xas_unlock(&xas);
         XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_value(min));
         XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_value(min));
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
@@ -452,9 +464,11 @@ static noinline void check_multi_store_2(struct xarray *xa, unsigned long index,
         XA_STATE(xas, xa, index);
         xa_store_order(xa, index, order, xa_mk_value(0), GFP_KERNEL);
 
+        xas_lock(&xas);
         XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(1)) != xa_mk_value(0));
         XA_BUG_ON(xa, xas.xa_index != index);
         XA_BUG_ON(xa, xas_store(&xas, NULL) != xa_mk_value(1));
+        xas_unlock(&xas);
         XA_BUG_ON(xa, !xa_empty(xa));
 }
 #endif
@@ -498,7 +512,7 @@ static noinline void check_multi_store(struct xarray *xa)
         rcu_read_unlock();
 
         /* We can erase multiple values with a single store */
-        xa_store_order(xa, 0, 63, NULL, GFP_KERNEL);
+        xa_store_order(xa, 0, BITS_PER_LONG - 1, NULL, GFP_KERNEL);
         XA_BUG_ON(xa, !xa_empty(xa));
 
         /* Even when the first slot is empty but the others aren't */
@@ -702,7 +716,7 @@ static noinline void check_multi_find_2(struct xarray *xa)
         }
 }
 
-static noinline void check_find(struct xarray *xa)
+static noinline void check_find_1(struct xarray *xa)
 {
         unsigned long i, j, k;
 
@@ -748,6 +762,34 @@ static noinline void check_find(struct xarray *xa)
                 XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_0));
         }
         XA_BUG_ON(xa, !xa_empty(xa));
+}
+
+static noinline void check_find_2(struct xarray *xa)
+{
+        void *entry;
+        unsigned long i, j, index = 0;
+
+        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                XA_BUG_ON(xa, true);
+        }
+
+        for (i = 0; i < 1024; i++) {
+                xa_store_index(xa, index, GFP_KERNEL);
+                j = 0;
+                index = 0;
+                xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                        XA_BUG_ON(xa, xa_mk_value(index) != entry);
+                        XA_BUG_ON(xa, index != j++);
+                }
+        }
+
+        xa_destroy(xa);
+}
+
+static noinline void check_find(struct xarray *xa)
+{
+        check_find_1(xa);
+        check_find_2(xa);
         check_multi_find(xa);
         check_multi_find_2(xa);
 }
@@ -1067,7 +1109,7 @@ static noinline void check_store_range(struct xarray *xa)
                         __check_store_range(xa, 4095 + i, 4095 + j);
                         __check_store_range(xa, 4096 + i, 4096 + j);
                         __check_store_range(xa, 123456 + i, 123456 + j);
-                        __check_store_range(xa, UINT_MAX + i, UINT_MAX + j);
+                        __check_store_range(xa, (1 << 24) + i, (1 << 24) + j);
                 }
         }
 }
@@ -1146,10 +1188,12 @@ static noinline void check_account(struct xarray *xa)
                 XA_STATE(xas, xa, 1 << order);
 
                 xa_store_order(xa, 0, order, xa, GFP_KERNEL);
+                rcu_read_lock();
                 xas_load(&xas);
                 XA_BUG_ON(xa, xas.xa_node->count == 0);
                 XA_BUG_ON(xa, xas.xa_node->count > (1 << order));
                 XA_BUG_ON(xa, xas.xa_node->nr_values != 0);
+                rcu_read_unlock();
 
                 xa_store_order(xa, 1 << order, order, xa_mk_value(1 << order),
                                 GFP_KERNEL);
diff --git a/lib/ubsan.c b/lib/ubsan.c
index 59fee96c29a0..e4162f59a81c 100644
--- a/lib/ubsan.c
+++ b/lib/ubsan.c
@@ -427,8 +427,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
 EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
 
 
-void __noreturn
-__ubsan_handle_builtin_unreachable(struct unreachable_data *data)
+void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
 {
         unsigned long flags;
 
diff --git a/lib/xarray.c b/lib/xarray.c
index 8b176f009c08..bbacca576593 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -610,8 +610,8 @@ static int xas_expand(struct xa_state *xas, void *head)
  * (see the xa_cmpxchg() implementation for an example).
  *
  * Return: If the slot already existed, returns the contents of this slot.
- * If the slot was newly created, returns NULL.  If it failed to create the
- * slot, returns NULL and indicates the error in @xas.
+ * If the slot was newly created, returns %NULL.  If it failed to create the
+ * slot, returns %NULL and indicates the error in @xas.
  */
 static void *xas_create(struct xa_state *xas)
 {
@@ -1334,44 +1334,31 @@ void *__xa_erase(struct xarray *xa, unsigned long index)
         XA_STATE(xas, xa, index);
         return xas_result(&xas, xas_store(&xas, NULL));
 }
-EXPORT_SYMBOL_GPL(__xa_erase);
+EXPORT_SYMBOL(__xa_erase);
 
 /**
- * xa_store() - Store this entry in the XArray.
+ * xa_erase() - Erase this entry from the XArray.
  * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
+ * @index: Index of entry.
  *
- * After this function returns, loads from this index will return @entry.
- * Storing into an existing multislot entry updates the entry of every index.
- * The marks associated with @index are unaffected unless @entry is %NULL.
+ * This function is the equivalent of calling xa_store() with %NULL as
+ * the third argument.  The XArray does not need to allocate memory, so
+ * the user does not need to provide GFP flags.
  *
- * Context: Process context.  Takes and releases the xa_lock.  May sleep
- * if the @gfp flags permit.
- * Return: The old entry at this index on success, xa_err(-EINVAL) if @entry
- * cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation
- * failed.
+ * Context: Any context.  Takes and releases the xa_lock.
+ * Return: The entry which used to be at this index.
  */
-void *xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
+void *xa_erase(struct xarray *xa, unsigned long index)
 {
-        XA_STATE(xas, xa, index);
-        void *curr;
-
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
-                return XA_ERROR(-EINVAL);
+        void *entry;
 
-        do {
-                xas_lock(&xas);
-                curr = xas_store(&xas, entry);
-                if (xa_track_free(xa) && entry)
-                        xas_clear_mark(&xas, XA_FREE_MARK);
-                xas_unlock(&xas);
-        } while (xas_nomem(&xas, gfp));
+        xa_lock(xa);
+        entry = __xa_erase(xa, index);
+        xa_unlock(xa);
 
-        return xas_result(&xas, curr);
+        return entry;
 }
-EXPORT_SYMBOL(xa_store);
+EXPORT_SYMBOL(xa_erase);
 
 /**
  * __xa_store() - Store this entry in the XArray.
@@ -1395,10 +1382,12 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 
         if (WARN_ON_ONCE(xa_is_internal(entry)))
                 return XA_ERROR(-EINVAL);
+        if (xa_track_free(xa) && !entry)
+                entry = XA_ZERO_ENTRY;
 
         do {
                 curr = xas_store(&xas, entry);
-                if (xa_track_free(xa) && entry)
+                if (xa_track_free(xa))
                         xas_clear_mark(&xas, XA_FREE_MARK);
         } while (__xas_nomem(&xas, gfp));
 
@@ -1407,45 +1396,33 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 EXPORT_SYMBOL(__xa_store);
 
 /**
- * xa_cmpxchg() - Conditionally replace an entry in the XArray.
+ * xa_store() - Store this entry in the XArray.
  * @xa: XArray.
  * @index: Index into array.
- * @old: Old value to test against.
- * @entry: New value to place in array.
+ * @entry: New entry.
  * @gfp: Memory allocation flags.
  *
- * If the entry at @index is the same as @old, replace it with @entry.
- * If the return value is equal to @old, then the exchange was successful.
+ * After this function returns, loads from this index will return @entry.
+ * Storing into an existing multislot entry updates the entry of every index.
+ * The marks associated with @index are unaffected unless @entry is %NULL.
  *
- * Context: Process context.  Takes and releases the xa_lock.  May sleep
- * if the @gfp flags permit.
- * Return: The old value at this index or xa_err() if an error happened.
+ * Context: Any context.  Takes and releases the xa_lock.
+ * May sleep if the @gfp flags permit.
+ * Return: The old entry at this index on success, xa_err(-EINVAL) if @entry
+ * cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation
+ * failed.
  */
-void *xa_cmpxchg(struct xarray *xa, unsigned long index,
-                        void *old, void *entry, gfp_t gfp)
+void *xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 {
-        XA_STATE(xas, xa, index);
         void *curr;
 
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
-                return XA_ERROR(-EINVAL);
-
-        do {
-                xas_lock(&xas);
-                curr = xas_load(&xas);
-                if (curr == XA_ZERO_ENTRY)
-                        curr = NULL;
-                if (curr == old) {
-                        xas_store(&xas, entry);
-                        if (xa_track_free(xa) && entry)
-                                xas_clear_mark(&xas, XA_FREE_MARK);
-                }
-                xas_unlock(&xas);
-        } while (xas_nomem(&xas, gfp));
+        xa_lock(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock(xa);
 
-        return xas_result(&xas, curr);
+        return curr;
 }
-EXPORT_SYMBOL(xa_cmpxchg);
+EXPORT_SYMBOL(xa_store);
 
 /**
  * __xa_cmpxchg() - Store this entry in the XArray.
@@ -1471,6 +1448,8 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 
         if (WARN_ON_ONCE(xa_is_internal(entry)))
                 return XA_ERROR(-EINVAL);
+        if (xa_track_free(xa) && !entry)
+                entry = XA_ZERO_ENTRY;
 
         do {
                 curr = xas_load(&xas);
@@ -1478,7 +1457,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
                         curr = NULL;
                 if (curr == old) {
                         xas_store(&xas, entry);
-                        if (xa_track_free(xa) && entry)
+                        if (xa_track_free(xa))
                                 xas_clear_mark(&xas, XA_FREE_MARK);
                 }
         } while (__xas_nomem(&xas, gfp));
@@ -1488,7 +1467,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 EXPORT_SYMBOL(__xa_cmpxchg);
 
 /**
- * xa_reserve() - Reserve this index in the XArray.
+ * __xa_reserve() - Reserve this index in the XArray.
  * @xa: XArray.
  * @index: Index into array.
  * @gfp: Memory allocation flags.
@@ -1496,33 +1475,32 @@ EXPORT_SYMBOL(__xa_cmpxchg);
  * Ensures there is somewhere to store an entry at @index in the array.
  * If there is already something stored at @index, this function does
  * nothing.  If there was nothing there, the entry is marked as reserved.
- * Loads from @index will continue to see a %NULL pointer until a
- * subsequent store to @index.
+ * Loading from a reserved entry returns a %NULL pointer.
  *
  * If you do not use the entry that you have reserved, call xa_release()
  * or xa_erase() to free any unnecessary memory.
  *
- * Context: Process context.  Takes and releases the xa_lock, IRQ or BH safe
- * if specified in XArray flags.  May sleep if the @gfp flags permit.
+ * Context: Any context.  Expects the xa_lock to be held on entry.  May
+ * release the lock, sleep and reacquire the lock if the @gfp flags permit.
  * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
  */
-int xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
+int __xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
 {
         XA_STATE(xas, xa, index);
-        unsigned int lock_type = xa_lock_type(xa);
         void *curr;
 
         do {
-                xas_lock_type(&xas, lock_type);
                 curr = xas_load(&xas);
-                if (!curr)
+                if (!curr) {
                         xas_store(&xas, XA_ZERO_ENTRY);
-                xas_unlock_type(&xas, lock_type);
-        } while (xas_nomem(&xas, gfp));
+                        if (xa_track_free(xa))
+                                xas_clear_mark(&xas, XA_FREE_MARK);
+                }
+        } while (__xas_nomem(&xas, gfp));
 
         return xas_error(&xas);
 }
-EXPORT_SYMBOL(xa_reserve);
+EXPORT_SYMBOL(__xa_reserve);
 
 #ifdef CONFIG_XARRAY_MULTI
 static void xas_set_range(struct xa_state *xas, unsigned long first,
@@ -1587,8 +1565,9 @@ void *xa_store_range(struct xarray *xa, unsigned long first,
         do {
                 xas_lock(&xas);
                 if (entry) {
-                        unsigned int order = (last == ~0UL) ? 64 :
-                                                ilog2(last + 1);
+                        unsigned int order = BITS_PER_LONG;
+                        if (last + 1)
+                                order = __ffs(last + 1);
                         xas_set_order(&xas, last, order);
                         xas_create(&xas);
                         if (xas_error(&xas))
@@ -1662,7 +1641,7 @@ EXPORT_SYMBOL(__xa_alloc);
  * @index: Index of entry.
  * @mark: Mark number.
  *
- * Attempting to set a mark on a NULL entry does not succeed.
+ * Attempting to set a mark on a %NULL entry does not succeed.
  *
  * Context: Any context.  Expects xa_lock to be held on entry.
  */
@@ -1674,7 +1653,7 @@ void __xa_set_mark(struct xarray *xa, unsigned long index, xa_mark_t mark)
         if (entry)
                 xas_set_mark(&xas, mark);
 }
-EXPORT_SYMBOL_GPL(__xa_set_mark);
+EXPORT_SYMBOL(__xa_set_mark);
 
 /**
  * __xa_clear_mark() - Clear this mark on this entry while locked.
@@ -1692,7 +1671,7 @@ void __xa_clear_mark(struct xarray *xa, unsigned long index, xa_mark_t mark)
         if (entry)
                 xas_clear_mark(&xas, mark);
 }
-EXPORT_SYMBOL_GPL(__xa_clear_mark);
+EXPORT_SYMBOL(__xa_clear_mark);
 
 /**
  * xa_get_mark() - Inquire whether this mark is set on this entry.
@@ -1732,7 +1711,7 @@ EXPORT_SYMBOL(xa_get_mark);
  * @index: Index of entry.
  * @mark: Mark number.
  *
- * Attempting to set a mark on a NULL entry does not succeed.
+ * Attempting to set a mark on a %NULL entry does not succeed.
  *
  * Context: Process context.  Takes and releases the xa_lock.
  */
@@ -1829,6 +1808,8 @@ void *xa_find_after(struct xarray *xa, unsigned long *indexp,
                         entry = xas_find_marked(&xas, max, filter);
                 else
                         entry = xas_find(&xas, max);
+                if (xas.xa_node == XAS_BOUNDS)
+                        break;
                 if (xas.xa_shift) {
                         if (xas.xa_index & ((1UL << xas.xa_shift) - 1))
                                 continue;
@@ -1899,7 +1880,7 @@ static unsigned int xas_extract_marked(struct xa_state *xas, void **dst,
  *
  * The @filter may be an XArray mark value, in which case entries which are
  * marked with that mark will be copied.  It may also be %XA_PRESENT, in
- * which case all entries which are not NULL will be copied.
+ * which case all entries which are not %NULL will be copied.
  *
  * The entries returned may not represent a snapshot of the XArray at a
  * moment in time.  For example, if another thread stores to index 5, then
diff --git a/mm/gup.c b/mm/gup.c
index f76e77a2d34b..8cb68a50dbdf 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -385,11 +385,17 @@ static struct page *follow_p4d_mask(struct vm_area_struct *vma,
  * @vma: vm_area_struct mapping @address
  * @address: virtual address to look up
  * @flags: flags modifying lookup behaviour
- * @page_mask: on output, *page_mask is set according to the size of the page
+ * @ctx: contains dev_pagemap for %ZONE_DEVICE memory pinning and a
+ *       pointer to output page_mask
  *
  * @flags can have FOLL_ flags set, defined in <linux/mm.h>
  *
- * Returns the mapped (struct page *), %NULL if no mapping exists, or
+ * When getting pages from ZONE_DEVICE memory, the @ctx->pgmap caches
+ * the device's dev_pagemap metadata to avoid repeating expensive lookups.
+ *
+ * On output, the @ctx->page_mask is set according to the size of the page.
+ *
+ * Return: the mapped (struct page *), %NULL if no mapping exists, or
  * an error pointer if there is a mapping to something not represented
  * by a page descriptor (see also vm_normal_page()).
  */
@@ -696,12 +702,11 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 if (!vma || start >= vma->vm_end) {
                         vma = find_extend_vma(mm, start);
                         if (!vma && in_gate_area(mm, start)) {
-                                int ret;
                                 ret = get_gate_page(mm, start & PAGE_MASK,
                                                 gup_flags, &vma,
                                                 pages ? &pages[i] : NULL);
                                 if (ret)
-                                        return i ? : ret;
+                                        goto out;
                                 ctx.page_mask = 0;
                                 goto next_page;
                         }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 55478ab3c83b..f2d19e4fe854 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -632,37 +632,27 @@ release:
 static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma, unsigned long addr)
 {
         const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE);
-        gfp_t this_node = 0;
-
-#ifdef CONFIG_NUMA
-        struct mempolicy *pol;
-        /*
-         * __GFP_THISNODE is used only when __GFP_DIRECT_RECLAIM is not
-         * specified, to express a general desire to stay on the current
-         * node for optimistic allocation attempts. If the defrag mode
-         * and/or madvise hint requires the direct reclaim then we prefer
-         * to fallback to other node rather than node reclaim because that
-         * can lead to excessive reclaim even though there is free memory
-         * on other nodes. We expect that NUMA preferences are specified
-         * by memory policies.
-         */
-        pol = get_vma_policy(vma, addr);
-        if (pol->mode != MPOL_BIND)
-                this_node = __GFP_THISNODE;
-        mpol_cond_put(pol);
-#endif
+        const gfp_t gfp_mask = GFP_TRANSHUGE_LIGHT | __GFP_THISNODE;
 
+        /* Always do synchronous compaction */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY);
+                return GFP_TRANSHUGE | __GFP_THISNODE |
+                       (vma_madvised ? 0 : __GFP_NORETRY);
+
+        /* Kick kcompactd and fail quickly */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM | this_node;
+                return gfp_mask | __GFP_KSWAPD_RECLAIM;
+
+        /* Synchronous compaction if madvised, otherwise kick kcompactd */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                                                             __GFP_KSWAPD_RECLAIM | this_node);
+                return gfp_mask | (vma_madvised ? __GFP_DIRECT_RECLAIM :
+                                                  __GFP_KSWAPD_RECLAIM);
+
+        /* Only do synchronous compaction if madvised */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                                                             this_node);
-        return GFP_TRANSHUGE_LIGHT | this_node;
+                return gfp_mask | (vma_madvised ? __GFP_DIRECT_RECLAIM : 0);
+
+        return gfp_mask;
 }
 
 /* Caller must hold page table lock. */
@@ -2350,7 +2340,7 @@ void vma_adjust_trans_huge(struct vm_area_struct *vma,
         }
 }
 
-static void freeze_page(struct page *page)
+static void unmap_page(struct page *page)
 {
         enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
                 TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
@@ -2365,7 +2355,7 @@ static void freeze_page(struct page *page)
         VM_BUG_ON_PAGE(!unmap_success, page);
 }
 
-static void unfreeze_page(struct page *page)
+static void remap_page(struct page *page)
 {
         int i;
         if (PageTransHuge(page)) {
@@ -2402,6 +2392,12 @@ static void __split_huge_page_tail(struct page *head, int tail,
                          (1L << PG_unevictable) |
                          (1L << PG_dirty)));
 
+        /* ->mapping in first tail page is compound_mapcount */
+        VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
+                        page_tail);
+        page_tail->mapping = head->mapping;
+        page_tail->index = head->index + tail;
+
         /* Page flags must be visible before we make the page non-compound. */
         smp_wmb();
 
@@ -2422,12 +2418,6 @@ static void __split_huge_page_tail(struct page *head, int tail,
         if (page_is_idle(head))
                 set_page_idle(page_tail);
 
-        /* ->mapping in first tail page is compound_mapcount */
-        VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
-                        page_tail);
-        page_tail->mapping = head->mapping;
-
-        page_tail->index = head->index + tail;
         page_cpupid_xchg_last(page_tail, page_cpupid_last(head));
 
         /*
@@ -2439,12 +2429,11 @@ static void __split_huge_page_tail(struct page *head, int tail,
 }
 
 static void __split_huge_page(struct page *page, struct list_head *list,
-                unsigned long flags)
+                pgoff_t end, unsigned long flags)
 {
         struct page *head = compound_head(page);
         struct zone *zone = page_zone(head);
         struct lruvec *lruvec;
-        pgoff_t end = -1;
         int i;
 
         lruvec = mem_cgroup_page_lruvec(head, zone->zone_pgdat);
@@ -2452,9 +2441,6 @@ static void __split_huge_page(struct page *page, struct list_head *list,
         /* complete memcg works before add pages to LRU */
         mem_cgroup_split_huge_fixup(head);
 
-        if (!PageAnon(page))
-                end = DIV_ROUND_UP(i_size_read(head->mapping->host), PAGE_SIZE);
-
         for (i = HPAGE_PMD_NR - 1; i >= 1; i--) {
                 __split_huge_page_tail(head, i, lruvec, list);
                 /* Some pages can be beyond i_size: drop them from page cache */
@@ -2483,7 +2469,7 @@ static void __split_huge_page(struct page *page, struct list_head *list,
 
         spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
 
-        unfreeze_page(head);
+        remap_page(head);
 
         for (i = 0; i < HPAGE_PMD_NR; i++) {
                 struct page *subpage = head + i;
@@ -2626,6 +2612,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
         int count, mapcount, extra_pins, ret;
         bool mlocked;
         unsigned long flags;
+        pgoff_t end;
 
         VM_BUG_ON_PAGE(is_huge_zero_page(page), page);
         VM_BUG_ON_PAGE(!PageLocked(page), page);
@@ -2648,6 +2635,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
                         ret = -EBUSY;
                         goto out;
                 }
+                end = -1;
                 mapping = NULL;
                 anon_vma_lock_write(anon_vma);
         } else {
@@ -2661,10 +2649,19 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
 
                 anon_vma = NULL;
                 i_mmap_lock_read(mapping);
+
+                /*
+                 *__split_huge_page() may need to trim off pages beyond EOF:
+                 * but on 32-bit, i_size_read() takes an irq-unsafe seqlock,
+                 * which cannot be nested inside the page tree lock. So note
+                 * end now: i_size itself may be changed at any moment, but
+                 * head page lock is good enough to serialize the trimming.
+                 */
+                end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE);
         }
 
         /*
-         * Racy check if we can split the page, before freeze_page() will
+         * Racy check if we can split the page, before unmap_page() will
          * split PMDs
          */
         if (!can_split_huge_page(head, &extra_pins)) {
@@ -2673,7 +2670,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
         }
 
         mlocked = PageMlocked(page);
-        freeze_page(head);
+        unmap_page(head);
         VM_BUG_ON_PAGE(compound_mapcount(head), head);
 
         /* Make sure the page is not on per-CPU pagevec as it takes pin */
@@ -2707,7 +2704,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
                 if (mapping)
                         __dec_node_page_state(page, NR_SHMEM_THPS);
                 spin_unlock(&pgdata->split_queue_lock);
-                __split_huge_page(page, list, flags);
+                __split_huge_page(page, list, end, flags);
                 if (PageSwapCache(head)) {
                         swp_entry_t entry = { .val = page_private(head) };
 
@@ -2727,7 +2724,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
 fail:           if (mapping)
                         xa_unlock(&mapping->i_pages);
                 spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
-                unfreeze_page(head);
+                remap_page(head);
                 ret = -EBUSY;
         }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c007fb5fb8d5..705a3e9cc910 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3233,7 +3233,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte)
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                             struct vm_area_struct *vma)
 {
-        pte_t *src_pte, *dst_pte, entry;
+        pte_t *src_pte, *dst_pte, entry, dst_entry;
         struct page *ptepage;
         unsigned long addr;
         int cow;
@@ -3261,15 +3261,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                         break;
                 }
 
-                /* If the pagetables are shared don't copy or take references */
-                if (dst_pte == src_pte)
+                /*
+                 * If the pagetables are shared don't copy or take references.
+                 * dst_pte == src_pte is the common case of src/dest sharing.
+                 *
+                 * However, src could have 'unshared' and dst shares with
+                 * another vma.  If dst_pte !none, this implies sharing.
+                 * Check here before taking page table lock, and once again
+                 * after taking the lock below.
+                 */
+                dst_entry = huge_ptep_get(dst_pte);
+                if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
                         continue;
 
                 dst_ptl = huge_pte_lock(h, dst, dst_pte);
                 src_ptl = huge_pte_lockptr(h, src, src_pte);
                 spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
                 entry = huge_ptep_get(src_pte);
-                if (huge_pte_none(entry)) { /* skip none entry */
+                dst_entry = huge_ptep_get(dst_pte);
+                if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
+                        /*
+                         * Skip if src entry none.  Also, skip in the
+                         * unlikely case dst entry !none as this implies
+                         * sharing with another vma.
+                         */
                         ;
                 } else if (unlikely(is_hugetlb_entry_migration(entry) ||
                                     is_hugetlb_entry_hwpoisoned(entry))) {
@@ -4065,7 +4080,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
 
                 /* fallback to copy_from_user outside mmap_sem */
                 if (unlikely(ret)) {
-                        ret = -EFAULT;
+                        ret = -ENOENT;
                         *pagep = page;
                         /* don't free the page */
                         goto out;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index c13625c1ad5e..8e2ff195ecb3 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1287,7 +1287,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
  * collapse_shmem - collapse small tmpfs/shmem pages into huge one.
  *
  * Basic scheme is simple, details are more complex:
- *  - allocate and freeze a new huge page;
+ *  - allocate and lock a new huge page;
  *  - scan page cache replacing old pages with the new one
  *    + swap in pages if necessary;
  *    + fill in gaps;
@@ -1295,11 +1295,11 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
  *  - if replacing succeeds:
  *    + copy data over;
  *    + free old pages;
- *    + unfreeze huge page;
+ *    + unlock huge page;
  *  - if replacing failed;
  *    + put all pages back and unfreeze them;
  *    + restore gaps in the page cache;
- *    + free huge page;
+ *    + unlock and free huge page;
  */
 static void collapse_shmem(struct mm_struct *mm,
                 struct address_space *mapping, pgoff_t start,
@@ -1329,19 +1329,6 @@ static void collapse_shmem(struct mm_struct *mm,
                 goto out;
         }
 
-        new_page->index = start;
-        new_page->mapping = mapping;
-        __SetPageSwapBacked(new_page);
-        __SetPageLocked(new_page);
-        BUG_ON(!page_ref_freeze(new_page, 1));
-
-        /*
-         * At this point the new_page is 'frozen' (page_count() is zero),
-         * locked and not up-to-date. It's safe to insert it into the page
-         * cache, because nobody would be able to map it or use it in other
-         * way until we unfreeze it.
-         */
-
         /* This will be less messy when we use multi-index entries */
         do {
                 xas_lock_irq(&xas);
@@ -1349,19 +1336,44 @@ static void collapse_shmem(struct mm_struct *mm,
                 if (!xas_error(&xas))
                         break;
                 xas_unlock_irq(&xas);
-                if (!xas_nomem(&xas, GFP_KERNEL))
+                if (!xas_nomem(&xas, GFP_KERNEL)) {
+                        mem_cgroup_cancel_charge(new_page, memcg, true);
+                        result = SCAN_FAIL;
                         goto out;
+                }
         } while (1);
 
+        __SetPageLocked(new_page);
+        __SetPageSwapBacked(new_page);
+        new_page->index = start;
+        new_page->mapping = mapping;
+
+        /*
+         * At this point the new_page is locked and not up-to-date.
+         * It's safe to insert it into the page cache, because nobody would
+         * be able to map it or use it in another way until we unlock it.
+         */
+
         xas_set(&xas, start);
         for (index = start; index < end; index++) {
                 struct page *page = xas_next(&xas);
 
                 VM_BUG_ON(index != xas.xa_index);
                 if (!page) {
+                        /*
+                         * Stop if extent has been truncated or hole-punched,
+                         * and is now completely empty.
+                         */
+                        if (index == start) {
+                                if (!xas_next_entry(&xas, end - 1)) {
+                                        result = SCAN_TRUNCATED;
+                                        goto xa_locked;
+                                }
+                                xas_set(&xas, index);
+                        }
                         if (!shmem_charge(mapping->host, 1)) {
                                 result = SCAN_FAIL;
-                                break;
+                                goto xa_locked;
                         }
                         xas_store(&xas, new_page + (index % HPAGE_PMD_NR));
                         nr_none++;
@@ -1376,13 +1388,12 @@ static void collapse_shmem(struct mm_struct *mm,
                                 result = SCAN_FAIL;
                                 goto xa_unlocked;
                         }
-                        xas_lock_irq(&xas);
-                        xas_set(&xas, index);
                 } else if (trylock_page(page)) {
                         get_page(page);
+                        xas_unlock_irq(&xas);
                 } else {
                         result = SCAN_PAGE_LOCK;
-                        break;
+                        goto xa_locked;
                 }
 
                 /*
@@ -1391,17 +1402,24 @@ static void collapse_shmem(struct mm_struct *mm,
                  */
                 VM_BUG_ON_PAGE(!PageLocked(page), page);
                 VM_BUG_ON_PAGE(!PageUptodate(page), page);
-                VM_BUG_ON_PAGE(PageTransCompound(page), page);
+
+                /*
+                 * If file was truncated then extended, or hole-punched, before
+                 * we locked the first page, then a THP might be there already.
+                 */
+                if (PageTransCompound(page)) {
+                        result = SCAN_PAGE_COMPOUND;
+                        goto out_unlock;
+                }
 
                 if (page_mapping(page) != mapping) {
                         result = SCAN_TRUNCATED;
                         goto out_unlock;
                 }
-                xas_unlock_irq(&xas);
 
                 if (isolate_lru_page(page)) {
                         result = SCAN_DEL_PAGE_LRU;
-                        goto out_isolate_failed;
+                        goto out_unlock;
                 }
 
                 if (page_mapped(page))
@@ -1421,7 +1439,9 @@ static void collapse_shmem(struct mm_struct *mm,
                  */
                 if (!page_ref_freeze(page, 3)) {
                         result = SCAN_PAGE_COUNT;
-                        goto out_lru;
+                        xas_unlock_irq(&xas);
+                        putback_lru_page(page);
+                        goto out_unlock;
                 }
 
                 /*
@@ -1433,71 +1453,74 @@ static void collapse_shmem(struct mm_struct *mm,
                 /* Finally, replace with the new page. */
                 xas_store(&xas, new_page + (index % HPAGE_PMD_NR));
                 continue;
-out_lru:
-                xas_unlock_irq(&xas);
-                putback_lru_page(page);
-out_isolate_failed:
-                unlock_page(page);
-                put_page(page);
-                goto xa_unlocked;
 out_unlock:
                 unlock_page(page);
                 put_page(page);
-                break;
+                goto xa_unlocked;
         }
-        xas_unlock_irq(&xas);
 
+        __inc_node_page_state(new_page, NR_SHMEM_THPS);
+        if (nr_none) {
+                struct zone *zone = page_zone(new_page);
+
+                __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none);
+                __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none);
+        }
+
+xa_locked:
+        xas_unlock_irq(&xas);
 xa_unlocked:
+
         if (result == SCAN_SUCCEED) {
                 struct page *page, *tmp;
-                struct zone *zone = page_zone(new_page);
 
                 /*
                  * Replacing old pages with new one has succeeded, now we
                  * need to copy the content and free the old pages.
                  */
+                index = start;
                 list_for_each_entry_safe(page, tmp, &pagelist, lru) {
+                        while (index < page->index) {
+                                clear_highpage(new_page + (index % HPAGE_PMD_NR));
+                                index++;
+                        }
                         copy_highpage(new_page + (page->index % HPAGE_PMD_NR),
                                         page);
                         list_del(&page->lru);
-                        unlock_page(page);
-                        page_ref_unfreeze(page, 1);
                         page->mapping = NULL;
+                        page_ref_unfreeze(page, 1);
                         ClearPageActive(page);
                         ClearPageUnevictable(page);
+                        unlock_page(page);
                         put_page(page);
+                        index++;
                 }
-
-                local_irq_disable();
-                __inc_node_page_state(new_page, NR_SHMEM_THPS);
-                if (nr_none) {
-                        __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none);
-                        __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none);
+                while (index < end) {
+                        clear_highpage(new_page + (index % HPAGE_PMD_NR));
+                        index++;
                 }
-                local_irq_enable();
 
-                /*
-                 * Remove pte page tables, so we can re-fault
-                 * the page as huge.
-                 */
-                retract_page_tables(mapping, start);
-
-                /* Everything is ready, let's unfreeze the new_page */
-                set_page_dirty(new_page);
                 SetPageUptodate(new_page);
-                page_ref_unfreeze(new_page, HPAGE_PMD_NR);
+                page_ref_add(new_page, HPAGE_PMD_NR - 1);
+                set_page_dirty(new_page);
                 mem_cgroup_commit_charge(new_page, memcg, false, true);
                 lru_cache_add_anon(new_page);
-                unlock_page(new_page);
 
+                /*
+                 * Remove pte page tables, so we can re-fault the page as huge.
+                 */
+                retract_page_tables(mapping, start);
                 *hpage = NULL;
 
                 khugepaged_pages_collapsed++;
         } else {
                 struct page *page;
+
                 /* Something went wrong: roll back page cache changes */
-                shmem_uncharge(mapping->host, nr_none);
                 xas_lock_irq(&xas);
+                mapping->nrpages -= nr_none;
+                shmem_uncharge(mapping->host, nr_none);
+
                 xas_set(&xas, start);
                 xas_for_each(&xas, page, end - 1) {
                         page = list_first_entry_or_null(&pagelist,
@@ -1519,19 +1542,18 @@ xa_unlocked:
                         xas_store(&xas, page);
                         xas_pause(&xas);
                         xas_unlock_irq(&xas);
-                        putback_lru_page(page);
                         unlock_page(page);
+                        putback_lru_page(page);
                         xas_lock_irq(&xas);
                 }
                 VM_BUG_ON(nr_none);
                 xas_unlock_irq(&xas);
 
-                /* Unfreeze new_page, caller would take care about freeing it */
-                page_ref_unfreeze(new_page, 1);
                 mem_cgroup_cancel_charge(new_page, memcg, true);
-                unlock_page(new_page);
                 new_page->mapping = NULL;
         }
+
+        unlock_page(new_page);
 out:
         VM_BUG_ON(!list_empty(&pagelist));
         /* TODO: tracepoints */
diff --git a/mm/memblock.c b/mm/memblock.c
index 7df468c8ebc8..9a2d5ae81ae1 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1179,7 +1179,7 @@ void __init_memblock __next_mem_range_rev(u64 *idx, int nid,
 
 #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
 /*
- * Common iterator interface used to define for_each_mem_range().
+ * Common iterator interface used to define for_each_mem_pfn_range().
  */
 void __init_memblock __next_mem_pfn_range(int *idx, int nid,
                                 unsigned long *out_start_pfn,
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 5837a067124d..69e278b469ef 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1662,7 +1662,7 @@ struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
  * freeing by another task.  It is the caller's responsibility to free the
  * extra reference for shared policies.
  */
-struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+static struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
                                                 unsigned long addr)
 {
         struct mempolicy *pol = __get_vma_policy(vma, addr);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a919ba5cb3c8..2ec9cc407216 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4061,17 +4061,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
         int reserve_flags;
 
         /*
-         * In the slowpath, we sanity check order to avoid ever trying to
-         * reclaim >= MAX_ORDER areas which will never succeed. Callers may
-         * be using allocators in order of preference for an area that is
-         * too large.
-         */
-        if (order >= MAX_ORDER) {
-                WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
-                return NULL;
-        }
-
-        /*
          * We also sanity check to catch abuse of atomic reserves being used by
          * callers that are not in atomic context.
          */
@@ -4364,6 +4353,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid,
         gfp_t alloc_mask; /* The gfp_t that was actually used for allocation */
         struct alloc_context ac = { };
 
+        /*
+         * There are several places where we assume that the order value is sane
+         * so bail out early if the request is out of bound.
+         */
+        if (unlikely(order >= MAX_ORDER)) {
+                WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
+                return NULL;
+        }
+
         gfp_mask &= gfp_allowed_mask;
         alloc_mask = gfp_mask;
         if (!prepare_alloc_pages(gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags))
@@ -5815,8 +5813,10 @@ void __meminit init_currently_empty_zone(struct zone *zone,
                                         unsigned long size)
 {
         struct pglist_data *pgdat = zone->zone_pgdat;
+        int zone_idx = zone_idx(zone) + 1;
 
-        pgdat->nr_zones = zone_idx(zone) + 1;
+        if (zone_idx > pgdat->nr_zones)
+                pgdat->nr_zones = zone_idx;
 
         zone->zone_start_pfn = zone_start_pfn;
 
@@ -7789,6 +7789,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
                         goto unmovable;
 
                 /*
+                 * If the zone is movable and we have ruled out all reserved
+                 * pages then it should be reasonably safe to assume the rest
+                 * is movable.
+                 */
+                if (zone_idx(zone) == ZONE_MOVABLE)
+                        continue;
+
+                /*
                  * Hugepages are not in LRU lists, but they're movable.
                  * We need not scan over tail pages bacause we don't
                  * handle each tail page individually in migration.
diff --git a/mm/rmap.c b/mm/rmap.c
index 1e79fac3186b..85b7f9423352 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1627,16 +1627,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                                                       address + PAGE_SIZE);
                 } else {
                         /*
-                         * We should not need to notify here as we reach this
-                         * case only from freeze_page() itself only call from
-                         * split_huge_page_to_list() so everything below must
-                         * be true:
-                         *   - page is not anonymous
-                         *   - page is locked
-                         *
-                         * So as it is a locked file back page thus it can not
-                         * be remove from the page cache and replace by a new
-                         * page before mmu_notifier_invalidate_range_end so no
+                         * This is a locked file-backed page, thus it cannot
+                         * be removed from the page cache and replaced by a new
+                         * page before mmu_notifier_invalidate_range_end, so no
                          * concurrent thread might update its page table to
                          * point at new page while a device still is using this
                          * page.
diff --git a/mm/shmem.c b/mm/shmem.c
index ea26d7a0342d..cddc72ac44d8 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -297,12 +297,14 @@ bool shmem_charge(struct inode *inode, long pages)
         if (!shmem_inode_acct_block(inode, pages))
                 return false;
 
+        /* nrpages adjustment first, then shmem_recalc_inode() when balanced */
+        inode->i_mapping->nrpages += pages;
+
         spin_lock_irqsave(&info->lock, flags);
         info->alloced += pages;
         inode->i_blocks += pages * BLOCKS_PER_PAGE;
         shmem_recalc_inode(inode);
         spin_unlock_irqrestore(&info->lock, flags);
-        inode->i_mapping->nrpages += pages;
 
         return true;
 }
@@ -312,6 +314,8 @@ void shmem_uncharge(struct inode *inode, long pages)
         struct shmem_inode_info *info = SHMEM_I(inode);
         unsigned long flags;
 
+        /* nrpages adjustment done by __delete_from_page_cache() or caller */
+
         spin_lock_irqsave(&info->lock, flags);
         info->alloced -= pages;
         inode->i_blocks -= pages * BLOCKS_PER_PAGE;
@@ -1509,11 +1513,13 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
 {
         struct page *oldpage, *newpage;
         struct address_space *swap_mapping;
+        swp_entry_t entry;
         pgoff_t swap_index;
         int error;
 
         oldpage = *pagep;
-        swap_index = page_private(oldpage);
+        entry.val = page_private(oldpage);
+        swap_index = swp_offset(entry);
         swap_mapping = page_mapping(oldpage);
 
         /*
@@ -1532,7 +1538,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         __SetPageLocked(newpage);
         __SetPageSwapBacked(newpage);
         SetPageUptodate(newpage);
-        set_page_private(newpage, swap_index);
+        set_page_private(newpage, entry.val);
         SetPageSwapCache(newpage);
 
         /*
@@ -2214,6 +2220,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
         struct page *page;
         pte_t _dst_pte, *dst_pte;
         int ret;
+        pgoff_t offset, max_off;
 
         ret = -ENOMEM;
         if (!shmem_inode_acct_block(inode, 1))
@@ -2236,7 +2243,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
                                 *pagep = page;
                                 shmem_inode_unacct_blocks(inode, 1);
                                 /* don't free the page */
-                                return -EFAULT;
+                                return -ENOENT;
                         }
                 } else {                /* mfill_zeropage_atomic */
                         clear_highpage(page);
@@ -2251,6 +2258,12 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
         __SetPageSwapBacked(page);
         __SetPageUptodate(page);
 
+        ret = -EFAULT;
+        offset = linear_page_index(dst_vma, dst_addr);
+        max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+        if (unlikely(offset >= max_off))
+                goto out_release;
+
         ret = mem_cgroup_try_charge_delay(page, dst_mm, gfp, &memcg, false);
         if (ret)
                 goto out_release;
@@ -2265,9 +2278,25 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
         _dst_pte = mk_pte(page, dst_vma->vm_page_prot);
         if (dst_vma->vm_flags & VM_WRITE)
                 _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte));
+        else {
+                /*
+                 * We don't set the pte dirty if the vma has no
+                 * VM_WRITE permission, so mark the page dirty or it
+                 * could be freed from under us. We could do it
+                 * unconditionally before unlock_page(), but doing it
+                 * only if VM_WRITE is not set is faster.
+                 */
+                set_page_dirty(page);
+        }
 
-        ret = -EEXIST;
         dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
+
+        ret = -EFAULT;
+        max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+        if (unlikely(offset >= max_off))
+                goto out_release_uncharge_unlock;
+
+        ret = -EEXIST;
         if (!pte_none(*dst_pte))
                 goto out_release_uncharge_unlock;
 
@@ -2285,13 +2314,15 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
 
         /* No need to invalidate - it was non-present before */
         update_mmu_cache(dst_vma, dst_addr, dst_pte);
-        unlock_page(page);
         pte_unmap_unlock(dst_pte, ptl);
+        unlock_page(page);
         ret = 0;
 out:
         return ret;
 out_release_uncharge_unlock:
         pte_unmap_unlock(dst_pte, ptl);
+        ClearPageDirty(page);
+        delete_from_page_cache(page);
 out_release_uncharge:
         mem_cgroup_cancel_charge(page, memcg, false);
 out_release:
@@ -2563,9 +2594,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)
         inode_lock(inode);
         /* We're holding i_mutex so we can access i_size directly */
 
-        if (offset < 0)
-                offset = -EINVAL;
-        else if (offset >= inode->i_size)
+        if (offset < 0 || offset >= inode->i_size)
                 offset = -ENXIO;
         else {
                 start = offset >> PAGE_SHIFT;
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 644f746e167a..8688ae65ef58 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2813,7 +2813,7 @@ static struct swap_info_struct *alloc_swap_info(void)
         unsigned int type;
         int i;
 
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        p = kvzalloc(sizeof(*p), GFP_KERNEL);
         if (!p)
                 return ERR_PTR(-ENOMEM);
 
@@ -2824,7 +2824,7 @@ static struct swap_info_struct *alloc_swap_info(void)
         }
         if (type >= MAX_SWAPFILES) {
                 spin_unlock(&swap_lock);
-                kfree(p);
+                kvfree(p);
                 return ERR_PTR(-EPERM);
         }
         if (type >= nr_swapfiles) {
@@ -2838,7 +2838,7 @@ static struct swap_info_struct *alloc_swap_info(void)
                 smp_wmb();
                 nr_swapfiles++;
         } else {
-                kfree(p);
+                kvfree(p);
                 p = swap_info[type];
                 /*
                  * Do not memset this entry: a racing procfs swap_next()
diff --git a/mm/truncate.c b/mm/truncate.c
index 45d68e90b703..798e7ccfb030 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -517,9 +517,13 @@ void truncate_inode_pages_final(struct address_space *mapping)
                  */
                 xa_lock_irq(&mapping->i_pages);
                 xa_unlock_irq(&mapping->i_pages);
-
-                truncate_inode_pages(mapping, 0);
         }
+
+        /*
+         * Cleancache needs notification even if there are no pages or shadow
+         * entries.
+         */
+        truncate_inode_pages(mapping, 0);
 }
 EXPORT_SYMBOL(truncate_inode_pages_final);
 
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 5029f241908f..458acda96f20 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -33,6 +33,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
         void *page_kaddr;
         int ret;
         struct page *page;
+        pgoff_t offset, max_off;
+        struct inode *inode;
 
         if (!*pagep) {
                 ret = -ENOMEM;
@@ -48,7 +50,7 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
 
                 /* fallback to copy_from_user outside mmap_sem */
                 if (unlikely(ret)) {
-                        ret = -EFAULT;
+                        ret = -ENOENT;
                         *pagep = page;
                         /* don't free the page */
                         goto out;
@@ -73,8 +75,17 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
         if (dst_vma->vm_flags & VM_WRITE)
                 _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte));
 
-        ret = -EEXIST;
         dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
+        if (dst_vma->vm_file) {
+                /* the shmem MAP_PRIVATE case requires checking the i_size */
+                inode = dst_vma->vm_file->f_inode;
+                offset = linear_page_index(dst_vma, dst_addr);
+                max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+                ret = -EFAULT;
+                if (unlikely(offset >= max_off))
+                        goto out_release_uncharge_unlock;
+        }
+        ret = -EEXIST;
         if (!pte_none(*dst_pte))
                 goto out_release_uncharge_unlock;
 
@@ -108,11 +119,22 @@ static int mfill_zeropage_pte(struct mm_struct *dst_mm,
         pte_t _dst_pte, *dst_pte;
         spinlock_t *ptl;
         int ret;
+        pgoff_t offset, max_off;
+        struct inode *inode;
 
         _dst_pte = pte_mkspecial(pfn_pte(my_zero_pfn(dst_addr),
                                          dst_vma->vm_page_prot));
-        ret = -EEXIST;
         dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
+        if (dst_vma->vm_file) {
+                /* the shmem MAP_PRIVATE case requires checking the i_size */
+                inode = dst_vma->vm_file->f_inode;
+                offset = linear_page_index(dst_vma, dst_addr);
+                max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+                ret = -EFAULT;
+                if (unlikely(offset >= max_off))
+                        goto out_unlock;
+        }
+        ret = -EEXIST;
         if (!pte_none(*dst_pte))
                 goto out_unlock;
         set_pte_at(dst_mm, dst_addr, dst_pte, _dst_pte);
@@ -205,8 +227,9 @@ retry:
                 if (!dst_vma || !is_vm_hugetlb_page(dst_vma))
                         goto out_unlock;
                 /*
-                 * Only allow __mcopy_atomic_hugetlb on userfaultfd
-                 * registered ranges.
+                 * Check the vma is registered in uffd, this is
+                 * required to enforce the VM_MAYWRITE check done at
+                 * uffd registration time.
                  */
                 if (!dst_vma->vm_userfaultfd_ctx.ctx)
                         goto out_unlock;
@@ -274,7 +297,7 @@ retry:
 
                 cond_resched();
 
-                if (unlikely(err == -EFAULT)) {
+                if (unlikely(err == -ENOENT)) {
                         up_read(&dst_mm->mmap_sem);
                         BUG_ON(!page);
 
@@ -380,7 +403,17 @@ static __always_inline ssize_t mfill_atomic_pte(struct mm_struct *dst_mm,
 {
         ssize_t err;
 
-        if (vma_is_anonymous(dst_vma)) {
+        /*
+         * The normal page fault path for a shmem will invoke the
+         * fault, fill the hole in the file and COW it right away. The
+         * result generates plain anonymous memory. So when we are
+         * asked to fill an hole in a MAP_PRIVATE shmem mapping, we'll
+         * generate anonymous memory directly without actually filling
+         * the hole. For the MAP_PRIVATE case the robustness check
+         * only happens in the pagetable (to verify it's still none)
+         * and not in the radix tree.
+         */
+        if (!(dst_vma->vm_flags & VM_SHARED)) {
                 if (!zeropage)
                         err = mcopy_atomic_pte(dst_mm, dst_pmd, dst_vma,
                                                dst_addr, src_addr, page);
@@ -449,13 +482,9 @@ retry:
         if (!dst_vma)
                 goto out_unlock;
         /*
-         * Be strict and only allow __mcopy_atomic on userfaultfd
-         * registered ranges to prevent userland errors going
-         * unnoticed. As far as the VM consistency is concerned, it
-         * would be perfectly safe to remove this check, but there's
-         * no useful usage for __mcopy_atomic ouside of userfaultfd
-         * registered ranges. This is after all why these are ioctls
-         * belonging to the userfaultfd and not syscalls.
+         * Check the vma is registered in uffd, this is required to
+         * enforce the VM_MAYWRITE check done at uffd registration
+         * time.
          */
         if (!dst_vma->vm_userfaultfd_ctx.ctx)
                 goto out_unlock;
@@ -489,7 +518,8 @@ retry:
          * dst_vma.
          */
         err = -ENOMEM;
-        if (vma_is_anonymous(dst_vma) && unlikely(anon_vma_prepare(dst_vma)))
+        if (!(dst_vma->vm_flags & VM_SHARED) &&
+            unlikely(anon_vma_prepare(dst_vma)))
                 goto out_unlock;
 
         while (src_addr < src_start + len) {
@@ -530,7 +560,7 @@ retry:
                                        src_addr, &page, zeropage);
                 cond_resched();
 
-                if (unlikely(err == -EFAULT)) {
+                if (unlikely(err == -ENOENT)) {
                         void *page_kaddr;
 
                         up_read(&dst_mm->mmap_sem);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 6038ce593ce3..9c624595e904 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1827,12 +1827,13 @@ static bool need_update(int cpu)
 
                 /*
                  * The fast way of checking if there are any vmstat diffs.
-                 * This works because the diffs are byte sized items.
                  */
-                if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS))
+                if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS *
+                               sizeof(p->vm_stat_diff[0])))
                         return true;
 #ifdef CONFIG_NUMA
-                if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS))
+                if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS *
+                               sizeof(p->vm_numa_stat_diff[0])))
                         return true;
 #endif
         }
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 4b366d181f35..aee9b0b8d907 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -99,6 +99,7 @@ struct z3fold_header {
 #define NCHUNKS         ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT)
 
 #define BUDDY_MASK      (0x3)
+#define BUDDY_SHIFT     2
 
 /**
  * struct z3fold_pool - stores metadata for each z3fold pool
@@ -145,7 +146,7 @@ enum z3fold_page_flags {
         MIDDLE_CHUNK_MAPPED,
         NEEDS_COMPACTING,
         PAGE_STALE,
-        UNDER_RECLAIM
+        PAGE_CLAIMED, /* by either reclaim or free */
 };
 
 /*****************
@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page,
         clear_bit(MIDDLE_CHUNK_MAPPED, &page->private);
         clear_bit(NEEDS_COMPACTING, &page->private);
         clear_bit(PAGE_STALE, &page->private);
-        clear_bit(UNDER_RECLAIM, &page->private);
+        clear_bit(PAGE_CLAIMED, &page->private);
 
         spin_lock_init(&zhdr->page_lock);
         kref_init(&zhdr->refcount);
@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)
         unsigned long handle;
 
         handle = (unsigned long)zhdr;
-        if (bud != HEADLESS)
-                handle += (bud + zhdr->first_num) & BUDDY_MASK;
+        if (bud != HEADLESS) {
+                handle |= (bud + zhdr->first_num) & BUDDY_MASK;
+                if (bud == LAST)
+                        handle |= (zhdr->last_chunks << BUDDY_SHIFT);
+        }
         return handle;
 }
 
@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle)
         return (struct z3fold_header *)(handle & PAGE_MASK);
 }
 
+/* only for LAST bud, returns zero otherwise */
+static unsigned short handle_to_chunks(unsigned long handle)
+{
+        return (handle & ~PAGE_MASK) >> BUDDY_SHIFT;
+}
+
 /*
  * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle
  *  but that doesn't matter. because the masking will result in the
@@ -720,37 +730,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
         page = virt_to_page(zhdr);
 
         if (test_bit(PAGE_HEADLESS, &page->private)) {
-                /* HEADLESS page stored */
-                bud = HEADLESS;
-        } else {
-                z3fold_page_lock(zhdr);
-                bud = handle_to_buddy(handle);
-
-                switch (bud) {
-                case FIRST:
-                        zhdr->first_chunks = 0;
-                        break;
-                case MIDDLE:
-                        zhdr->middle_chunks = 0;
-                        zhdr->start_middle = 0;
-                        break;
-                case LAST:
-                        zhdr->last_chunks = 0;
-                        break;
-                default:
-                        pr_err("%s: unknown bud %d\n", __func__, bud);
-                        WARN_ON(1);
-                        z3fold_page_unlock(zhdr);
-                        return;
+                /* if a headless page is under reclaim, just leave.
+                 * NB: we use test_and_set_bit for a reason: if the bit
+                 * has not been set before, we release this page
+                 * immediately so we don't care about its value any more.
+                 */
+                if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) {
+                        spin_lock(&pool->lock);
+                        list_del(&page->lru);
+                        spin_unlock(&pool->lock);
+                        free_z3fold_page(page);
+                        atomic64_dec(&pool->pages_nr);
                 }
+                return;
         }
 
-        if (bud == HEADLESS) {
-                spin_lock(&pool->lock);
-                list_del(&page->lru);
-                spin_unlock(&pool->lock);
-                free_z3fold_page(page);
-                atomic64_dec(&pool->pages_nr);
+        /* Non-headless case */
+        z3fold_page_lock(zhdr);
+        bud = handle_to_buddy(handle);
+
+        switch (bud) {
+        case FIRST:
+                zhdr->first_chunks = 0;
+                break;
+        case MIDDLE:
+                zhdr->middle_chunks = 0;
+                break;
+        case LAST:
+                zhdr->last_chunks = 0;
+                break;
+        default:
+                pr_err("%s: unknown bud %d\n", __func__, bud);
+                WARN_ON(1);
+                z3fold_page_unlock(zhdr);
                 return;
         }
 
@@ -758,7 +770,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
                 atomic64_dec(&pool->pages_nr);
                 return;
         }
-        if (test_bit(UNDER_RECLAIM, &page->private)) {
+        if (test_bit(PAGE_CLAIMED, &page->private)) {
                 z3fold_page_unlock(zhdr);
                 return;
         }
@@ -836,20 +848,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
                 }
                 list_for_each_prev(pos, &pool->lru) {
                         page = list_entry(pos, struct page, lru);
+
+                        /* this bit could have been set by free, in which case
+                         * we pass over to the next page in the pool.
+                         */
+                        if (test_and_set_bit(PAGE_CLAIMED, &page->private))
+                                continue;
+
+                        zhdr = page_address(page);
                         if (test_bit(PAGE_HEADLESS, &page->private))
-                                /* candidate found */
                                 break;
 
-                        zhdr = page_address(page);
-                        if (!z3fold_page_trylock(zhdr))
+                        if (!z3fold_page_trylock(zhdr)) {
+                                zhdr = NULL;
                                 continue; /* can't evict at this point */
+                        }
                         kref_get(&zhdr->refcount);
                         list_del_init(&zhdr->buddy);
                         zhdr->cpu = -1;
-                        set_bit(UNDER_RECLAIM, &page->private);
                         break;
                 }
 
+                if (!zhdr)
+                        break;
+
                 list_del_init(&page->lru);
                 spin_unlock(&pool->lock);
 
@@ -898,6 +920,7 @@ next:
                 if (test_bit(PAGE_HEADLESS, &page->private)) {
                         if (ret == 0) {
                                 free_z3fold_page(page);
+                                atomic64_dec(&pool->pages_nr);
                                 return 0;
                         }
                         spin_lock(&pool->lock);
@@ -905,7 +928,7 @@ next:
                         spin_unlock(&pool->lock);
                 } else {
                         z3fold_page_lock(zhdr);
-                        clear_bit(UNDER_RECLAIM, &page->private);
+                        clear_bit(PAGE_CLAIMED, &page->private);
                         if (kref_put(&zhdr->refcount,
                                         release_z3fold_page_locked)) {
                                 atomic64_dec(&pool->pages_nr);
@@ -964,7 +987,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle)
                 set_bit(MIDDLE_CHUNK_MAPPED, &page->private);
                 break;
         case LAST:
-                addr += PAGE_SIZE - (zhdr->last_chunks << CHUNK_SHIFT);
+                addr += PAGE_SIZE - (handle_to_chunks(handle) << CHUNK_SHIFT);
                 break;
         default:
                 pr_err("unknown buddy id %d\n", buddy);
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 9f481cfdf77d..e8090f099eb8 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -352,19 +352,21 @@ out:
  */
 int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
 {
+        static const size_t tvlv_padding = sizeof(__be32);
         struct batadv_elp_packet *elp_packet;
         unsigned char *elp_buff;
         u32 random_seqno;
         size_t size;
         int res = -ENOMEM;
 
-        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN;
+        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN + tvlv_padding;
         hard_iface->bat_v.elp_skb = dev_alloc_skb(size);
         if (!hard_iface->bat_v.elp_skb)
                 goto out;
 
         skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
-        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
+        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb,
+                                BATADV_ELP_HLEN + tvlv_padding);
         elp_packet = (struct batadv_elp_packet *)elp_buff;
 
         elp_packet->packet_type = BATADV_ELP;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 0fddc17106bd..5b71a289d04f 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -275,7 +275,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
         kfree(entry);
 
         packet = (struct batadv_frag_packet *)skb_out->data;
-        size = ntohs(packet->total_size);
+        size = ntohs(packet->total_size) + hdr_size;
 
         /* Make room for the rest of the fragments. */
         if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2920e06a5403..04c19a37e500 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -102,12 +102,18 @@ struct br_tunnel_info {
         struct metadata_dst     *tunnel_dst;
 };
 
+/* private vlan flags */
+enum {
+        BR_VLFLAG_PER_PORT_STATS = BIT(0),
+};
+
 /**
  * struct net_bridge_vlan - per-vlan entry
  *
  * @vnode: rhashtable member
  * @vid: VLAN id
  * @flags: bridge vlan flags
+ * @priv_flags: private (in-kernel) bridge vlan flags
  * @stats: per-cpu VLAN statistics
  * @br: if MASTER flag set, this points to a bridge struct
  * @port: if MASTER flag unset, this points to a port struct
@@ -127,6 +133,7 @@ struct net_bridge_vlan {
         struct rhash_head               tnode;
         u16                             vid;
         u16                             flags;
+        u16                             priv_flags;
         struct br_vlan_stats __percpu   *stats;
         union {
                 struct net_bridge       *br;
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 8c9297a01947..e84be08b8285 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -197,7 +197,7 @@ static void nbp_vlan_rcu_free(struct rcu_head *rcu)
         v = container_of(rcu, struct net_bridge_vlan, rcu);
         WARN_ON(br_vlan_is_master(v));
         /* if we had per-port stats configured then free them here */
-        if (v->brvlan->stats != v->stats)
+        if (v->priv_flags & BR_VLFLAG_PER_PORT_STATS)
                 free_percpu(v->stats);
         v->stats = NULL;
         kfree(v);
@@ -264,6 +264,7 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
                                 err = -ENOMEM;
                                 goto out_filt;
                         }
+                        v->priv_flags |= BR_VLFLAG_PER_PORT_STATS;
                 } else {
                         v->stats = masterv->stats;
                 }
diff --git a/net/can/raw.c b/net/can/raw.c
index 1051eee82581..3aab7664933f 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
         } else
                 ifindex = ro->ifindex;
 
-        if (ro->fd_frames) {
+        dev = dev_get_by_index(sock_net(sk), ifindex);
+        if (!dev)
+                return -ENXIO;
+
+        err = -EINVAL;
+        if (ro->fd_frames && dev->mtu == CANFD_MTU) {
                 if (unlikely(size != CANFD_MTU && size != CAN_MTU))
-                        return -EINVAL;
+                        goto put_dev;
         } else {
                 if (unlikely(size != CAN_MTU))
-                        return -EINVAL;
+                        goto put_dev;
         }
 
-        dev = dev_get_by_index(sock_net(sk), ifindex);
-        if (!dev)
-                return -ENXIO;
-
         skb = sock_alloc_send_skb(sk, size + sizeof(struct can_skb_priv),
                                   msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 57fcc6b4bf6e..2f126eff275d 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
         struct bio_vec bvec;
         int ret;
 
-        /* sendpage cannot properly handle pages with page_count == 0,
-         * we need to fallback to sendmsg if that's the case */
-        if (page_count(page) >= 1)
+        /*
+         * sendpage cannot properly handle pages with page_count == 0,
+         * we need to fall back to sendmsg if that's the case.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
+         */
+        if (page_count(page) >= 1 && !PageSlab(page))
                 return __ceph_tcp_sendpage(sock, page, offset, size, more);
 
         bvec.bv_page = page;
diff --git a/net/core/dev.c b/net/core/dev.c
index 77d43ae2a7bb..ddc551f24ba2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3272,7 +3272,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *first, struct net_device *de
                 }
 
                 skb = next;
-                if (netif_xmit_stopped(txq) && skb) {
+                if (netif_tx_queue_stopped(txq) && skb) {
                         rc = NETDEV_TX_BUSY;
                         break;
                 }
@@ -5655,6 +5655,10 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
+
+        /* eth_type_trans() assumes pkt_type is PACKET_HOST */
+        skb->pkt_type = PACKET_HOST;
+
         skb->encapsulation = 0;
         skb_shinfo(skb)->gso_type = 0;
         skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
@@ -5966,11 +5970,14 @@ bool napi_complete_done(struct napi_struct *n, int work_done)
                 if (work_done)
                         timeout = n->dev->gro_flush_timeout;
 
+                /* When the NAPI instance uses a timeout and keeps postponing
+                 * it, we need to bound somehow the time packets are kept in
+                 * the GRO layer
+                 */
+                napi_gro_flush(n, !!timeout);
                 if (timeout)
                         hrtimer_start(&n->timer, ns_to_ktime(timeout),
                                       HRTIMER_MODE_REL_PINNED);
-                else
-                        napi_gro_flush(n, false);
         }
         if (unlikely(!list_empty(&n->poll_list))) {
                 /* If n->poll_list is not empty, we need to mask irqs */
diff --git a/net/core/filter.c b/net/core/filter.c
index e521c5ebc7d1..9a1327eb25fa 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4852,18 +4852,17 @@ static struct sock *sk_lookup(struct net *net, struct bpf_sock_tuple *tuple,
         } else {
                 struct in6_addr *src6 = (struct in6_addr *)&tuple->ipv6.saddr;
                 struct in6_addr *dst6 = (struct in6_addr *)&tuple->ipv6.daddr;
-                u16 hnum = ntohs(tuple->ipv6.dport);
                 int sdif = inet6_sdif(skb);
 
                 if (proto == IPPROTO_TCP)
                         sk = __inet6_lookup(net, &tcp_hashinfo, skb, 0,
                                             src6, tuple->ipv6.sport,
-                                            dst6, hnum,
+                                            dst6, ntohs(tuple->ipv6.dport),
                                             dif, sdif, &refcounted);
                 else if (likely(ipv6_bpf_stub))
                         sk = ipv6_bpf_stub->udp6_lib_lookup(net,
                                                             src6, tuple->ipv6.sport,
-                                                            dst6, hnum,
+                                                            dst6, tuple->ipv6.dport,
                                                             dif, sdif,
                                                             &udp_table, skb);
 #endif
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 676f3ad629f9..588f475019d4 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1166,8 +1166,8 @@ ip_proto_again:
                 break;
         }
 
-        if (dissector_uses_key(flow_dissector,
-                               FLOW_DISSECTOR_KEY_PORTS)) {
+        if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) &&
+            !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) {
                 key_ports = skb_flow_dissector_target(flow_dissector,
                                                       FLOW_DISSECTOR_KEY_PORTS,
                                                       target_container);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 5da9552b186b..2b9fdbc43205 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -717,7 +717,8 @@ int netpoll_setup(struct netpoll *np)
 
                                 read_lock_bh(&idev->lock);
                                 list_for_each_entry(ifp, &idev->addr_list, if_list) {
-                                        if (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)
+                                        if (!!(ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL) !=
+                                            !!(ipv6_addr_type(&np->remote_ip.in6) & IPV6_ADDR_LINKLOCAL))
                                                 continue;
                                         np->local_ip.in6 = ifp->addr;
                                         err = 0;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index e01274bd5e3e..33d9227a8b80 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3367,7 +3367,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
                         cb->seq = 0;
                 }
                 ret = dumpit(skb, cb);
-                if (ret < 0)
+                if (ret)
                         break;
         }
         cb->family = idx;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 946de0e24c87..a8217e221e19 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4854,6 +4854,11 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         nf_reset(skb);
         nf_reset_trace(skb);
 
+#ifdef CONFIG_NET_SWITCHDEV
+        skb->offload_fwd_mark = 0;
+        skb->offload_mr_fwd_mark = 0;
+#endif
+
         if (!xnet)
                 return;
 
@@ -4944,6 +4949,8 @@ static unsigned int skb_gso_mac_seglen(const struct sk_buff *skb)
  *
  * This is a helper to do that correctly considering GSO_BY_FRAGS.
  *
+ * @skb: GSO skb
+ *
  * @seg_len: The segmented length (from skb_gso_*_seglen). In the
  *           GSO_BY_FRAGS case this will be [header sizes + GSO_BY_FRAGS].
  *
diff --git a/net/core/sock.c b/net/core/sock.c
index 6fcc4bc07d19..080a880a1761 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3279,6 +3279,7 @@ int sock_load_diag_module(int family, int protocol)
 
 #ifdef CONFIG_INET
         if (family == AF_INET &&
+            protocol != IPPROTO_RAW &&
             !rcu_access_pointer(inet_protos[protocol]))
                 return -ENOENT;
 #endif
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index bcb11f3a27c0..760a9e52e02b 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -178,21 +178,22 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 }
 
 static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
-                                                void *arg)
+                                                void *arg,
+                                                struct inet_frag_queue **prev)
 {
         struct inet_frags *f = nf->f;
         struct inet_frag_queue *q;
-        int err;
 
         q = inet_frag_alloc(nf, f, arg);
-        if (!q)
+        if (!q) {
+                *prev = ERR_PTR(-ENOMEM);
                 return NULL;
-
+        }
         mod_timer(&q->timer, jiffies + nf->timeout);
 
-        err = rhashtable_insert_fast(&nf->rhashtable, &q->node,
-                                     f->rhash_params);
-        if (err < 0) {
+        *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key,
+                                                 &q->node, f->rhash_params);
+        if (*prev) {
                 q->flags |= INET_FRAG_COMPLETE;
                 inet_frag_kill(q);
                 inet_frag_destroy(q);
@@ -204,22 +205,22 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
 /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */
 struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
 {
-        struct inet_frag_queue *fq;
+        struct inet_frag_queue *fq = NULL, *prev;
 
         if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
                 return NULL;
 
         rcu_read_lock();
 
-        fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
-        if (fq) {
+        prev = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
+        if (!prev)
+                fq = inet_frag_create(nf, key, &prev);
+        if (prev && !IS_ERR(prev)) {
+                fq = prev;
                 if (!refcount_inc_not_zero(&fq->refcnt))
                         fq = NULL;
-                rcu_read_unlock();
-                return fq;
         }
         rcu_read_unlock();
-
-        return inet_frag_create(nf, key);
+        return fq;
 }
 EXPORT_SYMBOL(inet_frag_find);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 9b0158fa431f..d6ee343fdb86 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -722,10 +722,14 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
         if (ip_is_fragment(&iph)) {
                 skb = skb_share_check(skb, GFP_ATOMIC);
                 if (skb) {
-                        if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
-                                return skb;
-                        if (pskb_trim_rcsum(skb, netoff + len))
-                                return skb;
+                        if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) {
+                                kfree_skb(skb);
+                                return NULL;
+                        }
+                        if (pskb_trim_rcsum(skb, netoff + len)) {
+                                kfree_skb(skb);
+                                return NULL;
+                        }
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                         if (ip_defrag(net, skb, user))
                                 return NULL;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c09219e7f230..5dbec21856f4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -939,7 +939,7 @@ static int __ip_append_data(struct sock *sk,
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        unsigned int pagedlen = 0;
+                        unsigned int pagedlen;
                         struct sk_buff *skb_prev;
 alloc_new_skb:
                         skb_prev = skb;
@@ -956,6 +956,7 @@ alloc_new_skb:
                         if (datalen > mtu - fragheaderlen)
                                 datalen = maxfraglen - fragheaderlen;
                         fraglen = datalen + fragheaderlen;
+                        pagedlen = 0;
 
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 26c36cccabdc..fffcc130900e 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1246,7 +1246,7 @@ int ip_setsockopt(struct sock *sk, int level,
                 return -ENOPROTOOPT;
 
         err = do_ip_setsockopt(sk, level, optname, optval, optlen);
-#ifdef CONFIG_BPFILTER
+#if IS_ENABLED(CONFIG_BPFILTER_UMH)
         if (optname >= BPFILTER_IPT_SO_SET_REPLACE &&
             optname < BPFILTER_IPT_SET_MAX)
                 err = bpfilter_ip_set_sockopt(sk, optname, optval, optlen);
@@ -1559,7 +1559,7 @@ int ip_getsockopt(struct sock *sk, int level,
         int err;
 
         err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
-#ifdef CONFIG_BPFILTER
+#if IS_ENABLED(CONFIG_BPFILTER_UMH)
         if (optname >= BPFILTER_IPT_SO_GET_INFO &&
             optname < BPFILTER_IPT_GET_MAX)
                 err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);
@@ -1596,7 +1596,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
         err = do_ip_getsockopt(sk, level, optname, optval, optlen,
                 MSG_CMSG_COMPAT);
 
-#ifdef CONFIG_BPFILTER
+#if IS_ENABLED(CONFIG_BPFILTER_UMH)
         if (optname >= BPFILTER_IPT_SO_GET_INFO &&
             optname < BPFILTER_IPT_GET_MAX)
                 err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index dde671e97829..c248e0dccbe1 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -80,7 +80,7 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
 
         iph->version    =       4;
         iph->ihl        =       sizeof(struct iphdr) >> 2;
-        iph->frag_off   =       df;
+        iph->frag_off   =       ip_mtu_locked(&rt->dst) ? 0 : df;
         iph->protocol   =       proto;
         iph->tos        =       tos;
         iph->daddr      =       dst;
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index ce1512b02cb2..fd3f9e8a74da 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -81,9 +81,12 @@ static int __init masquerade_tg_init(void)
         int ret;
 
         ret = xt_register_target(&masquerade_tg_reg);
+        if (ret)
+                return ret;
 
-        if (ret == 0)
-                nf_nat_masquerade_ipv4_register_notifier();
+        ret = nf_nat_masquerade_ipv4_register_notifier();
+        if (ret)
+                xt_unregister_target(&masquerade_tg_reg);
 
         return ret;
 }
diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
index a9d5e013e555..41327bb99093 100644
--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
@@ -147,28 +147,50 @@ static struct notifier_block masq_inet_notifier = {
         .notifier_call  = masq_inet_event,
 };
 
-static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
+static int masq_refcnt;
+static DEFINE_MUTEX(masq_mutex);
 
-void nf_nat_masquerade_ipv4_register_notifier(void)
+int nf_nat_masquerade_ipv4_register_notifier(void)
 {
+        int ret = 0;
+
+        mutex_lock(&masq_mutex);
         /* check if the notifier was already set */
-        if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
-                return;
+        if (++masq_refcnt > 1)
+                goto out_unlock;
 
         /* Register for device down reports */
-        register_netdevice_notifier(&masq_dev_notifier);
+        ret = register_netdevice_notifier(&masq_dev_notifier);
+        if (ret)
+                goto err_dec;
         /* Register IP address change reports */
-        register_inetaddr_notifier(&masq_inet_notifier);
+        ret = register_inetaddr_notifier(&masq_inet_notifier);
+        if (ret)
+                goto err_unregister;
+
+        mutex_unlock(&masq_mutex);
+        return ret;
+
+err_unregister:
+        unregister_netdevice_notifier(&masq_dev_notifier);
+err_dec:
+        masq_refcnt--;
+out_unlock:
+        mutex_unlock(&masq_mutex);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);
 
 void nf_nat_masquerade_ipv4_unregister_notifier(void)
 {
+        mutex_lock(&masq_mutex);
         /* check if the notifier still has clients */
-        if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
-                return;
+        if (--masq_refcnt > 0)
+                goto out_unlock;
 
         unregister_netdevice_notifier(&masq_dev_notifier);
         unregister_inetaddr_notifier(&masq_inet_notifier);
+out_unlock:
+        mutex_unlock(&masq_mutex);
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index f1193e1e928a..6847de1d1db8 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -69,7 +69,9 @@ static int __init nft_masq_ipv4_module_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_nat_masquerade_ipv4_register_notifier();
+        ret = nf_nat_masquerade_ipv4_register_notifier();
+        if (ret)
+                nft_unregister_expr(&nft_masq_ipv4_type);
 
         return ret;
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2868ef28ce52..a9d9555a973f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -579,10 +579,12 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
                 u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
                 u32 delta_us;
 
-                if (!delta)
-                        delta = 1;
-                delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
-                tcp_rcv_rtt_update(tp, delta_us, 0);
+                if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
+                        if (!delta)
+                                delta = 1;
+                        delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+                        tcp_rcv_rtt_update(tp, delta_us, 0);
+                }
         }
 }
 
@@ -2910,9 +2912,11 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag,
         if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
             flag & FLAG_ACKED) {
                 u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
-                u32 delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
 
-                seq_rtt_us = ca_rtt_us = delta_us;
+                if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
+                        seq_rtt_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+                        ca_rtt_us = seq_rtt_us;
+                }
         }
         rs->rtt_us = ca_rtt_us; /* RTT of last (S)ACKed packet (or -1) */
         if (seq_rtt_us < 0)
@@ -4268,7 +4272,7 @@ static void tcp_sack_new_ofo_skb(struct sock *sk, u32 seq, u32 end_seq)
          * If the sack array is full, forget about the last one.
          */
         if (this_sack >= TCP_NUM_SACKS) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
                 this_sack--;
                 tp->rx_opt.num_sacks--;
@@ -4363,6 +4367,7 @@ static bool tcp_try_coalesce(struct sock *sk,
         if (TCP_SKB_CB(from)->has_rxtstamp) {
                 TCP_SKB_CB(to)->has_rxtstamp = true;
                 to->tstamp = from->tstamp;
+                skb_hwtstamps(to)->hwtstamp = skb_hwtstamps(from)->hwtstamp;
         }
 
         return true;
@@ -5188,7 +5193,17 @@ send_now:
         if (!tcp_is_sack(tp) ||
             tp->compressed_ack >= sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr)
                 goto send_now;
-        tp->compressed_ack++;
+
+        if (tp->compressed_ack_rcv_nxt != tp->rcv_nxt) {
+                tp->compressed_ack_rcv_nxt = tp->rcv_nxt;
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
+                        NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
+                                      tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = 0;
+        }
+
+        if (++tp->compressed_ack <= TCP_FASTRETRANS_THRESH)
+                goto send_now;
 
         if (hrtimer_is_queued(&tp->compressed_ack_timer))
                 return;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 9c34b97d365d..3f510cad0b3e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -180,10 +180,10 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (unlikely(tp->compressed_ack)) {
+        if (unlikely(tp->compressed_ack > TCP_FASTRETRANS_THRESH)) {
                 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
-                              tp->compressed_ack);
-                tp->compressed_ack = 0;
+                              tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = TCP_FASTRETRANS_THRESH;
                 if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
                         __sock_put(sk);
         }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 676020663ce8..091c53925e4d 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -40,15 +40,17 @@ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         u32 elapsed, start_ts;
+        s32 remaining;
 
         start_ts = tcp_retransmit_stamp(sk);
         if (!icsk->icsk_user_timeout || !start_ts)
                 return icsk->icsk_rto;
         elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts;
-        if (elapsed >= icsk->icsk_user_timeout)
+        remaining = icsk->icsk_user_timeout - elapsed;
+        if (remaining <= 0)
                 return 1; /* user timeout has passed; fire ASAP */
-        else
-                return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(icsk->icsk_user_timeout - elapsed));
+
+        return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining));
 }
 
 /**
@@ -209,7 +211,7 @@ static bool retransmits_timed_out(struct sock *sk,
                                 (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
                 timeout = jiffies_to_msecs(timeout);
         }
-        return (tcp_time_stamp(tcp_sk(sk)) - start_ts) >= timeout;
+        return (s32)(tcp_time_stamp(tcp_sk(sk)) - start_ts - timeout) >= 0;
 }
 
 /* A write timeout has occurred. Process the after effects. */
@@ -740,7 +742,7 @@ static enum hrtimer_restart tcp_compressed_ack_kick(struct hrtimer *timer)
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
         } else {
                 if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 63a808d5af15..045597b9a7c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                                    bool send_na);
-static void addrconf_dad_run(struct inet6_dev *idev);
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
 static void addrconf_rs_timer(struct timer_list *t);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -3439,6 +3439,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
         struct netdev_notifier_changeupper_info *info;
         struct inet6_dev *idev = __in6_dev_get(dev);
         struct net *net = dev_net(dev);
@@ -3513,7 +3514,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 break;
                         }
 
-                        if (idev) {
+                        if (!IS_ERR_OR_NULL(idev)) {
                                 if (idev->if_flags & IF_READY) {
                                         /* device is already configured -
                                          * but resend MLD reports, we might
@@ -3521,6 +3522,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                          * multicast snooping switches
                                          */
                                         ipv6_mc_up(idev);
+                                        change_info = ptr;
+                                        if (change_info->flags_changed & IFF_NOARP)
+                                                addrconf_dad_run(idev, true);
                                         rt6_sync_up(dev, RTNH_F_LINKDOWN);
                                         break;
                                 }
@@ -3555,7 +3559,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 
                 if (!IS_ERR_OR_NULL(idev)) {
                         if (run_pending)
-                                addrconf_dad_run(idev);
+                                addrconf_dad_run(idev, false);
 
                         /* Device has an address by now */
                         rt6_sync_up(dev, RTNH_F_DEAD);
@@ -4173,16 +4177,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                 addrconf_verify_rtnl();
 }
 
-static void addrconf_dad_run(struct inet6_dev *idev)
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
 {
         struct inet6_ifaddr *ifp;
 
         read_lock_bh(&idev->lock);
         list_for_each_entry(ifp, &idev->addr_list, if_list) {
                 spin_lock(&ifp->lock);
-                if (ifp->flags & IFA_F_TENTATIVE &&
-                    ifp->state == INET6_IFADDR_STATE_DAD)
+                if ((ifp->flags & IFA_F_TENTATIVE &&
+                     ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
+                        if (restart)
+                                ifp->state = INET6_IFADDR_STATE_PREDAD;
                         addrconf_dad_kick(ifp);
+                }
                 spin_unlock(&ifp->lock);
         }
         read_unlock_bh(&idev->lock);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3f4d61017a69..f0cd291034f0 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -1001,6 +1001,9 @@ static int __init inet6_init(void)
         err = ip6_flowlabel_init();
         if (err)
                 goto ip6_flowlabel_fail;
+        err = ipv6_anycast_init();
+        if (err)
+                goto ipv6_anycast_fail;
         err = addrconf_init();
         if (err)
                 goto addrconf_fail;
@@ -1091,6 +1094,8 @@ ipv6_frag_fail:
 ipv6_exthdrs_fail:
         addrconf_cleanup();
 addrconf_fail:
+        ipv6_anycast_cleanup();
+ipv6_anycast_fail:
         ip6_flowlabel_cleanup();
 ip6_flowlabel_fail:
         ndisc_late_cleanup();
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 4e0ff7031edd..94999058e110 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -44,8 +44,22 @@
 
 #include <net/checksum.h>
 
+#define IN6_ADDR_HSIZE_SHIFT    8
+#define IN6_ADDR_HSIZE          BIT(IN6_ADDR_HSIZE_SHIFT)
+/*      anycast address hash table
+ */
+static struct hlist_head inet6_acaddr_lst[IN6_ADDR_HSIZE];
+static DEFINE_SPINLOCK(acaddr_hash_lock);
+
 static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr);
 
+static u32 inet6_acaddr_hash(struct net *net, const struct in6_addr *addr)
+{
+        u32 val = ipv6_addr_hash(addr) ^ net_hash_mix(net);
+
+        return hash_32(val, IN6_ADDR_HSIZE_SHIFT);
+}
+
 /*
  *      socket join an anycast group
  */
@@ -204,16 +218,39 @@ void ipv6_sock_ac_close(struct sock *sk)
         rtnl_unlock();
 }
 
+static void ipv6_add_acaddr_hash(struct net *net, struct ifacaddr6 *aca)
+{
+        unsigned int hash = inet6_acaddr_hash(net, &aca->aca_addr);
+
+        spin_lock(&acaddr_hash_lock);
+        hlist_add_head_rcu(&aca->aca_addr_lst, &inet6_acaddr_lst[hash]);
+        spin_unlock(&acaddr_hash_lock);
+}
+
+static void ipv6_del_acaddr_hash(struct ifacaddr6 *aca)
+{
+        spin_lock(&acaddr_hash_lock);
+        hlist_del_init_rcu(&aca->aca_addr_lst);
+        spin_unlock(&acaddr_hash_lock);
+}
+
 static void aca_get(struct ifacaddr6 *aca)
 {
         refcount_inc(&aca->aca_refcnt);
 }
 
+static void aca_free_rcu(struct rcu_head *h)
+{
+        struct ifacaddr6 *aca = container_of(h, struct ifacaddr6, rcu);
+
+        fib6_info_release(aca->aca_rt);
+        kfree(aca);
+}
+
 static void aca_put(struct ifacaddr6 *ac)
 {
         if (refcount_dec_and_test(&ac->aca_refcnt)) {
-                fib6_info_release(ac->aca_rt);
-                kfree(ac);
+                call_rcu(&ac->rcu, aca_free_rcu);
         }
 }
 
@@ -229,6 +266,7 @@ static struct ifacaddr6 *aca_alloc(struct fib6_info *f6i,
         aca->aca_addr = *addr;
         fib6_info_hold(f6i);
         aca->aca_rt = f6i;
+        INIT_HLIST_NODE(&aca->aca_addr_lst);
         aca->aca_users = 1;
         /* aca_tstamp should be updated upon changes */
         aca->aca_cstamp = aca->aca_tstamp = jiffies;
@@ -285,6 +323,8 @@ int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr)
         aca_get(aca);
         write_unlock_bh(&idev->lock);
 
+        ipv6_add_acaddr_hash(net, aca);
+
         ip6_ins_rt(net, f6i);
 
         addrconf_join_solict(idev->dev, &aca->aca_addr);
@@ -325,6 +365,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr)
         else
                 idev->ac_list = aca->aca_next;
         write_unlock_bh(&idev->lock);
+        ipv6_del_acaddr_hash(aca);
         addrconf_leave_solict(idev, &aca->aca_addr);
 
         ip6_del_rt(dev_net(idev->dev), aca->aca_rt);
@@ -352,6 +393,8 @@ void ipv6_ac_destroy_dev(struct inet6_dev *idev)
                 idev->ac_list = aca->aca_next;
                 write_unlock_bh(&idev->lock);
 
+                ipv6_del_acaddr_hash(aca);
+
                 addrconf_leave_solict(idev, &aca->aca_addr);
 
                 ip6_del_rt(dev_net(idev->dev), aca->aca_rt);
@@ -390,17 +433,25 @@ static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *ad
 bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
                          const struct in6_addr *addr)
 {
+        unsigned int hash = inet6_acaddr_hash(net, addr);
+        struct net_device *nh_dev;
+        struct ifacaddr6 *aca;
         bool found = false;
 
         rcu_read_lock();
         if (dev)
                 found = ipv6_chk_acast_dev(dev, addr);
         else
-                for_each_netdev_rcu(net, dev)
-                        if (ipv6_chk_acast_dev(dev, addr)) {
+                hlist_for_each_entry_rcu(aca, &inet6_acaddr_lst[hash],
+                                         aca_addr_lst) {
+                        nh_dev = fib6_info_nh_dev(aca->aca_rt);
+                        if (!nh_dev || !net_eq(dev_net(nh_dev), net))
+                                continue;
+                        if (ipv6_addr_equal(&aca->aca_addr, addr)) {
                                 found = true;
                                 break;
                         }
+                }
         rcu_read_unlock();
         return found;
 }
@@ -540,3 +591,24 @@ void ac6_proc_exit(struct net *net)
         remove_proc_entry("anycast6", net->proc_net);
 }
 #endif
+
+/*      Init / cleanup code
+ */
+int __init ipv6_anycast_init(void)
+{
+        int i;
+
+        for (i = 0; i < IN6_ADDR_HSIZE; i++)
+                INIT_HLIST_HEAD(&inet6_acaddr_lst[i]);
+        return 0;
+}
+
+void ipv6_anycast_cleanup(void)
+{
+        int i;
+
+        spin_lock(&acaddr_hash_lock);
+        for (i = 0; i < IN6_ADDR_HSIZE; i++)
+                WARN_ON(!hlist_empty(&inet6_acaddr_lst[i]));
+        spin_unlock(&acaddr_hash_lock);
+}
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 1b8bc008b53b..ae3786132c23 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -591,7 +591,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 
         /* fib entries are never clones */
         if (arg.filter.flags & RTM_F_CLONED)
-                return skb->len;
+                goto out;
 
         w = (void *)cb->args[2];
         if (!w) {
@@ -621,7 +621,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                 tb = fib6_get_table(net, arg.filter.table_id);
                 if (!tb) {
                         if (arg.filter.dump_all_families)
-                                return skb->len;
+                                goto out;
 
                         NL_SET_ERR_MSG_MOD(cb->extack, "FIB table does not exist");
                         return -ENOENT;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 89e0d5118afe..827a3f5ff3bb 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1354,7 +1354,7 @@ emsgsize:
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        unsigned int pagedlen = 0;
+                        unsigned int pagedlen;
 alloc_new_skb:
                         /* There's no room in the current skb */
                         if (skb)
@@ -1378,6 +1378,7 @@ alloc_new_skb:
                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
                                 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
                         fraglen = datalen + fragheaderlen;
+                        pagedlen = 0;
 
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 5ae8e1c51079..8b075f0bc351 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -24,7 +24,8 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
         unsigned int hh_len;
         struct dst_entry *dst;
         struct flowi6 fl6 = {
-                .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
+                .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
+                        rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
                 .flowi6_mark = skb->mark,
                 .flowi6_uid = sock_net_uid(net, sk),
                 .daddr = iph->daddr,
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 491f808e356a..29c7f1915a96 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -58,8 +58,12 @@ static int __init masquerade_tg6_init(void)
         int err;
 
         err = xt_register_target(&masquerade_tg6_reg);
-        if (err == 0)
-                nf_nat_masquerade_ipv6_register_notifier();
+        if (err)
+                return err;
+
+        err = nf_nat_masquerade_ipv6_register_notifier();
+        if (err)
+                xt_unregister_target(&masquerade_tg6_reg);
 
         return err;
 }
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index b8ac369f98ad..d219979c3e52 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
          */
         ret = -EINPROGRESS;
         if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
-            fq->q.meat == fq->q.len &&
-            nf_ct_frag6_reasm(fq, skb, dev))
-                ret = 0;
-        else
+            fq->q.meat == fq->q.len) {
+                unsigned long orefdst = skb->_skb_refdst;
+
+                skb->_skb_refdst = 0UL;
+                if (nf_ct_frag6_reasm(fq, skb, dev))
+                        ret = 0;
+                skb->_skb_refdst = orefdst;
+        } else {
                 skb_dst_drop(skb);
+        }
 
 out_unlock:
         spin_unlock_bh(&fq->q.lock);
diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
index 3e4bf2286abe..0ad0da5a2600 100644
--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
@@ -132,8 +132,8 @@ static void iterate_cleanup_work(struct work_struct *work)
  * of ipv6 addresses being deleted), we also need to add an upper
  * limit to the number of queued work items.
  */
-static int masq_inet_event(struct notifier_block *this,
-                           unsigned long event, void *ptr)
+static int masq_inet6_event(struct notifier_block *this,
+                            unsigned long event, void *ptr)
 {
         struct inet6_ifaddr *ifa = ptr;
         const struct net_device *dev;
@@ -171,30 +171,53 @@ static int masq_inet_event(struct notifier_block *this,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block masq_inet_notifier = {
-        .notifier_call  = masq_inet_event,
+static struct notifier_block masq_inet6_notifier = {
+        .notifier_call  = masq_inet6_event,
 };
 
-static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
+static int masq_refcnt;
+static DEFINE_MUTEX(masq_mutex);
 
-void nf_nat_masquerade_ipv6_register_notifier(void)
+int nf_nat_masquerade_ipv6_register_notifier(void)
 {
+        int ret = 0;
+
+        mutex_lock(&masq_mutex);
         /* check if the notifier is already set */
-        if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
-                return;
+        if (++masq_refcnt > 1)
+                goto out_unlock;
+
+        ret = register_netdevice_notifier(&masq_dev_notifier);
+        if (ret)
+                goto err_dec;
+
+        ret = register_inet6addr_notifier(&masq_inet6_notifier);
+        if (ret)
+                goto err_unregister;
 
-        register_netdevice_notifier(&masq_dev_notifier);
-        register_inet6addr_notifier(&masq_inet_notifier);
+        mutex_unlock(&masq_mutex);
+        return ret;
+
+err_unregister:
+        unregister_netdevice_notifier(&masq_dev_notifier);
+err_dec:
+        masq_refcnt--;
+out_unlock:
+        mutex_unlock(&masq_mutex);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6_register_notifier);
 
 void nf_nat_masquerade_ipv6_unregister_notifier(void)
 {
+        mutex_lock(&masq_mutex);
         /* check if the notifier still has clients */
-        if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
-                return;
+        if (--masq_refcnt > 0)
+                goto out_unlock;
 
-        unregister_inet6addr_notifier(&masq_inet_notifier);
+        unregister_inet6addr_notifier(&masq_inet6_notifier);
         unregister_netdevice_notifier(&masq_dev_notifier);
+out_unlock:
+        mutex_unlock(&masq_mutex);
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6_unregister_notifier);
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index dd0122f3cffe..e06c82e9dfcd 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -70,7 +70,9 @@ static int __init nft_masq_ipv6_module_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_nat_masquerade_ipv6_register_notifier();
+        ret = nf_nat_masquerade_ipv6_register_notifier();
+        if (ret)
+                nft_unregister_expr(&nft_masq_ipv6_type);
 
         return ret;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 2a7423c39456..059f0531f7c1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2232,8 +2232,7 @@ static void ip6_link_failure(struct sk_buff *skb)
         if (rt) {
                 rcu_read_lock();
                 if (rt->rt6i_flags & RTF_CACHE) {
-                        if (dst_hold_safe(&rt->dst))
-                                rt6_remove_exception_rt(rt);
+                        rt6_remove_exception_rt(rt);
                 } else {
                         struct fib6_info *from;
                         struct fib6_node *fn;
@@ -2360,10 +2359,13 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
 
 void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
 {
+        int oif = sk->sk_bound_dev_if;
         struct dst_entry *dst;
 
-        ip6_update_pmtu(skb, sock_net(sk), mtu,
-                        sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
+        if (!oif && skb->dev)
+                oif = l3mdev_master_ifindex(skb->dev);
+
+        ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid);
 
         dst = __sk_dst_get(sk);
         if (!dst || !dst->obsolete ||
@@ -3214,8 +3216,8 @@ static int ip6_del_cached_rt(struct rt6_info *rt, struct fib6_config *cfg)
         if (cfg->fc_flags & RTF_GATEWAY &&
             !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
                 goto out;
-        if (dst_hold_safe(&rt->dst))
-                rc = rt6_remove_exception_rt(rt);
+
+        rc = rt6_remove_exception_rt(rt);
 out:
         return rc;
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 82cdf9020b53..26f1d435696a 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1490,12 +1490,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
                         goto err_sock;
         }
 
-        sk = sock->sk;
-
-        sock_hold(sk);
-        tunnel->sock = sk;
         tunnel->l2tp_net = net;
-
         pn = l2tp_pernet(net);
 
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1510,6 +1505,10 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
 
+        sk = sock->sk;
+        sock_hold(sk);
+        tunnel->sock = sk;
+
         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
                 struct udp_tunnel_sock_cfg udp_cfg = {
                         .sk_user_data = tunnel,
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index bc4bd247bb7d..1577f2f76060 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
 MODULE_DESCRIPTION("core IP set support");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 
-/* When the nfnl mutex is held: */
+/* When the nfnl mutex or ip_set_ref_lock is held: */
 #define ip_set_dereference(p)           \
-        rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))
+        rcu_dereference_protected(p,    \
+                lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
+                lockdep_is_held(&ip_set_ref_lock))
 #define ip_set(inst, id)                \
         ip_set_dereference((inst)->ip_set_list)[id]
+#define ip_set_ref_netlink(inst,id)     \
+        rcu_dereference_raw((inst)->ip_set_list)[id]
 
 /* The set types are implemented in modules and registered set types
  * can be found in ip_set_type_list. Adding/deleting types is
@@ -693,21 +697,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index)
 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
 
 /* Get the name of a set behind a set index.
- * We assume the set is referenced, so it does exist and
- * can't be destroyed. The set cannot be renamed due to
- * the referencing either.
- *
+ * Set itself is protected by RCU, but its name isn't: to protect against
+ * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
+ * name.
  */
-const char *
-ip_set_name_byindex(struct net *net, ip_set_id_t index)
+void
+ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name)
 {
-        const struct ip_set *set = ip_set_rcu_get(net, index);
+        struct ip_set *set = ip_set_rcu_get(net, index);
 
         BUG_ON(!set);
-        BUG_ON(set->ref == 0);
 
-        /* Referenced, so it's safe */
-        return set->name;
+        read_lock_bh(&ip_set_ref_lock);
+        strncpy(name, set->name, IPSET_MAXNAMELEN);
+        read_unlock_bh(&ip_set_ref_lock);
 }
 EXPORT_SYMBOL_GPL(ip_set_name_byindex);
 
@@ -961,7 +964,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
                         /* Wraparound */
                         goto cleanup;
 
-                list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
+                list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
                 if (!list)
                         goto cleanup;
                 /* nfnl mutex is held, both lists are valid */
@@ -973,7 +976,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
                 /* Use new list */
                 index = inst->ip_set_max;
                 inst->ip_set_max = i;
-                kfree(tmp);
+                kvfree(tmp);
                 ret = 0;
         } else if (ret) {
                 goto cleanup;
@@ -1153,7 +1156,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
         if (!set)
                 return -ENOENT;
 
-        read_lock_bh(&ip_set_ref_lock);
+        write_lock_bh(&ip_set_ref_lock);
         if (set->ref != 0) {
                 ret = -IPSET_ERR_REFERENCED;
                 goto out;
@@ -1170,7 +1173,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
         strncpy(set->name, name2, IPSET_MAXNAMELEN);
 
 out:
-        read_unlock_bh(&ip_set_ref_lock);
+        write_unlock_bh(&ip_set_ref_lock);
         return ret;
 }
 
@@ -1252,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb)
                 struct ip_set_net *inst =
                         (struct ip_set_net *)cb->args[IPSET_CB_NET];
                 ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
-                struct ip_set *set = ip_set(inst, index);
+                struct ip_set *set = ip_set_ref_netlink(inst, index);
 
                 if (set->variant->uref)
                         set->variant->uref(set, cb, false);
@@ -1441,7 +1444,7 @@ next_set:
 release_refcount:
         /* If there was an error or set is done, release set */
         if (ret || !cb->args[IPSET_CB_ARG0]) {
-                set = ip_set(inst, index);
+                set = ip_set_ref_netlink(inst, index);
                 if (set->variant->uref)
                         set->variant->uref(set, cb, false);
                 pr_debug("release set %s\n", set->name);
@@ -2059,7 +2062,7 @@ ip_set_net_init(struct net *net)
         if (inst->ip_set_max >= IPSET_INVALID_ID)
                 inst->ip_set_max = IPSET_INVALID_ID - 1;
 
-        list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
+        list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
         if (!list)
                 return -ENOMEM;
         inst->is_deleted = false;
@@ -2087,7 +2090,7 @@ ip_set_net_exit(struct net *net)
                 }
         }
         nfnl_unlock(NFNL_SUBSYS_IPSET);
-        kfree(rcu_dereference_protected(inst->ip_set_list, 1));
+        kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
 }
 
 static struct pernet_operations ip_set_net_ops = {
diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
index d391485a6acd..613e18e720a4 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (tb[IPSET_ATTR_CIDR]) {
                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-                if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
+                if (e.cidr[0] > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
         }
 
         if (tb[IPSET_ATTR_CIDR2]) {
                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-                if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
+                if (e.cidr[1] > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
         }
 
@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (tb[IPSET_ATTR_CIDR]) {
                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-                if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
+                if (e.cidr[0] > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
         }
 
         if (tb[IPSET_ATTR_CIDR2]) {
                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-                if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
+                if (e.cidr[1] > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
         }
 
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 072a658fde04..4eef55da0878 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu)
 {
         struct set_elem *e = container_of(rcu, struct set_elem, rcu);
         struct ip_set *set = e->set;
-        struct list_set *map = set->data;
 
-        ip_set_put_byindex(map->net, e->id);
         ip_set_ext_destroy(set, e);
         kfree(e);
 }
@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu)
 static inline void
 list_set_del(struct ip_set *set, struct set_elem *e)
 {
+        struct list_set *map = set->data;
+
         set->elements--;
         list_del_rcu(&e->list);
+        ip_set_put_byindex(map->net, e->id);
         call_rcu(&e->rcu, __list_set_del_rcu);
 }
 
 static inline void
-list_set_replace(struct set_elem *e, struct set_elem *old)
+list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old)
 {
+        struct list_set *map = set->data;
+
         list_replace_rcu(&old->list, &e->list);
+        ip_set_put_byindex(map->net, old->id);
         call_rcu(&old->rcu, __list_set_del_rcu);
 }
 
@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
         INIT_LIST_HEAD(&e->list);
         list_set_init_extensions(set, ext, e);
         if (n)
-                list_set_replace(e, n);
+                list_set_replace(set, e, n);
         else if (next)
                 list_add_tail_rcu(&e->list, &next->list);
         else if (prev)
@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set,
         const struct list_set *map = set->data;
         struct nlattr *atd, *nested;
         u32 i = 0, first = cb->args[IPSET_CB_ARG0];
+        char name[IPSET_MAXNAMELEN];
         struct set_elem *e;
         int ret = 0;
 
@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set,
                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
                 if (!nested)
                         goto nla_put_failure;
-                if (nla_put_string(skb, IPSET_ATTR_NAME,
-                                   ip_set_name_byindex(map->net, e->id)))
+                ip_set_name_byindex(map->net, e->id, name);
+                if (nla_put_string(skb, IPSET_ATTR_NAME, name))
                         goto nla_put_failure;
                 if (ip_set_put_extensions(skb, set, e, true))
                         goto nla_put_failure;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 83395bf6dc35..432141f04af3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3980,6 +3980,9 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs)
 
 static struct notifier_block ip_vs_dst_notifier = {
         .notifier_call = ip_vs_dst_event,
+#ifdef CONFIG_IP_VS_IPV6
+        .priority = ADDRCONF_NOTIFY_PRIORITY + 5,
+#endif
 };
 
 int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 02ca7df793f5..b6d0f6deea86 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -49,6 +49,7 @@ struct nf_conncount_tuple {
         struct nf_conntrack_zone        zone;
         int                             cpu;
         u32                             jiffies32;
+        bool                            dead;
         struct rcu_head                 rcu_head;
 };
 
@@ -106,15 +107,16 @@ nf_conncount_add(struct nf_conncount_list *list,
         conn->zone = *zone;
         conn->cpu = raw_smp_processor_id();
         conn->jiffies32 = (u32)jiffies;
-        spin_lock(&list->list_lock);
+        conn->dead = false;
+        spin_lock_bh(&list->list_lock);
         if (list->dead == true) {
                 kmem_cache_free(conncount_conn_cachep, conn);
-                spin_unlock(&list->list_lock);
+                spin_unlock_bh(&list->list_lock);
                 return NF_CONNCOUNT_SKIP;
         }
         list_add_tail(&conn->node, &list->head);
         list->count++;
-        spin_unlock(&list->list_lock);
+        spin_unlock_bh(&list->list_lock);
         return NF_CONNCOUNT_ADDED;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_add);
@@ -132,19 +134,22 @@ static bool conn_free(struct nf_conncount_list *list,
 {
         bool free_entry = false;
 
-        spin_lock(&list->list_lock);
+        spin_lock_bh(&list->list_lock);
 
-        if (list->count == 0) {
-                spin_unlock(&list->list_lock);
-                return free_entry;
+        if (conn->dead) {
+                spin_unlock_bh(&list->list_lock);
+                return free_entry;
         }
 
         list->count--;
+        conn->dead = true;
         list_del_rcu(&conn->node);
-        if (list->count == 0)
+        if (list->count == 0) {
+                list->dead = true;
                 free_entry = true;
+        }
 
-        spin_unlock(&list->list_lock);
+        spin_unlock_bh(&list->list_lock);
         call_rcu(&conn->rcu_head, __conn_free);
         return free_entry;
 }
@@ -245,7 +250,7 @@ void nf_conncount_list_init(struct nf_conncount_list *list)
 {
         spin_lock_init(&list->list_lock);
         INIT_LIST_HEAD(&list->head);
-        list->count = 1;
+        list->count = 0;
         list->dead = false;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_list_init);
@@ -259,6 +264,7 @@ bool nf_conncount_gc_list(struct net *net,
         struct nf_conn *found_ct;
         unsigned int collected = 0;
         bool free_entry = false;
+        bool ret = false;
 
         list_for_each_entry_safe(conn, conn_n, &list->head, node) {
                 found = find_or_evict(net, list, conn, &free_entry);
@@ -288,7 +294,15 @@ bool nf_conncount_gc_list(struct net *net,
                 if (collected > CONNCOUNT_GC_MAX_NODES)
                         return false;
         }
-        return false;
+
+        spin_lock_bh(&list->list_lock);
+        if (!list->count) {
+                list->dead = true;
+                ret = true;
+        }
+        spin_unlock_bh(&list->list_lock);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_gc_list);
 
@@ -309,11 +323,8 @@ static void tree_nodes_free(struct rb_root *root,
         while (gc_count) {
                 rbconn = gc_nodes[--gc_count];
                 spin_lock(&rbconn->list.list_lock);
-                if (rbconn->list.count == 0 && rbconn->list.dead == false) {
-                        rbconn->list.dead = true;
-                        rb_erase(&rbconn->node, root);
-                        call_rcu(&rbconn->rcu_head, __tree_nodes_free);
-                }
+                rb_erase(&rbconn->node, root);
+                call_rcu(&rbconn->rcu_head, __tree_nodes_free);
                 spin_unlock(&rbconn->list.list_lock);
         }
 }
@@ -414,6 +425,7 @@ insert_tree(struct net *net,
         nf_conncount_list_init(&rbconn->list);
         list_add(&conn->node, &rbconn->list.head);
         count = 1;
+        rbconn->list.count = count;
 
         rb_link_node(&rbconn->node, parent, rbnode);
         rb_insert_color(&rbconn->node, root);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ca1168d67fac..e92e749aff53 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net,
         return drops;
 }
 
-static noinline int early_drop(struct net *net, unsigned int _hash)
+static noinline int early_drop(struct net *net, unsigned int hash)
 {
-        unsigned int i;
+        unsigned int i, bucket;
 
         for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
                 struct hlist_nulls_head *ct_hash;
-                unsigned int hash, hsize, drops;
+                unsigned int hsize, drops;
 
                 rcu_read_lock();
                 nf_conntrack_get_ht(&ct_hash, &hsize);
-                hash = reciprocal_scale(_hash++, hsize);
+                if (!i)
+                        bucket = reciprocal_scale(hash, hsize);
+                else
+                        bucket = (bucket + 1) % hsize;
 
-                drops = early_drop_list(net, &ct_hash[hash]);
+                drops = early_drop_list(net, &ct_hash[bucket]);
                 rcu_read_unlock();
 
                 if (drops) {
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 171e9e122e5f..023c1445bc39 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -384,11 +384,6 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
         },
 };
 
-static inline struct nf_dccp_net *dccp_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.dccp;
-}
-
 static noinline bool
 dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
          const struct dccp_hdr *dh)
@@ -401,7 +396,7 @@ dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
         state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
         switch (state) {
         default:
-                dn = dccp_pernet(net);
+                dn = nf_dccp_pernet(net);
                 if (dn->dccp_loose == 0) {
                         msg = "not picking up existing connection ";
                         goto out_invalid;
@@ -568,7 +563,7 @@ static int dccp_packet(struct nf_conn *ct, struct sk_buff *skb,
 
         timeouts = nf_ct_timeout_lookup(ct);
         if (!timeouts)
-                timeouts = dccp_pernet(nf_ct_net(ct))->dccp_timeout;
+                timeouts = nf_dccp_pernet(nf_ct_net(ct))->dccp_timeout;
         nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
 
         return NF_ACCEPT;
@@ -681,7 +676,7 @@ static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
 static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
                                       struct net *net, void *data)
 {
-        struct nf_dccp_net *dn = dccp_pernet(net);
+        struct nf_dccp_net *dn = nf_dccp_pernet(net);
         unsigned int *timeouts = data;
         int i;
 
@@ -814,7 +809,7 @@ static int dccp_kmemdup_sysctl_table(struct net *net, struct nf_proto_net *pn,
 
 static int dccp_init_net(struct net *net)
 {
-        struct nf_dccp_net *dn = dccp_pernet(net);
+        struct nf_dccp_net *dn = nf_dccp_pernet(net);
         struct nf_proto_net *pn = &dn->pn;
 
         if (!pn->users) {
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index e10e867e0b55..5da19d5fbc76 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -27,11 +27,6 @@ static bool nf_generic_should_process(u8 proto)
         }
 }
 
-static inline struct nf_generic_net *generic_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.generic;
-}
-
 static bool generic_pkt_to_tuple(const struct sk_buff *skb,
                                  unsigned int dataoff,
                                  struct net *net, struct nf_conntrack_tuple *tuple)
@@ -58,7 +53,7 @@ static int generic_packet(struct nf_conn *ct,
         }
 
         if (!timeout)
-                timeout = &generic_pernet(nf_ct_net(ct))->timeout;
+                timeout = &nf_generic_pernet(nf_ct_net(ct))->timeout;
 
         nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
         return NF_ACCEPT;
@@ -72,7 +67,7 @@ static int generic_packet(struct nf_conn *ct,
 static int generic_timeout_nlattr_to_obj(struct nlattr *tb[],
                                          struct net *net, void *data)
 {
-        struct nf_generic_net *gn = generic_pernet(net);
+        struct nf_generic_net *gn = nf_generic_pernet(net);
         unsigned int *timeout = data;
 
         if (!timeout)
@@ -138,7 +133,7 @@ static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn,
 
 static int generic_init_net(struct net *net)
 {
-        struct nf_generic_net *gn = generic_pernet(net);
+        struct nf_generic_net *gn = nf_generic_pernet(net);
         struct nf_proto_net *pn = &gn->pn;
 
         gn->timeout = nf_ct_generic_timeout;
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 9b48dc8b4b88..2a5e56c6d8d9 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -43,24 +43,12 @@
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
-enum grep_conntrack {
-        GRE_CT_UNREPLIED,
-        GRE_CT_REPLIED,
-        GRE_CT_MAX
-};
-
 static const unsigned int gre_timeouts[GRE_CT_MAX] = {
         [GRE_CT_UNREPLIED]      = 30*HZ,
         [GRE_CT_REPLIED]        = 180*HZ,
 };
 
 static unsigned int proto_gre_net_id __read_mostly;
-struct netns_proto_gre {
-        struct nf_proto_net     nf;
-        rwlock_t                keymap_lock;
-        struct list_head        keymap_list;
-        unsigned int            gre_timeouts[GRE_CT_MAX];
-};
 
 static inline struct netns_proto_gre *gre_pernet(struct net *net)
 {
@@ -402,6 +390,8 @@ static int __init nf_ct_proto_gre_init(void)
 {
         int ret;
 
+        BUILD_BUG_ON(offsetof(struct netns_proto_gre, nf) != 0);
+
         ret = register_pernet_subsys(&proto_gre_net_ops);
         if (ret < 0)
                 goto out_pernet;
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 3598520bd19b..de64d8a5fdfd 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -25,11 +25,6 @@
 
 static const unsigned int nf_ct_icmp_timeout = 30*HZ;
 
-static inline struct nf_icmp_net *icmp_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.icmp;
-}
-
 static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
                               struct net *net, struct nf_conntrack_tuple *tuple)
 {
@@ -103,7 +98,7 @@ static int icmp_packet(struct nf_conn *ct,
         }
 
         if (!timeout)
-                timeout = &icmp_pernet(nf_ct_net(ct))->timeout;
+                timeout = &nf_icmp_pernet(nf_ct_net(ct))->timeout;
 
         nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
         return NF_ACCEPT;
@@ -275,7 +270,7 @@ static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[],
                                       struct net *net, void *data)
 {
         unsigned int *timeout = data;
-        struct nf_icmp_net *in = icmp_pernet(net);
+        struct nf_icmp_net *in = nf_icmp_pernet(net);
 
         if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) {
                 if (!timeout)
@@ -337,7 +332,7 @@ static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn,
 
 static int icmp_init_net(struct net *net)
 {
-        struct nf_icmp_net *in = icmp_pernet(net);
+        struct nf_icmp_net *in = nf_icmp_pernet(net);
         struct nf_proto_net *pn = &in->pn;
 
         in->timeout = nf_ct_icmp_timeout;
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index 378618feed5d..a15eefb8e317 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -30,11 +30,6 @@
 
 static const unsigned int nf_ct_icmpv6_timeout = 30*HZ;
 
-static inline struct nf_icmp_net *icmpv6_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.icmpv6;
-}
-
 static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
                                 struct net *net,
@@ -87,7 +82,7 @@ static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 
 static unsigned int *icmpv6_get_timeouts(struct net *net)
 {
-        return &icmpv6_pernet(net)->timeout;
+        return &nf_icmpv6_pernet(net)->timeout;
 }
 
 /* Returns verdict for packet, or -1 for invalid. */
@@ -286,7 +281,7 @@ static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[],
                                         struct net *net, void *data)
 {
         unsigned int *timeout = data;
-        struct nf_icmp_net *in = icmpv6_pernet(net);
+        struct nf_icmp_net *in = nf_icmpv6_pernet(net);
 
         if (!timeout)
                 timeout = icmpv6_get_timeouts(net);
@@ -348,7 +343,7 @@ static int icmpv6_kmemdup_sysctl_table(struct nf_proto_net *pn,
 
 static int icmpv6_init_net(struct net *net)
 {
-        struct nf_icmp_net *in = icmpv6_pernet(net);
+        struct nf_icmp_net *in = nf_icmpv6_pernet(net);
         struct nf_proto_net *pn = &in->pn;
 
         in->timeout = nf_ct_icmpv6_timeout;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 3d719d3eb9a3..d53e3e78f605 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -146,11 +146,6 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
         }
 };
 
-static inline struct nf_sctp_net *sctp_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.sctp;
-}
-
 #ifdef CONFIG_NF_CONNTRACK_PROCFS
 /* Print out the private part of the conntrack. */
 static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
@@ -480,7 +475,7 @@ static int sctp_packet(struct nf_conn *ct,
 
         timeouts = nf_ct_timeout_lookup(ct);
         if (!timeouts)
-                timeouts = sctp_pernet(nf_ct_net(ct))->timeouts;
+                timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
 
         nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
 
@@ -599,7 +594,7 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
                                       struct net *net, void *data)
 {
         unsigned int *timeouts = data;
-        struct nf_sctp_net *sn = sctp_pernet(net);
+        struct nf_sctp_net *sn = nf_sctp_pernet(net);
         int i;
 
         /* set default SCTP timeouts. */
@@ -736,7 +731,7 @@ static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn,
 
 static int sctp_init_net(struct net *net)
 {
-        struct nf_sctp_net *sn = sctp_pernet(net);
+        struct nf_sctp_net *sn = nf_sctp_pernet(net);
         struct nf_proto_net *pn = &sn->pn;
 
         if (!pn->users) {
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 1bcf9984d45e..4dcbd51a8e97 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -272,11 +272,6 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
         }
 };
 
-static inline struct nf_tcp_net *tcp_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.tcp;
-}
-
 #ifdef CONFIG_NF_CONNTRACK_PROCFS
 /* Print out the private part of the conntrack. */
 static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
@@ -475,7 +470,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                           const struct tcphdr *tcph)
 {
         struct net *net = nf_ct_net(ct);
-        struct nf_tcp_net *tn = tcp_pernet(net);
+        struct nf_tcp_net *tn = nf_tcp_pernet(net);
         struct ip_ct_tcp_state *sender = &state->seen[dir];
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
@@ -767,7 +762,7 @@ static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
 {
         enum tcp_conntrack new_state;
         struct net *net = nf_ct_net(ct);
-        const struct nf_tcp_net *tn = tcp_pernet(net);
+        const struct nf_tcp_net *tn = nf_tcp_pernet(net);
         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
 
@@ -841,7 +836,7 @@ static int tcp_packet(struct nf_conn *ct,
                       const struct nf_hook_state *state)
 {
         struct net *net = nf_ct_net(ct);
-        struct nf_tcp_net *tn = tcp_pernet(net);
+        struct nf_tcp_net *tn = nf_tcp_pernet(net);
         struct nf_conntrack_tuple *tuple;
         enum tcp_conntrack new_state, old_state;
         unsigned int index, *timeouts;
@@ -1283,7 +1278,7 @@ static unsigned int tcp_nlattr_tuple_size(void)
 static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
                                      struct net *net, void *data)
 {
-        struct nf_tcp_net *tn = tcp_pernet(net);
+        struct nf_tcp_net *tn = nf_tcp_pernet(net);
         unsigned int *timeouts = data;
         int i;
 
@@ -1508,7 +1503,7 @@ static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
 
 static int tcp_init_net(struct net *net)
 {
-        struct nf_tcp_net *tn = tcp_pernet(net);
+        struct nf_tcp_net *tn = nf_tcp_pernet(net);
         struct nf_proto_net *pn = &tn->pn;
 
         if (!pn->users) {
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index a7aa70370913..c879d8d78cfd 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -32,14 +32,9 @@ static const unsigned int udp_timeouts[UDP_CT_MAX] = {
         [UDP_CT_REPLIED]        = 180*HZ,
 };
 
-static inline struct nf_udp_net *udp_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.udp;
-}
-
 static unsigned int *udp_get_timeouts(struct net *net)
 {
-        return udp_pernet(net)->timeouts;
+        return nf_udp_pernet(net)->timeouts;
 }
 
 static void udp_error_log(const struct sk_buff *skb,
@@ -212,7 +207,7 @@ static int udp_timeout_nlattr_to_obj(struct nlattr *tb[],
                                      struct net *net, void *data)
 {
         unsigned int *timeouts = data;
-        struct nf_udp_net *un = udp_pernet(net);
+        struct nf_udp_net *un = nf_udp_pernet(net);
 
         if (!timeouts)
                 timeouts = un->timeouts;
@@ -292,7 +287,7 @@ static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn,
 
 static int udp_init_net(struct net *net)
 {
-        struct nf_udp_net *un = udp_pernet(net);
+        struct nf_udp_net *un = nf_udp_pernet(net);
         struct nf_proto_net *pn = &un->pn;
 
         if (!pn->users) {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 42487d01a3ed..2e61aab6ed73 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2457,7 +2457,7 @@ err:
 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
                                    struct nft_rule *rule)
 {
-        struct nft_expr *expr;
+        struct nft_expr *expr, *next;
 
         /*
          * Careful: some expressions might not be initialized in case this
@@ -2465,8 +2465,9 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
          */
         expr = nft_expr_first(rule);
         while (expr != nft_expr_last(rule) && expr->ops) {
+                next = nft_expr_next(expr);
                 nf_tables_expr_destroy(ctx, expr);
-                expr = nft_expr_next(expr);
+                expr = next;
         }
         kfree(rule);
 }
@@ -2589,17 +2590,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
 
                 if (chain->use == UINT_MAX)
                         return -EOVERFLOW;
-        }
-
-        if (nla[NFTA_RULE_POSITION]) {
-                if (!(nlh->nlmsg_flags & NLM_F_CREATE))
-                        return -EOPNOTSUPP;
 
-                pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
-                old_rule = __nft_rule_lookup(chain, pos_handle);
-                if (IS_ERR(old_rule)) {
-                        NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
-                        return PTR_ERR(old_rule);
+                if (nla[NFTA_RULE_POSITION]) {
+                        pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
+                        old_rule = __nft_rule_lookup(chain, pos_handle);
+                        if (IS_ERR(old_rule)) {
+                                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
+                                return PTR_ERR(old_rule);
+                        }
                 }
         }
 
@@ -2669,21 +2667,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
         }
 
         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
-                if (!nft_is_active_next(net, old_rule)) {
-                        err = -ENOENT;
-                        goto err2;
-                }
-                trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
-                                           old_rule);
+                trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
                 if (trans == NULL) {
                         err = -ENOMEM;
                         goto err2;
                 }
-                nft_deactivate_next(net, old_rule);
-                chain->use--;
-
-                if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
-                        err = -ENOMEM;
+                err = nft_delrule(&ctx, old_rule);
+                if (err < 0) {
+                        nft_trans_destroy(trans);
                         goto err2;
                 }
 
@@ -6324,7 +6315,7 @@ static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
         call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
 }
 
-static void nf_tables_commit_chain_active(struct net *net, struct nft_chain *chain)
+static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
 {
         struct nft_rule **g0, **g1;
         bool next_genbit;
@@ -6441,11 +6432,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
 
         /* step 2.  Make rules_gen_X visible to packet path */
         list_for_each_entry(table, &net->nft.tables, list) {
-                list_for_each_entry(chain, &table->chains, list) {
-                        if (!nft_is_active_next(net, chain))
-                                continue;
-                        nf_tables_commit_chain_active(net, chain);
-                }
+                list_for_each_entry(chain, &table->chains, list)
+                        nf_tables_commit_chain(net, chain);
         }
 
         /*
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index e7a50af1b3d6..109b0d27345a 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -382,7 +382,8 @@ err:
 static int
 cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
                             u32 seq, u32 type, int event, u16 l3num,
-                            const struct nf_conntrack_l4proto *l4proto)
+                            const struct nf_conntrack_l4proto *l4proto,
+                            const unsigned int *timeouts)
 {
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
@@ -408,7 +409,7 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
         if (!nest_parms)
                 goto nla_put_failure;
 
-        ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, NULL);
+        ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
         if (ret < 0)
                 goto nla_put_failure;
 
@@ -430,6 +431,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
                                  struct netlink_ext_ack *extack)
 {
         const struct nf_conntrack_l4proto *l4proto;
+        unsigned int *timeouts = NULL;
         struct sk_buff *skb2;
         int ret, err;
         __u16 l3num;
@@ -442,12 +444,55 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
         l4proto = nf_ct_l4proto_find_get(l4num);
 
-        /* This protocol is not supported, skip. */
-        if (l4proto->l4proto != l4num) {
-                err = -EOPNOTSUPP;
+        err = -EOPNOTSUPP;
+        if (l4proto->l4proto != l4num)
                 goto err;
+
+        switch (l4proto->l4proto) {
+        case IPPROTO_ICMP:
+                timeouts = &nf_icmp_pernet(net)->timeout;
+                break;
+        case IPPROTO_TCP:
+                timeouts = nf_tcp_pernet(net)->timeouts;
+                break;
+        case IPPROTO_UDP: /* fallthrough */
+        case IPPROTO_UDPLITE:
+                timeouts = nf_udp_pernet(net)->timeouts;
+                break;
+        case IPPROTO_DCCP:
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+                timeouts = nf_dccp_pernet(net)->dccp_timeout;
+#endif
+                break;
+        case IPPROTO_ICMPV6:
+                timeouts = &nf_icmpv6_pernet(net)->timeout;
+                break;
+        case IPPROTO_SCTP:
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+                timeouts = nf_sctp_pernet(net)->timeouts;
+#endif
+                break;
+        case IPPROTO_GRE:
+#ifdef CONFIG_NF_CT_PROTO_GRE
+                if (l4proto->net_id) {
+                        struct netns_proto_gre *net_gre;
+
+                        net_gre = net_generic(net, *l4proto->net_id);
+                        timeouts = net_gre->gre_timeouts;
+                }
+#endif
+                break;
+        case 255:
+                timeouts = &nf_generic_pernet(net)->timeout;
+                break;
+        default:
+                WARN_ONCE(1, "Missing timeouts for proto %d", l4proto->l4proto);
+                break;
         }
 
+        if (!timeouts)
+                goto err;
+
         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (skb2 == NULL) {
                 err = -ENOMEM;
@@ -458,8 +503,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
                                           nlh->nlmsg_seq,
                                           NFNL_MSG_TYPE(nlh->nlmsg_type),
                                           IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
-                                          l3num,
-                                          l4proto);
+                                          l3num, l4proto, timeouts);
         if (ret <= 0) {
                 kfree_skb(skb2);
                 err = -ENOMEM;
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 768292eac2a4..7334e0b80a5e 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt)
         return false;
 }
 
-static int nft_compat_chain_validate_dependency(const char *tablename,
-                                                const struct nft_chain *chain)
+static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
+                                                const char *tablename)
 {
+        enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
+        const struct nft_chain *chain = ctx->chain;
         const struct nft_base_chain *basechain;
 
         if (!tablename ||
@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
                 return 0;
 
         basechain = nft_base_chain(chain);
-        if (strcmp(tablename, "nat") == 0 &&
-            basechain->type->type != NFT_CHAIN_T_NAT)
-                return -EINVAL;
+        if (strcmp(tablename, "nat") == 0) {
+                if (ctx->family != NFPROTO_BRIDGE)
+                        type = NFT_CHAIN_T_NAT;
+                if (basechain->type->type != type)
+                        return -EINVAL;
+        }
 
         return 0;
 }
@@ -342,8 +347,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
                 if (target->hooks && !(hook_mask & target->hooks))
                         return -EINVAL;
 
-                ret = nft_compat_chain_validate_dependency(target->table,
-                                                           ctx->chain);
+                ret = nft_compat_chain_validate_dependency(ctx, target->table);
                 if (ret < 0)
                         return ret;
         }
@@ -516,6 +520,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
                     void *info)
 {
         struct xt_match *match = expr->ops->data;
+        struct module *me = match->me;
         struct xt_mtdtor_param par;
 
         par.net = ctx->net;
@@ -526,7 +531,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 par.match->destroy(&par);
 
         if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
-                module_put(match->me);
+                module_put(me);
 }
 
 static void
@@ -590,8 +595,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
                 if (match->hooks && !(hook_mask & match->hooks))
                         return -EINVAL;
 
-                ret = nft_compat_chain_validate_dependency(match->table,
-                                                           ctx->chain);
+                ret = nft_compat_chain_validate_dependency(ctx, match->table);
                 if (ret < 0)
                         return ret;
         }
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index e82d9a966c45..974525eb92df 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -214,7 +214,9 @@ static int __init nft_flow_offload_module_init(void)
 {
         int err;
 
-        register_netdevice_notifier(&flow_offload_netdev_notifier);
+        err = register_netdevice_notifier(&flow_offload_netdev_notifier);
+        if (err)
+                goto err;
 
         err = nft_register_expr(&nft_flow_offload_type);
         if (err < 0)
@@ -224,6 +226,7 @@ static int __init nft_flow_offload_module_init(void)
 
 register_expr:
         unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+err:
         return err;
 }
 
diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
index 649d1700ec5b..3cc1b3dc3c3c 100644
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -24,7 +24,6 @@ struct nft_ng_inc {
         u32                     modulus;
         atomic_t                counter;
         u32                     offset;
-        struct nft_set          *map;
 };
 
 static u32 nft_ng_inc_gen(struct nft_ng_inc *priv)
@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
         regs->data[priv->dreg] = nft_ng_inc_gen(priv);
 }
 
-static void nft_ng_inc_map_eval(const struct nft_expr *expr,
-                                struct nft_regs *regs,
-                                const struct nft_pktinfo *pkt)
-{
-        struct nft_ng_inc *priv = nft_expr_priv(expr);
-        const struct nft_set *map = priv->map;
-        const struct nft_set_ext *ext;
-        u32 result;
-        bool found;
-
-        result = nft_ng_inc_gen(priv);
-        found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
-
-        if (!found)
-                return;
-
-        nft_data_copy(&regs->data[priv->dreg],
-                      nft_set_ext_data(ext), map->dlen);
-}
-
 static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
         [NFTA_NG_DREG]          = { .type = NLA_U32 },
         [NFTA_NG_MODULUS]       = { .type = NLA_U32 },
         [NFTA_NG_TYPE]          = { .type = NLA_U32 },
         [NFTA_NG_OFFSET]        = { .type = NLA_U32 },
-        [NFTA_NG_SET_NAME]      = { .type = NLA_STRING,
-                                    .len = NFT_SET_MAXNAMELEN - 1 },
-        [NFTA_NG_SET_ID]        = { .type = NLA_U32 },
 };
 
 static int nft_ng_inc_init(const struct nft_ctx *ctx,
@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
                                            NFT_DATA_VALUE, sizeof(u32));
 }
 
-static int nft_ng_inc_map_init(const struct nft_ctx *ctx,
-                               const struct nft_expr *expr,
-                               const struct nlattr * const tb[])
-{
-        struct nft_ng_inc *priv = nft_expr_priv(expr);
-        u8 genmask = nft_genmask_next(ctx->net);
-
-        nft_ng_inc_init(ctx, expr, tb);
-
-        priv->map = nft_set_lookup_global(ctx->net, ctx->table,
-                                          tb[NFTA_NG_SET_NAME],
-                                          tb[NFTA_NG_SET_ID], genmask);
-
-        return PTR_ERR_OR_ZERO(priv->map);
-}
-
 static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
                        u32 modulus, enum nft_ng_types type, u32 offset)
 {
@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
                            priv->offset);
 }
 
-static int nft_ng_inc_map_dump(struct sk_buff *skb,
-                               const struct nft_expr *expr)
-{
-        const struct nft_ng_inc *priv = nft_expr_priv(expr);
-
-        if (nft_ng_dump(skb, priv->dreg, priv->modulus,
-                        NFT_NG_INCREMENTAL, priv->offset) ||
-            nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
-                goto nla_put_failure;
-
-        return 0;
-
-nla_put_failure:
-        return -1;
-}
-
 struct nft_ng_random {
         enum nft_registers      dreg:8;
         u32                     modulus;
         u32                     offset;
-        struct nft_set          *map;
 };
 
 static u32 nft_ng_random_gen(struct nft_ng_random *priv)
@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr,
         regs->data[priv->dreg] = nft_ng_random_gen(priv);
 }
 
-static void nft_ng_random_map_eval(const struct nft_expr *expr,
-                                   struct nft_regs *regs,
-                                   const struct nft_pktinfo *pkt)
-{
-        struct nft_ng_random *priv = nft_expr_priv(expr);
-        const struct nft_set *map = priv->map;
-        const struct nft_set_ext *ext;
-        u32 result;
-        bool found;
-
-        result = nft_ng_random_gen(priv);
-        found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
-        if (!found)
-                return;
-
-        nft_data_copy(&regs->data[priv->dreg],
-                      nft_set_ext_data(ext), map->dlen);
-}
-
 static int nft_ng_random_init(const struct nft_ctx *ctx,
                               const struct nft_expr *expr,
                               const struct nlattr * const tb[])
@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
                                            NFT_DATA_VALUE, sizeof(u32));
 }
 
-static int nft_ng_random_map_init(const struct nft_ctx *ctx,
-                                  const struct nft_expr *expr,
-                                  const struct nlattr * const tb[])
-{
-        struct nft_ng_random *priv = nft_expr_priv(expr);
-        u8 genmask = nft_genmask_next(ctx->net);
-
-        nft_ng_random_init(ctx, expr, tb);
-        priv->map = nft_set_lookup_global(ctx->net, ctx->table,
-                                          tb[NFTA_NG_SET_NAME],
-                                          tb[NFTA_NG_SET_ID], genmask);
-
-        return PTR_ERR_OR_ZERO(priv->map);
-}
-
 static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         const struct nft_ng_random *priv = nft_expr_priv(expr);
@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
                            priv->offset);
 }
 
-static int nft_ng_random_map_dump(struct sk_buff *skb,
-                                  const struct nft_expr *expr)
-{
-        const struct nft_ng_random *priv = nft_expr_priv(expr);
-
-        if (nft_ng_dump(skb, priv->dreg, priv->modulus,
-                        NFT_NG_RANDOM, priv->offset) ||
-            nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
-                goto nla_put_failure;
-
-        return 0;
-
-nla_put_failure:
-        return -1;
-}
-
 static struct nft_expr_type nft_ng_type;
 static const struct nft_expr_ops nft_ng_inc_ops = {
         .type           = &nft_ng_type,
@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = {
         .dump           = nft_ng_inc_dump,
 };
 
-static const struct nft_expr_ops nft_ng_inc_map_ops = {
-        .type           = &nft_ng_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)),
-        .eval           = nft_ng_inc_map_eval,
-        .init           = nft_ng_inc_map_init,
-        .dump           = nft_ng_inc_map_dump,
-};
-
 static const struct nft_expr_ops nft_ng_random_ops = {
         .type           = &nft_ng_type,
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = {
         .dump           = nft_ng_random_dump,
 };
 
-static const struct nft_expr_ops nft_ng_random_map_ops = {
-        .type           = &nft_ng_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
-        .eval           = nft_ng_random_map_eval,
-        .init           = nft_ng_random_map_init,
-        .dump           = nft_ng_random_map_dump,
-};
-
 static const struct nft_expr_ops *
 nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
 {
@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
 
         switch (type) {
         case NFT_NG_INCREMENTAL:
-                if (tb[NFTA_NG_SET_NAME])
-                        return &nft_ng_inc_map_ops;
                 return &nft_ng_inc_ops;
         case NFT_NG_RANDOM:
-                if (tb[NFTA_NG_SET_NAME])
-                        return &nft_ng_random_map_ops;
                 return &nft_ng_random_ops;
         }
 
diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index ca5e5d8c5ef8..b13618c764ec 100644
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -50,7 +50,7 @@ static int nft_osf_init(const struct nft_ctx *ctx,
         int err;
         u8 ttl;
 
-        if (nla_get_u8(tb[NFTA_OSF_TTL])) {
+        if (tb[NFTA_OSF_TTL]) {
                 ttl = nla_get_u8(tb[NFTA_OSF_TTL]);
                 if (ttl > 2)
                         return -EINVAL;
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index c6acfc2d9c84..eb4cbd244c3d 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -114,6 +114,22 @@ static void idletimer_tg_expired(struct timer_list *t)
         schedule_work(&timer->work);
 }
 
+static int idletimer_check_sysfs_name(const char *name, unsigned int size)
+{
+        int ret;
+
+        ret = xt_check_proc_name(name, size);
+        if (ret < 0)
+                return ret;
+
+        if (!strcmp(name, "power") ||
+            !strcmp(name, "subsystem") ||
+            !strcmp(name, "uevent"))
+                return -EINVAL;
+
+        return 0;
+}
+
 static int idletimer_tg_create(struct idletimer_tg_info *info)
 {
         int ret;
@@ -124,6 +140,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
                 goto out;
         }
 
+        ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
+        if (ret < 0)
+                goto out_free_timer;
+
         sysfs_attr_init(&info->timer->attr.attr);
         info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
         if (!info->timer->attr.attr.name) {
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index dec843cadf46..9e05c86ba5c4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -201,18 +201,8 @@ static __net_init int xt_rateest_net_init(struct net *net)
         return 0;
 }
 
-static void __net_exit xt_rateest_net_exit(struct net *net)
-{
-        struct xt_rateest_net *xn = net_generic(net, xt_rateest_id);
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(xn->hash); i++)
-                WARN_ON_ONCE(!hlist_empty(&xn->hash[i]));
-}
-
 static struct pernet_operations xt_rateest_net_ops = {
         .init = xt_rateest_net_init,
-        .exit = xt_rateest_net_exit,
         .id   = &xt_rateest_id,
         .size = sizeof(struct xt_rateest_net),
 };
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 3e7d259e5d8d..1ad4017f9b73 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -295,9 +295,10 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,
 
         /* copy match config into hashtable config */
         ret = cfg_copy(&hinfo->cfg, (void *)cfg, 3);
-
-        if (ret)
+        if (ret) {
+                vfree(hinfo);
                 return ret;
+        }
 
         hinfo->cfg.size = size;
         if (hinfo->cfg.max == 0)
@@ -814,7 +815,6 @@ hashlimit_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
         int ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
-
         if (ret)
                 return ret;
 
@@ -830,7 +830,6 @@ hashlimit_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
         int ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
-
         if (ret)
                 return ret;
 
@@ -921,7 +920,6 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
                 return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
-
         if (ret)
                 return ret;
 
@@ -940,7 +938,6 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
                 return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
-
         if (ret)
                 return ret;
 
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 6bec37ab4472..a4660c48ff01 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1203,7 +1203,8 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
                                          &info->labels.mask);
                 if (err)
                         return err;
-        } else if (labels_nonzero(&info->labels.mask)) {
+        } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
+                   labels_nonzero(&info->labels.mask)) {
                 err = ovs_ct_set_labels(ct, key, &info->labels.value,
                                         &info->labels.mask);
                 if (err)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ec3095f13aae..a74650e98f42 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2394,7 +2394,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
                 void *ph;
                 __u32 ts;
 
-                ph = skb_shinfo(skb)->destructor_arg;
+                ph = skb_zcopy_get_nouarg(skb);
                 packet_dec_pending(&po->tx_ring);
 
                 ts = __packet_set_timestamp(po, ph, skb);
@@ -2461,7 +2461,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->mark = po->sk.sk_mark;
         skb->tstamp = sockc->transmit_time;
         sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
-        skb_shinfo(skb)->destructor_arg = ph.raw;
+        skb_zcopy_set_nouarg(skb, ph.raw);
 
         skb_reserve(skb, hlen);
         skb_reset_network_header(skb);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 64362d078da8..a2522f9d71e2 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -375,17 +375,36 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
  * getting ACKs from the server.  Returns a number representing the life state
  * which can be compared to that returned by a previous call.
  *
- * If this is a client call, ping ACKs will be sent to the server to find out
- * whether it's still responsive and whether the call is still alive on the
- * server.
+ * If the life state stalls, rxrpc_kernel_probe_life() should be called and
+ * then 2RTT waited.
  */
-u32 rxrpc_kernel_check_life(struct socket *sock, struct rxrpc_call *call)
+u32 rxrpc_kernel_check_life(const struct socket *sock,
+                            const struct rxrpc_call *call)
 {
         return call->acks_latest;
 }
 EXPORT_SYMBOL(rxrpc_kernel_check_life);
 
 /**
+ * rxrpc_kernel_probe_life - Poke the peer to see if it's still alive
+ * @sock: The socket the call is on
+ * @call: The call to check
+ *
+ * In conjunction with rxrpc_kernel_check_life(), allow a kernel service to
+ * find out whether a call is still alive by pinging it.  This should cause the
+ * life state to be bumped in about 2*RTT.
+ *
+ * The must be called in TASK_RUNNING state on pain of might_sleep() objecting.
+ */
+void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
+{
+        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                          rxrpc_propose_ack_ping_for_check_life);
+        rxrpc_send_ack_packet(call, true, NULL);
+}
+EXPORT_SYMBOL(rxrpc_kernel_probe_life);
+
+/**
  * rxrpc_kernel_get_epoch - Retrieve the epoch value from a call.
  * @sock: The socket the call is on
  * @call: The call to query
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 382196e57a26..bc628acf4f4f 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -611,6 +611,7 @@ struct rxrpc_call {
                                                  * not hard-ACK'd packet follows this.
                                                  */
         rxrpc_seq_t             tx_top;         /* Highest Tx slot allocated. */
+        u16                     tx_backoff;     /* Delay to insert due to Tx failure */
 
         /* TCP-style slow-start congestion control [RFC5681].  Since the SMSS
          * is fixed, we keep these numbers in terms of segments (ie. DATA
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index 8e7434e92097..468efc3660c0 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -123,6 +123,7 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
                 else
                         ack_at = expiry;
 
+                ack_at += READ_ONCE(call->tx_backoff);
                 ack_at += now;
                 if (time_before(ack_at, call->ack_at)) {
                         WRITE_ONCE(call->ack_at, ack_at);
@@ -311,6 +312,7 @@ void rxrpc_process_call(struct work_struct *work)
                 container_of(work, struct rxrpc_call, processor);
         rxrpc_serial_t *send_ack;
         unsigned long now, next, t;
+        unsigned int iterations = 0;
 
         rxrpc_see_call(call);
 
@@ -319,6 +321,11 @@ void rxrpc_process_call(struct work_struct *work)
                call->debug_id, rxrpc_call_states[call->state], call->events);
 
 recheck_state:
+        /* Limit the number of times we do this before returning to the manager */
+        iterations++;
+        if (iterations > 5)
+                goto requeue;
+
         if (test_and_clear_bit(RXRPC_CALL_EV_ABORT, &call->events)) {
                 rxrpc_send_abort_packet(call);
                 goto recheck_state;
@@ -447,13 +454,16 @@ recheck_state:
         rxrpc_reduce_call_timer(call, next, now, rxrpc_timer_restart);
 
         /* other events may have been raised since we started checking */
-        if (call->events && call->state < RXRPC_CALL_COMPLETE) {
-                __rxrpc_queue_call(call);
-                goto out;
-        }
+        if (call->events && call->state < RXRPC_CALL_COMPLETE)
+                goto requeue;
 
 out_put:
         rxrpc_put_call(call, rxrpc_call_put);
 out:
         _leave("");
+        return;
+
+requeue:
+        __rxrpc_queue_call(call);
+        goto out;
 }
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 189418888839..736aa9281100 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -35,6 +35,21 @@ struct rxrpc_abort_buffer {
 static const char rxrpc_keepalive_string[] = "";
 
 /*
+ * Increase Tx backoff on transmission failure and clear it on success.
+ */
+static void rxrpc_tx_backoff(struct rxrpc_call *call, int ret)
+{
+        if (ret < 0) {
+                u16 tx_backoff = READ_ONCE(call->tx_backoff);
+
+                if (tx_backoff < HZ)
+                        WRITE_ONCE(call->tx_backoff, tx_backoff + 1);
+        } else {
+                WRITE_ONCE(call->tx_backoff, 0);
+        }
+}
+
+/*
  * Arrange for a keepalive ping a certain time after we last transmitted.  This
  * lets the far side know we're still interested in this call and helps keep
  * the route through any intervening firewall open.
@@ -210,6 +225,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
         else
                 trace_rxrpc_tx_packet(call->debug_id, &pkt->whdr,
                                       rxrpc_tx_point_call_ack);
+        rxrpc_tx_backoff(call, ret);
 
         if (call->state < RXRPC_CALL_COMPLETE) {
                 if (ret < 0) {
@@ -218,7 +234,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
                         rxrpc_propose_ACK(call, pkt->ack.reason,
                                           ntohs(pkt->ack.maxSkew),
                                           ntohl(pkt->ack.serial),
-                                          true, true,
+                                          false, true,
                                           rxrpc_propose_ack_retry_tx);
                 } else {
                         spin_lock_bh(&call->lock);
@@ -300,7 +316,7 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
         else
                 trace_rxrpc_tx_packet(call->debug_id, &pkt.whdr,
                                       rxrpc_tx_point_call_abort);
-
+        rxrpc_tx_backoff(call, ret);
 
         rxrpc_put_connection(conn);
         return ret;
@@ -413,6 +429,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
         else
                 trace_rxrpc_tx_packet(call->debug_id, &whdr,
                                       rxrpc_tx_point_call_data_nofrag);
+        rxrpc_tx_backoff(call, ret);
         if (ret == -EMSGSIZE)
                 goto send_fragmentable;
 
@@ -445,9 +462,18 @@ done:
                         rxrpc_reduce_call_timer(call, expect_rx_by, nowj,
                                                 rxrpc_timer_set_for_normal);
                 }
-        }
 
-        rxrpc_set_keepalive(call);
+                rxrpc_set_keepalive(call);
+        } else {
+                /* Cancel the call if the initial transmission fails,
+                 * particularly if that's due to network routing issues that
+                 * aren't going away anytime soon.  The layer above can arrange
+                 * the retransmission.
+                 */
+                if (!test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags))
+                        rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
+                                                  RX_USER_ABORT, ret);
+        }
 
         _leave(" = %d [%u]", ret, call->peer->maxdata);
         return ret;
@@ -506,6 +532,7 @@ send_fragmentable:
         else
                 trace_rxrpc_tx_packet(call->debug_id, &whdr,
                                       rxrpc_tx_point_call_data_frag);
+        rxrpc_tx_backoff(call, ret);
 
         up_write(&conn->params.local->defrag_sem);
         goto done;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 1dae5f2b358f..c8cf4d10c435 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -258,7 +258,8 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,
         if (is_redirect) {
                 skb2->tc_redirected = 1;
                 skb2->tc_from_ingress = skb2->tc_at_ingress;
-
+                if (skb2->tc_from_ingress)
+                        skb2->tstamp = 0;
                 /* let's the caller reinsert the packet, if possible */
                 if (use_reinsert) {
                         res->ingress = want_ingress;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index da3dd0f68cc2..2b372a06b432 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -201,7 +201,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                         goto out_release;
                 }
         } else {
-                return err;
+                ret = err;
+                goto out_free;
         }
 
         p = to_pedit(*a);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 052855d47354..37c9b8f0e10f 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -27,10 +27,7 @@ struct tcf_police_params {
         u32                     tcfp_ewma_rate;
         s64                     tcfp_burst;
         u32                     tcfp_mtu;
-        s64                     tcfp_toks;
-        s64                     tcfp_ptoks;
         s64                     tcfp_mtu_ptoks;
-        s64                     tcfp_t_c;
         struct psched_ratecfg   rate;
         bool                    rate_present;
         struct psched_ratecfg   peak;
@@ -41,6 +38,11 @@ struct tcf_police_params {
 struct tcf_police {
         struct tc_action        common;
         struct tcf_police_params __rcu *params;
+
+        spinlock_t              tcfp_lock ____cacheline_aligned_in_smp;
+        s64                     tcfp_toks;
+        s64                     tcfp_ptoks;
+        s64                     tcfp_t_c;
 };
 
 #define to_police(pc) ((struct tcf_police *)pc)
@@ -122,6 +124,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                         return ret;
                 }
                 ret = ACT_P_CREATED;
+                spin_lock_init(&(to_police(*a)->tcfp_lock));
         } else if (!ovr) {
                 tcf_idr_release(*a, bind);
                 return -EEXIST;
@@ -186,12 +189,9 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
-        new->tcfp_toks = new->tcfp_burst;
-        if (new->peak_present) {
+        if (new->peak_present)
                 new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
                                                          new->tcfp_mtu);
-                new->tcfp_ptoks = new->tcfp_mtu_ptoks;
-        }
 
         if (tb[TCA_POLICE_AVRATE])
                 new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
@@ -207,7 +207,12 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         spin_lock_bh(&police->tcf_lock);
-        new->tcfp_t_c = ktime_get_ns();
+        spin_lock_bh(&police->tcfp_lock);
+        police->tcfp_t_c = ktime_get_ns();
+        police->tcfp_toks = new->tcfp_burst;
+        if (new->peak_present)
+                police->tcfp_ptoks = new->tcfp_mtu_ptoks;
+        spin_unlock_bh(&police->tcfp_lock);
         police->tcf_action = parm->action;
         rcu_swap_protected(police->params,
                            new,
@@ -257,25 +262,28 @@ static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
                 }
 
                 now = ktime_get_ns();
-                toks = min_t(s64, now - p->tcfp_t_c, p->tcfp_burst);
+                spin_lock_bh(&police->tcfp_lock);
+                toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
                 if (p->peak_present) {
-                        ptoks = toks + p->tcfp_ptoks;
+                        ptoks = toks + police->tcfp_ptoks;
                         if (ptoks > p->tcfp_mtu_ptoks)
                                 ptoks = p->tcfp_mtu_ptoks;
                         ptoks -= (s64)psched_l2t_ns(&p->peak,
                                                     qdisc_pkt_len(skb));
                 }
-                toks += p->tcfp_toks;
+                toks += police->tcfp_toks;
                 if (toks > p->tcfp_burst)
                         toks = p->tcfp_burst;
                 toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
                 if ((toks|ptoks) >= 0) {
-                        p->tcfp_t_c = now;
-                        p->tcfp_toks = toks;
-                        p->tcfp_ptoks = ptoks;
+                        police->tcfp_t_c = now;
+                        police->tcfp_toks = toks;
+                        police->tcfp_ptoks = ptoks;
+                        spin_unlock_bh(&police->tcfp_lock);
                         ret = p->tcfp_result;
                         goto inc_drops;
                 }
+                spin_unlock_bh(&police->tcfp_lock);
         }
 
 inc_overlimits:
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9aada2d0ef06..c6c327874abc 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -709,11 +709,23 @@ static int fl_set_enc_opt(struct nlattr **tb, struct fl_flow_key *key,
                           struct netlink_ext_ack *extack)
 {
         const struct nlattr *nla_enc_key, *nla_opt_key, *nla_opt_msk = NULL;
-        int option_len, key_depth, msk_depth = 0;
+        int err, option_len, key_depth, msk_depth = 0;
+
+        err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS],
+                                  TCA_FLOWER_KEY_ENC_OPTS_MAX,
+                                  enc_opts_policy, extack);
+        if (err)
+                return err;
 
         nla_enc_key = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS]);
 
         if (tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]) {
+                err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK],
+                                          TCA_FLOWER_KEY_ENC_OPTS_MAX,
+                                          enc_opts_policy, extack);
+                if (err)
+                        return err;
+
                 nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
                 msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
         }
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 4b1af706896c..25a7cf6d380f 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -469,22 +469,29 @@ begin:
                 goto begin;
         }
         prefetch(&skb->end);
-        f->credit -= qdisc_pkt_len(skb);
+        plen = qdisc_pkt_len(skb);
+        f->credit -= plen;
 
-        if (ktime_to_ns(skb->tstamp) || !q->rate_enable)
+        if (!q->rate_enable)
                 goto out;
 
         rate = q->flow_max_rate;
-        if (skb->sk)
-                rate = min(skb->sk->sk_pacing_rate, rate);
-
-        if (rate <= q->low_rate_threshold) {
-                f->credit = 0;
-                plen = qdisc_pkt_len(skb);
-        } else {
-                plen = max(qdisc_pkt_len(skb), q->quantum);
-                if (f->credit > 0)
-                        goto out;
+
+        /* If EDT time was provided for this skb, we need to
+         * update f->time_next_packet only if this qdisc enforces
+         * a flow max rate.
+         */
+        if (!skb->tstamp) {
+                if (skb->sk)
+                        rate = min(skb->sk->sk_pacing_rate, rate);
+
+                if (rate <= q->low_rate_threshold) {
+                        f->credit = 0;
+                } else {
+                        plen = max(plen, q->quantum);
+                        if (f->credit > 0)
+                                goto out;
+                }
         }
         if (rate != ~0UL) {
                 u64 len = (u64)plen * NSEC_PER_SEC;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 57b3ad9394ad..2c38e3d07924 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -648,15 +648,6 @@ deliver:
                          */
                         skb->dev = qdisc_dev(sch);
 
-#ifdef CONFIG_NET_CLS_ACT
-                        /*
-                         * If it's at ingress let's pretend the delay is
-                         * from the network (tstamp will be updated).
-                         */
-                        if (skb->tc_redirected && skb->tc_from_ingress)
-                                skb->tstamp = 0;
-#endif
-
                         if (q->slot.slot_next) {
                                 q->slot.packets_left--;
                                 q->slot.bytes_left -= qdisc_pkt_len(skb);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 67939ad99c01..025f48e14a91 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -118,6 +118,9 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
                 sctp_transport_route(tp, NULL, sp);
                 if (asoc->param_flags & SPP_PMTUD_ENABLE)
                         sctp_assoc_sync_pmtu(asoc);
+        } else if (!sctp_transport_pmtu_check(tp)) {
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
         }
 
         if (asoc->pmtu_pending) {
@@ -396,25 +399,6 @@ finish:
         return retval;
 }
 
-static void sctp_packet_release_owner(struct sk_buff *skb)
-{
-        sk_free(skb->sk);
-}
-
-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
-{
-        skb_orphan(skb);
-        skb->sk = sk;
-        skb->destructor = sctp_packet_release_owner;
-
-        /*
-         * The data chunks have already been accounted for in sctp_sendmsg(),
-         * therefore only reserve a single byte to keep socket around until
-         * the packet has been transmitted.
-         */
-        refcount_inc(&sk->sk_wmem_alloc);
-}
-
 static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
 {
         if (SCTP_OUTPUT_CB(head)->last == head)
@@ -426,6 +410,7 @@ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
         head->truesize += skb->truesize;
         head->data_len += skb->len;
         head->len += skb->len;
+        refcount_add(skb->truesize, &head->sk->sk_wmem_alloc);
 
         __skb_header_release(skb);
 }
@@ -601,7 +586,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         if (!head)
                 goto out;
         skb_reserve(head, packet->overhead + MAX_HEADER);
-        sctp_packet_set_owner_w(head, sk);
+        skb_set_owner_w(head, sk);
 
         /* set sctp header */
         sh = skb_push(head, sizeof(struct sctphdr));
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 9cb854b05342..c37e1c2dec9d 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -212,7 +212,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
         INIT_LIST_HEAD(&q->retransmit);
         INIT_LIST_HEAD(&q->sacked);
         INIT_LIST_HEAD(&q->abandoned);
-        sctp_sched_set_sched(asoc, SCTP_SS_FCFS);
+        sctp_sched_set_sched(asoc, SCTP_SS_DEFAULT);
 }
 
 /* Free the outqueue structure and any related pending chunks.
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 739f3e50120d..bf618d1b41fd 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3940,32 +3940,16 @@ static int sctp_setsockopt_pr_supported(struct sock *sk,
                                         unsigned int optlen)
 {
         struct sctp_assoc_value params;
-        struct sctp_association *asoc;
-        int retval = -EINVAL;
 
         if (optlen != sizeof(params))
-                goto out;
-
-        if (copy_from_user(&params, optval, optlen)) {
-                retval = -EFAULT;
-                goto out;
-        }
-
-        asoc = sctp_id2assoc(sk, params.assoc_id);
-        if (asoc) {
-                asoc->prsctp_enable = !!params.assoc_value;
-        } else if (!params.assoc_id) {
-                struct sctp_sock *sp = sctp_sk(sk);
+                return -EINVAL;
 
-                sp->ep->prsctp_enable = !!params.assoc_value;
-        } else {
-                goto out;
-        }
+        if (copy_from_user(&params, optval, optlen))
+                return -EFAULT;
 
-        retval = 0;
+        sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value;
 
-out:
-        return retval;
+        return 0;
 }
 
 static int sctp_setsockopt_default_prinfo(struct sock *sk,
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index ffb940d3b57c..3892e7630f3a 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -535,7 +535,6 @@ int sctp_send_add_streams(struct sctp_association *asoc,
                 goto out;
         }
 
-        stream->incnt = incnt;
         stream->outcnt = outcnt;
 
         asoc->strreset_outstanding = !!out + !!in;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 80e2119f1c70..5fbaf1901571 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -127,6 +127,8 @@ static int smc_release(struct socket *sock)
         smc = smc_sk(sk);
 
         /* cleanup for a dangling non-blocking connect */
+        if (smc->connect_info && sk->sk_state == SMC_INIT)
+                tcp_abort(smc->clcsock->sk, ECONNABORTED);
         flush_work(&smc->connect_work);
         kfree(smc->connect_info);
         smc->connect_info = NULL;
@@ -547,7 +549,8 @@ static int smc_connect_rdma(struct smc_sock *smc,
 
         mutex_lock(&smc_create_lgr_pending);
         local_contact = smc_conn_create(smc, false, aclc->hdr.flag, ibdev,
-                                        ibport, &aclc->lcl, NULL, 0);
+                                        ibport, ntoh24(aclc->qpn), &aclc->lcl,
+                                        NULL, 0);
         if (local_contact < 0) {
                 if (local_contact == -ENOMEM)
                         reason_code = SMC_CLC_DECL_MEM;/* insufficient memory*/
@@ -618,7 +621,7 @@ static int smc_connect_ism(struct smc_sock *smc,
         int rc = 0;
 
         mutex_lock(&smc_create_lgr_pending);
-        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0,
+        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0, 0,
                                         NULL, ismdev, aclc->gid);
         if (local_contact < 0)
                 return smc_connect_abort(smc, SMC_CLC_DECL_MEM, 0);
@@ -1083,7 +1086,7 @@ static int smc_listen_rdma_init(struct smc_sock *new_smc,
                                 int *local_contact)
 {
         /* allocate connection / link group */
-        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport,
+        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport, 0,
                                          &pclc->lcl, NULL, 0);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
@@ -1107,7 +1110,7 @@ static int smc_listen_ism_init(struct smc_sock *new_smc,
         struct smc_clc_msg_smcd *pclc_smcd;
 
         pclc_smcd = smc_get_clc_msg_smcd(pclc);
-        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, NULL,
+        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, 0, NULL,
                                          ismdev, pclc_smcd->gid);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index ed5dcf03fe0b..db83332ac1c8 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -81,7 +81,7 @@ static inline void smc_cdc_add_pending_send(struct smc_connection *conn,
                 sizeof(struct smc_cdc_msg) > SMC_WR_BUF_SIZE,
                 "must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg)");
         BUILD_BUG_ON_MSG(
-                sizeof(struct smc_cdc_msg) != SMC_WR_TX_SIZE,
+                offsetofend(struct smc_cdc_msg, reserved) > SMC_WR_TX_SIZE,
                 "must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send()");
         BUILD_BUG_ON_MSG(
                 sizeof(struct smc_cdc_tx_pend) > SMC_WR_TX_PEND_PRIV_SIZE,
@@ -177,23 +177,24 @@ void smc_cdc_tx_dismiss_slots(struct smc_connection *conn)
 int smcd_cdc_msg_send(struct smc_connection *conn)
 {
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
+        union smc_host_cursor curs;
         struct smcd_cdc_msg cdc;
         int rc, diff;
 
         memset(&cdc, 0, sizeof(cdc));
         cdc.common.type = SMC_CDC_MSG_TYPE;
-        cdc.prod_wrap = conn->local_tx_ctrl.prod.wrap;
-        cdc.prod_count = conn->local_tx_ctrl.prod.count;
-
-        cdc.cons_wrap = conn->local_tx_ctrl.cons.wrap;
-        cdc.cons_count = conn->local_tx_ctrl.cons.count;
-        cdc.prod_flags = conn->local_tx_ctrl.prod_flags;
-        cdc.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.prod.acurs);
+        cdc.prod.wrap = curs.wrap;
+        cdc.prod.count = curs.count;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.cons.acurs);
+        cdc.cons.wrap = curs.wrap;
+        cdc.cons.count = curs.count;
+        cdc.cons.prod_flags = conn->local_tx_ctrl.prod_flags;
+        cdc.cons.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
         rc = smcd_tx_ism_write(conn, &cdc, sizeof(cdc), 0, 1);
         if (rc)
                 return rc;
-        smc_curs_copy(&conn->rx_curs_confirmed, &conn->local_tx_ctrl.cons,
-                      conn);
+        smc_curs_copy(&conn->rx_curs_confirmed, &curs, conn);
         /* Calculate transmitted data and increment free send buffer space */
         diff = smc_curs_diff(conn->sndbuf_desc->len, &conn->tx_curs_fin,
                              &conn->tx_curs_sent);
@@ -331,13 +332,16 @@ static void smc_cdc_msg_recv(struct smc_sock *smc, struct smc_cdc_msg *cdc)
 static void smcd_cdc_rx_tsklet(unsigned long data)
 {
         struct smc_connection *conn = (struct smc_connection *)data;
+        struct smcd_cdc_msg *data_cdc;
         struct smcd_cdc_msg cdc;
         struct smc_sock *smc;
 
         if (!conn)
                 return;
 
-        memcpy(&cdc, conn->rmb_desc->cpu_addr, sizeof(cdc));
+        data_cdc = (struct smcd_cdc_msg *)conn->rmb_desc->cpu_addr;
+        smcd_curs_copy(&cdc.prod, &data_cdc->prod, conn);
+        smcd_curs_copy(&cdc.cons, &data_cdc->cons, conn);
         smc = container_of(conn, struct smc_sock, conn);
         smc_cdc_msg_recv(smc, (struct smc_cdc_msg *)&cdc);
 }
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index 934df4473a7c..b5bfe38c7f9b 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -48,21 +48,31 @@ struct smc_cdc_msg {
         struct smc_cdc_producer_flags   prod_flags;
         struct smc_cdc_conn_state_flags conn_state_flags;
         u8                              reserved[18];
-} __packed;                                     /* format defined in RFC7609 */
+};
+
+/* SMC-D cursor format */
+union smcd_cdc_cursor {
+        struct {
+                u16     wrap;
+                u32     count;
+                struct smc_cdc_producer_flags   prod_flags;
+                struct smc_cdc_conn_state_flags conn_state_flags;
+        } __packed;
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_t              acurs;          /* for atomic processing */
+#else
+        u64                     acurs;          /* for atomic processing */
+#endif
+} __aligned(8);
 
 /* CDC message for SMC-D */
 struct smcd_cdc_msg {
         struct smc_wr_rx_hdr common;    /* Type = 0xFE */
         u8 res1[7];
-        u16 prod_wrap;
-        u32 prod_count;
-        u8 res2[2];
-        u16 cons_wrap;
-        u32 cons_count;
-        struct smc_cdc_producer_flags   prod_flags;
-        struct smc_cdc_conn_state_flags conn_state_flags;
+        union smcd_cdc_cursor   prod;
+        union smcd_cdc_cursor   cons;
         u8 res3[8];
-} __packed;
+} __aligned(8);
 
 static inline bool smc_cdc_rxed_any_close(struct smc_connection *conn)
 {
@@ -135,6 +145,21 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
 #endif
 }
 
+static inline void smcd_curs_copy(union smcd_cdc_cursor *tgt,
+                                  union smcd_cdc_cursor *src,
+                                  struct smc_connection *conn)
+{
+#ifndef KERNEL_HAS_ATOMIC64
+        unsigned long flags;
+
+        spin_lock_irqsave(&conn->acurs_lock, flags);
+        tgt->acurs = src->acurs;
+        spin_unlock_irqrestore(&conn->acurs_lock, flags);
+#else
+        atomic64_set(&tgt->acurs, atomic64_read(&src->acurs));
+#endif
+}
+
 /* calculate cursor difference between old and new, where old <= new */
 static inline int smc_curs_diff(unsigned int size,
                                 union smc_host_cursor *old,
@@ -222,12 +247,17 @@ static inline void smcr_cdc_msg_to_host(struct smc_host_cdc_msg *local,
 static inline void smcd_cdc_msg_to_host(struct smc_host_cdc_msg *local,
                                         struct smcd_cdc_msg *peer)
 {
-        local->prod.wrap = peer->prod_wrap;
-        local->prod.count = peer->prod_count;
-        local->cons.wrap = peer->cons_wrap;
-        local->cons.count = peer->cons_count;
-        local->prod_flags = peer->prod_flags;
-        local->conn_state_flags = peer->conn_state_flags;
+        union smc_host_cursor temp;
+
+        temp.wrap = peer->prod.wrap;
+        temp.count = peer->prod.count;
+        atomic64_set(&local->prod.acurs, atomic64_read(&temp.acurs));
+
+        temp.wrap = peer->cons.wrap;
+        temp.count = peer->cons.count;
+        atomic64_set(&local->cons.acurs, atomic64_read(&temp.acurs));
+        local->prod_flags = peer->cons.prod_flags;
+        local->conn_state_flags = peer->cons.conn_state_flags;
 }
 
 static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 18daebcef181..1c9fa7f0261a 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -184,6 +184,8 @@ free:
 
                 if (!lgr->is_smcd && lnk->state != SMC_LNK_INACTIVE)
                         smc_llc_link_inactive(lnk);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -485,7 +487,7 @@ void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport)
 }
 
 /* Called when SMC-D device is terminated or peer is lost */
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid, unsigned short vlan)
 {
         struct smc_link_group *lgr, *l;
         LIST_HEAD(lgr_free_list);
@@ -495,7 +497,7 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &smc_lgr_list.list, list) {
                 if (lgr->is_smcd && lgr->smcd == dev &&
                     (!peer_gid || lgr->peer_gid == peer_gid) &&
-                    !list_empty(&lgr->list)) {
+                    (vlan == VLAN_VID_MASK || lgr->vlan_id == vlan)) {
                         __smc_lgr_terminate(lgr);
                         list_move(&lgr->list, &lgr_free_list);
                 }
@@ -506,6 +508,8 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &lgr_free_list, list) {
                 list_del_init(&lgr->list);
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (!peer_gid && vlan == VLAN_VID_MASK) /* dev terminated? */
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -559,7 +563,7 @@ out:
 
 static bool smcr_lgr_match(struct smc_link_group *lgr,
                            struct smc_clc_msg_local *lcl,
-                           enum smc_lgr_role role)
+                           enum smc_lgr_role role, u32 clcqpn)
 {
         return !memcmp(lgr->peer_systemid, lcl->id_for_peer,
                        SMC_SYSTEMID_LEN) &&
@@ -567,7 +571,9 @@ static bool smcr_lgr_match(struct smc_link_group *lgr,
                         SMC_GID_SIZE) &&
                 !memcmp(lgr->lnk[SMC_SINGLE_LINK].peer_mac, lcl->mac,
                         sizeof(lcl->mac)) &&
-                lgr->role == role;
+                lgr->role == role &&
+                (lgr->role == SMC_SERV ||
+                 lgr->lnk[SMC_SINGLE_LINK].peer_qpn == clcqpn);
 }
 
 static bool smcd_lgr_match(struct smc_link_group *lgr,
@@ -578,7 +584,7 @@ static bool smcd_lgr_match(struct smc_link_group *lgr,
 
 /* create a new SMC connection (and a new link group if necessary) */
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid)
 {
@@ -603,7 +609,7 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
         list_for_each_entry(lgr, &smc_lgr_list.list, list) {
                 write_lock_bh(&lgr->conns_lock);
                 if ((is_smcd ? smcd_lgr_match(lgr, smcd, peer_gid) :
-                     smcr_lgr_match(lgr, lcl, role)) &&
+                     smcr_lgr_match(lgr, lcl, role, clcqpn)) &&
                     !lgr->sync_err &&
                     lgr->vlan_id == vlan_id &&
                     (role == SMC_CLNT ||
@@ -1024,6 +1030,8 @@ void smc_core_exit(void)
                         smc_llc_link_inactive(lnk);
                 }
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr); /* free link group */
         }
 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index c156674733c9..cf98f4d6093e 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -247,7 +247,8 @@ void smc_lgr_free(struct smc_link_group *lgr);
 void smc_lgr_forget(struct smc_link_group *lgr);
 void smc_lgr_terminate(struct smc_link_group *lgr);
 void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport);
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid);
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid,
+                        unsigned short vlan);
 int smc_buf_create(struct smc_sock *smc, bool is_smcd);
 int smc_uncompress_bufsize(u8 compressed);
 int smc_rmb_rtoken_handling(struct smc_connection *conn,
@@ -262,7 +263,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, unsigned short *vlan_id);
 
 void smc_conn_free(struct smc_connection *conn);
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid);
 void smcd_conn_free(struct smc_connection *conn);
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index e36f21ce7252..2fff79db1a59 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -187,22 +187,28 @@ struct smc_ism_event_work {
 #define ISM_EVENT_REQUEST               0x0001
 #define ISM_EVENT_RESPONSE              0x0002
 #define ISM_EVENT_REQUEST_IR            0x00000001
+#define ISM_EVENT_CODE_SHUTDOWN         0x80
 #define ISM_EVENT_CODE_TESTLINK         0x83
 
+union smcd_sw_event_info {
+        u64     info;
+        struct {
+                u8              uid[SMC_LGR_ID_SIZE];
+                unsigned short  vlan_id;
+                u16             code;
+        };
+};
+
 static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
 {
-        union {
-                u64     info;
-                struct {
-                        u32             uid;
-                        unsigned short  vlanid;
-                        u16             code;
-                };
-        } ev_info;
+        union smcd_sw_event_info ev_info;
 
+        ev_info.info = wrk->event.info;
         switch (wrk->event.code) {
+        case ISM_EVENT_CODE_SHUTDOWN:   /* Peer shut down DMBs */
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, ev_info.vlan_id);
+                break;
         case ISM_EVENT_CODE_TESTLINK:   /* Activity timer */
-                ev_info.info = wrk->event.info;
                 if (ev_info.code == ISM_EVENT_REQUEST) {
                         ev_info.code = ISM_EVENT_RESPONSE;
                         wrk->smcd->ops->signal_event(wrk->smcd,
@@ -215,6 +221,21 @@ static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
         }
 }
 
+int smc_ism_signal_shutdown(struct smc_link_group *lgr)
+{
+        int rc;
+        union smcd_sw_event_info ev_info;
+
+        memcpy(ev_info.uid, lgr->id, SMC_LGR_ID_SIZE);
+        ev_info.vlan_id = lgr->vlan_id;
+        ev_info.code = ISM_EVENT_REQUEST;
+        rc = lgr->smcd->ops->signal_event(lgr->smcd, lgr->peer_gid,
+                                          ISM_EVENT_REQUEST_IR,
+                                          ISM_EVENT_CODE_SHUTDOWN,
+                                          ev_info.info);
+        return rc;
+}
+
 /* worker for SMC-D events */
 static void smc_ism_event_work(struct work_struct *work)
 {
@@ -223,7 +244,7 @@ static void smc_ism_event_work(struct work_struct *work)
 
         switch (wrk->event.type) {
         case ISM_EVENT_GID:     /* GID event, token is peer GID */
-                smc_smcd_terminate(wrk->smcd, wrk->event.tok);
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, VLAN_VID_MASK);
                 break;
         case ISM_EVENT_DMB:
                 break;
@@ -289,7 +310,7 @@ void smcd_unregister_dev(struct smcd_dev *smcd)
         spin_unlock(&smcd_dev_list.lock);
         flush_workqueue(smcd->event_wq);
         destroy_workqueue(smcd->event_wq);
-        smc_smcd_terminate(smcd, 0);
+        smc_smcd_terminate(smcd, 0, VLAN_VID_MASK);
 
         device_del(&smcd->dev);
 }
diff --git a/net/smc/smc_ism.h b/net/smc/smc_ism.h
index aee45b860b79..4da946cbfa29 100644
--- a/net/smc/smc_ism.h
+++ b/net/smc/smc_ism.h
@@ -45,4 +45,5 @@ int smc_ism_register_dmb(struct smc_link_group *lgr, int buf_size,
 int smc_ism_unregister_dmb(struct smcd_dev *dev, struct smc_buf_desc *dmb_desc);
 int smc_ism_write(struct smcd_dev *dev, const struct smc_ism_position *pos,
                   void *data, size_t len);
+int smc_ism_signal_shutdown(struct smc_link_group *lgr);
 #endif
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 3c458d279855..c2694750a6a8 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
 
         pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
         if (pend->idx < link->wr_tx_cnt) {
+                u32 idx = pend->idx;
+
                 /* clear the full struct smc_wr_tx_pend including .priv */
                 memset(&link->wr_tx_pends[pend->idx], 0,
                        sizeof(link->wr_tx_pends[pend->idx]));
                 memset(&link->wr_tx_bufs[pend->idx], 0,
                        sizeof(link->wr_tx_bufs[pend->idx]));
-                test_and_clear_bit(pend->idx, link->wr_tx_mask);
+                test_and_clear_bit(idx, link->wr_tx_mask);
                 return 1;
         }
 
diff --git a/net/socket.c b/net/socket.c
index 593826e11a53..334fcc617ef2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -853,7 +853,7 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
         struct socket *sock = file->private_data;
 
         if (unlikely(!sock->ops->splice_read))
-                return -EINVAL;
+                return generic_file_splice_read(file, ppos, pipe, len, flags);
 
         return sock->ops->splice_read(sock, ppos, pipe, len, flags);
 }
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index d8831b988b1e..ab4a3be1542a 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred)
 {
         struct auth_cred *acred = &container_of(cred, struct generic_cred,
                                                 gc_base)->acred;
-        bool ret;
-
-        get_rpccred(cred);
-        ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
-        put_rpccred(cred);
-
-        return ret;
+        return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
 }
 
 static const struct rpc_credops generic_credops = {
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 30f970cdc7f6..5d3f252659f1 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1239,36 +1239,59 @@ gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
         return &gss_auth->rpc_auth;
 }
 
+static struct gss_cred *
+gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
+{
+        struct gss_cred *new;
+
+        /* Make a copy of the cred so that we can reference count it */
+        new = kzalloc(sizeof(*gss_cred), GFP_NOIO);
+        if (new) {
+                struct auth_cred acred = {
+                        .uid = gss_cred->gc_base.cr_uid,
+                };
+                struct gss_cl_ctx *ctx =
+                        rcu_dereference_protected(gss_cred->gc_ctx, 1);
+
+                rpcauth_init_cred(&new->gc_base, &acred,
+                                &gss_auth->rpc_auth,
+                                &gss_nullops);
+                new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
+                new->gc_service = gss_cred->gc_service;
+                new->gc_principal = gss_cred->gc_principal;
+                kref_get(&gss_auth->kref);
+                rcu_assign_pointer(new->gc_ctx, ctx);
+                gss_get_ctx(ctx);
+        }
+        return new;
+}
+
 /*
- * gss_destroying_context will cause the RPCSEC_GSS to send a NULL RPC call
+ * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
  * to the server with the GSS control procedure field set to
  * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
  * all RPCSEC_GSS state associated with that context.
  */
-static int
-gss_destroying_context(struct rpc_cred *cred)
+static void
+gss_send_destroy_context(struct rpc_cred *cred)
 {
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
         struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
         struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
+        struct gss_cred *new;
         struct rpc_task *task;
 
-        if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0)
-                return 0;
-
-        ctx->gc_proc = RPC_GSS_PROC_DESTROY;
-        cred->cr_ops = &gss_nullops;
-
-        /* Take a reference to ensure the cred will be destroyed either
-         * by the RPC call or by the put_rpccred() below */
-        get_rpccred(cred);
+        new = gss_dup_cred(gss_auth, gss_cred);
+        if (new) {
+                ctx->gc_proc = RPC_GSS_PROC_DESTROY;
 
-        task = rpc_call_null(gss_auth->client, cred, RPC_TASK_ASYNC|RPC_TASK_SOFT);
-        if (!IS_ERR(task))
-                rpc_put_task(task);
+                task = rpc_call_null(gss_auth->client, &new->gc_base,
+                                RPC_TASK_ASYNC|RPC_TASK_SOFT);
+                if (!IS_ERR(task))
+                        rpc_put_task(task);
 
-        put_rpccred(cred);
-        return 1;
+                put_rpccred(&new->gc_base);
+        }
 }
 
 /* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
@@ -1330,8 +1353,8 @@ static void
 gss_destroy_cred(struct rpc_cred *cred)
 {
 
-        if (gss_destroying_context(cred))
-                return;
+        if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
+                gss_send_destroy_context(cred);
         gss_destroy_nullcred(cred);
 }
 
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 2bbb8d38d2bf..f302c6eb8779 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -546,7 +546,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode);
 static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
                 size_t nbytes)
 {
-        static __be32 *p;
+        __be32 *p;
         int space_left;
         int frag1bytes, frag2bytes;
 
@@ -673,11 +673,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
                 WARN_ON_ONCE(xdr->iov);
                 return;
         }
-        if (fraglen) {
+        if (fraglen)
                 xdr->end = head->iov_base + head->iov_len;
-                xdr->page_ptr--;
-        }
         /* (otherwise assume xdr->end is already set) */
+        xdr->page_ptr--;
         head->iov_len = len;
         buf->len = len;
         xdr->p = head->iov_base + head->iov_len;
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 2830709957bd..c138d68e8a69 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -166,7 +166,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
 
         /* Apply trial address if we just left trial period */
         if (!trial && !self) {
-                tipc_net_finalize(net, tn->trial_addr);
+                tipc_sched_net_finalize(net, tn->trial_addr);
+                msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
                 msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
         }
 
@@ -300,14 +301,12 @@ static void tipc_disc_timeout(struct timer_list *t)
                 goto exit;
         }
 
-        /* Trial period over ? */
-        if (!time_before(jiffies, tn->addr_trial_end)) {
-                /* Did we just leave it ? */
-                if (!tipc_own_addr(net))
-                        tipc_net_finalize(net, tn->trial_addr);
-
-                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
-                msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
+        /* Did we just leave trial period ? */
+        if (!time_before(jiffies, tn->addr_trial_end) && !tipc_own_addr(net)) {
+                mod_timer(&d->timer, jiffies + TIPC_DISC_INIT);
+                spin_unlock_bh(&d->lock);
+                tipc_sched_net_finalize(net, tn->trial_addr);
+                return;
         }
 
         /* Adjust timeout interval according to discovery phase */
@@ -319,6 +318,8 @@ static void tipc_disc_timeout(struct timer_list *t)
                         d->timer_intv = TIPC_DISC_SLOW;
                 else if (!d->num_nodes && d->timer_intv > TIPC_DISC_FAST)
                         d->timer_intv = TIPC_DISC_FAST;
+                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+                msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
         }
 
         mod_timer(&d->timer, jiffies + d->timer_intv);
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 201c3b5bc96b..836727e363c4 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1594,14 +1594,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                 if (in_range(peers_prio, l->priority + 1, TIPC_MAX_LINK_PRI))
                         l->priority = peers_prio;
 
-                /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
-                if (msg_peer_stopping(hdr))
+                /* If peer is going down we want full re-establish cycle */
+                if (msg_peer_stopping(hdr)) {
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
-                else if ((mtyp == RESET_MSG) || !link_is_up(l))
+                        break;
+                }
+                /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
+                if (mtyp == RESET_MSG || !link_is_up(l))
                         rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
 
                 /* ACTIVATE_MSG takes up link if it was already locally reset */
-                if ((mtyp == ACTIVATE_MSG) && (l->state == LINK_ESTABLISHING))
+                if (mtyp == ACTIVATE_MSG && l->state == LINK_ESTABLISHING)
                         rc = TIPC_LINK_UP_EVT;
 
                 l->peer_session = msg_session(hdr);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 62199cf5a56c..f076edb74338 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -104,6 +104,14 @@
  *     - A local spin_lock protecting the queue of subscriber events.
 */
 
+struct tipc_net_work {
+        struct work_struct work;
+        struct net *net;
+        u32 addr;
+};
+
+static void tipc_net_finalize(struct net *net, u32 addr);
+
 int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
 {
         if (tipc_own_id(net)) {
@@ -119,17 +127,38 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
         return 0;
 }
 
-void tipc_net_finalize(struct net *net, u32 addr)
+static void tipc_net_finalize(struct net *net, u32 addr)
 {
         struct tipc_net *tn = tipc_net(net);
 
-        if (!cmpxchg(&tn->node_addr, 0, addr)) {
-                tipc_set_node_addr(net, addr);
-                tipc_named_reinit(net);
-                tipc_sk_reinit(net);
-                tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
-                                     TIPC_CLUSTER_SCOPE, 0, addr);
-        }
+        if (cmpxchg(&tn->node_addr, 0, addr))
+                return;
+        tipc_set_node_addr(net, addr);
+        tipc_named_reinit(net);
+        tipc_sk_reinit(net);
+        tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+                             TIPC_CLUSTER_SCOPE, 0, addr);
+}
+
+static void tipc_net_finalize_work(struct work_struct *work)
+{
+        struct tipc_net_work *fwork;
+
+        fwork = container_of(work, struct tipc_net_work, work);
+        tipc_net_finalize(fwork->net, fwork->addr);
+        kfree(fwork);
+}
+
+void tipc_sched_net_finalize(struct net *net, u32 addr)
+{
+        struct tipc_net_work *fwork = kzalloc(sizeof(*fwork), GFP_ATOMIC);
+
+        if (!fwork)
+                return;
+        INIT_WORK(&fwork->work, tipc_net_finalize_work);
+        fwork->net = net;
+        fwork->addr = addr;
+        schedule_work(&fwork->work);
 }
 
 void tipc_net_stop(struct net *net)
diff --git a/net/tipc/net.h b/net/tipc/net.h
index 09ad02b50bb1..b7f2e364eb99 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -42,7 +42,7 @@
 extern const struct nla_policy tipc_nl_net_policy[];
 
 int tipc_net_init(struct net *net, u8 *node_id, u32 addr);
-void tipc_net_finalize(struct net *net, u32 addr);
+void tipc_sched_net_finalize(struct net *net, u32 addr);
 void tipc_net_stop(struct net *net);
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 2afc4f8c37a7..488019766433 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -584,12 +584,15 @@ static void  tipc_node_clear_links(struct tipc_node *node)
 /* tipc_node_cleanup - delete nodes that does not
  * have active links for NODE_CLEANUP_AFTER time
  */
-static int tipc_node_cleanup(struct tipc_node *peer)
+static bool tipc_node_cleanup(struct tipc_node *peer)
 {
         struct tipc_net *tn = tipc_net(peer->net);
         bool deleted = false;
 
-        spin_lock_bh(&tn->node_list_lock);
+        /* If lock held by tipc_node_stop() the node will be deleted anyway */
+        if (!spin_trylock_bh(&tn->node_list_lock))
+                return false;
+
         tipc_node_write_lock(peer);
 
         if (!node_is_up(peer) && time_after(jiffies, peer->delete_at)) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 636e6131769d..b57b1be7252b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1555,16 +1555,17 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
 /**
  * tipc_sk_anc_data_recv - optionally capture ancillary data for received message
  * @m: descriptor for message info
- * @msg: received message header
+ * @skb: received message buffer
  * @tsk: TIPC port associated with message
  *
  * Note: Ancillary data is not captured if not requested by receiver.
  *
  * Returns 0 if successful, otherwise errno
  */
-static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
+static int tipc_sk_anc_data_recv(struct msghdr *m, struct sk_buff *skb,
                                  struct tipc_sock *tsk)
 {
+        struct tipc_msg *msg;
         u32 anc_data[3];
         u32 err;
         u32 dest_type;
@@ -1573,6 +1574,7 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
 
         if (likely(m->msg_controllen == 0))
                 return 0;
+        msg = buf_msg(skb);
 
         /* Optionally capture errored message object(s) */
         err = msg ? msg_errcode(msg) : 0;
@@ -1583,6 +1585,9 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
                 if (res)
                         return res;
                 if (anc_data[1]) {
+                        if (skb_linearize(skb))
+                                return -ENOMEM;
+                        msg = buf_msg(skb);
                         res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1],
                                        msg_data(msg));
                         if (res)
@@ -1744,9 +1749,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 
         /* Collect msg meta data, including error code and rejected data */
         tipc_sk_set_orig_addr(m, skb);
-        rc = tipc_sk_anc_data_recv(m, hdr, tsk);
+        rc = tipc_sk_anc_data_recv(m, skb, tsk);
         if (unlikely(rc))
                 goto exit;
+        hdr = buf_msg(skb);
 
         /* Capture data if non-error msg, otherwise just set return value */
         if (likely(!err)) {
@@ -1856,9 +1862,10 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,
                 /* Collect msg meta data, incl. error code and rejected data */
                 if (!copied) {
                         tipc_sk_set_orig_addr(m, skb);
-                        rc = tipc_sk_anc_data_recv(m, hdr, tsk);
+                        rc = tipc_sk_anc_data_recv(m, skb, tsk);
                         if (rc)
                                 break;
+                        hdr = buf_msg(skb);
                 }
 
                 /* Copy data if msg ok, otherwise return error/partial data */
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index a8e7ba9f73e8..6a6be9f440cf 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -236,10 +236,8 @@ ifdef CONFIG_GCOV_KERNEL
 objtool_args += --no-unreachable
 endif
 ifdef CONFIG_RETPOLINE
-ifneq ($(RETPOLINE_CFLAGS),)
   objtool_args += --retpoline
 endif
-endif
 
 
 ifdef CONFIG_MODVERSIONS
diff --git a/scripts/faddr2line b/scripts/faddr2line
index a0149db00be7..6c6439f69a72 100755
--- a/scripts/faddr2line
+++ b/scripts/faddr2line
@@ -71,7 +71,7 @@ die() {
 
 # Try to figure out the source directory prefix so we can remove it from the
 # addr2line output.  HACK ALERT: This assumes that start_kernel() is in
-# kernel/init.c!  This only works for vmlinux.  Otherwise it falls back to
+# init/main.c!  This only works for vmlinux.  Otherwise it falls back to
 # printing the absolute path.
 find_dir_prefix() {
         local objfile=$1
diff --git a/scripts/kconfig/merge_config.sh b/scripts/kconfig/merge_config.sh
index da66e7742282..0ef906499646 100755
--- a/scripts/kconfig/merge_config.sh
+++ b/scripts/kconfig/merge_config.sh
@@ -102,7 +102,8 @@ if [ ! -r "$INITFILE" ]; then
 fi
 
 MERGE_LIST=$*
-SED_CONFIG_EXP="s/^\(# \)\{0,1\}\(${CONFIG_PREFIX}[a-zA-Z0-9_]*\)[= ].*/\2/p"
+SED_CONFIG_EXP1="s/^\(${CONFIG_PREFIX}[a-zA-Z0-9_]*\)=.*/\1/p"
+SED_CONFIG_EXP2="s/^# \(${CONFIG_PREFIX}[a-zA-Z0-9_]*\) is not set$/\1/p"
 
 TMP_FILE=$(mktemp ./.tmp.config.XXXXXXXXXX)
 
@@ -116,7 +117,7 @@ for MERGE_FILE in $MERGE_LIST ; do
                 echo "The merge file '$MERGE_FILE' does not exist.  Exit." >&2
                 exit 1
         fi
-        CFG_LIST=$(sed -n "$SED_CONFIG_EXP" $MERGE_FILE)
+        CFG_LIST=$(sed -n -e "$SED_CONFIG_EXP1" -e "$SED_CONFIG_EXP2" $MERGE_FILE)
 
         for CFG in $CFG_LIST ; do
                 grep -q -w $CFG $TMP_FILE || continue
@@ -159,7 +160,7 @@ make KCONFIG_ALLCONFIG=$TMP_FILE $OUTPUT_ARG $ALLTARGET
 
 
 # Check all specified config values took (might have missed-dependency issues)
-for CFG in $(sed -n "$SED_CONFIG_EXP" $TMP_FILE); do
+for CFG in $(sed -n -e "$SED_CONFIG_EXP1" -e "$SED_CONFIG_EXP2" $TMP_FILE); do
 
         REQUESTED_VAL=$(grep -w -e "$CFG" $TMP_FILE)
         ACTUAL_VAL=$(grep -w -e "$CFG" "$KCONFIG_CONFIG")
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index 90c9a8ac7adb..f43a274f4f1d 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -81,11 +81,11 @@ else
         cp System.map "$tmpdir/boot/System.map-$version"
         cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version"
 fi
-cp "$($MAKE -s image_name)" "$tmpdir/$installed_image_path"
+cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path"
 
-if grep -q "^CONFIG_OF=y" $KCONFIG_CONFIG ; then
+if grep -q "^CONFIG_OF_EARLY_FLATTREE=y" $KCONFIG_CONFIG ; then
         # Only some architectures with OF support have this target
-        if grep -q dtbs_install "${srctree}/arch/$SRCARCH/Makefile"; then
+        if [ -d "${srctree}/arch/$SRCARCH/boot/dts" ]; then
                 $MAKE KBUILD_SRC= INSTALL_DTBS_PATH="$tmpdir/usr/lib/$packagename" dtbs_install
         fi
 fi
diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
index 663a7f343b42..edcad61fe3cd 100755
--- a/scripts/package/mkdebian
+++ b/scripts/package/mkdebian
@@ -88,6 +88,7 @@ set_debarch() {
 version=$KERNELRELEASE
 if [ -n "$KDEB_PKGVERSION" ]; then
         packageversion=$KDEB_PKGVERSION
+        revision=${packageversion##*-}
 else
         revision=$(cat .version 2>/dev/null||echo 1)
         packageversion=$version-$revision
@@ -205,10 +206,12 @@ cat <<EOF > debian/rules
 #!$(command -v $MAKE) -f
 
 build:
-        \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC=
+        \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
+        KBUILD_BUILD_VERSION=${revision} KBUILD_SRC=
 
 binary-arch:
-        \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= intdeb-pkg
+        \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
+        KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= intdeb-pkg
 
 clean:
         rm -rf debian/*tmp debian/files
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index e05646dc24dc..009147d4718e 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -12,6 +12,7 @@
 # how we were called determines which rpms we build and how we build them
 if [ "$1" = prebuilt ]; then
         S=DEL
+        MAKE="$MAKE -f $srctree/Makefile"
 else
         S=
 fi
@@ -78,19 +79,19 @@ $S	%prep
 $S      %setup -q
 $S
 $S      %build
-$S      make %{?_smp_mflags} KBUILD_BUILD_VERSION=%{release}
+$S      $MAKE %{?_smp_mflags} KBUILD_BUILD_VERSION=%{release}
 $S
         %install
         mkdir -p %{buildroot}/boot
         %ifarch ia64
         mkdir -p %{buildroot}/boot/efi
-        cp \$(make image_name) %{buildroot}/boot/efi/vmlinuz-$KERNELRELEASE
+        cp \$($MAKE image_name) %{buildroot}/boot/efi/vmlinuz-$KERNELRELEASE
         ln -s efi/vmlinuz-$KERNELRELEASE %{buildroot}/boot/
         %else
-        cp \$(make image_name) %{buildroot}/boot/vmlinuz-$KERNELRELEASE
+        cp \$($MAKE image_name) %{buildroot}/boot/vmlinuz-$KERNELRELEASE
         %endif
-$M      make %{?_smp_mflags} INSTALL_MOD_PATH=%{buildroot} KBUILD_SRC= modules_install
-        make %{?_smp_mflags} INSTALL_HDR_PATH=%{buildroot}/usr KBUILD_SRC= headers_install
+$M      $MAKE %{?_smp_mflags} INSTALL_MOD_PATH=%{buildroot} modules_install
+        $MAKE %{?_smp_mflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install
         cp System.map %{buildroot}/boot/System.map-$KERNELRELEASE
         cp .config %{buildroot}/boot/config-$KERNELRELEASE
         bzip2 -9 --keep vmlinux
diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 79f7dd57d571..71f39410691b 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -74,7 +74,7 @@ scm_version()
                 fi
 
                 # Check for uncommitted changes
-                if git status -uno --porcelain | grep -qv '^.. scripts/package'; then
+                if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
                         printf '%s' -dirty
                 fi
 
diff --git a/scripts/spdxcheck.py b/scripts/spdxcheck.py
index 839e190bbd7a..5056fb3b897d 100755
--- a/scripts/spdxcheck.py
+++ b/scripts/spdxcheck.py
@@ -168,7 +168,6 @@ class id_parser(object):
         self.curline = 0
         try:
             for line in fd:
-                line = line.decode(locale.getpreferredencoding(False), errors='ignore')
                 self.curline += 1
                 if self.curline > maxlines:
                     break
diff --git a/scripts/unifdef.c b/scripts/unifdef.c
index 7493c0ee51cc..db00e3e30a59 100644
--- a/scripts/unifdef.c
+++ b/scripts/unifdef.c
@@ -395,7 +395,7 @@ usage(void)
  * When we have processed a group that starts off with a known-false
  * #if/#elif sequence (which has therefore been deleted) followed by a
  * #elif that we don't understand and therefore must keep, we edit the
- * latter into a #if to keep the nesting correct. We use strncpy() to
+ * latter into a #if to keep the nesting correct. We use memcpy() to
  * overwrite the 4 byte token "elif" with "if  " without a '\0' byte.
  *
  * When we find a true #elif in a group, the following block will
@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop();  ignoreon(); }
 static void Itrue (void) { Ftrue();  ignoreon(); }
 static void Ifalse(void) { Ffalse(); ignoreon(); }
 /* modify this line */
-static void Mpass (void) { strncpy(keyword, "if  ", 4); Pelif(); }
+static void Mpass (void) { memcpy(keyword, "if  ", 4); Pelif(); }
 static void Mtrue (void) { keywordedit("else");  state(IS_TRUE_MIDDLE); }
 static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); }
 static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); }
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 6dc075144508..d775e03fbbcc 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -106,6 +106,7 @@ int asymmetric_verify(struct key *keyring, const char *sig,
 
         pks.pkey_algo = "rsa";
         pks.hash_algo = hash_algo_name[hdr->hash_algo];
+        pks.encoding = "pkcs1";
         pks.digest = (u8 *)data;
         pks.digest_size = datalen;
         pks.s = hdr->sig;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7ce683259357..a67459eb62d5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5318,6 +5318,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
         addr_buf = address;
 
         while (walk_size < addrlen) {
+                if (walk_size + sizeof(sa_family_t) > addrlen)
+                        return -EINVAL;
+
                 addr = addr_buf;
                 switch (addr->sa_family) {
                 case AF_UNSPEC:
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 74b951f55608..9cec81209617 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
         { RTM_NEWSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ },
         { RTM_GETSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
         { RTM_NEWCACHEREPORT,   NETLINK_ROUTE_SOCKET__NLMSG_READ },
+        { RTM_NEWCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_DELCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_GETCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 };
 
 static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
@@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
 
         switch (sclass) {
         case SECCLASS_NETLINK_ROUTE_SOCKET:
-                /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
+                /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
+                 * If the BUILD_BUG_ON() below fails you must update the
+                 * structures at the top of this file with the new mappings
+                 * before updating the BUILD_BUG_ON() macro!
+                 */
                 BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
                                  sizeof(nlmsg_route_perms));
@@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
                 break;
 
         case SECCLASS_NETLINK_XFRM_SOCKET:
+                /* If the BUILD_BUG_ON() below fails you must update the
+                 * structures at the top of this file with the new mappings
+                 * before updating the BUILD_BUG_ON() macro!
+                 */
                 BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
                                  sizeof(nlmsg_xfrm_perms));
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 2fe459df3c85..b7efa2296969 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -245,9 +245,13 @@ int mls_context_to_sid(struct policydb *pol,
         char *rangep[2];
 
         if (!pol->mls_enabled) {
-                if ((def_sid != SECSID_NULL && oldc) || (*scontext) == '\0')
-                        return 0;
-                return -EINVAL;
+                /*
+                 * With no MLS, only return -EINVAL if there is a MLS field
+                 * and it did not come from an xattr.
+                 */
+                if (oldc && def_sid == SECSID_NULL)
+                        return -EINVAL;
+                return 0;
         }
 
         /*
diff --git a/sound/core/control.c b/sound/core/control.c
index 9aa15bfc7936..649d3217590e 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -348,6 +348,40 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
         return 0;
 }
 
+/* add a new kcontrol object; call with card->controls_rwsem locked */
+static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+{
+        struct snd_ctl_elem_id id;
+        unsigned int idx;
+        unsigned int count;
+
+        id = kcontrol->id;
+        if (id.index > UINT_MAX - kcontrol->count)
+                return -EINVAL;
+
+        if (snd_ctl_find_id(card, &id)) {
+                dev_err(card->dev,
+                        "control %i:%i:%i:%s:%i is already present\n",
+                        id.iface, id.device, id.subdevice, id.name, id.index);
+                return -EBUSY;
+        }
+
+        if (snd_ctl_find_hole(card, kcontrol->count) < 0)
+                return -ENOMEM;
+
+        list_add_tail(&kcontrol->list, &card->controls);
+        card->controls_count += kcontrol->count;
+        kcontrol->id.numid = card->last_numid + 1;
+        card->last_numid += kcontrol->count;
+
+        id = kcontrol->id;
+        count = kcontrol->count;
+        for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+                snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+
+        return 0;
+}
+
 /**
  * snd_ctl_add - add the control instance to the card
  * @card: the card instance
@@ -364,45 +398,18 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
  */
 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
 {
-        struct snd_ctl_elem_id id;
-        unsigned int idx;
-        unsigned int count;
         int err = -EINVAL;
 
         if (! kcontrol)
                 return err;
         if (snd_BUG_ON(!card || !kcontrol->info))
                 goto error;
-        id = kcontrol->id;
-        if (id.index > UINT_MAX - kcontrol->count)
-                goto error;
 
         down_write(&card->controls_rwsem);
-        if (snd_ctl_find_id(card, &id)) {
-                up_write(&card->controls_rwsem);
-                dev_err(card->dev, "control %i:%i:%i:%s:%i is already present\n",
-                                        id.iface,
-                                        id.device,
-                                        id.subdevice,
-                                        id.name,
-                                        id.index);
-                err = -EBUSY;
-                goto error;
-        }
-        if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
-                up_write(&card->controls_rwsem);
-                err = -ENOMEM;
-                goto error;
-        }
-        list_add_tail(&kcontrol->list, &card->controls);
-        card->controls_count += kcontrol->count;
-        kcontrol->id.numid = card->last_numid + 1;
-        card->last_numid += kcontrol->count;
-        id = kcontrol->id;
-        count = kcontrol->count;
+        err = __snd_ctl_add(card, kcontrol);
         up_write(&card->controls_rwsem);
-        for (idx = 0; idx < count; idx++, id.index++, id.numid++)
-                snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+        if (err < 0)
+                goto error;
         return 0;
 
  error:
@@ -1361,9 +1368,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
                 kctl->tlv.c = snd_ctl_elem_user_tlv;
 
         /* This function manage to free the instance on failure. */
-        err = snd_ctl_add(card, kctl);
-        if (err < 0)
-                return err;
+        down_write(&card->controls_rwsem);
+        err = __snd_ctl_add(card, kctl);
+        if (err < 0) {
+                snd_ctl_free_one(kctl);
+                goto unlock;
+        }
         offset = snd_ctl_get_ioff(kctl, &info->id);
         snd_ctl_build_ioff(&info->id, kctl, offset);
         /*
@@ -1374,10 +1384,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
          * which locks the element.
          */
 
-        down_write(&card->controls_rwsem);
         card->user_ctl_count++;
-        up_write(&card->controls_rwsem);
 
+ unlock:
+        up_write(&card->controls_rwsem);
         return 0;
 }
 
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f8d4a419f3af..467039b342b5 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         runtime->oss.channels = params_channels(params);
         runtime->oss.rate = params_rate(params);
 
-        vfree(runtime->oss.buffer);
-        runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
+        kvfree(runtime->oss.buffer);
+        runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
         if (!runtime->oss.buffer) {
                 err = -ENOMEM;
                 goto failure;
@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime;
         runtime = substream->runtime;
-        vfree(runtime->oss.buffer);
+        kvfree(runtime->oss.buffer);
         runtime->oss.buffer = NULL;
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
         snd_pcm_oss_plugin_clear(substream);
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index 141c5f3a9575..31cb2acf8afc 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
                 return -ENXIO;
         size /= 8;
         if (plugin->buf_frames < frames) {
-                vfree(plugin->buf);
-                plugin->buf = vmalloc(size);
+                kvfree(plugin->buf);
+                plugin->buf = kvzalloc(size, GFP_KERNEL);
                 plugin->buf_frames = frames;
         }
         if (!plugin->buf) {
@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
         if (plugin->private_free)
                 plugin->private_free(plugin);
         kfree(plugin->buf_channels);
-        vfree(plugin->buf);
+        kvfree(plugin->buf);
         kfree(plugin);
         return 0;
 }
diff --git a/sound/isa/wss/wss_lib.c b/sound/isa/wss/wss_lib.c
index 32453f81b95a..3a5008837576 100644
--- a/sound/isa/wss/wss_lib.c
+++ b/sound/isa/wss/wss_lib.c
@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct snd_pcm_substream *substream)
         if (err < 0) {
                 if (chip->release_dma)
                         chip->release_dma(chip, chip->dma_private_data, chip->dma1);
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
                 return err;
         }
         chip->playback_substream = substream;
@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct snd_pcm_substream *substream)
         if (err < 0) {
                 if (chip->release_dma)
                         chip->release_dma(chip, chip->dma_private_data, chip->dma2);
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
                 return err;
         }
         chip->capture_substream = substream;
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index f4459d1a9d67..27b468f057dd 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -824,7 +824,7 @@ static int snd_ac97_put_spsa(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
 {
         struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
         int reg = kcontrol->private_value & 0xff;
-        int shift = (kcontrol->private_value >> 8) & 0xff;
+        int shift = (kcontrol->private_value >> 8) & 0x0f;
         int mask = (kcontrol->private_value >> 16) & 0xff;
         // int invert = (kcontrol->private_value >> 24) & 0xff;
         unsigned short value, old, new;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d8eb2b5f51ae..0bbdf1a01e76 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2169,6 +2169,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
         SND_PCI_QUIRK(0x1849, 0xc892, "Asrock B85M-ITX", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+        SND_PCI_QUIRK(0x1849, 0x0397, "Asrock N68C-S UCC", 0),
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
         SND_PCI_QUIRK(0x1849, 0x7662, "Asrock H81M-HDS", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
         SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0),
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 0a24037184c3..0a567634e5fa 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1177,6 +1177,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
         SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
         SND_PCI_QUIRK(0x1102, 0x0010, "Sound Blaster Z", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1102, 0x0023, "Sound Blaster Z", QUIRK_SBZ),
+        SND_PCI_QUIRK(0x1102, 0x0033, "Sound Blaster ZxR", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
@@ -8413,7 +8414,7 @@ static void ca0132_free(struct hda_codec *codec)
 
         snd_hda_power_down(codec);
         if (spec->mem_base)
-                iounmap(spec->mem_base);
+                pci_iounmap(codec->bus->pci, spec->mem_base);
         kfree(spec->spec_init_verbs);
         kfree(codec->spec);
 }
@@ -8488,7 +8489,7 @@ static void ca0132_config(struct hda_codec *codec)
                 break;
         case QUIRK_AE5:
                 codec_dbg(codec, "%s: QUIRK_AE5 applied.\n", __func__);
-                snd_hda_apply_pincfgs(codec, r3di_pincfgs);
+                snd_hda_apply_pincfgs(codec, ae5_pincfgs);
                 break;
         }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fa61674a5605..06f93032d0cc 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -388,6 +388,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
         case 0x10ec0285:
         case 0x10ec0298:
         case 0x10ec0289:
+        case 0x10ec0300:
                 alc_update_coef_idx(codec, 0x10, 1<<9, 0);
                 break;
         case 0x10ec0275:
@@ -2830,6 +2831,7 @@ enum {
         ALC269_TYPE_ALC215,
         ALC269_TYPE_ALC225,
         ALC269_TYPE_ALC294,
+        ALC269_TYPE_ALC300,
         ALC269_TYPE_ALC700,
 };
 
@@ -2864,6 +2866,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
         case ALC269_TYPE_ALC215:
         case ALC269_TYPE_ALC225:
         case ALC269_TYPE_ALC294:
+        case ALC269_TYPE_ALC300:
         case ALC269_TYPE_ALC700:
                 ssids = alc269_ssids;
                 break;
@@ -5358,6 +5361,16 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
         spec->gen.preferred_dacs = preferred_pairs;
 }
 
+/* The DAC of NID 0x3 will introduce click/pop noise on headphones, so invalidate it */
+static void alc285_fixup_invalidate_dacs(struct hda_codec *codec,
+                              const struct hda_fixup *fix, int action)
+{
+        if (action != HDA_FIXUP_ACT_PRE_PROBE)
+                return;
+
+        snd_hda_override_wcaps(codec, 0x03, 0);
+}
+
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
@@ -5495,6 +5508,8 @@ enum {
         ALC255_FIXUP_DELL_HEADSET_MIC,
         ALC295_FIXUP_HP_X360,
         ALC221_FIXUP_HP_HEADSET_MIC,
+        ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+        ALC295_FIXUP_HP_AUTO_MUTE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5659,6 +5674,8 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC269_FIXUP_HP_MUTE_LED_MIC3] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_hp_mute_led_mic3,
+                .chained = true,
+                .chain_id = ALC295_FIXUP_HP_AUTO_MUTE
         },
         [ALC269_FIXUP_HP_GPIO_LED] = {
                 .type = HDA_FIXUP_FUNC,
@@ -6362,6 +6379,14 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MIC
         },
+        [ALC285_FIXUP_LENOVO_HEADPHONE_NOISE] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc285_fixup_invalidate_dacs,
+        },
+        [ALC295_FIXUP_HP_AUTO_MUTE] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_auto_mute_via_amp,
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6481,6 +6506,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
         SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
         SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
@@ -6531,6 +6557,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
         SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
@@ -7033,6 +7060,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60130},
                 {0x19, 0x03a11020},
                 {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x19, 0x04a11040},
+                {0x21, 0x04211020}),
         SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
@@ -7294,6 +7326,10 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
                 break;
+        case 0x10ec0300:
+                spec->codec_variant = ALC269_TYPE_ALC300;
+                spec->gen.mixer_nid = 0; /* no loopback on ALC300 */
+                break;
         case 0x10ec0700:
         case 0x10ec0701:
         case 0x10ec0703:
@@ -8404,6 +8440,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
         HDA_CODEC_ENTRY(0x10ec0295, "ALC295", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269),
         HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861),
         HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd),
         HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861),
diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
index 97f49b751e6e..568575b72f2f 100644
--- a/sound/pci/hda/thinkpad_helper.c
+++ b/sound/pci/hda/thinkpad_helper.c
@@ -58,8 +58,8 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
                         removefunc = false;
                 }
                 if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0 &&
-                    snd_hda_gen_add_micmute_led(codec,
-                                                update_tpacpi_micmute) > 0)
+                    !snd_hda_gen_add_micmute_led(codec,
+                                                 update_tpacpi_micmute))
                         removefunc = false;
         }
 
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 4e9854889a95..e63d6e33df48 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -2187,11 +2187,6 @@ static int hdac_hdmi_runtime_suspend(struct device *dev)
          */
         snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
                                                         AC_PWRST_D3);
-        err = snd_hdac_display_power(bus, false);
-        if (err < 0) {
-                dev_err(dev, "Cannot turn on display power on i915\n");
-                return err;
-        }
 
         hlink = snd_hdac_ext_bus_get_link(bus, dev_name(dev));
         if (!hlink) {
@@ -2201,7 +2196,11 @@ static int hdac_hdmi_runtime_suspend(struct device *dev)
 
         snd_hdac_ext_bus_link_put(bus, hlink);
 
-        return 0;
+        err = snd_hdac_display_power(bus, false);
+        if (err < 0)
+                dev_err(dev, "Cannot turn off display power on i915\n");
+
+        return err;
 }
 
 static int hdac_hdmi_runtime_resume(struct device *dev)
diff --git a/sound/soc/codecs/pcm186x.h b/sound/soc/codecs/pcm186x.h
index 2c6ba55bf394..bb3f0c42a1cd 100644
--- a/sound/soc/codecs/pcm186x.h
+++ b/sound/soc/codecs/pcm186x.h
@@ -139,7 +139,7 @@ enum pcm186x_type {
 #define PCM186X_MAX_REGISTER            PCM186X_CURR_TRIM_CTRL
 
 /* PCM186X_PAGE */
-#define PCM186X_RESET                   0xff
+#define PCM186X_RESET                   0xfe
 
 /* PCM186X_ADCX_INPUT_SEL_X */
 #define PCM186X_ADC_INPUT_SEL_POL       BIT(7)
diff --git a/sound/soc/codecs/pcm3060.c b/sound/soc/codecs/pcm3060.c
index 494d9d662be8..771b46e1974b 100644
--- a/sound/soc/codecs/pcm3060.c
+++ b/sound/soc/codecs/pcm3060.c
@@ -198,20 +198,16 @@ static const struct snd_kcontrol_new pcm3060_dapm_controls[] = {
 };
 
 static const struct snd_soc_dapm_widget pcm3060_dapm_widgets[] = {
-        SND_SOC_DAPM_OUTPUT("OUTL+"),
-        SND_SOC_DAPM_OUTPUT("OUTR+"),
-        SND_SOC_DAPM_OUTPUT("OUTL-"),
-        SND_SOC_DAPM_OUTPUT("OUTR-"),
+        SND_SOC_DAPM_OUTPUT("OUTL"),
+        SND_SOC_DAPM_OUTPUT("OUTR"),
 
         SND_SOC_DAPM_INPUT("INL"),
         SND_SOC_DAPM_INPUT("INR"),
 };
 
 static const struct snd_soc_dapm_route pcm3060_dapm_map[] = {
-        { "OUTL+", NULL, "Playback" },
-        { "OUTR+", NULL, "Playback" },
-        { "OUTL-", NULL, "Playback" },
-        { "OUTR-", NULL, "Playback" },
+        { "OUTL", NULL, "Playback" },
+        { "OUTR", NULL, "Playback" },
 
         { "Capture", NULL, "INL" },
         { "Capture", NULL, "INR" },
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index a53dc174bbf0..66501b8dc46f 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -765,38 +765,41 @@ static unsigned int wm_adsp_region_to_reg(struct wm_adsp_region const *mem,
 
 static void wm_adsp2_show_fw_status(struct wm_adsp *dsp)
 {
-        u16 scratch[4];
+        unsigned int scratch[4];
+        unsigned int addr = dsp->base + ADSP2_SCRATCH0;
+        unsigned int i;
         int ret;
 
-        ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2_SCRATCH0,
-                                scratch, sizeof(scratch));
-        if (ret) {
-                adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
-                return;
+        for (i = 0; i < ARRAY_SIZE(scratch); ++i) {
+                ret = regmap_read(dsp->regmap, addr + i, &scratch[i]);
+                if (ret) {
+                        adsp_err(dsp, "Failed to read SCRATCH%u: %d\n", i, ret);
+                        return;
+                }
         }
 
         adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
-                 be16_to_cpu(scratch[0]),
-                 be16_to_cpu(scratch[1]),
-                 be16_to_cpu(scratch[2]),
-                 be16_to_cpu(scratch[3]));
+                 scratch[0], scratch[1], scratch[2], scratch[3]);
 }
 
 static void wm_adsp2v2_show_fw_status(struct wm_adsp *dsp)
 {
-        u32 scratch[2];
+        unsigned int scratch[2];
         int ret;
 
-        ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
-                              scratch, sizeof(scratch));
-
+        ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
+                          &scratch[0]);
         if (ret) {
-                adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
+                adsp_err(dsp, "Failed to read SCRATCH0_1: %d\n", ret);
                 return;
         }
 
-        scratch[0] = be32_to_cpu(scratch[0]);
-        scratch[1] = be32_to_cpu(scratch[1]);
+        ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH2_3,
+                          &scratch[1]);
+        if (ret) {
+                adsp_err(dsp, "Failed to read SCRATCH2_3: %d\n", ret);
+                return;
+        }
 
         adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
                  scratch[0] & 0xFFFF,
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 0caa1f4eb94d..18e717703685 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -101,22 +101,42 @@ config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
           codec, then enable this option by saying Y or m. This is a
           recommended option
 
-config SND_SOC_INTEL_SKYLAKE_SSP_CLK
-        tristate
-
 config SND_SOC_INTEL_SKYLAKE
         tristate "SKL/BXT/KBL/GLK/CNL... Platforms"
         depends on PCI && ACPI
+        select SND_SOC_INTEL_SKYLAKE_COMMON
+        help
+          If you have a Intel Skylake/Broxton/ApolloLake/KabyLake/
+          GeminiLake or CannonLake platform with the DSP enabled in the BIOS
+          then enable this option by saying Y or m.
+
+if  SND_SOC_INTEL_SKYLAKE
+
+config SND_SOC_INTEL_SKYLAKE_SSP_CLK
+        tristate
+
+config SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
+        bool "HDAudio codec support"
+        help
+          If you have a Intel Skylake/Broxton/ApolloLake/KabyLake/
+          GeminiLake or CannonLake platform with an HDaudio codec
+          then enable this option by saying Y
+
+config SND_SOC_INTEL_SKYLAKE_COMMON
+        tristate
         select SND_HDA_EXT_CORE
         select SND_HDA_DSP_LOADER
         select SND_SOC_TOPOLOGY
         select SND_SOC_INTEL_SST
+        select SND_SOC_HDAC_HDA if SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
         select SND_SOC_ACPI_INTEL_MATCH
         help
           If you have a Intel Skylake/Broxton/ApolloLake/KabyLake/
           GeminiLake or CannonLake platform with the DSP enabled in the BIOS
           then enable this option by saying Y or m.
 
+endif ## SND_SOC_INTEL_SKYLAKE
+
 config SND_SOC_ACPI_INTEL_MATCH
         tristate
         select SND_SOC_ACPI if ACPI
diff --git a/sound/soc/intel/boards/Kconfig b/sound/soc/intel/boards/Kconfig
index 73ca1350aa31..b177db2a0dbb 100644
--- a/sound/soc/intel/boards/Kconfig
+++ b/sound/soc/intel/boards/Kconfig
@@ -293,16 +293,6 @@ config SND_SOC_INTEL_KBL_DA7219_MAX98927_MACH
           Say Y if you have such a device.
           If unsure select "N".
 
-config SND_SOC_INTEL_SKL_HDA_DSP_GENERIC_MACH
-        tristate "SKL/KBL/BXT/APL with HDA Codecs"
-        select SND_SOC_HDAC_HDMI
-        select SND_SOC_HDAC_HDA
-        help
-          This adds support for ASoC machine driver for Intel platforms
-          SKL/KBL/BXT/APL with iDisp, HDA audio codecs.
-          Say Y or m if you have such a device. This is a recommended option.
-          If unsure select "N".
-
 config SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH
         tristate "GLK with RT5682 and MAX98357A in I2S Mode"
         depends on MFD_INTEL_LPSS && I2C && ACPI
@@ -319,4 +309,18 @@ config SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH
 
 endif ## SND_SOC_INTEL_SKYLAKE
 
+if SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
+
+config SND_SOC_INTEL_SKL_HDA_DSP_GENERIC_MACH
+        tristate "SKL/KBL/BXT/APL with HDA Codecs"
+        select SND_SOC_HDAC_HDMI
+        # SND_SOC_HDAC_HDA is already selected
+        help
+          This adds support for ASoC machine driver for Intel platforms
+          SKL/KBL/BXT/APL with iDisp, HDA audio codecs.
+          Say Y or m if you have such a device. This is a recommended option.
+          If unsure select "N".
+
+endif ## SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
+
 endif ## SND_SOC_INTEL_MACH
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index db6976f4ddaa..9d9f6e41d81c 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -19,6 +19,7 @@
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  */
 
+#include <linux/dmi.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
@@ -35,6 +36,8 @@
 #define CHT_PLAT_CLK_3_HZ       19200000
 #define CHT_CODEC_DAI   "HiFi"
 
+#define QUIRK_PMC_PLT_CLK_0                             0x01
+
 struct cht_mc_private {
         struct clk *mclk;
         struct snd_soc_jack jack;
@@ -385,11 +388,29 @@ static struct snd_soc_card snd_soc_card_cht = {
         .num_controls = ARRAY_SIZE(cht_mc_controls),
 };
 
+static const struct dmi_system_id cht_max98090_quirk_table[] = {
+        {
+                /* Swanky model Chromebook (Toshiba Chromebook 2) */
+                .matches = {
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Swanky"),
+                },
+                .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
+        },
+        {}
+};
+
 static int snd_cht_mc_probe(struct platform_device *pdev)
 {
+        const struct dmi_system_id *dmi_id;
         struct device *dev = &pdev->dev;
         int ret_val = 0;
         struct cht_mc_private *drv;
+        const char *mclk_name;
+        int quirks = 0;
+
+        dmi_id = dmi_first_match(cht_max98090_quirk_table);
+        if (dmi_id)
+                quirks = (unsigned long)dmi_id->driver_data;
 
         drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
         if (!drv)
@@ -411,11 +432,16 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         snd_soc_card_cht.dev = &pdev->dev;
         snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
 
-        drv->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+        if (quirks & QUIRK_PMC_PLT_CLK_0)
+                mclk_name = "pmc_plt_clk_0";
+        else
+                mclk_name = "pmc_plt_clk_3";
+
+        drv->mclk = devm_clk_get(&pdev->dev, mclk_name);
         if (IS_ERR(drv->mclk)) {
                 dev_err(&pdev->dev,
-                        "Failed to get MCLK from pmc_plt_clk_3: %ld\n",
-                        PTR_ERR(drv->mclk));
+                        "Failed to get MCLK from %s: %ld\n",
+                        mclk_name, PTR_ERR(drv->mclk));
                 return PTR_ERR(drv->mclk);
         }
 
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 29225623b4b4..7487f388e65d 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -37,7 +37,9 @@
 #include "skl.h"
 #include "skl-sst-dsp.h"
 #include "skl-sst-ipc.h"
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
 #include "../../../soc/codecs/hdac_hda.h"
+#endif
 
 /*
  * initialize the PCI registers
@@ -658,6 +660,8 @@ static void skl_clock_device_unregister(struct skl *skl)
                 platform_device_unregister(skl->clk_dev);
 }
 
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
+
 #define IDISP_INTEL_VENDOR_ID   0x80860000
 
 /*
@@ -676,6 +680,8 @@ static void load_codec_module(struct hda_codec *codec)
 #endif
 }
 
+#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */
+
 /*
  * Probe the given codec address
  */
@@ -685,9 +691,11 @@ static int probe_codec(struct hdac_bus *bus, int addr)
                 (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID;
         unsigned int res = -1;
         struct skl *skl = bus_to_skl(bus);
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
         struct hdac_hda_priv *hda_codec;
-        struct hdac_device *hdev;
         int err;
+#endif
+        struct hdac_device *hdev;
 
         mutex_lock(&bus->cmd_mutex);
         snd_hdac_bus_send_cmd(bus, cmd);
@@ -697,6 +705,7 @@ static int probe_codec(struct hdac_bus *bus, int addr)
                 return -EIO;
         dev_dbg(bus->dev, "codec #%d probed OK: %x\n", addr, res);
 
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
         hda_codec = devm_kzalloc(&skl->pci->dev, sizeof(*hda_codec),
                                  GFP_KERNEL);
         if (!hda_codec)
@@ -715,6 +724,13 @@ static int probe_codec(struct hdac_bus *bus, int addr)
                 load_codec_module(&hda_codec->codec);
         }
         return 0;
+#else
+        hdev = devm_kzalloc(&skl->pci->dev, sizeof(*hdev), GFP_KERNEL);
+        if (!hdev)
+                return -ENOMEM;
+
+        return snd_hdac_ext_bus_device_init(bus, addr, hdev);
+#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */
 }
 
 /* Codec initialization */
@@ -815,6 +831,12 @@ static void skl_probe_work(struct work_struct *work)
                 }
         }
 
+        /*
+         * we are done probing so decrement link counts
+         */
+        list_for_each_entry(hlink, &bus->hlink_list, list)
+                snd_hdac_ext_bus_link_put(bus, hlink);
+
         if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
                 err = snd_hdac_display_power(bus, false);
                 if (err < 0) {
@@ -824,12 +846,6 @@ static void skl_probe_work(struct work_struct *work)
                 }
         }
 
-        /*
-         * we are done probing so decrement link counts
-         */
-        list_for_each_entry(hlink, &bus->hlink_list, list)
-                snd_hdac_ext_bus_link_put(bus, hlink);
-
         /* configure PM */
         pm_runtime_put_noidle(bus->dev);
         pm_runtime_allow(bus->dev);
@@ -870,7 +886,7 @@ static int skl_create(struct pci_dev *pci,
         hbus = skl_to_hbus(skl);
         bus = skl_to_bus(skl);
 
-#if IS_ENABLED(CONFIG_SND_SOC_HDAC_HDA)
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
         ext_ops = snd_soc_hdac_hda_get_ops();
 #endif
         snd_hdac_ext_bus_init(bus, &pci->dev, &bus_core_ops, io_ops, ext_ops);
diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
index d5ae9eb8c756..fed45b41f9d3 100644
--- a/sound/soc/omap/omap-abe-twl6040.c
+++ b/sound/soc/omap/omap-abe-twl6040.c
@@ -36,6 +36,8 @@
 #include "../codecs/twl6040.h"
 
 struct abe_twl6040 {
+        struct snd_soc_card card;
+        struct snd_soc_dai_link dai_links[2];
         int     jack_detection; /* board can detect jack events */
         int     mclk_freq;      /* MCLK frequency speed for twl6040 */
 };
@@ -208,40 +210,10 @@ static int omap_abe_dmic_init(struct snd_soc_pcm_runtime *rtd)
                                 ARRAY_SIZE(dmic_audio_map));
 }
 
-/* Digital audio interface glue - connects codec <--> CPU */
-static struct snd_soc_dai_link abe_twl6040_dai_links[] = {
-        {
-                .name = "TWL6040",
-                .stream_name = "TWL6040",
-                .codec_dai_name = "twl6040-legacy",
-                .codec_name = "twl6040-codec",
-                .init = omap_abe_twl6040_init,
-                .ops = &omap_abe_ops,
-        },
-        {
-                .name = "DMIC",
-                .stream_name = "DMIC Capture",
-                .codec_dai_name = "dmic-hifi",
-                .codec_name = "dmic-codec",
-                .init = omap_abe_dmic_init,
-                .ops = &omap_abe_dmic_ops,
-        },
-};
-
-/* Audio machine driver */
-static struct snd_soc_card omap_abe_card = {
-        .owner = THIS_MODULE,
-
-        .dapm_widgets = twl6040_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets),
-        .dapm_routes = audio_map,
-        .num_dapm_routes = ARRAY_SIZE(audio_map),
-};
-
 static int omap_abe_probe(struct platform_device *pdev)
 {
         struct device_node *node = pdev->dev.of_node;
-        struct snd_soc_card *card = &omap_abe_card;
+        struct snd_soc_card *card;
         struct device_node *dai_node;
         struct abe_twl6040 *priv;
         int num_links = 0;
@@ -252,12 +224,18 @@ static int omap_abe_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        card->dev = &pdev->dev;
-
         priv = devm_kzalloc(&pdev->dev, sizeof(struct abe_twl6040), GFP_KERNEL);
         if (priv == NULL)
                 return -ENOMEM;
 
+        card = &priv->card;
+        card->dev = &pdev->dev;
+        card->owner = THIS_MODULE;
+        card->dapm_widgets = twl6040_dapm_widgets;
+        card->num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets);
+        card->dapm_routes = audio_map;
+        card->num_dapm_routes = ARRAY_SIZE(audio_map);
+
         if (snd_soc_of_parse_card_name(card, "ti,model")) {
                 dev_err(&pdev->dev, "Card name is not provided\n");
                 return -ENODEV;
@@ -274,14 +252,27 @@ static int omap_abe_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "McPDM node is not provided\n");
                 return -EINVAL;
         }
-        abe_twl6040_dai_links[0].cpu_of_node = dai_node;
-        abe_twl6040_dai_links[0].platform_of_node = dai_node;
+
+        priv->dai_links[0].name = "DMIC";
+        priv->dai_links[0].stream_name = "TWL6040";
+        priv->dai_links[0].cpu_of_node = dai_node;
+        priv->dai_links[0].platform_of_node = dai_node;
+        priv->dai_links[0].codec_dai_name = "twl6040-legacy";
+        priv->dai_links[0].codec_name = "twl6040-codec";
+        priv->dai_links[0].init = omap_abe_twl6040_init;
+        priv->dai_links[0].ops = &omap_abe_ops;
 
         dai_node = of_parse_phandle(node, "ti,dmic", 0);
         if (dai_node) {
                 num_links = 2;
-                abe_twl6040_dai_links[1].cpu_of_node = dai_node;
-                abe_twl6040_dai_links[1].platform_of_node = dai_node;
+                priv->dai_links[1].name = "TWL6040";
+                priv->dai_links[1].stream_name = "DMIC Capture";
+                priv->dai_links[1].cpu_of_node = dai_node;
+                priv->dai_links[1].platform_of_node = dai_node;
+                priv->dai_links[1].codec_dai_name = "dmic-hifi";
+                priv->dai_links[1].codec_name = "dmic-codec";
+                priv->dai_links[1].init = omap_abe_dmic_init;
+                priv->dai_links[1].ops = &omap_abe_dmic_ops;
         } else {
                 num_links = 1;
         }
@@ -300,7 +291,7 @@ static int omap_abe_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        card->dai_link = abe_twl6040_dai_links;
+        card->dai_link = priv->dai_links;
         card->num_links = num_links;
 
         snd_soc_card_set_drvdata(card, priv);
diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
index fe966272bd0c..cba9645b6487 100644
--- a/sound/soc/omap/omap-dmic.c
+++ b/sound/soc/omap/omap-dmic.c
@@ -48,6 +48,8 @@ struct omap_dmic {
         struct device *dev;
         void __iomem *io_base;
         struct clk *fclk;
+        struct pm_qos_request pm_qos_req;
+        int latency;
         int fclk_freq;
         int out_freq;
         int clk_div;
@@ -124,6 +126,8 @@ static void omap_dmic_dai_shutdown(struct snd_pcm_substream *substream,
 
         mutex_lock(&dmic->mutex);
 
+        pm_qos_remove_request(&dmic->pm_qos_req);
+
         if (!dai->active)
                 dmic->active = 0;
 
@@ -228,6 +232,8 @@ static int omap_dmic_dai_hw_params(struct snd_pcm_substream *substream,
         /* packet size is threshold * channels */
         dma_data = snd_soc_dai_get_dma_data(dai, substream);
         dma_data->maxburst = dmic->threshold * channels;
+        dmic->latency = (OMAP_DMIC_THRES_MAX - dmic->threshold) * USEC_PER_SEC /
+                        params_rate(params);
 
         return 0;
 }
@@ -238,6 +244,9 @@ static int omap_dmic_dai_prepare(struct snd_pcm_substream *substream,
         struct omap_dmic *dmic = snd_soc_dai_get_drvdata(dai);
         u32 ctrl;
 
+        if (pm_qos_request_active(&dmic->pm_qos_req))
+                pm_qos_update_request(&dmic->pm_qos_req, dmic->latency);
+
         /* Configure uplink threshold */
         omap_dmic_write(dmic, OMAP_DMIC_FIFO_CTRL_REG, dmic->threshold);
 
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index d0ebb6b9bfac..2d6decbfc99e 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -308,9 +308,9 @@ static int omap_mcbsp_dai_hw_params(struct snd_pcm_substream *substream,
                         pkt_size = channels;
                 }
 
-                latency = ((((buffer_size - pkt_size) / channels) * 1000)
-                                 / (params->rate_num / params->rate_den));
-
+                latency = (buffer_size - pkt_size) / channels;
+                latency = latency * USEC_PER_SEC /
+                          (params->rate_num / params->rate_den);
                 mcbsp->latency[substream->stream] = latency;
 
                 omap_mcbsp_set_threshold(substream, pkt_size);
diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
index 4c1be36c2207..7d5bdc5a2890 100644
--- a/sound/soc/omap/omap-mcpdm.c
+++ b/sound/soc/omap/omap-mcpdm.c
@@ -54,6 +54,8 @@ struct omap_mcpdm {
         unsigned long phys_base;
         void __iomem *io_base;
         int irq;
+        struct pm_qos_request pm_qos_req;
+        int latency[2];
 
         struct mutex mutex;
 
@@ -277,6 +279,9 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
                                   struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
+        int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
+        int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
+        int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
 
         mutex_lock(&mcpdm->mutex);
 
@@ -289,6 +294,14 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
                 }
         }
 
+        if (mcpdm->latency[stream2])
+                pm_qos_update_request(&mcpdm->pm_qos_req,
+                                      mcpdm->latency[stream2]);
+        else if (mcpdm->latency[stream1])
+                pm_qos_remove_request(&mcpdm->pm_qos_req);
+
+        mcpdm->latency[stream1] = 0;
+
         mutex_unlock(&mcpdm->mutex);
 }
 
@@ -300,7 +313,7 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
         int stream = substream->stream;
         struct snd_dmaengine_dai_dma_data *dma_data;
         u32 threshold;
-        int channels;
+        int channels, latency;
         int link_mask = 0;
 
         channels = params_channels(params);
@@ -344,14 +357,25 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
 
                 dma_data->maxburst =
                                 (MCPDM_DN_THRES_MAX - threshold) * channels;
+                latency = threshold;
         } else {
                 /* If playback is not running assume a stereo stream to come */
                 if (!mcpdm->config[!stream].link_mask)
                         mcpdm->config[!stream].link_mask = (0x3 << 3);
 
                 dma_data->maxburst = threshold * channels;
+                latency = (MCPDM_DN_THRES_MAX - threshold);
         }
 
+        /*
+         * The DMA must act to a DMA request within latency time (usec) to avoid
+         * under/overflow
+         */
+        mcpdm->latency[stream] = latency * USEC_PER_SEC / params_rate(params);
+
+        if (!mcpdm->latency[stream])
+                mcpdm->latency[stream] = 10;
+
         /* Check if we need to restart McPDM with this stream */
         if (mcpdm->config[stream].link_mask &&
             mcpdm->config[stream].link_mask != link_mask)
@@ -366,6 +390,20 @@ static int omap_mcpdm_prepare(struct snd_pcm_substream *substream,
                                   struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
+        struct pm_qos_request *pm_qos_req = &mcpdm->pm_qos_req;
+        int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
+        int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
+        int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+        int latency = mcpdm->latency[stream2];
+
+        /* Prevent omap hardware from hitting off between FIFO fills */
+        if (!latency || mcpdm->latency[stream1] < latency)
+                latency = mcpdm->latency[stream1];
+
+        if (pm_qos_request_active(pm_qos_req))
+                pm_qos_update_request(pm_qos_req, latency);
+        else if (latency)
+                pm_qos_add_request(pm_qos_req, PM_QOS_CPU_DMA_LATENCY, latency);
 
         if (!omap_mcpdm_active(mcpdm)) {
                 omap_mcpdm_start(mcpdm);
@@ -427,6 +465,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
         free_irq(mcpdm->irq, (void *)mcpdm);
         pm_runtime_disable(mcpdm->dev);
 
+        if (pm_qos_request_active(&mcpdm->pm_qos_req))
+                pm_qos_remove_request(&mcpdm->pm_qos_req);
+
         return 0;
 }
 
diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c
index eb1b9da05dd4..4715527054e5 100644
--- a/sound/soc/qcom/common.c
+++ b/sound/soc/qcom/common.c
@@ -13,6 +13,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
         struct device_node *cpu = NULL;
         struct device *dev = card->dev;
         struct snd_soc_dai_link *link;
+        struct of_phandle_args args;
         int ret, num_links;
 
         ret = snd_soc_of_parse_card_name(card, "model");
@@ -47,12 +48,14 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
                         goto err;
                 }
 
-                link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
-                if (!link->cpu_of_node) {
+                ret = of_parse_phandle_with_args(cpu, "sound-dai",
+                                        "#sound-dai-cells", 0, &args);
+                if (ret) {
                         dev_err(card->dev, "error getting cpu phandle\n");
-                        ret = -EINVAL;
                         goto err;
                 }
+                link->cpu_of_node = args.np;
+                link->id = args.args[0];
 
                 ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
                 if (ret) {
diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c
index 60ff4a2d3577..8f6c8fc073a9 100644
--- a/sound/soc/qcom/qdsp6/q6afe-dai.c
+++ b/sound/soc/qcom/qdsp6/q6afe-dai.c
@@ -1112,204 +1112,204 @@ static int q6afe_of_xlate_dai_name(struct snd_soc_component *component,
 }
 
 static const struct snd_soc_dapm_widget q6afe_dai_widgets[] = {
-        SND_SOC_DAPM_AIF_OUT("HDMI_RX", "HDMI Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_RX", "Slimbus Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_RX", "Slimbus1 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_RX", "Slimbus2 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_RX", "Slimbus3 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_RX", "Slimbus4 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_RX", "Slimbus5 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_RX", "Slimbus6 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_0_TX", "Slimbus Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_1_TX", "Slimbus1 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_2_TX", "Slimbus2 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_3_TX", "Slimbus3 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_4_TX", "Slimbus4 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_5_TX", "Slimbus5 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_6_TX", "Slimbus6 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_RX", "Quaternary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("QUAT_MI2S_RX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_MI2S_TX", "Quaternary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_MI2S_RX", "Tertiary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_MI2S_RX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_MI2S_TX", "Tertiary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_RX", "Secondary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_MI2S_TX", "Secondary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_RX_SD1",
+        SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX_SD1",
                         "Secondary MI2S Playback SD1",
                         0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRI_MI2S_RX", "Primary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("PRI_MI2S_RX", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRI_MI2S_TX", "Primary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("PRI_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_0", "Primary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_1", "Primary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_2", "Primary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_3", "Primary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_4", "Primary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_5", "Primary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_6", "Primary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_7", "Primary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_0", "Primary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_1", "Primary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_2", "Primary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_3", "Primary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_4", "Primary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_5", "Primary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_6", "Primary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_7", "Primary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_0", "Secondary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_1", "Secondary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_2", "Secondary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_3", "Secondary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_4", "Secondary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_5", "Secondary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_6", "Secondary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_7", "Secondary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_0", "Secondary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_1", "Secondary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_2", "Secondary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_3", "Secondary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_4", "Secondary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_5", "Secondary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_6", "Secondary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_7", "Secondary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_0", "Tertiary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_1", "Tertiary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_2", "Tertiary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_3", "Tertiary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_4", "Tertiary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_5", "Tertiary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_6", "Tertiary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_7", "Tertiary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_0", "Tertiary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_1", "Tertiary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_2", "Tertiary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_3", "Tertiary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_4", "Tertiary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_5", "Tertiary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_6", "Tertiary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_7", "Tertiary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_0", "Quaternary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_1", "Quaternary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_2", "Quaternary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_3", "Quaternary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_4", "Quaternary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_5", "Quaternary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_6", "Quaternary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_7", "Quaternary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_0", "Quaternary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_1", "Quaternary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_2", "Quaternary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_3", "Quaternary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_4", "Quaternary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_5", "Quaternary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_6", "Quaternary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_7", "Quaternary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_0", "Quinary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_1", "Quinary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_2", "Quinary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_3", "Quinary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_4", "Quinary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_5", "Quinary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_6", "Quinary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_7", "Quinary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_0", "Quinary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_1", "Quinary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_2", "Quinary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_3", "Quinary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_4", "Quinary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_5", "Quinary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_6", "Quinary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_7", "Quinary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 };
 
diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c
index 000775b4bba8..829b5e987b2a 100644
--- a/sound/soc/qcom/qdsp6/q6afe.c
+++ b/sound/soc/qcom/qdsp6/q6afe.c
@@ -49,14 +49,14 @@
 #define AFE_PORT_I2S_SD1                0x2
 #define AFE_PORT_I2S_SD2                0x3
 #define AFE_PORT_I2S_SD3                0x4
-#define AFE_PORT_I2S_SD0_MASK           BIT(0x1)
-#define AFE_PORT_I2S_SD1_MASK           BIT(0x2)
-#define AFE_PORT_I2S_SD2_MASK           BIT(0x3)
-#define AFE_PORT_I2S_SD3_MASK           BIT(0x4)
-#define AFE_PORT_I2S_SD0_1_MASK         GENMASK(2, 1)
-#define AFE_PORT_I2S_SD2_3_MASK         GENMASK(4, 3)
-#define AFE_PORT_I2S_SD0_1_2_MASK       GENMASK(3, 1)
-#define AFE_PORT_I2S_SD0_1_2_3_MASK     GENMASK(4, 1)
+#define AFE_PORT_I2S_SD0_MASK           BIT(0x0)
+#define AFE_PORT_I2S_SD1_MASK           BIT(0x1)
+#define AFE_PORT_I2S_SD2_MASK           BIT(0x2)
+#define AFE_PORT_I2S_SD3_MASK           BIT(0x3)
+#define AFE_PORT_I2S_SD0_1_MASK         GENMASK(1, 0)
+#define AFE_PORT_I2S_SD2_3_MASK         GENMASK(3, 2)
+#define AFE_PORT_I2S_SD0_1_2_MASK       GENMASK(2, 0)
+#define AFE_PORT_I2S_SD0_1_2_3_MASK     GENMASK(3, 0)
 #define AFE_PORT_I2S_QUAD01             0x5
 #define AFE_PORT_I2S_QUAD23             0x6
 #define AFE_PORT_I2S_6CHS               0x7
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index a16c71c03058..86115de5c1b2 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -122,7 +122,6 @@ static struct snd_pcm_hardware q6asm_dai_hardware_playback = {
                         .rate_max =     48000,                          \
                 },                                                      \
                 .name = "MultiMedia"#num,                               \
-                .probe = fe_dai_probe,                                  \
                 .id = MSM_FRONTEND_DAI_MULTIMEDIA##num,                 \
         }
 
@@ -511,38 +510,6 @@ static void q6asm_dai_pcm_free(struct snd_pcm *pcm)
         }
 }
 
-static const struct snd_soc_dapm_route afe_pcm_routes[] = {
-        {"MM_DL1",  NULL, "MultiMedia1 Playback" },
-        {"MM_DL2",  NULL, "MultiMedia2 Playback" },
-        {"MM_DL3",  NULL, "MultiMedia3 Playback" },
-        {"MM_DL4",  NULL, "MultiMedia4 Playback" },
-        {"MM_DL5",  NULL, "MultiMedia5 Playback" },
-        {"MM_DL6",  NULL, "MultiMedia6 Playback" },
-        {"MM_DL7",  NULL, "MultiMedia7 Playback" },
-        {"MM_DL7",  NULL, "MultiMedia8 Playback" },
-        {"MultiMedia1 Capture", NULL, "MM_UL1"},
-        {"MultiMedia2 Capture", NULL, "MM_UL2"},
-        {"MultiMedia3 Capture", NULL, "MM_UL3"},
-        {"MultiMedia4 Capture", NULL, "MM_UL4"},
-        {"MultiMedia5 Capture", NULL, "MM_UL5"},
-        {"MultiMedia6 Capture", NULL, "MM_UL6"},
-        {"MultiMedia7 Capture", NULL, "MM_UL7"},
-        {"MultiMedia8 Capture", NULL, "MM_UL8"},
-
-};
-
-static int fe_dai_probe(struct snd_soc_dai *dai)
-{
-        struct snd_soc_dapm_context *dapm;
-
-        dapm = snd_soc_component_get_dapm(dai->component);
-        snd_soc_dapm_add_routes(dapm, afe_pcm_routes,
-                                ARRAY_SIZE(afe_pcm_routes));
-
-        return 0;
-}
-
-
 static const struct snd_soc_component_driver q6asm_fe_dai_component = {
         .name           = DRV_NAME,
         .ops            = &q6asm_dai_ops,
diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index c6b51571be94..d61b8404f7da 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -909,6 +909,25 @@ static const struct snd_soc_dapm_route intercon[] = {
         {"MM_UL6", NULL, "MultiMedia6 Mixer"},
         {"MM_UL7", NULL, "MultiMedia7 Mixer"},
         {"MM_UL8", NULL, "MultiMedia8 Mixer"},
+
+        {"MM_DL1",  NULL, "MultiMedia1 Playback" },
+        {"MM_DL2",  NULL, "MultiMedia2 Playback" },
+        {"MM_DL3",  NULL, "MultiMedia3 Playback" },
+        {"MM_DL4",  NULL, "MultiMedia4 Playback" },
+        {"MM_DL5",  NULL, "MultiMedia5 Playback" },
+        {"MM_DL6",  NULL, "MultiMedia6 Playback" },
+        {"MM_DL7",  NULL, "MultiMedia7 Playback" },
+        {"MM_DL8",  NULL, "MultiMedia8 Playback" },
+
+        {"MultiMedia1 Capture", NULL, "MM_UL1"},
+        {"MultiMedia2 Capture", NULL, "MM_UL2"},
+        {"MultiMedia3 Capture", NULL, "MM_UL3"},
+        {"MultiMedia4 Capture", NULL, "MM_UL4"},
+        {"MultiMedia5 Capture", NULL, "MM_UL5"},
+        {"MultiMedia6 Capture", NULL, "MM_UL6"},
+        {"MultiMedia7 Capture", NULL, "MM_UL7"},
+        {"MultiMedia8 Capture", NULL, "MM_UL8"},
+
 };
 
 static int routing_hw_params(struct snd_pcm_substream *substream,
diff --git a/sound/soc/rockchip/rockchip_pcm.c b/sound/soc/rockchip/rockchip_pcm.c
index 9e7b5fa4cf59..4ac78d7a4b2d 100644
--- a/sound/soc/rockchip/rockchip_pcm.c
+++ b/sound/soc/rockchip/rockchip_pcm.c
@@ -33,6 +33,7 @@ static const struct snd_pcm_hardware snd_rockchip_hardware = {
 
 static const struct snd_dmaengine_pcm_config rk_dmaengine_pcm_config = {
         .pcm_hardware = &snd_rockchip_hardware,
+        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
         .prealloc_buffer_size = 32 * 1024,
 };
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index fcb4df23248c..6ec78f3096dd 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -306,7 +306,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         if (rsnd_ssi_is_multi_slave(mod, io))
                 return 0;
 
-        if (ssi->rate) {
+        if (ssi->usrcnt > 1) {
                 if (ssi->rate != rate) {
                         dev_err(dev, "SSI parent/child should use same rate\n");
                         return -EINVAL;
diff --git a/sound/soc/soc-acpi.c b/sound/soc/soc-acpi.c
index b8e72b52db30..4fb29f0e561e 100644
--- a/sound/soc/soc-acpi.c
+++ b/sound/soc/soc-acpi.c
@@ -10,11 +10,17 @@ struct snd_soc_acpi_mach *
 snd_soc_acpi_find_machine(struct snd_soc_acpi_mach *machines)
 {
         struct snd_soc_acpi_mach *mach;
+        struct snd_soc_acpi_mach *mach_alt;
 
         for (mach = machines; mach->id[0]; mach++) {
                 if (acpi_dev_present(mach->id, NULL, -1)) {
-                        if (mach->machine_quirk)
-                                mach = mach->machine_quirk(mach);
+                        if (mach->machine_quirk) {
+                                mach_alt = mach->machine_quirk(mach);
+                                if (!mach_alt)
+                                        continue; /* not full match, ignore */
+                                mach = mach_alt;
+                        }
+
                         return mach;
                 }
         }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 6ddcf12bc030..b29d0f65611e 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2131,6 +2131,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
         }
 
         card->instantiated = 1;
+        dapm_mark_endpoints_dirty(card);
         snd_soc_dapm_sync(&card->dapm);
         mutex_unlock(&card->mutex);
         mutex_unlock(&client_mutex);
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index ea05cc91aa05..211589b0b2ef 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -390,7 +390,7 @@ static int stm32_sai_add_mclk_provider(struct stm32_sai_sub_data *sai)
         char *mclk_name, *p, *s = (char *)pname;
         int ret, i = 0;
 
-        mclk = devm_kzalloc(dev, sizeof(mclk), GFP_KERNEL);
+        mclk = devm_kzalloc(dev, sizeof(*mclk), GFP_KERNEL);
         if (!mclk)
                 return -ENOMEM;
 
diff --git a/sound/soc/sunxi/Kconfig b/sound/soc/sunxi/Kconfig
index 66aad0d3f9c7..8134c3c94229 100644
--- a/sound/soc/sunxi/Kconfig
+++ b/sound/soc/sunxi/Kconfig
@@ -31,7 +31,7 @@ config SND_SUN8I_CODEC_ANALOG
 config SND_SUN50I_CODEC_ANALOG
         tristate "Allwinner sun50i Codec Analog Controls Support"
         depends on (ARM64 && ARCH_SUNXI) || COMPILE_TEST
-        select SND_SUNXI_ADDA_PR_REGMAP
+        select SND_SUN8I_ADDA_PR_REGMAP
         help
           Say Y or M if you want to add support for the analog controls for
           the codec embedded in Allwinner A64 SoC.
diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
index 522a72fde78d..92c5de026c43 100644
--- a/sound/soc/sunxi/sun8i-codec.c
+++ b/sound/soc/sunxi/sun8i-codec.c
@@ -481,7 +481,11 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
         { "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
           "AIF1 Slot 0 Right"},
 
-        /* ADC routes */
+        /* ADC Routes */
+        { "AIF1 Slot 0 Right ADC", NULL, "ADC" },
+        { "AIF1 Slot 0 Left ADC", NULL, "ADC" },
+
+        /* ADC Mixer Routes */
         { "Left Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
           "AIF1 Slot 0 Left ADC" },
         { "Right Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
@@ -605,16 +609,10 @@ err_pm_disable:
 
 static int sun8i_codec_remove(struct platform_device *pdev)
 {
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
-        struct sun8i_codec *scodec = snd_soc_card_get_drvdata(card);
-
         pm_runtime_disable(&pdev->dev);
         if (!pm_runtime_status_suspended(&pdev->dev))
                 sun8i_codec_runtime_suspend(&pdev->dev);
 
-        clk_disable_unprepare(scodec->clk_module);
-        clk_disable_unprepare(scodec->clk_bus);
-
         return 0;
 }
 
diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c
index e73c962590eb..079063d8038d 100644
--- a/sound/sparc/cs4231.c
+++ b/sound/sparc/cs4231.c
@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(struct snd_pcm_substream *substream)
         runtime->hw = snd_cs4231_playback;
 
         err = snd_cs4231_open(chip, CS4231_MODE_PLAY);
-        if (err < 0) {
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+        if (err < 0)
                 return err;
-        }
         chip->playback_substream = substream;
         chip->p_periods_sent = 0;
         snd_pcm_set_sync(substream);
@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struct snd_pcm_substream *substream)
         runtime->hw = snd_cs4231_capture;
 
         err = snd_cs4231_open(chip, CS4231_MODE_RECORD);
-        if (err < 0) {
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+        if (err < 0)
                 return err;
-        }
         chip->capture_substream = substream;
         chip->c_periods_sent = 0;
         snd_pcm_set_sync(substream);
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 849953e5775c..37fc0447c071 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3382,5 +3382,15 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
                 .ifnum = QUIRK_NO_INTERFACE
         }
 },
+/* Dell WD19 Dock */
+{
+        USB_DEVICE(0x0bda, 0x402e),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .vendor_name = "Dell",
+                .product_name = "WD19 Dock",
+                .profile_name = "Dell-WD15-Dock",
+                .ifnum = QUIRK_NO_INTERFACE
+        }
+},
 
 #undef USB_DEVICE_VENDOR_SPEC
diff --git a/tools/arch/arm64/include/asm/barrier.h b/tools/arch/arm64/include/asm/barrier.h
index 12835ea0e417..378c051fa177 100644
--- a/tools/arch/arm64/include/asm/barrier.h
+++ b/tools/arch/arm64/include/asm/barrier.h
@@ -14,74 +14,75 @@
 #define wmb()           asm volatile("dmb ishst" ::: "memory")
 #define rmb()           asm volatile("dmb ishld" ::: "memory")
 
-#define smp_store_release(p, v)                                 \
-do {                                                            \
-        union { typeof(*p) __val; char __c[1]; } __u =          \
-                { .__val = (__force typeof(*p)) (v) };          \
-                                                                \
-        switch (sizeof(*p)) {                                   \
-        case 1:                                                 \
-                asm volatile ("stlrb %w1, %0"                   \
-                                : "=Q" (*p)                     \
-                                : "r" (*(__u8 *)__u.__c)        \
-                                : "memory");                    \
-                break;                                          \
-        case 2:                                                 \
-                asm volatile ("stlrh %w1, %0"                   \
-                                : "=Q" (*p)                     \
-                                : "r" (*(__u16 *)__u.__c)       \
-                                : "memory");                    \
-                break;                                          \
-        case 4:                                                 \
-                asm volatile ("stlr %w1, %0"                    \
-                                : "=Q" (*p)                     \
-                                : "r" (*(__u32 *)__u.__c)       \
-                                : "memory");                    \
-                break;                                          \
-        case 8:                                                 \
-                asm volatile ("stlr %1, %0"                     \
-                                : "=Q" (*p)                     \
-                                : "r" (*(__u64 *)__u.__c)       \
-                                : "memory");                    \
-                break;                                          \
-        default:                                                \
-                /* Only to shut up gcc ... */                   \
-                mb();                                           \
-                break;                                          \
-        }                                                       \
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        union { typeof(*p) __val; char __c[1]; } __u =                  \
+                { .__val = (v) };                                       \
+                                                                        \
+        switch (sizeof(*p)) {                                           \
+        case 1:                                                         \
+                asm volatile ("stlrb %w1, %0"                           \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u8_alias_t *)__u.__c)        \
+                                : "memory");                            \
+                break;                                                  \
+        case 2:                                                         \
+                asm volatile ("stlrh %w1, %0"                           \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u16_alias_t *)__u.__c)       \
+                                : "memory");                            \
+                break;                                                  \
+        case 4:                                                         \
+                asm volatile ("stlr %w1, %0"                            \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u32_alias_t *)__u.__c)       \
+                                : "memory");                            \
+                break;                                                  \
+        case 8:                                                         \
+                asm volatile ("stlr %1, %0"                             \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u64_alias_t *)__u.__c)       \
+                                : "memory");                            \
+                break;                                                  \
+        default:                                                        \
+                /* Only to shut up gcc ... */                           \
+                mb();                                                   \
+                break;                                                  \
+        }                                                               \
 } while (0)
 
-#define smp_load_acquire(p)                                     \
-({                                                              \
-        union { typeof(*p) __val; char __c[1]; } __u;           \
-                                                                \
-        switch (sizeof(*p)) {                                   \
-        case 1:                                                 \
-                asm volatile ("ldarb %w0, %1"                   \
-                        : "=r" (*(__u8 *)__u.__c)               \
-                        : "Q" (*p) : "memory");                 \
-                break;                                          \
-        case 2:                                                 \
-                asm volatile ("ldarh %w0, %1"                   \
-                        : "=r" (*(__u16 *)__u.__c)              \
-                        : "Q" (*p) : "memory");                 \
-                break;                                          \
-        case 4:                                                 \
-                asm volatile ("ldar %w0, %1"                    \
-                        : "=r" (*(__u32 *)__u.__c)              \
-                        : "Q" (*p) : "memory");                 \
-                break;                                          \
-        case 8:                                                 \
-                asm volatile ("ldar %0, %1"                     \
-                        : "=r" (*(__u64 *)__u.__c)              \
-                        : "Q" (*p) : "memory");                 \
-                break;                                          \
-        default:                                                \
-                /* Only to shut up gcc ... */                   \
-                mb();                                           \
-                break;                                          \
-        }                                                       \
-        __u.__val;                                              \
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        union { typeof(*p) __val; char __c[1]; } __u =                  \
+                { .__c = { 0 } };                                       \
+                                                                        \
+        switch (sizeof(*p)) {                                           \
+        case 1:                                                         \
+                asm volatile ("ldarb %w0, %1"                           \
+                        : "=r" (*(__u8_alias_t *)__u.__c)               \
+                        : "Q" (*p) : "memory");                         \
+                break;                                                  \
+        case 2:                                                         \
+                asm volatile ("ldarh %w0, %1"                           \
+                        : "=r" (*(__u16_alias_t *)__u.__c)              \
+                        : "Q" (*p) : "memory");                         \
+                break;                                                  \
+        case 4:                                                         \
+                asm volatile ("ldar %w0, %1"                            \
+                        : "=r" (*(__u32_alias_t *)__u.__c)              \
+                        : "Q" (*p) : "memory");                         \
+                break;                                                  \
+        case 8:                                                         \
+                asm volatile ("ldar %0, %1"                             \
+                        : "=r" (*(__u64_alias_t *)__u.__c)              \
+                        : "Q" (*p) : "memory");                         \
+                break;                                                  \
+        default:                                                        \
+                /* Only to shut up gcc ... */                           \
+                mb();                                                   \
+                break;                                                  \
+        }                                                               \
+        __u.__val;                                                      \
 })
 
 #endif /* _TOOLS_LINUX_ASM_AARCH64_BARRIER_H */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 89a048c2faec..28c4a502b419 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -331,6 +331,8 @@
 #define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
 #define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
 #define X86_FEATURE_CLDEMOTE            (16*32+25) /* CLDEMOTE instruction */
+#define X86_FEATURE_MOVDIRI             (16*32+27) /* MOVDIRI instruction */
+#define X86_FEATURE_MOVDIR64B           (16*32+28) /* MOVDIR64B instruction */
 
 /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
 #define X86_FEATURE_OVERFLOW_RECOV      (17*32+ 0) /* MCA overflow recovery support */
diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
index edbe81534c6d..d07ccf8a23f7 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
@@ -137,4 +137,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-map**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index f55a2daed59b..7bb787cfa971 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -171,4 +171,10 @@ The following three commands are equivalent:
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-cgroup**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-net.rst b/tools/bpf/bpftool/Documentation/bpftool-net.rst
index 408ec30d8872..ed87c9b619ad 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-net.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-net.rst
@@ -136,4 +136,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-map**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-perf.rst b/tools/bpf/bpftool/Documentation/bpftool-perf.rst
index e3eb0eab7641..f4c5e5538bb8 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-perf.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-perf.rst
@@ -78,4 +78,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-map**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
index ac4e904b10fb..ecf618807125 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
@@ -124,7 +124,8 @@ OPTIONS
                   Generate human-readable JSON output. Implies **-j**.
 
         -f, --bpffs
-                  Show file names of pinned programs.
+                  When showing BPF programs, show file names of pinned
+                  programs.
 
 EXAMPLES
 ========
@@ -206,4 +207,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool.rst b/tools/bpf/bpftool/Documentation/bpftool.rst
index 04cd4f92ab89..129b7a9c0f9b 100644
--- a/tools/bpf/bpftool/Documentation/bpftool.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool.rst
@@ -63,5 +63,10 @@ OPTIONS
 
 SEE ALSO
 ========
-        **bpftool-map**\ (8), **bpftool-prog**\ (8), **bpftool-cgroup**\ (8)
-        **bpftool-perf**\ (8), **bpftool-net**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 25af85304ebe..70fd48d79f61 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -130,16 +130,17 @@ static int mnt_bpffs(const char *target, char *buff, size_t bufflen)
         return 0;
 }
 
-int open_obj_pinned(char *path)
+int open_obj_pinned(char *path, bool quiet)
 {
         int fd;
 
         fd = bpf_obj_get(path);
         if (fd < 0) {
-                p_err("bpf obj get (%s): %s", path,
-                      errno == EACCES && !is_bpffs(dirname(path)) ?
-                    "directory not in bpf file system (bpffs)" :
-                    strerror(errno));
+                if (!quiet)
+                        p_err("bpf obj get (%s): %s", path,
+                              errno == EACCES && !is_bpffs(dirname(path)) ?
+                            "directory not in bpf file system (bpffs)" :
+                            strerror(errno));
                 return -1;
         }
 
@@ -151,7 +152,7 @@ int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type)
         enum bpf_obj_type type;
         int fd;
 
-        fd = open_obj_pinned(path);
+        fd = open_obj_pinned(path, false);
         if (fd < 0)
                 return -1;
 
@@ -304,7 +305,7 @@ char *get_fdinfo(int fd, const char *key)
                 return NULL;
         }
 
-        while ((n = getline(&line, &line_n, fdi))) {
+        while ((n = getline(&line, &line_n, fdi)) > 0) {
                 char *value;
                 int len;
 
@@ -384,7 +385,7 @@ int build_pinned_obj_table(struct pinned_obj_table *tab,
                 while ((ftse = fts_read(fts))) {
                         if (!(ftse->fts_info & FTS_F))
                                 continue;
-                        fd = open_obj_pinned(ftse->fts_path);
+                        fd = open_obj_pinned(ftse->fts_path, true);
                         if (fd < 0)
                                 continue;
 
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 28322ace2856..a8bf1e2d9818 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -127,7 +127,7 @@ int cmd_select(const struct cmd *cmds, int argc, char **argv,
 int get_fd_type(int fd);
 const char *get_fd_type_name(enum bpf_obj_type type);
 char *get_fdinfo(int fd, const char *key);
-int open_obj_pinned(char *path);
+int open_obj_pinned(char *path, bool quiet);
 int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type);
 int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32));
 int do_pin_fd(int fd, const char *name);
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 5302ee282409..ccee180dfb76 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -357,10 +357,9 @@ static void print_prog_plain(struct bpf_prog_info *info, int fd)
         if (!hash_empty(prog_table.table)) {
                 struct pinned_obj *obj;
 
-                printf("\n");
                 hash_for_each_possible(prog_table.table, obj, hash, info->id) {
                         if (obj->id == info->id)
-                                printf("\tpinned %s\n", obj->path);
+                                printf("\n\tpinned %s", obj->path);
                 }
         }
 
@@ -845,6 +844,7 @@ static int do_load(int argc, char **argv)
                         }
                         NEXT_ARG();
                 } else if (is_prefix(*argv, "map")) {
+                        void *new_map_replace;
                         char *endptr, *name;
                         int fd;
 
@@ -878,12 +878,15 @@ static int do_load(int argc, char **argv)
                         if (fd < 0)
                                 goto err_free_reuse_maps;
 
-                        map_replace = reallocarray(map_replace, old_map_fds + 1,
-                                                   sizeof(*map_replace));
-                        if (!map_replace) {
+                        new_map_replace = reallocarray(map_replace,
+                                                       old_map_fds + 1,
+                                                       sizeof(*map_replace));
+                        if (!new_map_replace) {
                                 p_err("mem alloc failed");
                                 goto err_free_reuse_maps;
                         }
+                        map_replace = new_map_replace;
+
                         map_replace[old_map_fds].idx = idx;
                         map_replace[old_map_fds].name = name;
                         map_replace[old_map_fds].fd = fd;
diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
index f216b2f5c3d7..d74bb9414d7c 100644
--- a/tools/build/Makefile.feature
+++ b/tools/build/Makefile.feature
@@ -33,6 +33,7 @@ FEATURE_TESTS_BASIC :=                  \
         dwarf_getlocations              \
         fortify-source                  \
         sync-compare-and-swap           \
+        get_current_dir_name            \
         glibc                           \
         gtk2                            \
         gtk2-infobar                    \
diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
index 0516259be70f..304b984f11b9 100644
--- a/tools/build/feature/Makefile
+++ b/tools/build/feature/Makefile
@@ -7,6 +7,7 @@ FILES=                                          \
          test-dwarf_getlocations.bin            \
          test-fortify-source.bin                \
          test-sync-compare-and-swap.bin         \
+         test-get_current_dir_name.bin          \
          test-glibc.bin                         \
          test-gtk2.bin                          \
          test-gtk2-infobar.bin                  \
@@ -101,6 +102,9 @@ $(OUTPUT)test-bionic.bin:
 $(OUTPUT)test-libelf.bin:
         $(BUILD) -lelf
 
+$(OUTPUT)test-get_current_dir_name.bin:
+        $(BUILD)
+
 $(OUTPUT)test-glibc.bin:
         $(BUILD)
 
diff --git a/tools/build/feature/test-all.c b/tools/build/feature/test-all.c
index 8dc20a61341f..56722bfe6bdd 100644
--- a/tools/build/feature/test-all.c
+++ b/tools/build/feature/test-all.c
@@ -34,6 +34,10 @@
 # include "test-libelf-mmap.c"
 #undef main
 
+#define main main_test_get_current_dir_name
+# include "test-get_current_dir_name.c"
+#undef main
+
 #define main main_test_glibc
 # include "test-glibc.c"
 #undef main
@@ -174,6 +178,7 @@ int main(int argc, char *argv[])
         main_test_hello();
         main_test_libelf();
         main_test_libelf_mmap();
+        main_test_get_current_dir_name();
         main_test_glibc();
         main_test_dwarf();
         main_test_dwarf_getlocations();
diff --git a/tools/build/feature/test-get_current_dir_name.c b/tools/build/feature/test-get_current_dir_name.c
new file mode 100644
index 000000000000..573000f93212
--- /dev/null
+++ b/tools/build/feature/test-get_current_dir_name.c
@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+#include <unistd.h>
+#include <stdlib.h>
+
+int main(void)
+{
+        free(get_current_dir_name());
+        return 0;
+}
diff --git a/tools/include/uapi/asm-generic/ioctls.h b/tools/include/uapi/asm-generic/ioctls.h
index 040651735662..cdc9f4ca8c27 100644
--- a/tools/include/uapi/asm-generic/ioctls.h
+++ b/tools/include/uapi/asm-generic/ioctls.h
@@ -79,6 +79,8 @@
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
 #define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
+#define TIOCGISO7816    _IOR('T', 0x42, struct serial_iso7816)
+#define TIOCSISO7816    _IOWR('T', 0x43, struct serial_iso7816)
 
 #define FIONCLEX        0x5450
 #define FIOCLEX         0x5451
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index 7f5634ce8e88..a4446f452040 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -529,6 +529,28 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_CS_TIMESTAMP_FREQUENCY 51
 
+/*
+ * Once upon a time we supposed that writes through the GGTT would be
+ * immediately in physical memory (once flushed out of the CPU path). However,
+ * on a few different processors and chipsets, this is not necessarily the case
+ * as the writes appear to be buffered internally. Thus a read of the backing
+ * storage (physical memory) via a different path (with different physical tags
+ * to the indirect write via the GGTT) will see stale values from before
+ * the GGTT write. Inside the kernel, we can for the most part keep track of
+ * the different read/write domains in use (e.g. set-domain), but the assumption
+ * of coherency is baked into the ABI, hence reporting its true state in this
+ * parameter.
+ *
+ * Reports true when writes via mmap_gtt are immediately visible following an
+ * lfence to flush the WCB.
+ *
+ * Reports false when writes via mmap_gtt are indeterminately delayed in an in
+ * internal buffer and are _not_ immediately visible to third parties accessing
+ * directly via mmap_cpu/mmap_wc. Use of mmap_gtt as part of an IPC
+ * communications channel when reporting false is strongly disadvised.
+ */
+#define I915_PARAM_MMAP_GTT_COHERENT    52
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
diff --git a/tools/include/uapi/linux/pkt_cls.h b/tools/include/uapi/linux/pkt_cls.h
new file mode 100644
index 000000000000..401d0c1e612d
--- /dev/null
+++ b/tools/include/uapi/linux/pkt_cls.h
@@ -0,0 +1,612 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __LINUX_PKT_CLS_H
+#define __LINUX_PKT_CLS_H
+
+#include <linux/types.h>
+#include <linux/pkt_sched.h>
+
+#define TC_COOKIE_MAX_SIZE 16
+
+/* Action attributes */
+enum {
+        TCA_ACT_UNSPEC,
+        TCA_ACT_KIND,
+        TCA_ACT_OPTIONS,
+        TCA_ACT_INDEX,
+        TCA_ACT_STATS,
+        TCA_ACT_PAD,
+        TCA_ACT_COOKIE,
+        __TCA_ACT_MAX
+};
+
+#define TCA_ACT_MAX __TCA_ACT_MAX
+#define TCA_OLD_COMPAT (TCA_ACT_MAX+1)
+#define TCA_ACT_MAX_PRIO 32
+#define TCA_ACT_BIND    1
+#define TCA_ACT_NOBIND  0
+#define TCA_ACT_UNBIND  1
+#define TCA_ACT_NOUNBIND        0
+#define TCA_ACT_REPLACE         1
+#define TCA_ACT_NOREPLACE       0
+
+#define TC_ACT_UNSPEC   (-1)
+#define TC_ACT_OK               0
+#define TC_ACT_RECLASSIFY       1
+#define TC_ACT_SHOT             2
+#define TC_ACT_PIPE             3
+#define TC_ACT_STOLEN           4
+#define TC_ACT_QUEUED           5
+#define TC_ACT_REPEAT           6
+#define TC_ACT_REDIRECT         7
+#define TC_ACT_TRAP             8 /* For hw path, this means "trap to cpu"
+                                   * and don't further process the frame
+                                   * in hardware. For sw path, this is
+                                   * equivalent of TC_ACT_STOLEN - drop
+                                   * the skb and act like everything
+                                   * is alright.
+                                   */
+#define TC_ACT_VALUE_MAX        TC_ACT_TRAP
+
+/* There is a special kind of actions called "extended actions",
+ * which need a value parameter. These have a local opcode located in
+ * the highest nibble, starting from 1. The rest of the bits
+ * are used to carry the value. These two parts together make
+ * a combined opcode.
+ */
+#define __TC_ACT_EXT_SHIFT 28
+#define __TC_ACT_EXT(local) ((local) << __TC_ACT_EXT_SHIFT)
+#define TC_ACT_EXT_VAL_MASK ((1 << __TC_ACT_EXT_SHIFT) - 1)
+#define TC_ACT_EXT_OPCODE(combined) ((combined) & (~TC_ACT_EXT_VAL_MASK))
+#define TC_ACT_EXT_CMP(combined, opcode) (TC_ACT_EXT_OPCODE(combined) == opcode)
+
+#define TC_ACT_JUMP __TC_ACT_EXT(1)
+#define TC_ACT_GOTO_CHAIN __TC_ACT_EXT(2)
+#define TC_ACT_EXT_OPCODE_MAX   TC_ACT_GOTO_CHAIN
+
+/* Action type identifiers*/
+enum {
+        TCA_ID_UNSPEC=0,
+        TCA_ID_POLICE=1,
+        /* other actions go here */
+        __TCA_ID_MAX=255
+};
+
+#define TCA_ID_MAX __TCA_ID_MAX
+
+struct tc_police {
+        __u32                   index;
+        int                     action;
+#define TC_POLICE_UNSPEC        TC_ACT_UNSPEC
+#define TC_POLICE_OK            TC_ACT_OK
+#define TC_POLICE_RECLASSIFY    TC_ACT_RECLASSIFY
+#define TC_POLICE_SHOT          TC_ACT_SHOT
+#define TC_POLICE_PIPE          TC_ACT_PIPE
+
+        __u32                   limit;
+        __u32                   burst;
+        __u32                   mtu;
+        struct tc_ratespec      rate;
+        struct tc_ratespec      peakrate;
+        int                     refcnt;
+        int                     bindcnt;
+        __u32                   capab;
+};
+
+struct tcf_t {
+        __u64   install;
+        __u64   lastuse;
+        __u64   expires;
+        __u64   firstuse;
+};
+
+struct tc_cnt {
+        int                   refcnt;
+        int                   bindcnt;
+};
+
+#define tc_gen \
+        __u32                 index; \
+        __u32                 capab; \
+        int                   action; \
+        int                   refcnt; \
+        int                   bindcnt
+
+enum {
+        TCA_POLICE_UNSPEC,
+        TCA_POLICE_TBF,
+        TCA_POLICE_RATE,
+        TCA_POLICE_PEAKRATE,
+        TCA_POLICE_AVRATE,
+        TCA_POLICE_RESULT,
+        TCA_POLICE_TM,
+        TCA_POLICE_PAD,
+        __TCA_POLICE_MAX
+#define TCA_POLICE_RESULT TCA_POLICE_RESULT
+};
+
+#define TCA_POLICE_MAX (__TCA_POLICE_MAX - 1)
+
+/* tca flags definitions */
+#define TCA_CLS_FLAGS_SKIP_HW   (1 << 0) /* don't offload filter to HW */
+#define TCA_CLS_FLAGS_SKIP_SW   (1 << 1) /* don't use filter in SW */
+#define TCA_CLS_FLAGS_IN_HW     (1 << 2) /* filter is offloaded to HW */
+#define TCA_CLS_FLAGS_NOT_IN_HW (1 << 3) /* filter isn't offloaded to HW */
+#define TCA_CLS_FLAGS_VERBOSE   (1 << 4) /* verbose logging */
+
+/* U32 filters */
+
+#define TC_U32_HTID(h) ((h)&0xFFF00000)
+#define TC_U32_USERHTID(h) (TC_U32_HTID(h)>>20)
+#define TC_U32_HASH(h) (((h)>>12)&0xFF)
+#define TC_U32_NODE(h) ((h)&0xFFF)
+#define TC_U32_KEY(h) ((h)&0xFFFFF)
+#define TC_U32_UNSPEC   0
+#define TC_U32_ROOT     (0xFFF00000)
+
+enum {
+        TCA_U32_UNSPEC,
+        TCA_U32_CLASSID,
+        TCA_U32_HASH,
+        TCA_U32_LINK,
+        TCA_U32_DIVISOR,
+        TCA_U32_SEL,
+        TCA_U32_POLICE,
+        TCA_U32_ACT,
+        TCA_U32_INDEV,
+        TCA_U32_PCNT,
+        TCA_U32_MARK,
+        TCA_U32_FLAGS,
+        TCA_U32_PAD,
+        __TCA_U32_MAX
+};
+
+#define TCA_U32_MAX (__TCA_U32_MAX - 1)
+
+struct tc_u32_key {
+        __be32          mask;
+        __be32          val;
+        int             off;
+        int             offmask;
+};
+
+struct tc_u32_sel {
+        unsigned char           flags;
+        unsigned char           offshift;
+        unsigned char           nkeys;
+
+        __be16                  offmask;
+        __u16                   off;
+        short                   offoff;
+
+        short                   hoff;
+        __be32                  hmask;
+        struct tc_u32_key       keys[0];
+};
+
+struct tc_u32_mark {
+        __u32           val;
+        __u32           mask;
+        __u32           success;
+};
+
+struct tc_u32_pcnt {
+        __u64 rcnt;
+        __u64 rhit;
+        __u64 kcnts[0];
+};
+
+/* Flags */
+
+#define TC_U32_TERMINAL         1
+#define TC_U32_OFFSET           2
+#define TC_U32_VAROFFSET        4
+#define TC_U32_EAT              8
+
+#define TC_U32_MAXDEPTH 8
+
+
+/* RSVP filter */
+
+enum {
+        TCA_RSVP_UNSPEC,
+        TCA_RSVP_CLASSID,
+        TCA_RSVP_DST,
+        TCA_RSVP_SRC,
+        TCA_RSVP_PINFO,
+        TCA_RSVP_POLICE,
+        TCA_RSVP_ACT,
+        __TCA_RSVP_MAX
+};
+
+#define TCA_RSVP_MAX (__TCA_RSVP_MAX - 1 )
+
+struct tc_rsvp_gpi {
+        __u32   key;
+        __u32   mask;
+        int     offset;
+};
+
+struct tc_rsvp_pinfo {
+        struct tc_rsvp_gpi dpi;
+        struct tc_rsvp_gpi spi;
+        __u8    protocol;
+        __u8    tunnelid;
+        __u8    tunnelhdr;
+        __u8    pad;
+};
+
+/* ROUTE filter */
+
+enum {
+        TCA_ROUTE4_UNSPEC,
+        TCA_ROUTE4_CLASSID,
+        TCA_ROUTE4_TO,
+        TCA_ROUTE4_FROM,
+        TCA_ROUTE4_IIF,
+        TCA_ROUTE4_POLICE,
+        TCA_ROUTE4_ACT,
+        __TCA_ROUTE4_MAX
+};
+
+#define TCA_ROUTE4_MAX (__TCA_ROUTE4_MAX - 1)
+
+
+/* FW filter */
+
+enum {
+        TCA_FW_UNSPEC,
+        TCA_FW_CLASSID,
+        TCA_FW_POLICE,
+        TCA_FW_INDEV, /*  used by CONFIG_NET_CLS_IND */
+        TCA_FW_ACT, /* used by CONFIG_NET_CLS_ACT */
+        TCA_FW_MASK,
+        __TCA_FW_MAX
+};
+
+#define TCA_FW_MAX (__TCA_FW_MAX - 1)
+
+/* TC index filter */
+
+enum {
+        TCA_TCINDEX_UNSPEC,
+        TCA_TCINDEX_HASH,
+        TCA_TCINDEX_MASK,
+        TCA_TCINDEX_SHIFT,
+        TCA_TCINDEX_FALL_THROUGH,
+        TCA_TCINDEX_CLASSID,
+        TCA_TCINDEX_POLICE,
+        TCA_TCINDEX_ACT,
+        __TCA_TCINDEX_MAX
+};
+
+#define TCA_TCINDEX_MAX     (__TCA_TCINDEX_MAX - 1)
+
+/* Flow filter */
+
+enum {
+        FLOW_KEY_SRC,
+        FLOW_KEY_DST,
+        FLOW_KEY_PROTO,
+        FLOW_KEY_PROTO_SRC,
+        FLOW_KEY_PROTO_DST,
+        FLOW_KEY_IIF,
+        FLOW_KEY_PRIORITY,
+        FLOW_KEY_MARK,
+        FLOW_KEY_NFCT,
+        FLOW_KEY_NFCT_SRC,
+        FLOW_KEY_NFCT_DST,
+        FLOW_KEY_NFCT_PROTO_SRC,
+        FLOW_KEY_NFCT_PROTO_DST,
+        FLOW_KEY_RTCLASSID,
+        FLOW_KEY_SKUID,
+        FLOW_KEY_SKGID,
+        FLOW_KEY_VLAN_TAG,
+        FLOW_KEY_RXHASH,
+        __FLOW_KEY_MAX,
+};
+
+#define FLOW_KEY_MAX    (__FLOW_KEY_MAX - 1)
+
+enum {
+        FLOW_MODE_MAP,
+        FLOW_MODE_HASH,
+};
+
+enum {
+        TCA_FLOW_UNSPEC,
+        TCA_FLOW_KEYS,
+        TCA_FLOW_MODE,
+        TCA_FLOW_BASECLASS,
+        TCA_FLOW_RSHIFT,
+        TCA_FLOW_ADDEND,
+        TCA_FLOW_MASK,
+        TCA_FLOW_XOR,
+        TCA_FLOW_DIVISOR,
+        TCA_FLOW_ACT,
+        TCA_FLOW_POLICE,
+        TCA_FLOW_EMATCHES,
+        TCA_FLOW_PERTURB,
+        __TCA_FLOW_MAX
+};
+
+#define TCA_FLOW_MAX    (__TCA_FLOW_MAX - 1)
+
+/* Basic filter */
+
+enum {
+        TCA_BASIC_UNSPEC,
+        TCA_BASIC_CLASSID,
+        TCA_BASIC_EMATCHES,
+        TCA_BASIC_ACT,
+        TCA_BASIC_POLICE,
+        __TCA_BASIC_MAX
+};
+
+#define TCA_BASIC_MAX (__TCA_BASIC_MAX - 1)
+
+
+/* Cgroup classifier */
+
+enum {
+        TCA_CGROUP_UNSPEC,
+        TCA_CGROUP_ACT,
+        TCA_CGROUP_POLICE,
+        TCA_CGROUP_EMATCHES,
+        __TCA_CGROUP_MAX,
+};
+
+#define TCA_CGROUP_MAX (__TCA_CGROUP_MAX - 1)
+
+/* BPF classifier */
+
+#define TCA_BPF_FLAG_ACT_DIRECT         (1 << 0)
+
+enum {
+        TCA_BPF_UNSPEC,
+        TCA_BPF_ACT,
+        TCA_BPF_POLICE,
+        TCA_BPF_CLASSID,
+        TCA_BPF_OPS_LEN,
+        TCA_BPF_OPS,
+        TCA_BPF_FD,
+        TCA_BPF_NAME,
+        TCA_BPF_FLAGS,
+        TCA_BPF_FLAGS_GEN,
+        TCA_BPF_TAG,
+        TCA_BPF_ID,
+        __TCA_BPF_MAX,
+};
+
+#define TCA_BPF_MAX (__TCA_BPF_MAX - 1)
+
+/* Flower classifier */
+
+enum {
+        TCA_FLOWER_UNSPEC,
+        TCA_FLOWER_CLASSID,
+        TCA_FLOWER_INDEV,
+        TCA_FLOWER_ACT,
+        TCA_FLOWER_KEY_ETH_DST,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_DST_MASK,    /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_SRC,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_SRC_MASK,    /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_TYPE,        /* be16 */
+        TCA_FLOWER_KEY_IP_PROTO,        /* u8 */
+        TCA_FLOWER_KEY_IPV4_SRC,        /* be32 */
+        TCA_FLOWER_KEY_IPV4_SRC_MASK,   /* be32 */
+        TCA_FLOWER_KEY_IPV4_DST,        /* be32 */
+        TCA_FLOWER_KEY_IPV4_DST_MASK,   /* be32 */
+        TCA_FLOWER_KEY_IPV6_SRC,        /* struct in6_addr */
+        TCA_FLOWER_KEY_IPV6_SRC_MASK,   /* struct in6_addr */
+        TCA_FLOWER_KEY_IPV6_DST,        /* struct in6_addr */
+        TCA_FLOWER_KEY_IPV6_DST_MASK,   /* struct in6_addr */
+        TCA_FLOWER_KEY_TCP_SRC,         /* be16 */
+        TCA_FLOWER_KEY_TCP_DST,         /* be16 */
+        TCA_FLOWER_KEY_UDP_SRC,         /* be16 */
+        TCA_FLOWER_KEY_UDP_DST,         /* be16 */
+
+        TCA_FLOWER_FLAGS,
+        TCA_FLOWER_KEY_VLAN_ID,         /* be16 */
+        TCA_FLOWER_KEY_VLAN_PRIO,       /* u8   */
+        TCA_FLOWER_KEY_VLAN_ETH_TYPE,   /* be16 */
+
+        TCA_FLOWER_KEY_ENC_KEY_ID,      /* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_SRC,    /* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_SRC_MASK,/* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_DST,    /* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_DST_MASK,/* be32 */
+        TCA_FLOWER_KEY_ENC_IPV6_SRC,    /* struct in6_addr */
+        TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK,/* struct in6_addr */
+        TCA_FLOWER_KEY_ENC_IPV6_DST,    /* struct in6_addr */
+        TCA_FLOWER_KEY_ENC_IPV6_DST_MASK,/* struct in6_addr */
+
+        TCA_FLOWER_KEY_TCP_SRC_MASK,    /* be16 */
+        TCA_FLOWER_KEY_TCP_DST_MASK,    /* be16 */
+        TCA_FLOWER_KEY_UDP_SRC_MASK,    /* be16 */
+        TCA_FLOWER_KEY_UDP_DST_MASK,    /* be16 */
+        TCA_FLOWER_KEY_SCTP_SRC_MASK,   /* be16 */
+        TCA_FLOWER_KEY_SCTP_DST_MASK,   /* be16 */
+
+        TCA_FLOWER_KEY_SCTP_SRC,        /* be16 */
+        TCA_FLOWER_KEY_SCTP_DST,        /* be16 */
+
+        TCA_FLOWER_KEY_ENC_UDP_SRC_PORT,        /* be16 */
+        TCA_FLOWER_KEY_ENC_UDP_SRC_PORT_MASK,   /* be16 */
+        TCA_FLOWER_KEY_ENC_UDP_DST_PORT,        /* be16 */
+        TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK,   /* be16 */
+
+        TCA_FLOWER_KEY_FLAGS,           /* be32 */
+        TCA_FLOWER_KEY_FLAGS_MASK,      /* be32 */
+
+        TCA_FLOWER_KEY_ICMPV4_CODE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV4_CODE_MASK,/* u8 */
+        TCA_FLOWER_KEY_ICMPV4_TYPE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,/* u8 */
+        TCA_FLOWER_KEY_ICMPV6_CODE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV6_CODE_MASK,/* u8 */
+        TCA_FLOWER_KEY_ICMPV6_TYPE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,/* u8 */
+
+        TCA_FLOWER_KEY_ARP_SIP,         /* be32 */
+        TCA_FLOWER_KEY_ARP_SIP_MASK,    /* be32 */
+        TCA_FLOWER_KEY_ARP_TIP,         /* be32 */
+        TCA_FLOWER_KEY_ARP_TIP_MASK,    /* be32 */
+        TCA_FLOWER_KEY_ARP_OP,          /* u8 */
+        TCA_FLOWER_KEY_ARP_OP_MASK,     /* u8 */
+        TCA_FLOWER_KEY_ARP_SHA,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ARP_SHA_MASK,    /* ETH_ALEN */
+        TCA_FLOWER_KEY_ARP_THA,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ARP_THA_MASK,    /* ETH_ALEN */
+
+        TCA_FLOWER_KEY_MPLS_TTL,        /* u8 - 8 bits */
+        TCA_FLOWER_KEY_MPLS_BOS,        /* u8 - 1 bit */
+        TCA_FLOWER_KEY_MPLS_TC,         /* u8 - 3 bits */
+        TCA_FLOWER_KEY_MPLS_LABEL,      /* be32 - 20 bits */
+
+        TCA_FLOWER_KEY_TCP_FLAGS,       /* be16 */
+        TCA_FLOWER_KEY_TCP_FLAGS_MASK,  /* be16 */
+
+        TCA_FLOWER_KEY_IP_TOS,          /* u8 */
+        TCA_FLOWER_KEY_IP_TOS_MASK,     /* u8 */
+        TCA_FLOWER_KEY_IP_TTL,          /* u8 */
+        TCA_FLOWER_KEY_IP_TTL_MASK,     /* u8 */
+
+        TCA_FLOWER_KEY_CVLAN_ID,        /* be16 */
+        TCA_FLOWER_KEY_CVLAN_PRIO,      /* u8   */
+        TCA_FLOWER_KEY_CVLAN_ETH_TYPE,  /* be16 */
+
+        TCA_FLOWER_KEY_ENC_IP_TOS,      /* u8 */
+        TCA_FLOWER_KEY_ENC_IP_TOS_MASK, /* u8 */
+        TCA_FLOWER_KEY_ENC_IP_TTL,      /* u8 */
+        TCA_FLOWER_KEY_ENC_IP_TTL_MASK, /* u8 */
+
+        TCA_FLOWER_KEY_ENC_OPTS,
+        TCA_FLOWER_KEY_ENC_OPTS_MASK,
+
+        TCA_FLOWER_IN_HW_COUNT,
+
+        __TCA_FLOWER_MAX,
+};
+
+#define TCA_FLOWER_MAX (__TCA_FLOWER_MAX - 1)
+
+enum {
+        TCA_FLOWER_KEY_ENC_OPTS_UNSPEC,
+        TCA_FLOWER_KEY_ENC_OPTS_GENEVE, /* Nested
+                                         * TCA_FLOWER_KEY_ENC_OPT_GENEVE_
+                                         * attributes
+                                         */
+        __TCA_FLOWER_KEY_ENC_OPTS_MAX,
+};
+
+#define TCA_FLOWER_KEY_ENC_OPTS_MAX (__TCA_FLOWER_KEY_ENC_OPTS_MAX - 1)
+
+enum {
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_UNSPEC,
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS,            /* u16 */
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE,             /* u8 */
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA,             /* 4 to 128 bytes */
+
+        __TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX,
+};
+
+#define TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX \
+                (__TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX - 1)
+
+enum {
+        TCA_FLOWER_KEY_FLAGS_IS_FRAGMENT = (1 << 0),
+        TCA_FLOWER_KEY_FLAGS_FRAG_IS_FIRST = (1 << 1),
+};
+
+/* Match-all classifier */
+
+enum {
+        TCA_MATCHALL_UNSPEC,
+        TCA_MATCHALL_CLASSID,
+        TCA_MATCHALL_ACT,
+        TCA_MATCHALL_FLAGS,
+        __TCA_MATCHALL_MAX,
+};
+
+#define TCA_MATCHALL_MAX (__TCA_MATCHALL_MAX - 1)
+
+/* Extended Matches */
+
+struct tcf_ematch_tree_hdr {
+        __u16           nmatches;
+        __u16           progid;
+};
+
+enum {
+        TCA_EMATCH_TREE_UNSPEC,
+        TCA_EMATCH_TREE_HDR,
+        TCA_EMATCH_TREE_LIST,
+        __TCA_EMATCH_TREE_MAX
+};
+#define TCA_EMATCH_TREE_MAX (__TCA_EMATCH_TREE_MAX - 1)
+
+struct tcf_ematch_hdr {
+        __u16           matchid;
+        __u16           kind;
+        __u16           flags;
+        __u16           pad; /* currently unused */
+};
+
+/*  0                   1
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 
+ * +-----------------------+-+-+---+
+ * |         Unused        |S|I| R |
+ * +-----------------------+-+-+---+
+ *
+ * R(2) ::= relation to next ematch
+ *          where: 0 0 END (last ematch)
+ *                 0 1 AND
+ *                 1 0 OR
+ *                 1 1 Unused (invalid)
+ * I(1) ::= invert result
+ * S(1) ::= simple payload
+ */
+#define TCF_EM_REL_END  0
+#define TCF_EM_REL_AND  (1<<0)
+#define TCF_EM_REL_OR   (1<<1)
+#define TCF_EM_INVERT   (1<<2)
+#define TCF_EM_SIMPLE   (1<<3)
+
+#define TCF_EM_REL_MASK 3
+#define TCF_EM_REL_VALID(v) (((v) & TCF_EM_REL_MASK) != TCF_EM_REL_MASK)
+
+enum {
+        TCF_LAYER_LINK,
+        TCF_LAYER_NETWORK,
+        TCF_LAYER_TRANSPORT,
+        __TCF_LAYER_MAX
+};
+#define TCF_LAYER_MAX (__TCF_LAYER_MAX - 1)
+
+/* Ematch type assignments
+ *   1..32767           Reserved for ematches inside kernel tree
+ *   32768..65535       Free to use, not reliable
+ */
+#define TCF_EM_CONTAINER        0
+#define TCF_EM_CMP              1
+#define TCF_EM_NBYTE            2
+#define TCF_EM_U32              3
+#define TCF_EM_META             4
+#define TCF_EM_TEXT             5
+#define TCF_EM_VLAN             6
+#define TCF_EM_CANID            7
+#define TCF_EM_IPSET            8
+#define TCF_EM_IPT              9
+#define TCF_EM_MAX              9
+
+enum {
+        TCF_EM_PROG_TC
+};
+
+enum {
+        TCF_EM_OPND_EQ,
+        TCF_EM_OPND_GT,
+        TCF_EM_OPND_LT
+};
+
+#endif
diff --git a/tools/include/uapi/linux/prctl.h b/tools/include/uapi/linux/prctl.h
index c0d7ea0bf5b6..b17201edfa09 100644
--- a/tools/include/uapi/linux/prctl.h
+++ b/tools/include/uapi/linux/prctl.h
@@ -212,6 +212,7 @@ struct prctl_mm_map {
 #define PR_SET_SPECULATION_CTRL         53
 /* Speculation control variants */
 # define PR_SPEC_STORE_BYPASS           0
+# define PR_SPEC_INDIRECT_BRANCH        1
 /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
 # define PR_SPEC_NOT_AFFECTED           0
 # define PR_SPEC_PRCTL                  (1UL << 0)
diff --git a/tools/include/uapi/linux/tc_act/tc_bpf.h b/tools/include/uapi/linux/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..6e89a5df49a4
--- /dev/null
+++ b/tools/include/uapi/linux/tc_act/tc_bpf.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __LINUX_TC_BPF_H
+#define __LINUX_TC_BPF_H
+
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_BPF 13
+
+struct tc_act_bpf {
+        tc_gen;
+};
+
+enum {
+        TCA_ACT_BPF_UNSPEC,
+        TCA_ACT_BPF_TM,
+        TCA_ACT_BPF_PARMS,
+        TCA_ACT_BPF_OPS_LEN,
+        TCA_ACT_BPF_OPS,
+        TCA_ACT_BPF_FD,
+        TCA_ACT_BPF_NAME,
+        TCA_ACT_BPF_PAD,
+        TCA_ACT_BPF_TAG,
+        TCA_ACT_BPF_ID,
+        __TCA_ACT_BPF_MAX,
+};
+#define TCA_ACT_BPF_MAX (__TCA_ACT_BPF_MAX - 1)
+
+#endif
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 6dbb9fae0f9d..b8f3cca8e58b 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -31,6 +31,8 @@
 #include "elf.h"
 #include "warn.h"
 
+#define MAX_NAME_LEN 128
+
 struct section *find_section_by_name(struct elf *elf, const char *name)
 {
         struct section *sec;
@@ -298,6 +300,8 @@ static int read_symbols(struct elf *elf)
         /* Create parent/child links for any cold subfunctions */
         list_for_each_entry(sec, &elf->sections, list) {
                 list_for_each_entry(sym, &sec->symbol_list, list) {
+                        char pname[MAX_NAME_LEN + 1];
+                        size_t pnamelen;
                         if (sym->type != STT_FUNC)
                                 continue;
                         sym->pfunc = sym->cfunc = sym;
@@ -305,14 +309,21 @@ static int read_symbols(struct elf *elf)
                         if (!coldstr)
                                 continue;
 
-                        coldstr[0] = '\0';
-                        pfunc = find_symbol_by_name(elf, sym->name);
-                        coldstr[0] = '.';
+                        pnamelen = coldstr - sym->name;
+                        if (pnamelen > MAX_NAME_LEN) {
+                                WARN("%s(): parent function name exceeds maximum length of %d characters",
+                                     sym->name, MAX_NAME_LEN);
+                                return -1;
+                        }
+
+                        strncpy(pname, sym->name, pnamelen);
+                        pname[pnamelen] = '\0';
+                        pfunc = find_symbol_by_name(elf, pname);
 
                         if (!pfunc) {
                                 WARN("%s(): can't find parent function",
                                      sym->name);
-                                goto err;
+                                return -1;
                         }
 
                         sym->pfunc = pfunc;
diff --git a/tools/perf/Documentation/perf-list.txt b/tools/perf/Documentation/perf-list.txt
index 236b9b97dfdb..667c14e56031 100644
--- a/tools/perf/Documentation/perf-list.txt
+++ b/tools/perf/Documentation/perf-list.txt
@@ -55,7 +55,6 @@ counted. The following modifiers exist:
  S - read sample value (PERF_SAMPLE_READ)
  D - pin the event to the PMU
  W - group is weak and will fallback to non-group if not schedulable,
-     only supported in 'perf stat' for now.
 
 The 'p' modifier can be used for specifying how precise the instruction
 address should be. The 'p' modifier can be specified multiple times:
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index e30d20fb482d..a0e8c23f9125 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -299,6 +299,11 @@ ifndef NO_BIONIC
   endif
 endif
 
+ifeq ($(feature-get_current_dir_name), 1)
+  CFLAGS += -DHAVE_GET_CURRENT_DIR_NAME
+endif
+
+
 ifdef NO_LIBELF
   NO_DWARF := 1
   NO_DEMANGLE := 1
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 3ccb4f0bf088..d95655489f7e 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -387,7 +387,7 @@ SHELL = $(SHELL_PATH)
 
 linux_uapi_dir := $(srctree)/tools/include/uapi/linux
 asm_generic_uapi_dir := $(srctree)/tools/include/uapi/asm-generic
-arch_asm_uapi_dir := $(srctree)/tools/arch/$(ARCH)/include/uapi/asm/
+arch_asm_uapi_dir := $(srctree)/tools/arch/$(SRCARCH)/include/uapi/asm/
 
 beauty_outdir := $(OUTPUT)trace/beauty/generated
 beauty_ioctl_outdir := $(beauty_outdir)/ioctl
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 10cf889c6d75..488779bc4c8d 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -391,7 +391,12 @@ try_again:
                                         ui__warning("%s\n", msg);
                                 goto try_again;
                         }
-
+                        if ((errno == EINVAL || errno == EBADF) &&
+                            pos->leader != pos &&
+                            pos->weak_group) {
+                                pos = perf_evlist__reset_weak_group(evlist, pos);
+                                goto try_again;
+                        }
                         rc = -errno;
                         perf_evsel__open_strerror(pos, &opts->target,
                                                   errno, msg, sizeof(msg));
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index d1028d7755bb..a635abfa77b6 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -383,32 +383,6 @@ static bool perf_evsel__should_store_id(struct perf_evsel *counter)
         return STAT_RECORD || counter->attr.read_format & PERF_FORMAT_ID;
 }
 
-static struct perf_evsel *perf_evsel__reset_weak_group(struct perf_evsel *evsel)
-{
-        struct perf_evsel *c2, *leader;
-        bool is_open = true;
-
-        leader = evsel->leader;
-        pr_debug("Weak group for %s/%d failed\n",
-                        leader->name, leader->nr_members);
-
-        /*
-         * for_each_group_member doesn't work here because it doesn't
-         * include the first entry.
-         */
-        evlist__for_each_entry(evsel_list, c2) {
-                if (c2 == evsel)
-                        is_open = false;
-                if (c2->leader == leader) {
-                        if (is_open)
-                                perf_evsel__close(c2);
-                        c2->leader = c2;
-                        c2->nr_members = 0;
-                }
-        }
-        return leader;
-}
-
 static bool is_target_alive(struct target *_target,
                             struct thread_map *threads)
 {
@@ -477,7 +451,7 @@ try_again:
                         if ((errno == EINVAL || errno == EBADF) &&
                             counter->leader != counter &&
                             counter->weak_group) {
-                                counter = perf_evsel__reset_weak_group(counter);
+                                counter = perf_evlist__reset_weak_group(evsel_list, counter);
                                 goto try_again;
                         }
 
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index b2838de13de0..aa0c73e57924 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1429,6 +1429,9 @@ int cmd_top(int argc, const char **argv)
                 }
         }
 
+        if (opts->branch_stack && callchain_param.enabled)
+                symbol_conf.show_branchflag_count = true;
+
         sort__mode = SORT_MODE__TOP;
         /* display thread wants entries to be collapsed in a different tree */
         perf_hpp_list.need_collapse = 1;
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index dc8a6c4986ce..835619476370 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -108,6 +108,7 @@ struct trace {
         } stats;
         unsigned int            max_stack;
         unsigned int            min_stack;
+        bool                    raw_augmented_syscalls;
         bool                    not_ev_qualifier;
         bool                    live;
         bool                    full_time;
@@ -1724,13 +1725,28 @@ static int trace__fprintf_sample(struct trace *trace, struct perf_evsel *evsel,
         return printed;
 }
 
-static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size)
+static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, bool raw_augmented)
 {
         void *augmented_args = NULL;
+        /*
+         * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
+         * and there we get all 6 syscall args plus the tracepoint common
+         * fields (sizeof(long)) and the syscall_nr (another long). So we check
+         * if that is the case and if so don't look after the sc->args_size,
+         * but always after the full raw_syscalls:sys_enter payload, which is
+         * fixed.
+         *
+         * We'll revisit this later to pass s->args_size to the BPF augmenter
+         * (now tools/perf/examples/bpf/augmented_raw_syscalls.c, so that it
+         * copies only what we need for each syscall, like what happens when we
+         * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace
+         * traffic to just what is needed for each syscall.
+         */
+        int args_size = raw_augmented ? (8 * (int)sizeof(long)) : sc->args_size;
 
-        *augmented_args_size = sample->raw_size - sc->args_size;
+        *augmented_args_size = sample->raw_size - args_size;
         if (*augmented_args_size > 0)
-                augmented_args = sample->raw_data + sc->args_size;
+                augmented_args = sample->raw_data + args_size;
 
         return augmented_args;
 }
@@ -1780,7 +1796,7 @@ static int trace__sys_enter(struct trace *trace, struct perf_evsel *evsel,
          * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
          */
         if (evsel != trace->syscalls.events.sys_enter)
-                augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size);
+                augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls);
         ttrace->entry_time = sample->time;
         msg = ttrace->entry_str;
         printed += scnprintf(msg + printed, trace__entry_str_size - printed, "%s(", sc->name);
@@ -1833,7 +1849,7 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct perf_evsel *evse
                 goto out_put;
 
         args = perf_evsel__sc_tp_ptr(evsel, args, sample);
-        augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size);
+        augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls);
         syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
         fprintf(trace->output, "%s", msg);
         err = 0;
@@ -3501,7 +3517,15 @@ int cmd_trace(int argc, const char **argv)
                 evsel->handler = trace__sys_enter;
 
                 evlist__for_each_entry(trace.evlist, evsel) {
+                        bool raw_syscalls_sys_exit = strcmp(perf_evsel__name(evsel), "raw_syscalls:sys_exit") == 0;
+
+                        if (raw_syscalls_sys_exit) {
+                                trace.raw_augmented_syscalls = true;
+                                goto init_augmented_syscall_tp;
+                        }
+
                         if (strstarts(perf_evsel__name(evsel), "syscalls:sys_exit_")) {
+init_augmented_syscall_tp:
                                 perf_evsel__init_augmented_syscall_tp(evsel);
                                 perf_evsel__init_augmented_syscall_tp_ret(evsel);
                                 evsel->handler = trace__sys_exit;
diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
new file mode 100644
index 000000000000..90a19336310b
--- /dev/null
+++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Augment the raw_syscalls tracepoints with the contents of the pointer arguments.
+ *
+ * Test it with:
+ *
+ * perf trace -e tools/perf/examples/bpf/augmented_raw_syscalls.c cat /etc/passwd > /dev/null
+ *
+ * This exactly matches what is marshalled into the raw_syscall:sys_enter
+ * payload expected by the 'perf trace' beautifiers.
+ *
+ * For now it just uses the existing tracepoint augmentation code in 'perf
+ * trace', in the next csets we'll hook up these with the sys_enter/sys_exit
+ * code that will combine entry/exit in a strace like way.
+ */
+
+#include <stdio.h>
+#include <linux/socket.h>
+
+/* bpf-output associated map */
+struct bpf_map SEC("maps") __augmented_syscalls__ = {
+        .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
+        .key_size = sizeof(int),
+        .value_size = sizeof(u32),
+        .max_entries = __NR_CPUS__,
+};
+
+struct syscall_enter_args {
+        unsigned long long common_tp_fields;
+        long               syscall_nr;
+        unsigned long      args[6];
+};
+
+struct syscall_exit_args {
+        unsigned long long common_tp_fields;
+        long               syscall_nr;
+        long               ret;
+};
+
+struct augmented_filename {
+        unsigned int    size;
+        int             reserved;
+        char            value[256];
+};
+
+#define SYS_OPEN 2
+#define SYS_OPENAT 257
+
+SEC("raw_syscalls:sys_enter")
+int sys_enter(struct syscall_enter_args *args)
+{
+        struct {
+                struct syscall_enter_args args;
+                struct augmented_filename filename;
+        } augmented_args;
+        unsigned int len = sizeof(augmented_args);
+        const void *filename_arg = NULL;
+
+        probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
+        /*
+         * Yonghong and Edward Cree sayz:
+         *
+         * https://www.spinics.net/lists/netdev/msg531645.html
+         *
+         * >>   R0=inv(id=0) R1=inv2 R6=ctx(id=0,off=0,imm=0) R7=inv64 R10=fp0,call_-1
+         * >> 10: (bf) r1 = r6
+         * >> 11: (07) r1 += 16
+         * >> 12: (05) goto pc+2
+         * >> 15: (79) r3 = *(u64 *)(r1 +0)
+         * >> dereference of modified ctx ptr R1 off=16 disallowed
+         * > Aha, we at least got a different error message this time.
+         * > And indeed llvm has done that optimisation, rather than the more obvious
+         * > 11: r3 = *(u64 *)(r1 +16)
+         * > because it wants to have lots of reads share a single insn.  You may be able
+         * > to defeat that optimisation by adding compiler barriers, idk.  Maybe someone
+         * > with llvm knowledge can figure out how to stop it (ideally, llvm would know
+         * > when it's generating for bpf backend and not do that).  -O0?  ¯\_(ツ)_/¯
+         *
+         * The optimization mostly likes below:
+         *
+         *      br1:
+         *      ...
+         *      r1 += 16
+         *      goto merge
+         *      br2:
+         *      ...
+         *      r1 += 20
+         *      goto merge
+         *      merge:
+         *      *(u64 *)(r1 + 0)
+         *
+         * The compiler tries to merge common loads. There is no easy way to
+         * stop this compiler optimization without turning off a lot of other
+         * optimizations. The easiest way is to add barriers:
+         *
+         *       __asm__ __volatile__("": : :"memory")
+         *
+         *       after the ctx memory access to prevent their down stream merging.
+         */
+        switch (augmented_args.args.syscall_nr) {
+        case SYS_OPEN:   filename_arg = (const void *)args->args[0];
+                        __asm__ __volatile__("": : :"memory");
+                         break;
+        case SYS_OPENAT: filename_arg = (const void *)args->args[1];
+                         break;
+        }
+
+        if (filename_arg != NULL) {
+                augmented_args.filename.reserved = 0;
+                augmented_args.filename.size = probe_read_str(&augmented_args.filename.value,
+                                                              sizeof(augmented_args.filename.value),
+                                                              filename_arg);
+                if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) {
+                        len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size;
+                        len &= sizeof(augmented_args.filename.value) - 1;
+                }
+        } else {
+                len = sizeof(augmented_args.args);
+        }
+
+        perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, &augmented_args, len);
+        return 0;
+}
+
+SEC("raw_syscalls:sys_exit")
+int sys_exit(struct syscall_exit_args *args)
+{
+        return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */
+}
+
+license(GPL);
diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
index ac1bcdc17dae..f7eb63cbbc65 100644
--- a/tools/perf/jvmti/jvmti_agent.c
+++ b/tools/perf/jvmti/jvmti_agent.c
@@ -125,7 +125,7 @@ perf_get_timestamp(void)
 }
 
 static int
-debug_cache_init(void)
+create_jit_cache_dir(void)
 {
         char str[32];
         char *base, *p;
@@ -144,8 +144,13 @@ debug_cache_init(void)
 
         strftime(str, sizeof(str), JIT_LANG"-jit-%Y%m%d", &tm);
 
-        snprintf(jit_path, PATH_MAX - 1, "%s/.debug/", base);
-
+        ret = snprintf(jit_path, PATH_MAX, "%s/.debug/", base);
+        if (ret >= PATH_MAX) {
+                warnx("jvmti: cannot generate jit cache dir because %s/.debug/"
+                        " is too long, please check the cwd, JITDUMPDIR, and"
+                        " HOME variables", base);
+                return -1;
+        }
         ret = mkdir(jit_path, 0755);
         if (ret == -1) {
                 if (errno != EEXIST) {
@@ -154,20 +159,32 @@ debug_cache_init(void)
                 }
         }
 
-        snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit", base);
+        ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit", base);
+        if (ret >= PATH_MAX) {
+                warnx("jvmti: cannot generate jit cache dir because"
+                        " %s/.debug/jit is too long, please check the cwd,"
+                        " JITDUMPDIR, and HOME variables", base);
+                return -1;
+        }
         ret = mkdir(jit_path, 0755);
         if (ret == -1) {
                 if (errno != EEXIST) {
-                        warn("cannot create jit cache dir %s", jit_path);
+                        warn("jvmti: cannot create jit cache dir %s", jit_path);
                         return -1;
                 }
         }
 
-        snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit/%s.XXXXXXXX", base, str);
-
+        ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit/%s.XXXXXXXX", base, str);
+        if (ret >= PATH_MAX) {
+                warnx("jvmti: cannot generate jit cache dir because"
+                        " %s/.debug/jit/%s.XXXXXXXX is too long, please check"
+                        " the cwd, JITDUMPDIR, and HOME variables",
+                        base, str);
+                return -1;
+        }
         p = mkdtemp(jit_path);
         if (p != jit_path) {
-                warn("cannot create jit cache dir %s", jit_path);
+                warn("jvmti: cannot create jit cache dir %s", jit_path);
                 return -1;
         }
 
@@ -228,7 +245,7 @@ void *jvmti_open(void)
 {
         char dump_path[PATH_MAX];
         struct jitheader header;
-        int fd;
+        int fd, ret;
         FILE *fp;
 
         init_arch_timestamp();
@@ -245,12 +262,22 @@ void *jvmti_open(void)
 
         memset(&header, 0, sizeof(header));
 
-        debug_cache_init();
+        /*
+         * jitdump file dir
+         */
+        if (create_jit_cache_dir() < 0)
+                return NULL;
 
         /*
          * jitdump file name
          */
-        scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
+        ret = snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
+        if (ret >= PATH_MAX) {
+                warnx("jvmti: cannot generate jitdump file full path because"
+                        " %s/jit-%i.dump is too long, please check the cwd,"
+                        " JITDUMPDIR, and HOME variables", jit_path, getpid());
+                return NULL;
+        }
 
         fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666);
         if (fd == -1)
diff --git a/tools/perf/scripts/python/exported-sql-viewer.py b/tools/perf/scripts/python/exported-sql-viewer.py
index 24cb0bd56afa..f278ce5ebab7 100755
--- a/tools/perf/scripts/python/exported-sql-viewer.py
+++ b/tools/perf/scripts/python/exported-sql-viewer.py
@@ -119,6 +119,14 @@ def dsoname(name):
                 return "[kernel]"
         return name
 
+def findnth(s, sub, n, offs=0):
+        pos = s.find(sub)
+        if pos < 0:
+                return pos
+        if n <= 1:
+                return offs + pos
+        return findnth(s[pos + 1:], sub, n - 1, offs + pos + 1)
+
 # Percent to one decimal place
 
 def PercentToOneDP(n, d):
@@ -1464,6 +1472,317 @@ class BranchWindow(QMdiSubWindow):
                 else:
                         self.find_bar.NotFound()
 
+# Dialog data item converted and validated using a SQL table
+
+class SQLTableDialogDataItem():
+
+        def __init__(self, glb, label, placeholder_text, table_name, match_column, column_name1, column_name2, parent):
+                self.glb = glb
+                self.label = label
+                self.placeholder_text = placeholder_text
+                self.table_name = table_name
+                self.match_column = match_column
+                self.column_name1 = column_name1
+                self.column_name2 = column_name2
+                self.parent = parent
+
+                self.value = ""
+
+                self.widget = QLineEdit()
+                self.widget.editingFinished.connect(self.Validate)
+                self.widget.textChanged.connect(self.Invalidate)
+                self.red = False
+                self.error = ""
+                self.validated = True
+
+                self.last_id = 0
+                self.first_time = 0
+                self.last_time = 2 ** 64
+                if self.table_name == "<timeranges>":
+                        query = QSqlQuery(self.glb.db)
+                        QueryExec(query, "SELECT id, time FROM samples ORDER BY id DESC LIMIT 1")
+                        if query.next():
+                                self.last_id = int(query.value(0))
+                                self.last_time = int(query.value(1))
+                        QueryExec(query, "SELECT time FROM samples WHERE time != 0 ORDER BY id LIMIT 1")
+                        if query.next():
+                                self.first_time = int(query.value(0))
+                        if placeholder_text:
+                                placeholder_text += ", between " + str(self.first_time) + " and " + str(self.last_time)
+
+                if placeholder_text:
+                        self.widget.setPlaceholderText(placeholder_text)
+
+        def ValueToIds(self, value):
+                ids = []
+                query = QSqlQuery(self.glb.db)
+                stmt = "SELECT id FROM " + self.table_name + " WHERE " + self.match_column + " = '" + value + "'"
+                ret = query.exec_(stmt)
+                if ret:
+                        while query.next():
+                                ids.append(str(query.value(0)))
+                return ids
+
+        def IdBetween(self, query, lower_id, higher_id, order):
+                QueryExec(query, "SELECT id FROM samples WHERE id > " + str(lower_id) + " AND id < " + str(higher_id) + " ORDER BY id " + order + " LIMIT 1")
+                if query.next():
+                        return True, int(query.value(0))
+                else:
+                        return False, 0
+
+        def BinarySearchTime(self, lower_id, higher_id, target_time, get_floor):
+                query = QSqlQuery(self.glb.db)
+                while True:
+                        next_id = int((lower_id + higher_id) / 2)
+                        QueryExec(query, "SELECT time FROM samples WHERE id = " + str(next_id))
+                        if not query.next():
+                                ok, dbid = self.IdBetween(query, lower_id, next_id, "DESC")
+                                if not ok:
+                                        ok, dbid = self.IdBetween(query, next_id, higher_id, "")
+                                        if not ok:
+                                                return str(higher_id)
+                                next_id = dbid
+                                QueryExec(query, "SELECT time FROM samples WHERE id = " + str(next_id))
+                        next_time = int(query.value(0))
+                        if get_floor:
+                                if target_time > next_time:
+                                        lower_id = next_id
+                                else:
+                                        higher_id = next_id
+                                if higher_id <= lower_id + 1:
+                                        return str(higher_id)
+                        else:
+                                if target_time >= next_time:
+                                        lower_id = next_id
+                                else:
+                                        higher_id = next_id
+                                if higher_id <= lower_id + 1:
+                                        return str(lower_id)
+
+        def ConvertRelativeTime(self, val):
+                print "val ", val
+                mult = 1
+                suffix = val[-2:]
+                if suffix == "ms":
+                        mult = 1000000
+                elif suffix == "us":
+                        mult = 1000
+                elif suffix == "ns":
+                        mult = 1
+                else:
+                        return val
+                val = val[:-2].strip()
+                if not self.IsNumber(val):
+                        return val
+                val = int(val) * mult
+                if val >= 0:
+                        val += self.first_time
+                else:
+                        val += self.last_time
+                return str(val)
+
+        def ConvertTimeRange(self, vrange):
+                print "vrange ", vrange
+                if vrange[0] == "":
+                        vrange[0] = str(self.first_time)
+                if vrange[1] == "":
+                        vrange[1] = str(self.last_time)
+                vrange[0] = self.ConvertRelativeTime(vrange[0])
+                vrange[1] = self.ConvertRelativeTime(vrange[1])
+                print "vrange2 ", vrange
+                if not self.IsNumber(vrange[0]) or not self.IsNumber(vrange[1]):
+                        return False
+                print "ok1"
+                beg_range = max(int(vrange[0]), self.first_time)
+                end_range = min(int(vrange[1]), self.last_time)
+                if beg_range > self.last_time or end_range < self.first_time:
+                        return False
+                print "ok2"
+                vrange[0] = self.BinarySearchTime(0, self.last_id, beg_range, True)
+                vrange[1] = self.BinarySearchTime(1, self.last_id + 1, end_range, False)
+                print "vrange3 ", vrange
+                return True
+
+        def AddTimeRange(self, value, ranges):
+                print "value ", value
+                n = value.count("-")
+                if n == 1:
+                        pass
+                elif n == 2:
+                        if value.split("-")[1].strip() == "":
+                                n = 1
+                elif n == 3:
+                        n = 2
+                else:
+                        return False
+                pos = findnth(value, "-", n)
+                vrange = [value[:pos].strip() ,value[pos+1:].strip()]
+                if self.ConvertTimeRange(vrange):
+                        ranges.append(vrange)
+                        return True
+                return False
+
+        def InvalidValue(self, value):
+                self.value = ""
+                palette = QPalette()
+                palette.setColor(QPalette.Text,Qt.red)
+                self.widget.setPalette(palette)
+                self.red = True
+                self.error = self.label + " invalid value '" + value + "'"
+                self.parent.ShowMessage(self.error)
+
+        def IsNumber(self, value):
+                try:
+                        x = int(value)
+                except:
+                        x = 0
+                return str(x) == value
+
+        def Invalidate(self):
+                self.validated = False
+
+        def Validate(self):
+                input_string = self.widget.text()
+                self.validated = True
+                if self.red:
+                        palette = QPalette()
+                        self.widget.setPalette(palette)
+                        self.red = False
+                if not len(input_string.strip()):
+                        self.error = ""
+                        self.value = ""
+                        return
+                if self.table_name == "<timeranges>":
+                        ranges = []
+                        for value in [x.strip() for x in input_string.split(",")]:
+                                if not self.AddTimeRange(value, ranges):
+                                        return self.InvalidValue(value)
+                        ranges = [("(" + self.column_name1 + " >= " + r[0] + " AND " + self.column_name1 + " <= " + r[1] + ")") for r in ranges]
+                        self.value = " OR ".join(ranges)
+                elif self.table_name == "<ranges>":
+                        singles = []
+                        ranges = []
+                        for value in [x.strip() for x in input_string.split(",")]:
+                                if "-" in value:
+                                        vrange = value.split("-")
+                                        if len(vrange) != 2 or not self.IsNumber(vrange[0]) or not self.IsNumber(vrange[1]):
+                                                return self.InvalidValue(value)
+                                        ranges.append(vrange)
+                                else:
+                                        if not self.IsNumber(value):
+                                                return self.InvalidValue(value)
+                                        singles.append(value)
+                        ranges = [("(" + self.column_name1 + " >= " + r[0] + " AND " + self.column_name1 + " <= " + r[1] + ")") for r in ranges]
+                        if len(singles):
+                                ranges.append(self.column_name1 + " IN (" + ",".join(singles) + ")")
+                        self.value = " OR ".join(ranges)
+                elif self.table_name:
+                        all_ids = []
+                        for value in [x.strip() for x in input_string.split(",")]:
+                                ids = self.ValueToIds(value)
+                                if len(ids):
+                                        all_ids.extend(ids)
+                                else:
+                                        return self.InvalidValue(value)
+                        self.value = self.column_name1 + " IN (" + ",".join(all_ids) + ")"
+                        if self.column_name2:
+                                self.value = "( " + self.value + " OR " + self.column_name2 + " IN (" + ",".join(all_ids) + ") )"
+                else:
+                        self.value = input_string.strip()
+                self.error = ""
+                self.parent.ClearMessage()
+
+        def IsValid(self):
+                if not self.validated:
+                        self.Validate()
+                if len(self.error):
+                        self.parent.ShowMessage(self.error)
+                        return False
+                return True
+
+# Selected branch report creation dialog
+
+class SelectedBranchDialog(QDialog):
+
+        def __init__(self, glb, parent=None):
+                super(SelectedBranchDialog, self).__init__(parent)
+
+                self.glb = glb
+
+                self.name = ""
+                self.where_clause = ""
+
+                self.setWindowTitle("Selected Branches")
+                self.setMinimumWidth(600)
+
+                items = (
+                        ("Report name:", "Enter a name to appear in the window title bar", "", "", "", ""),
+                        ("Time ranges:", "Enter time ranges", "<timeranges>", "", "samples.id", ""),
+                        ("CPUs:", "Enter CPUs or ranges e.g. 0,5-6", "<ranges>", "", "cpu", ""),
+                        ("Commands:", "Only branches with these commands will be included", "comms", "comm", "comm_id", ""),
+                        ("PIDs:", "Only branches with these process IDs will be included", "threads", "pid", "thread_id", ""),
+                        ("TIDs:", "Only branches with these thread IDs will be included", "threads", "tid", "thread_id", ""),
+                        ("DSOs:", "Only branches with these DSOs will be included", "dsos", "short_name", "samples.dso_id", "to_dso_id"),
+                        ("Symbols:", "Only branches with these symbols will be included", "symbols", "name", "symbol_id", "to_symbol_id"),
+                        ("Raw SQL clause: ", "Enter a raw SQL WHERE clause", "", "", "", ""),
+                        )
+                self.data_items = [SQLTableDialogDataItem(glb, *x, parent=self) for x in items]
+
+                self.grid = QGridLayout()
+
+                for row in xrange(len(self.data_items)):
+                        self.grid.addWidget(QLabel(self.data_items[row].label), row, 0)
+                        self.grid.addWidget(self.data_items[row].widget, row, 1)
+
+                self.status = QLabel()
+
+                self.ok_button = QPushButton("Ok", self)
+                self.ok_button.setDefault(True)
+                self.ok_button.released.connect(self.Ok)
+                self.ok_button.setSizePolicy(QSizePolicy.Fixed, QSizePolicy.Fixed)
+
+                self.cancel_button = QPushButton("Cancel", self)
+                self.cancel_button.released.connect(self.reject)
+                self.cancel_button.setSizePolicy(QSizePolicy.Fixed, QSizePolicy.Fixed)
+
+                self.hbox = QHBoxLayout()
+                #self.hbox.addStretch()
+                self.hbox.addWidget(self.status)
+                self.hbox.addWidget(self.ok_button)
+                self.hbox.addWidget(self.cancel_button)
+
+                self.vbox = QVBoxLayout()
+                self.vbox.addLayout(self.grid)
+                self.vbox.addLayout(self.hbox)
+
+                self.setLayout(self.vbox);
+
+        def Ok(self):
+                self.name = self.data_items[0].value
+                if not self.name:
+                        self.ShowMessage("Report name is required")
+                        return
+                for d in self.data_items:
+                        if not d.IsValid():
+                                return
+                for d in self.data_items[1:]:
+                        if len(d.value):
+                                if len(self.where_clause):
+                                        self.where_clause += " AND "
+                                self.where_clause += d.value
+                if len(self.where_clause):
+                        self.where_clause = " AND ( " + self.where_clause + " ) "
+                else:
+                        self.ShowMessage("No selection")
+                        return
+                self.accept()
+
+        def ShowMessage(self, msg):
+                self.status.setText("<font color=#FF0000>" + msg)
+
+        def ClearMessage(self):
+                self.status.setText("")
+
 # Event list
 
 def GetEventList(db):
@@ -1656,7 +1975,7 @@ class TableWindow(QMdiSubWindow, ResizeColumnsToContentsBase):
         def FindDone(self, row):
                 self.find_bar.Idle()
                 if row >= 0:
-                        self.view.setCurrentIndex(self.model.index(row, 0, QModelIndex()))
+                        self.view.setCurrentIndex(self.model.mapFromSource(self.data_model.index(row, 0, QModelIndex())))
                 else:
                         self.find_bar.NotFound()
 
@@ -1765,6 +2084,149 @@ class WindowMenu():
         def setActiveSubWindow(self, nr):
                 self.mdi_area.setActiveSubWindow(self.mdi_area.subWindowList()[nr - 1])
 
+# Help text
+
+glb_help_text = """
+<h1>Contents</h1>
+<style>
+p.c1 {
+    text-indent: 40px;
+}
+p.c2 {
+    text-indent: 80px;
+}
+}
+</style>
+<p class=c1><a href=#reports>1. Reports</a></p>
+<p class=c2><a href=#callgraph>1.1 Context-Sensitive Call Graph</a></p>
+<p class=c2><a href=#allbranches>1.2 All branches</a></p>
+<p class=c2><a href=#selectedbranches>1.3 Selected branches</a></p>
+<p class=c1><a href=#tables>2. Tables</a></p>
+<h1 id=reports>1. Reports</h1>
+<h2 id=callgraph>1.1 Context-Sensitive Call Graph</h2>
+The result is a GUI window with a tree representing a context-sensitive
+call-graph. Expanding a couple of levels of the tree and adjusting column
+widths to suit will display something like:
+<pre>
+                                         Call Graph: pt_example
+Call Path                          Object      Count   Time(ns)  Time(%)  Branch Count   Branch Count(%)
+v- ls
+    v- 2638:2638
+        v- _start                  ld-2.19.so    1     10074071   100.0         211135            100.0
+          |- unknown               unknown       1        13198     0.1              1              0.0
+          >- _dl_start             ld-2.19.so    1      1400980    13.9          19637              9.3
+          >- _d_linit_internal     ld-2.19.so    1       448152     4.4          11094              5.3
+          v-__libc_start_main@plt  ls            1      8211741    81.5         180397             85.4
+             >- _dl_fixup          ld-2.19.so    1         7607     0.1            108              0.1
+             >- __cxa_atexit       libc-2.19.so  1        11737     0.1             10              0.0
+             >- __libc_csu_init    ls            1        10354     0.1             10              0.0
+             |- _setjmp            libc-2.19.so  1            0     0.0              4              0.0
+             v- main               ls            1      8182043    99.6         180254             99.9
+</pre>
+<h3>Points to note:</h3>
+<ul>
+<li>The top level is a command name (comm)</li>
+<li>The next level is a thread (pid:tid)</li>
+<li>Subsequent levels are functions</li>
+<li>'Count' is the number of calls</li>
+<li>'Time' is the elapsed time until the function returns</li>
+<li>Percentages are relative to the level above</li>
+<li>'Branch Count' is the total number of branches for that function and all functions that it calls
+</ul>
+<h3>Find</h3>
+Ctrl-F displays a Find bar which finds function names by either an exact match or a pattern match.
+The pattern matching symbols are ? for any character and * for zero or more characters.
+<h2 id=allbranches>1.2 All branches</h2>
+The All branches report displays all branches in chronological order.
+Not all data is fetched immediately. More records can be fetched using the Fetch bar provided.
+<h3>Disassembly</h3>
+Open a branch to display disassembly. This only works if:
+<ol>
+<li>The disassembler is available. Currently, only Intel XED is supported - see <a href=#xed>Intel XED Setup</a></li>
+<li>The object code is available. Currently, only the perf build ID cache is searched for object code.
+The default directory ~/.debug can be overridden by setting environment variable PERF_BUILDID_DIR.
+One exception is kcore where the DSO long name is used (refer dsos_view on the Tables menu),
+or alternatively, set environment variable PERF_KCORE to the kcore file name.</li>
+</ol>
+<h4 id=xed>Intel XED Setup</h4>
+To use Intel XED, libxed.so must be present.  To build and install libxed.so:
+<pre>
+git clone https://github.com/intelxed/mbuild.git mbuild
+git clone https://github.com/intelxed/xed
+cd xed
+./mfile.py --share
+sudo ./mfile.py --prefix=/usr/local install
+sudo ldconfig
+</pre>
+<h3>Find</h3>
+Ctrl-F displays a Find bar which finds substrings by either an exact match or a regular expression match.
+Refer to Python documentation for the regular expression syntax.
+All columns are searched, but only currently fetched rows are searched.
+<h2 id=selectedbranches>1.3 Selected branches</h2>
+This is the same as the <a href=#allbranches>All branches</a> report but with the data reduced
+by various selection criteria. A dialog box displays available criteria which are AND'ed together.
+<h3>1.3.1 Time ranges</h3>
+The time ranges hint text shows the total time range. Relative time ranges can also be entered in
+ms, us or ns. Also, negative values are relative to the end of trace.  Examples:
+<pre>
+        81073085947329-81073085958238   From 81073085947329 to 81073085958238
+        100us-200us             From 100us to 200us
+        10ms-                   From 10ms to the end
+        -100ns                  The first 100ns
+        -10ms-                  The last 10ms
+</pre>
+N.B. Due to the granularity of timestamps, there could be no branches in any given time range.
+<h1 id=tables>2. Tables</h1>
+The Tables menu shows all tables and views in the database. Most tables have an associated view
+which displays the information in a more friendly way. Not all data for large tables is fetched
+immediately. More records can be fetched using the Fetch bar provided. Columns can be sorted,
+but that can be slow for large tables.
+<p>There are also tables of database meta-information.
+For SQLite3 databases, the sqlite_master table is included.
+For PostgreSQL databases, information_schema.tables/views/columns are included.
+<h3>Find</h3>
+Ctrl-F displays a Find bar which finds substrings by either an exact match or a regular expression match.
+Refer to Python documentation for the regular expression syntax.
+All columns are searched, but only currently fetched rows are searched.
+<p>N.B. Results are found in id order, so if the table is re-ordered, find-next and find-previous
+will go to the next/previous result in id order, instead of display order.
+"""
+
+# Help window
+
+class HelpWindow(QMdiSubWindow):
+
+        def __init__(self, glb, parent=None):
+                super(HelpWindow, self).__init__(parent)
+
+                self.text = QTextBrowser()
+                self.text.setHtml(glb_help_text)
+                self.text.setReadOnly(True)
+                self.text.setOpenExternalLinks(True)
+
+                self.setWidget(self.text)
+
+                AddSubWindow(glb.mainwindow.mdi_area, self, "Exported SQL Viewer Help")
+
+# Main window that only displays the help text
+
+class HelpOnlyWindow(QMainWindow):
+
+        def __init__(self, parent=None):
+                super(HelpOnlyWindow, self).__init__(parent)
+
+                self.setMinimumSize(200, 100)
+                self.resize(800, 600)
+                self.setWindowTitle("Exported SQL Viewer Help")
+                self.setWindowIcon(self.style().standardIcon(QStyle.SP_MessageBoxInformation))
+
+                self.text = QTextBrowser()
+                self.text.setHtml(glb_help_text)
+                self.text.setReadOnly(True)
+                self.text.setOpenExternalLinks(True)
+
+                self.setCentralWidget(self.text)
+
 # Font resize
 
 def ResizeFont(widget, diff):
@@ -1851,6 +2313,9 @@ class MainWindow(QMainWindow):
 
                 self.window_menu = WindowMenu(self.mdi_area, menu)
 
+                help_menu = menu.addMenu("&Help")
+                help_menu.addAction(CreateAction("&Exported SQL Viewer Help", "Helpful information", self.Help, self, QKeySequence.HelpContents))
+
         def Find(self):
                 win = self.mdi_area.activeSubWindow()
                 if win:
@@ -1888,6 +2353,8 @@ class MainWindow(QMainWindow):
                         if event == "branches":
                                 label = "All branches" if branches_events == 1 else "All branches " + "(id=" + dbid + ")"
                                 reports_menu.addAction(CreateAction(label, "Create a new window displaying branch events", lambda x=dbid: self.NewBranchView(x), self))
+                                label = "Selected branches" if branches_events == 1 else "Selected branches " + "(id=" + dbid + ")"
+                                reports_menu.addAction(CreateAction(label, "Create a new window displaying branch events", lambda x=dbid: self.NewSelectedBranchView(x), self))
 
         def TableMenu(self, tables, menu):
                 table_menu = menu.addMenu("&Tables")
@@ -1900,9 +2367,18 @@ class MainWindow(QMainWindow):
         def NewBranchView(self, event_id):
                 BranchWindow(self.glb, event_id, "", "", self)
 
+        def NewSelectedBranchView(self, event_id):
+                dialog = SelectedBranchDialog(self.glb, self)
+                ret = dialog.exec_()
+                if ret:
+                        BranchWindow(self.glb, event_id, dialog.name, dialog.where_clause, self)
+
         def NewTableView(self, table_name):
                 TableWindow(self.glb, table_name, self)
 
+        def Help(self):
+                HelpWindow(self.glb, self)
+
 # XED Disassembler
 
 class xed_state_t(Structure):
@@ -1929,7 +2405,12 @@ class XEDInstruction():
 class LibXED():
 
         def __init__(self):
-                self.libxed = CDLL("libxed.so")
+                try:
+                        self.libxed = CDLL("libxed.so")
+                except:
+                        self.libxed = None
+                if not self.libxed:
+                        self.libxed = CDLL("/usr/local/lib/libxed.so")
 
                 self.xed_tables_init = self.libxed.xed_tables_init
                 self.xed_tables_init.restype = None
@@ -2097,10 +2578,16 @@ class DBRef():
 
 def Main():
         if (len(sys.argv) < 2):
-                print >> sys.stderr, "Usage is: exported-sql-viewer.py <database name>"
+                print >> sys.stderr, "Usage is: exported-sql-viewer.py {<database name> | --help-only}"
                 raise Exception("Too few arguments")
 
         dbname = sys.argv[1]
+        if dbname == "--help-only":
+                app = QApplication(sys.argv)
+                mainwindow = HelpOnlyWindow()
+                mainwindow.show()
+                err = app.exec_()
+                sys.exit(err)
 
         is_sqlite3 = False
         try:
diff --git a/tools/perf/tests/attr/base-record b/tools/perf/tests/attr/base-record
index 37940665f736..efd0157b9d22 100644
--- a/tools/perf/tests/attr/base-record
+++ b/tools/perf/tests/attr/base-record
@@ -9,7 +9,7 @@ size=112
 config=0
 sample_period=*
 sample_type=263
-read_format=0
+read_format=0|4
 disabled=1
 inherit=1
 pinned=0
diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
index 8a33ca4f9e1f..f0729c454f16 100644
--- a/tools/perf/tests/attr/test-record-group-sampling
+++ b/tools/perf/tests/attr/test-record-group-sampling
@@ -37,4 +37,3 @@ sample_freq=0
 sample_period=0
 freq=0
 write_backward=0
-sample_id_all=0
diff --git a/tools/perf/trace/beauty/ioctl.c b/tools/perf/trace/beauty/ioctl.c
index 5d2a7fd8d407..eae59ad15ce3 100644
--- a/tools/perf/trace/beauty/ioctl.c
+++ b/tools/perf/trace/beauty/ioctl.c
@@ -31,6 +31,7 @@ static size_t ioctl__scnprintf_tty_cmd(int nr, int dir, char *bf, size_t size)
         "TCSETSW2", "TCSETSF2", "TIOCGRS48", "TIOCSRS485", "TIOCGPTN", "TIOCSPTLCK",
         "TIOCGDEV", "TCSETX", "TCSETXF", "TCSETXW", "TIOCSIG", "TIOCVHANGUP", "TIOCGPKT",
         "TIOCGPTLCK", [_IOC_NR(TIOCGEXCL)] = "TIOCGEXCL", "TIOCGPTPEER",
+        "TIOCGISO7816", "TIOCSISO7816",
         [_IOC_NR(FIONCLEX)] = "FIONCLEX", "FIOCLEX", "FIOASYNC", "TIOCSERCONFIG",
         "TIOCSERGWILD", "TIOCSERSWILD", "TIOCGLCKTRMIOS", "TIOCSLCKTRMIOS",
         "TIOCSERGSTRUCT", "TIOCSERGETLSR", "TIOCSERGETMULTI", "TIOCSERSETMULTI",
diff --git a/tools/perf/util/Build b/tools/perf/util/Build
index ecd9f9ceda77..b7bf201fe8a8 100644
--- a/tools/perf/util/Build
+++ b/tools/perf/util/Build
@@ -10,6 +10,7 @@ libperf-y += evlist.o
 libperf-y += evsel.o
 libperf-y += evsel_fprintf.o
 libperf-y += find_bit.o
+libperf-y += get_current_dir_name.o
 libperf-y += kallsyms.o
 libperf-y += levenshtein.o
 libperf-y += llvm-utils.o
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index e88e6f9b1463..668d2a9ef0f4 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -1810,3 +1810,30 @@ void perf_evlist__force_leader(struct perf_evlist *evlist)
                 leader->forced_leader = true;
         }
 }
+
+struct perf_evsel *perf_evlist__reset_weak_group(struct perf_evlist *evsel_list,
+                                                 struct perf_evsel *evsel)
+{
+        struct perf_evsel *c2, *leader;
+        bool is_open = true;
+
+        leader = evsel->leader;
+        pr_debug("Weak group for %s/%d failed\n",
+                        leader->name, leader->nr_members);
+
+        /*
+         * for_each_group_member doesn't work here because it doesn't
+         * include the first entry.
+         */
+        evlist__for_each_entry(evsel_list, c2) {
+                if (c2 == evsel)
+                        is_open = false;
+                if (c2->leader == leader) {
+                        if (is_open)
+                                perf_evsel__close(c2);
+                        c2->leader = c2;
+                        c2->nr_members = 0;
+                }
+        }
+        return leader;
+}
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index dc66436add98..9919eed6d15b 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -312,4 +312,7 @@ bool perf_evlist__exclude_kernel(struct perf_evlist *evlist);
 
 void perf_evlist__force_leader(struct perf_evlist *evlist);
 
+struct perf_evsel *perf_evlist__reset_weak_group(struct perf_evlist *evlist,
+                                                 struct perf_evsel *evsel);
+
 #endif /* __PERF_EVLIST_H */
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 6d187059a373..dbc0466db368 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -956,7 +956,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
                 attr->sample_freq    = 0;
                 attr->sample_period  = 0;
                 attr->write_backward = 0;
-                attr->sample_id_all  = 0;
         }
 
         if (opts->no_samples)
@@ -1093,7 +1092,7 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
                 attr->exclude_user   = 1;
         }
 
-        if (evsel->own_cpus)
+        if (evsel->own_cpus || evsel->unit)
                 evsel->attr.read_format |= PERF_FORMAT_ID;
 
         /*
diff --git a/tools/perf/util/get_current_dir_name.c b/tools/perf/util/get_current_dir_name.c
new file mode 100644
index 000000000000..267aa609a582
--- /dev/null
+++ b/tools/perf/util/get_current_dir_name.c
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (C) 2018, Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com>
+//
+#ifndef HAVE_GET_CURRENT_DIR_NAME
+#include "util.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdlib.h>
+
+/* Android's 'bionic' library, for one, doesn't have this */
+
+char *get_current_dir_name(void)
+{
+        char pwd[PATH_MAX];
+
+        return getcwd(pwd, sizeof(pwd)) == NULL ? NULL : strdup(pwd);
+}
+#endif // HAVE_GET_CURRENT_DIR_NAME
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index 58f6a9ceb590..4503f3ca45ab 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -1474,6 +1474,8 @@ static void intel_pt_calc_mtc_timestamp(struct intel_pt_decoder *decoder)
                 decoder->have_calc_cyc_to_tsc = false;
                 intel_pt_calc_cyc_to_tsc(decoder, true);
         }
+
+        intel_pt_log_to("Setting timestamp", decoder->timestamp);
 }
 
 static void intel_pt_calc_cbr(struct intel_pt_decoder *decoder)
@@ -1514,6 +1516,8 @@ static void intel_pt_calc_cyc_timestamp(struct intel_pt_decoder *decoder)
                 decoder->timestamp = timestamp;
 
         decoder->timestamp_insn_cnt = 0;
+
+        intel_pt_log_to("Setting timestamp", decoder->timestamp);
 }
 
 /* Walk PSB+ packets when already in sync. */
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-log.c b/tools/perf/util/intel-pt-decoder/intel-pt-log.c
index e02bc7b166a0..5e64da270f97 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-log.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-log.c
@@ -31,6 +31,11 @@ static FILE *f;
 static char log_name[MAX_LOG_NAME];
 bool intel_pt_enable_logging;
 
+void *intel_pt_log_fp(void)
+{
+        return f;
+}
+
 void intel_pt_log_enable(void)
 {
         intel_pt_enable_logging = true;
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-log.h b/tools/perf/util/intel-pt-decoder/intel-pt-log.h
index 45b64f93f358..cc084937f701 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-log.h
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-log.h
@@ -22,6 +22,7 @@
 
 struct intel_pt_pkt;
 
+void *intel_pt_log_fp(void);
 void intel_pt_log_enable(void);
 void intel_pt_log_disable(void);
 void intel_pt_log_set_name(const char *name);
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 86cc9a64e982..149ff361ca78 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -206,6 +206,16 @@ static void intel_pt_dump_event(struct intel_pt *pt, unsigned char *buf,
         intel_pt_dump(pt, buf, len);
 }
 
+static void intel_pt_log_event(union perf_event *event)
+{
+        FILE *f = intel_pt_log_fp();
+
+        if (!intel_pt_enable_logging || !f)
+                return;
+
+        perf_event__fprintf(event, f);
+}
+
 static int intel_pt_do_fix_overlap(struct intel_pt *pt, struct auxtrace_buffer *a,
                                    struct auxtrace_buffer *b)
 {
@@ -2010,9 +2020,9 @@ static int intel_pt_process_event(struct perf_session *session,
                  event->header.type == PERF_RECORD_SWITCH_CPU_WIDE)
                 err = intel_pt_context_switch(pt, event, sample);
 
-        intel_pt_log("event %s (%u): cpu %d time %"PRIu64" tsc %#"PRIx64"\n",
-                     perf_event__name(event->header.type), event->header.type,
-                     sample->cpu, sample->time, timestamp);
+        intel_pt_log("event %u: cpu %d time %"PRIu64" tsc %#"PRIx64" ",
+                     event->header.type, sample->cpu, sample->time, timestamp);
+        intel_pt_log_event(event);
 
         return err;
 }
diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c
index cf8bd123cf73..aed170bd4384 100644
--- a/tools/perf/util/namespaces.c
+++ b/tools/perf/util/namespaces.c
@@ -18,6 +18,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <asm/bug.h>
 
 struct namespaces *namespaces__new(struct namespaces_event *event)
 {
@@ -186,6 +187,7 @@ void nsinfo__mountns_enter(struct nsinfo *nsi,
         char curpath[PATH_MAX];
         int oldns = -1;
         int newns = -1;
+        char *oldcwd = NULL;
 
         if (nc == NULL)
                 return;
@@ -199,9 +201,13 @@ void nsinfo__mountns_enter(struct nsinfo *nsi,
         if (snprintf(curpath, PATH_MAX, "/proc/self/ns/mnt") >= PATH_MAX)
                 return;
 
+        oldcwd = get_current_dir_name();
+        if (!oldcwd)
+                return;
+
         oldns = open(curpath, O_RDONLY);
         if (oldns < 0)
-                return;
+                goto errout;
 
         newns = open(nsi->mntns_path, O_RDONLY);
         if (newns < 0)
@@ -210,11 +216,13 @@ void nsinfo__mountns_enter(struct nsinfo *nsi,
         if (setns(newns, CLONE_NEWNS) < 0)
                 goto errout;
 
+        nc->oldcwd = oldcwd;
         nc->oldns = oldns;
         nc->newns = newns;
         return;
 
 errout:
+        free(oldcwd);
         if (oldns > -1)
                 close(oldns);
         if (newns > -1)
@@ -223,11 +231,16 @@ errout:
 
 void nsinfo__mountns_exit(struct nscookie *nc)
 {
-        if (nc == NULL || nc->oldns == -1 || nc->newns == -1)
+        if (nc == NULL || nc->oldns == -1 || nc->newns == -1 || !nc->oldcwd)
                 return;
 
         setns(nc->oldns, CLONE_NEWNS);
 
+        if (nc->oldcwd) {
+                WARN_ON_ONCE(chdir(nc->oldcwd));
+                zfree(&nc->oldcwd);
+        }
+
         if (nc->oldns > -1) {
                 close(nc->oldns);
                 nc->oldns = -1;
diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h
index cae1a9a39722..d5f46c09ea31 100644
--- a/tools/perf/util/namespaces.h
+++ b/tools/perf/util/namespaces.h
@@ -38,6 +38,7 @@ struct nsinfo {
 struct nscookie {
         int                     oldns;
         int                     newns;
+        char                    *oldcwd;
 };
 
 int nsinfo__init(struct nsinfo *nsi);
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 7799788f662f..7e49baad304d 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -773,7 +773,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
 
                 if (!is_arm_pmu_core(name)) {
                         pname = pe->pmu ? pe->pmu : "cpu";
-                        if (strncmp(pname, name, strlen(pname)))
+                        if (strcmp(pname, name))
                                 continue;
                 }
 
diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
index 14508ee7707a..ece040b799f6 100644
--- a/tools/perf/util/util.h
+++ b/tools/perf/util/util.h
@@ -59,6 +59,10 @@ int fetch_kernel_version(unsigned int *puint,
 
 const char *perf_tip(const char *dirpath);
 
+#ifndef HAVE_GET_CURRENT_DIR_NAME
+char *get_current_dir_name(void);
+#endif
+
 #ifndef HAVE_SCHED_GETCPU_SUPPORT
 int sched_getcpu(void);
 #endif
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 1dd5f4fcffd5..db66a952c173 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -129,7 +129,7 @@ WARNINGS += $(call cc-supports,-Wno-pointer-sign)
 WARNINGS += $(call cc-supports,-Wdeclaration-after-statement)
 WARNINGS += -Wshadow
 
-CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
+override CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
                 -DPACKAGE_BUGREPORT=\"$(PACKAGE_BUGREPORT)\" -D_GNU_SOURCE
 
 UTIL_OBJS =  utils/helpers/amd.o utils/helpers/msr.o \
@@ -156,12 +156,12 @@ LIB_SRC = 	lib/cpufreq.c lib/cpupower.c lib/cpuidle.c
 LIB_OBJS =      lib/cpufreq.o lib/cpupower.o lib/cpuidle.o
 LIB_OBJS :=     $(addprefix $(OUTPUT),$(LIB_OBJS))
 
-CFLAGS +=       -pipe
+override CFLAGS +=      -pipe
 
 ifeq ($(strip $(NLS)),true)
         INSTALL_NLS += install-gmo
         COMPILE_NLS += create-gmo
-        CFLAGS += -DNLS
+        override CFLAGS += -DNLS
 endif
 
 ifeq ($(strip $(CPUFREQ_BENCH)),true)
@@ -175,7 +175,7 @@ ifeq ($(strip $(STATIC)),true)
         UTIL_SRC += $(LIB_SRC)
 endif
 
-CFLAGS += $(WARNINGS)
+override CFLAGS += $(WARNINGS)
 
 ifeq ($(strip $(V)),false)
         QUIET=@
@@ -188,10 +188,10 @@ export QUIET ECHO
 
 # if DEBUG is enabled, then we do not strip or optimize
 ifeq ($(strip $(DEBUG)),true)
-        CFLAGS += -O1 -g -DDEBUG
+        override CFLAGS += -O1 -g -DDEBUG
         STRIPCMD = /bin/true -Since_we_are_debugging
 else
-        CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
+        override CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
         STRIPCMD = $(STRIP) -s --remove-section=.note --remove-section=.comment
 endif
 
diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
index d79ab161cc75..f68b4bc55273 100644
--- a/tools/power/cpupower/bench/Makefile
+++ b/tools/power/cpupower/bench/Makefile
@@ -9,7 +9,7 @@ endif
 ifeq ($(strip $(STATIC)),true)
 LIBS = -L../ -L$(OUTPUT) -lm
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \
-       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o
+       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o
 else
 LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index 59af84b8ef45..b1b6c43644e7 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -13,10 +13,10 @@ INSTALL = /usr/bin/install
 default: all
 
 $(OUTPUT)centrino-decode: ../i386/centrino-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 $(OUTPUT)powernow-k8-decode: ../i386/powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 all: $(OUTPUT)centrino-decode $(OUTPUT)powernow-k8-decode
 
diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c
index 1b993fe1ce23..0c0f3e3f0d80 100644
--- a/tools/power/cpupower/lib/cpufreq.c
+++ b/tools/power/cpupower/lib/cpufreq.c
@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s",
                          cpu, fname);
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 /* helper function to write a new value to a /sys file */
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index 9bd4c7655fdb..852d25462388 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname);
 
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 
diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
index 9c395ec924de..9711d628b0f4 100644
--- a/tools/power/cpupower/lib/cpupower.c
+++ b/tools/power/cpupower/lib/cpupower.c
@@ -15,7 +15,7 @@
 #include "cpupower.h"
 #include "cpupower_intern.h"
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen)
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen)
 {
         int fd;
         ssize_t numread;
@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s",
                          cpu, fname);
-        if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0)
+        if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
                 return -1;
         *result = strtol(linebuf, &endp, 0);
         if (endp == linebuf || errno == ERANGE)
diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h
index 92affdfbe417..4887c76d23f8 100644
--- a/tools/power/cpupower/lib/cpupower_intern.h
+++ b/tools/power/cpupower/lib/cpupower_intern.h
@@ -3,4 +3,4 @@
 #define MAX_LINE_LEN 4096
 #define SYSFS_PATH_MAX 255
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen);
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index 9527d47a1070..01ec04bf91b5 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -140,8 +140,8 @@ static u32 handle[] = {
         [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
 };
 
-static unsigned long dimm_fail_cmd_flags[NUM_DCR];
-static int dimm_fail_cmd_code[NUM_DCR];
+static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)];
+static int dimm_fail_cmd_code[ARRAY_SIZE(handle)];
 
 static const struct nd_intel_smart smart_def = {
         .flags = ND_INTEL_SMART_HEALTH_VALID
@@ -205,7 +205,7 @@ struct nfit_test {
                 unsigned long deadline;
                 spinlock_t lock;
         } ars_state;
-        struct device *dimm_dev[NUM_DCR];
+        struct device *dimm_dev[ARRAY_SIZE(handle)];
         struct nd_intel_smart *smart;
         struct nd_intel_smart_threshold *smart_threshold;
         struct badrange badrange;
@@ -2680,7 +2680,7 @@ static int nfit_test_probe(struct platform_device *pdev)
                 u32 nfit_handle = __to_nfit_memdev(nfit_mem)->device_handle;
                 int i;
 
-                for (i = 0; i < NUM_DCR; i++)
+                for (i = 0; i < ARRAY_SIZE(handle); i++)
                         if (nfit_handle == handle[i])
                                 dev_set_drvdata(nfit_test->dimm_dev[i],
                                                 nfit_mem);
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index f1fe492c8e17..f0017c831e57 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -24,6 +24,7 @@ TARGETS += memory-hotplug
 TARGETS += mount
 TARGETS += mqueue
 TARGETS += net
+TARGETS += netfilter
 TARGETS += nsfs
 TARGETS += powerpc
 TARGETS += proc
diff --git a/tools/testing/selftests/bpf/test_netcnt.c b/tools/testing/selftests/bpf/test_netcnt.c
index 7887df693399..44ed7f29f8ab 100644
--- a/tools/testing/selftests/bpf/test_netcnt.c
+++ b/tools/testing/selftests/bpf/test_netcnt.c
@@ -81,7 +81,10 @@ int main(int argc, char **argv)
                 goto err;
         }
 
-        assert(system("ping localhost -6 -c 10000 -f -q > /dev/null") == 0);
+        if (system("which ping6 &>/dev/null") == 0)
+                assert(!system("ping6 localhost -c 10000 -f -q > /dev/null"));
+        else
+                assert(!system("ping -6 localhost -c 10000 -f -q > /dev/null"));
 
         if (bpf_prog_query(cgroup_fd, BPF_CGROUP_INET_EGRESS, 0, NULL, NULL,
                            &prog_cnt)) {
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 6f61df62f690..550b7e46bf4a 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -13896,6 +13896,25 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
                 .result = ACCEPT,
         },
+        {
+                "calls: ctx read at start of subprog",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
+                        BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
+                .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
new file mode 100644
index 000000000000..47ed6cef93fb
--- /dev/null
+++ b/tools/testing/selftests/netfilter/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+# Makefile for netfilter selftests
+
+TEST_PROGS := nft_trans_stress.sh
+
+include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
new file mode 100644
index 000000000000..1017313e41a8
--- /dev/null
+++ b/tools/testing/selftests/netfilter/config
@@ -0,0 +1,2 @@
+CONFIG_NET_NS=y
+NF_TABLES_INET=y
diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
new file mode 100755
index 000000000000..f1affd12c4b1
--- /dev/null
+++ b/tools/testing/selftests/netfilter/nft_trans_stress.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+#
+# This test is for stress-testing the nf_tables config plane path vs.
+# packet path processing: Make sure we never release rules that are
+# still visible to other cpus.
+#
+# set -e
+
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+testns=testns1
+tables="foo bar baz quux"
+
+nft --version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without nft tool"
+        exit $ksft_skip
+fi
+
+ip -Version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without ip tool"
+        exit $ksft_skip
+fi
+
+tmp=$(mktemp)
+
+for table in $tables; do
+        echo add table inet "$table" >> "$tmp"
+        echo flush table inet "$table" >> "$tmp"
+
+        echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
+        echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
+        for c in $(seq 1 400); do
+                chain=$(printf "chain%03u" "$c")
+                echo "add chain inet $table $chain" >> "$tmp"
+        done
+
+        for c in $(seq 1 400); do
+                chain=$(printf "chain%03u" "$c")
+                for BASE in INPUT OUTPUT; do
+                        echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
+                done
+                echo "add rule inet $table $chain counter return" >> "$tmp"
+        done
+done
+
+ip netns add "$testns"
+ip -netns "$testns" link set lo up
+
+lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
+cpunum=$((cpunum-1))
+for i in $(seq 0 $cpunum);do
+        mask=$(printf 0x%x $((1<<$i)))
+        ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
+        ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
+done)
+
+sleep 1
+
+for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
+
+for table in $tables;do
+        randsleep=$((RANDOM%10))
+        sleep $randsleep
+        ip netns exec "$testns" nft delete table inet $table 2>/dev/null
+done
+
+randsleep=$((RANDOM%10))
+sleep $randsleep
+
+pkill -9 ping
+
+wait
+
+rm -f "$tmp"
+ip netns del "$testns"
diff --git a/tools/testing/selftests/powerpc/mm/wild_bctr.c b/tools/testing/selftests/powerpc/mm/wild_bctr.c
index 1b0e9e9a2ddc..f2fa101c5a6a 100644
--- a/tools/testing/selftests/powerpc/mm/wild_bctr.c
+++ b/tools/testing/selftests/powerpc/mm/wild_bctr.c
@@ -47,8 +47,9 @@ static int ok(void)
         return 0;
 }
 
-#define REG_POISON      0x5a5aUL
-#define POISONED_REG(n) ((REG_POISON << 48) | ((n) << 32) | (REG_POISON << 16) | (n))
+#define REG_POISON      0x5a5a
+#define POISONED_REG(n) ((((unsigned long)REG_POISON) << 48) | ((n) << 32) | \
+                         (((unsigned long)REG_POISON) << 16) | (n))
 
 static inline void poison_regs(void)
 {
@@ -105,6 +106,20 @@ static void dump_regs(void)
         }
 }
 
+#ifdef _CALL_AIXDESC
+struct opd {
+        unsigned long ip;
+        unsigned long toc;
+        unsigned long env;
+};
+static struct opd bad_opd = {
+        .ip = BAD_NIP,
+};
+#define BAD_FUNC (&bad_opd)
+#else
+#define BAD_FUNC BAD_NIP
+#endif
+
 int test_wild_bctr(void)
 {
         int (*func_ptr)(void);
@@ -133,7 +148,7 @@ int test_wild_bctr(void)
 
                 poison_regs();
 
-                func_ptr = (int (*)(void))BAD_NIP;
+                func_ptr = (int (*)(void))BAD_FUNC;
                 func_ptr();
 
                 FAIL_IF(1); /* we didn't segv? */
diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c
index 6f1f4a6e1ecb..85744425b08d 100644
--- a/tools/testing/selftests/proc/proc-self-map-files-002.c
+++ b/tools/testing/selftests/proc/proc-self-map-files-002.c
@@ -13,7 +13,7 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
-/* Test readlink /proc/self/map_files/... with address 0. */
+/* Test readlink /proc/self/map_files/... with minimum address. */
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -47,6 +47,11 @@ static void fail(const char *fmt, unsigned long a, unsigned long b)
 int main(void)
 {
         const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
+#ifdef __arm__
+        unsigned long va = 2 * PAGE_SIZE;
+#else
+        unsigned long va = 0;
+#endif
         void *p;
         int fd;
         unsigned long a, b;
@@ -55,7 +60,7 @@ int main(void)
         if (fd == -1)
                 return 1;
 
-        p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
+        p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
         if (p == MAP_FAILED) {
                 if (errno == EPERM)
                         return 2;
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index 87a04a8a5945..7607ba3e3cbe 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -134,9 +134,9 @@ def exec_cmd(args, pm, stage, command):
     (rawout, serr) = proc.communicate()
 
     if proc.returncode != 0 and len(serr) > 0:
-        foutput = serr.decode("utf-8")
+        foutput = serr.decode("utf-8", errors="ignore")
     else:
-        foutput = rawout.decode("utf-8")
+        foutput = rawout.decode("utf-8", errors="ignore")
 
     proc.stdout.close()
     proc.stderr.close()
@@ -169,6 +169,8 @@ def prepare_env(args, pm, stage, prefix, cmdlist, output = None):
                   file=sys.stderr)
             print("\n{} *** Error message: \"{}\"".format(prefix, foutput),
                   file=sys.stderr)
+            print("returncode {}; expected {}".format(proc.returncode,
+                                                      exit_codes))
             print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr)
             print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr)
             print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr)
@@ -195,12 +197,18 @@ def run_one_test(pm, args, index, tidx):
         print('-----> execute stage')
     pm.call_pre_execute()
     (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"])
-    exit_code = p.returncode
+    if p:
+        exit_code = p.returncode
+    else:
+        exit_code = None
+
     pm.call_post_execute()
 
-    if (exit_code != int(tidx["expExitCode"])):
+    if (exit_code is None or exit_code != int(tidx["expExitCode"])):
         result = False
-        print("exit:", exit_code, int(tidx["expExitCode"]))
+        print("exit: {!r}".format(exit_code))
+        print("exit: {}".format(int(tidx["expExitCode"])))
+        #print("exit: {!r} {}".format(exit_code, int(tidx["expExitCode"])))
         print(procout)
     else:
         if args.verbose > 0: