639 files changed, 7490 insertions, 3917 deletions

diff --git a/CREDITS b/CREDITS
index 84cbec4c6211..c9273393fe14 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2204,6 +2204,10 @@ S: Post Office Box 371
 S: North Little Rock, Arkansas 72115
 S: USA
 
+N: Christopher Li
+E: sparse@chrisli.org
+D: Sparse maintainer 2009 - 2018
+
 N: Stephan Linz
 E: linz@mazet.de
 E: Stephan.Linz@gmx.de
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 5463d5a4d85c..aefd358a5ca3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3505,6 +3505,10 @@
                         before loading.
                         See Documentation/blockdev/ramdisk.txt.
 
+        psi=            [KNL] Enable or disable pressure stall information
+                        tracking.
+                        Format: <bool>
+
         psmouse.proto=  [HW,MOUSE] Highest PS2 mouse protocol extension to
                         probe for; one of (bare|imps|exps|lifebook|any).
         psmouse.rate=   [HW,MOUSE] Set desired mouse report rate, in reports
@@ -4195,9 +4199,13 @@
 
         spectre_v2=     [X86] Control mitigation of Spectre variant 2
                         (indirect branch speculation) vulnerability.
+                        The default operation protects the kernel from
+                        user space attacks.
 
-                        on   - unconditionally enable
-                        off  - unconditionally disable
+                        on   - unconditionally enable, implies
+                               spectre_v2_user=on
+                        off  - unconditionally disable, implies
+                               spectre_v2_user=off
                         auto - kernel detects whether your CPU model is
                                vulnerable
 
@@ -4207,6 +4215,12 @@
                         CONFIG_RETPOLINE configuration option, and the
                         compiler with which the kernel was built.
 
+                        Selecting 'on' will also enable the mitigation
+                        against user space to user space task attacks.
+
+                        Selecting 'off' will disable both the kernel and
+                        the user space protections.
+
                         Specific mitigations can also be selected manually:
 
                         retpoline         - replace indirect branches
@@ -4216,6 +4230,48 @@
                         Not specifying this option is equivalent to
                         spectre_v2=auto.
 
+        spectre_v2_user=
+                        [X86] Control mitigation of Spectre variant 2
+                        (indirect branch speculation) vulnerability between
+                        user space tasks
+
+                        on      - Unconditionally enable mitigations. Is
+                                  enforced by spectre_v2=on
+
+                        off     - Unconditionally disable mitigations. Is
+                                  enforced by spectre_v2=off
+
+                        prctl   - Indirect branch speculation is enabled,
+                                  but mitigation can be enabled via prctl
+                                  per thread.  The mitigation control state
+                                  is inherited on fork.
+
+                        prctl,ibpb
+                                - Like "prctl" above, but only STIBP is
+                                  controlled per thread. IBPB is issued
+                                  always when switching between different user
+                                  space processes.
+
+                        seccomp
+                                - Same as "prctl" above, but all seccomp
+                                  threads will enable the mitigation unless
+                                  they explicitly opt out.
+
+                        seccomp,ibpb
+                                - Like "seccomp" above, but only STIBP is
+                                  controlled per thread. IBPB is issued
+                                  always when switching between different
+                                  user space processes.
+
+                        auto    - Kernel selects the mitigation depending on
+                                  the available CPU features and vulnerability.
+
+                        Default mitigation:
+                        If CONFIG_SECCOMP=y then "seccomp", otherwise "prctl"
+
+                        Not specifying this option is equivalent to
+                        spectre_v2_user=auto.
+
         spec_store_bypass_disable=
                         [HW] Control Speculative Store Bypass (SSB) Disable mitigation
                         (Speculative Store Bypass vulnerability)
@@ -4714,6 +4770,8 @@
                                         prevent spurious wakeup);
                                 n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a
                                         pause after every control message);
+                                o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra
+                                        delay after resetting its port);
                         Example: quirks=0781:5580:bk,0a5c:5834:gij
 
         usbhid.mousepoll=
diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
index 164bf71149fd..30187d49dc2c 100644
--- a/Documentation/admin-guide/security-bugs.rst
+++ b/Documentation/admin-guide/security-bugs.rst
@@ -32,16 +32,17 @@ Disclosure and embargoed information
 The security list is not a disclosure channel.  For that, see Coordination
 below.
 
-Once a robust fix has been developed, our preference is to release the
-fix in a timely fashion, treating it no differently than any of the other
-thousands of changes and fixes the Linux kernel project releases every
-month.
-
-However, at the request of the reporter, we will postpone releasing the
-fix for up to 5 business days after the date of the report or after the
-embargo has lifted; whichever comes first.  The only exception to that
-rule is if the bug is publicly known, in which case the preference is to
-release the fix as soon as it's available.
+Once a robust fix has been developed, the release process starts.  Fixes
+for publicly known bugs are released immediately.
+
+Although our preference is to release fixes for publicly undisclosed bugs
+as soon as they become available, this may be postponed at the request of
+the reporter or an affected party for up to 7 calendar days from the start
+of the release process, with an exceptional extension to 14 calendar days
+if it is agreed that the criticality of the bug requires more time.  The
+only valid reason for deferring the publication of a fix is to accommodate
+the logistics of QA and large scale rollouts which require release
+coordination.
 
 Whilst embargoed information may be shared with trusted individuals in
 order to develop a fix, such information will not be published alongside
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index 76ccded8b74c..8f9577621144 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -57,6 +57,7 @@ stable kernels.
 | ARM            | Cortex-A73      | #858921         | ARM64_ERRATUM_858921        |
 | ARM            | Cortex-A55      | #1024718        | ARM64_ERRATUM_1024718       |
 | ARM            | Cortex-A76      | #1188873        | ARM64_ERRATUM_1188873       |
+| ARM            | Cortex-A76      | #1286807        | ARM64_ERRATUM_1286807       |
 | ARM            | MMU-500         | #841119,#826419 | N/A                         |
 |                |                 |                 |                             |
 | Cavium         | ThunderX ITS    | #22375, #24313  | CAVIUM_ERRATUM_22375        |
diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index a4e705108f42..dbe96cb5558e 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -74,7 +74,8 @@ using :c:func:`xa_load`.  xa_store will overwrite any entry with the
 new entry and return the previous entry stored at that index.  You can
 use :c:func:`xa_erase` instead of calling :c:func:`xa_store` with a
 ``NULL`` entry.  There is no difference between an entry that has never
-been stored to and one that has most recently had ``NULL`` stored to it.
+been stored to, one that has been erased and one that has most recently
+had ``NULL`` stored to it.
 
 You can conditionally replace an entry at an index by using
 :c:func:`xa_cmpxchg`.  Like :c:func:`cmpxchg`, it will only succeed if
@@ -105,23 +106,44 @@ may result in the entry being marked at some, but not all of the other
 indices.  Storing into one index may result in the entry retrieved by
 some, but not all of the other indices changing.
 
+Sometimes you need to ensure that a subsequent call to :c:func:`xa_store`
+will not need to allocate memory.  The :c:func:`xa_reserve` function
+will store a reserved entry at the indicated index.  Users of the normal
+API will see this entry as containing ``NULL``.  If you do not need to
+use the reserved entry, you can call :c:func:`xa_release` to remove the
+unused entry.  If another user has stored to the entry in the meantime,
+:c:func:`xa_release` will do nothing; if instead you want the entry to
+become ``NULL``, you should use :c:func:`xa_erase`.
+
+If all entries in the array are ``NULL``, the :c:func:`xa_empty` function
+will return ``true``.
+
 Finally, you can remove all entries from an XArray by calling
 :c:func:`xa_destroy`.  If the XArray entries are pointers, you may wish
 to free the entries first.  You can do this by iterating over all present
 entries in the XArray using the :c:func:`xa_for_each` iterator.
 
-ID assignment
--------------
+Allocating XArrays
+------------------
+
+If you use :c:func:`DEFINE_XARRAY_ALLOC` to define the XArray, or
+initialise it by passing ``XA_FLAGS_ALLOC`` to :c:func:`xa_init_flags`,
+the XArray changes to track whether entries are in use or not.
 
 You can call :c:func:`xa_alloc` to store the entry at any unused index
 in the XArray.  If you need to modify the array from interrupt context,
 you can use :c:func:`xa_alloc_bh` or :c:func:`xa_alloc_irq` to disable
-interrupts while allocating the ID.  Unlike :c:func:`xa_store`, allocating
-a ``NULL`` pointer does not delete an entry.  Instead it reserves an
-entry like :c:func:`xa_reserve` and you can release it using either
-:c:func:`xa_erase` or :c:func:`xa_release`.  To use ID assignment, the
-XArray must be defined with :c:func:`DEFINE_XARRAY_ALLOC`, or initialised
-by passing ``XA_FLAGS_ALLOC`` to :c:func:`xa_init_flags`,
+interrupts while allocating the ID.
+
+Using :c:func:`xa_store`, :c:func:`xa_cmpxchg` or :c:func:`xa_insert`
+will mark the entry as being allocated.  Unlike a normal XArray, storing
+``NULL`` will mark the entry as being in use, like :c:func:`xa_reserve`.
+To free an entry, use :c:func:`xa_erase` (or :c:func:`xa_release` if
+you only want to free the entry if it's ``NULL``).
+
+You cannot use ``XA_MARK_0`` with an allocating XArray as this mark
+is used to track whether an entry is free or not.  The other marks are
+available for your use.
 
 Memory allocation
 -----------------
@@ -158,6 +180,8 @@ Takes RCU read lock:
 
 Takes xa_lock internally:
  * :c:func:`xa_store`
+ * :c:func:`xa_store_bh`
+ * :c:func:`xa_store_irq`
  * :c:func:`xa_insert`
  * :c:func:`xa_erase`
  * :c:func:`xa_erase_bh`
@@ -167,6 +191,9 @@ Takes xa_lock internally:
  * :c:func:`xa_alloc`
  * :c:func:`xa_alloc_bh`
  * :c:func:`xa_alloc_irq`
+ * :c:func:`xa_reserve`
+ * :c:func:`xa_reserve_bh`
+ * :c:func:`xa_reserve_irq`
  * :c:func:`xa_destroy`
  * :c:func:`xa_set_mark`
  * :c:func:`xa_clear_mark`
@@ -177,6 +204,7 @@ Assumes xa_lock held on entry:
  * :c:func:`__xa_erase`
  * :c:func:`__xa_cmpxchg`
  * :c:func:`__xa_alloc`
+ * :c:func:`__xa_reserve`
  * :c:func:`__xa_set_mark`
  * :c:func:`__xa_clear_mark`
 
@@ -234,7 +262,8 @@ Sharing the XArray with interrupt context is also possible, either
 using :c:func:`xa_lock_irqsave` in both the interrupt handler and process
 context, or :c:func:`xa_lock_irq` in process context and :c:func:`xa_lock`
 in the interrupt handler.  Some of the more common patterns have helper
-functions such as :c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
+functions such as :c:func:`xa_store_bh`, :c:func:`xa_store_irq`,
+:c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
 
 Sometimes you need to protect access to the XArray with a mutex because
 that lock sits above another mutex in the locking hierarchy.  That does
@@ -322,7 +351,8 @@ to :c:func:`xas_retry`, and retry the operation if it returns ``true``.
      - :c:func:`xa_is_zero`
      - Zero entries appear as ``NULL`` through the Normal API, but occupy
        an entry in the XArray which can be used to reserve the index for
-       future use.
+       future use.  This is used by allocating XArrays for allocated entries
+       which are ``NULL``.
 
 Other internal entries may be added in the future.  As far as possible, they
 will be handled by :c:func:`xas_retry`.
diff --git a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
index 903a78da65be..3a9926f99937 100644
--- a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+++ b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
@@ -17,7 +17,7 @@ Example:
                 reg = <1>;
                 clocks = <&clk32m>;
                 interrupt-parent = <&gpio4>;
-                interrupts = <13 IRQ_TYPE_EDGE_RISING>;
+                interrupts = <13 IRQ_TYPE_LEVEL_HIGH>;
                 vdd-supply = <&reg5v0>;
                 xceiver-supply = <&reg5v0>;
         };
diff --git a/Documentation/devicetree/bindings/net/can/rcar_can.txt b/Documentation/devicetree/bindings/net/can/rcar_can.txt
index cc4372842bf3..9936b9ee67c3 100644
--- a/Documentation/devicetree/bindings/net/can/rcar_can.txt
+++ b/Documentation/devicetree/bindings/net/can/rcar_can.txt
@@ -5,6 +5,7 @@ Required properties:
 - compatible: "renesas,can-r8a7743" if CAN controller is a part of R8A7743 SoC.
               "renesas,can-r8a7744" if CAN controller is a part of R8A7744 SoC.
               "renesas,can-r8a7745" if CAN controller is a part of R8A7745 SoC.
+              "renesas,can-r8a774a1" if CAN controller is a part of R8A774A1 SoC.
               "renesas,can-r8a7778" if CAN controller is a part of R8A7778 SoC.
               "renesas,can-r8a7779" if CAN controller is a part of R8A7779 SoC.
               "renesas,can-r8a7790" if CAN controller is a part of R8A7790 SoC.
@@ -14,26 +15,32 @@ Required properties:
               "renesas,can-r8a7794" if CAN controller is a part of R8A7794 SoC.
               "renesas,can-r8a7795" if CAN controller is a part of R8A7795 SoC.
               "renesas,can-r8a7796" if CAN controller is a part of R8A7796 SoC.
+              "renesas,can-r8a77965" if CAN controller is a part of R8A77965 SoC.
               "renesas,rcar-gen1-can" for a generic R-Car Gen1 compatible device.
               "renesas,rcar-gen2-can" for a generic R-Car Gen2 or RZ/G1
               compatible device.
-              "renesas,rcar-gen3-can" for a generic R-Car Gen3 compatible device.
+              "renesas,rcar-gen3-can" for a generic R-Car Gen3 or RZ/G2
+              compatible device.
               When compatible with the generic version, nodes must list the
               SoC-specific version corresponding to the platform first
               followed by the generic version.
 
 - reg: physical base address and size of the R-Car CAN register map.
 - interrupts: interrupt specifier for the sole interrupt.
-- clocks: phandles and clock specifiers for 3 CAN clock inputs.
-- clock-names: 3 clock input name strings: "clkp1", "clkp2", "can_clk".
+- clocks: phandles and clock specifiers for 2 CAN clock inputs for RZ/G2
+          devices.
+          phandles and clock specifiers for 3 CAN clock inputs for every other
+          SoC.
+- clock-names: 2 clock input name strings for RZ/G2: "clkp1", "can_clk".
+               3 clock input name strings for every other SoC: "clkp1", "clkp2",
+               "can_clk".
 - pinctrl-0: pin control group to be used for this controller.
 - pinctrl-names: must be "default".
 
-Required properties for "renesas,can-r8a7795" and "renesas,can-r8a7796"
-compatible:
-In R8A7795 and R8A7796 SoCs, "clkp2" can be CANFD clock. This is a div6 clock
-and can be used by both CAN and CAN FD controller at the same time. It needs to
-be scaled to maximum frequency if any of these controllers use it. This is done
+Required properties for R8A7795, R8A7796 and R8A77965:
+For the denoted SoCs, "clkp2" can be CANFD clock. This is a div6 clock and can
+be used by both CAN and CAN FD controller at the same time. It needs to be
+scaled to maximum frequency if any of these controllers use it. This is done
 using the below properties:
 
 - assigned-clocks: phandle of clkp2(CANFD) clock.
@@ -42,8 +49,9 @@ using the below properties:
 Optional properties:
 - renesas,can-clock-select: R-Car CAN Clock Source Select. Valid values are:
                             <0x0> (default) : Peripheral clock (clkp1)
-                            <0x1> : Peripheral clock (clkp2)
-                            <0x3> : Externally input clock
+                            <0x1> : Peripheral clock (clkp2) (not supported by
+                                    RZ/G2 devices)
+                            <0x3> : External input clock
 
 Example
 -------
diff --git a/Documentation/devicetree/bindings/net/dsa/dsa.txt b/Documentation/devicetree/bindings/net/dsa/dsa.txt
index 3ceeb8de1196..35694c0c376b 100644
--- a/Documentation/devicetree/bindings/net/dsa/dsa.txt
+++ b/Documentation/devicetree/bindings/net/dsa/dsa.txt
@@ -7,7 +7,7 @@ limitations.
 Current Binding
 ---------------
 
-Switches are true Linux devices and can be probes by any means. Once
+Switches are true Linux devices and can be probed by any means. Once
 probed, they register to the DSA framework, passing a node
 pointer. This node is expected to fulfil the following binding, and
 may contain additional properties as required by the device it is
diff --git a/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt b/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt
index adf20b2bdf71..fbc198d5dd39 100644
--- a/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt
+++ b/Documentation/devicetree/bindings/phy/qcom-qmp-phy.txt
@@ -40,24 +40,36 @@ Required properties:
                 "ref" for 19.2 MHz ref clk,
                 "com_aux" for phy common block aux clock,
                 "ref_aux" for phy reference aux clock,
+
+                For "qcom,ipq8074-qmp-pcie-phy": no clocks are listed.
                 For "qcom,msm8996-qmp-pcie-phy" must contain:
                         "aux", "cfg_ahb", "ref".
                 For "qcom,msm8996-qmp-usb3-phy" must contain:
                         "aux", "cfg_ahb", "ref".
-                For "qcom,qmp-v3-usb3-phy" must contain:
+                For "qcom,sdm845-qmp-usb3-phy" must contain:
+                        "aux", "cfg_ahb", "ref", "com_aux".
+                For "qcom,sdm845-qmp-usb3-uni-phy" must contain:
                         "aux", "cfg_ahb", "ref", "com_aux".
+                For "qcom,sdm845-qmp-ufs-phy" must contain:
+                        "ref", "ref_aux".
 
  - resets: a list of phandles and reset controller specifier pairs,
            one for each entry in reset-names.
  - reset-names: "phy" for reset of phy block,
                 "common" for phy common block reset,
-                "cfg" for phy's ahb cfg block reset (Optional).
+                "cfg" for phy's ahb cfg block reset.
+
+                For "qcom,ipq8074-qmp-pcie-phy" must contain:
+                        "phy", "common".
                 For "qcom,msm8996-qmp-pcie-phy" must contain:
-                 "phy", "common", "cfg".
+                        "phy", "common", "cfg".
                 For "qcom,msm8996-qmp-usb3-phy" must contain
-                 "phy", "common".
-                For "qcom,ipq8074-qmp-pcie-phy" must contain:
-                 "phy", "common".
+                        "phy", "common".
+                For "qcom,sdm845-qmp-usb3-phy" must contain:
+                        "phy", "common".
+                For "qcom,sdm845-qmp-usb3-uni-phy" must contain:
+                        "phy", "common".
+                For "qcom,sdm845-qmp-ufs-phy": no resets are listed.
 
  - vdda-phy-supply: Phandle to a regulator supply to PHY core block.
  - vdda-pll-supply: Phandle to 1.8V regulator supply to PHY refclk pll block.
@@ -79,9 +91,10 @@ Required properties for child node:
 
  - #phy-cells: must be 0
 
+Required properties child node of pcie and usb3 qmp phys:
  - clocks: a list of phandles and clock-specifier pairs,
            one for each entry in clock-names.
- - clock-names: Must contain following for pcie and usb qmp phys:
+ - clock-names: Must contain following:
                  "pipe<lane-number>" for pipe clock specific to each lane.
  - clock-output-names: Name of the PHY clock that will be the parent for
                        the above pipe clock.
@@ -91,9 +104,11 @@ Required properties for child node:
                         (or)
                   "pcie20_phy1_pipe_clk"
 
+Required properties for child node of PHYs with lane reset, AKA:
+        "qcom,msm8996-qmp-pcie-phy"
  - resets: a list of phandles and reset controller specifier pairs,
            one for each entry in reset-names.
- - reset-names: Must contain following for pcie qmp phys:
+ - reset-names: Must contain following:
                  "lane<lane-number>" for reset specific to each lane.
 
 Example:
diff --git a/Documentation/devicetree/bindings/spi/spi-uniphier.txt b/Documentation/devicetree/bindings/spi/spi-uniphier.txt
index 504a4ecfc7b1..b04e66a52de5 100644
--- a/Documentation/devicetree/bindings/spi/spi-uniphier.txt
+++ b/Documentation/devicetree/bindings/spi/spi-uniphier.txt
@@ -5,18 +5,20 @@ UniPhier SoCs have SCSSI which supports SPI single channel.
 Required properties:
  - compatible: should be "socionext,uniphier-scssi"
  - reg: address and length of the spi master registers
- - #address-cells: must be <1>, see spi-bus.txt
- - #size-cells: must be <0>, see spi-bus.txt
- - clocks: A phandle to the clock for the device.
- - resets: A phandle to the reset control for the device.
+ - interrupts: a single interrupt specifier
+ - pinctrl-names: should be "default"
+ - pinctrl-0: pin control state for the default mode
+ - clocks: a phandle to the clock for the device
+ - resets: a phandle to the reset control for the device
 
 Example:
 
 spi0: spi@54006000 {
         compatible = "socionext,uniphier-scssi";
         reg = <0x54006000 0x100>;
-        #address-cells = <1>;
-        #size-cells = <0>;
+        interrupts = <0 39 4>;
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_spi0>;
         clocks = <&peri_clk 11>;
         resets = <&peri_rst 11>;
 };
diff --git a/Documentation/input/event-codes.rst b/Documentation/input/event-codes.rst
index cef220c176a4..a8c0873beb95 100644
--- a/Documentation/input/event-codes.rst
+++ b/Documentation/input/event-codes.rst
@@ -190,16 +190,7 @@ A few EV_REL codes have special meanings:
 * REL_WHEEL, REL_HWHEEL:
 
   - These codes are used for vertical and horizontal scroll wheels,
-    respectively. The value is the number of "notches" moved on the wheel, the
-    physical size of which varies by device. For high-resolution wheels (which
-    report multiple events for each notch of movement, or do not have notches)
-    this may be an approximation based on the high-resolution scroll events.
-
-* REL_WHEEL_HI_RES:
-
-  - If a vertical scroll wheel supports high-resolution scrolling, this code
-    will be emitted in addition to REL_WHEEL. The value is the (approximate)
-    distance travelled by the user's finger, in microns.
+    respectively.
 
 EV_ABS
 ------
diff --git a/Documentation/media/uapi/v4l/dev-meta.rst b/Documentation/media/uapi/v4l/dev-meta.rst
index f7ac8d0d3af1..b65dc078abeb 100644
--- a/Documentation/media/uapi/v4l/dev-meta.rst
+++ b/Documentation/media/uapi/v4l/dev-meta.rst
@@ -40,7 +40,7 @@ To use the :ref:`format` ioctls applications set the ``type`` field of the
 the desired operation. Both drivers and applications must set the remainder of
 the :c:type:`v4l2_format` structure to 0.
 
-.. _v4l2-meta-format:
+.. c:type:: v4l2_meta_format
 
 .. tabularcolumns:: |p{1.4cm}|p{2.2cm}|p{13.9cm}|
 
diff --git a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
index 3ead350e099f..9ea494a8faca 100644
--- a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
+++ b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
@@ -133,6 +133,11 @@ The format as returned by :ref:`VIDIOC_TRY_FMT <VIDIOC_G_FMT>` must be identical
       - Definition of a data format, see :ref:`pixfmt`, used by SDR
         capture and output devices.
     * -
+      - struct :c:type:`v4l2_meta_format`
+      - ``meta``
+      - Definition of a metadata format, see :ref:`meta-formats`, used by
+        metadata capture devices.
+    * -
       - __u8
       - ``raw_data``\ [200]
       - Place holder for future extensions.
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 605e00cdd6be..89f1302d593a 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -1056,18 +1056,23 @@ The kernel interface functions are as follows:
 
         u32 rxrpc_kernel_check_life(struct socket *sock,
                                     struct rxrpc_call *call);
+        void rxrpc_kernel_probe_life(struct socket *sock,
+                                     struct rxrpc_call *call);
 
-     This returns a number that is updated when ACKs are received from the peer
-     (notably including PING RESPONSE ACKs which we can elicit by sending PING
-     ACKs to see if the call still exists on the server).  The caller should
-     compare the numbers of two calls to see if the call is still alive after
-     waiting for a suitable interval.
+     The first function returns a number that is updated when ACKs are received
+     from the peer (notably including PING RESPONSE ACKs which we can elicit by
+     sending PING ACKs to see if the call still exists on the server).  The
+     caller should compare the numbers of two calls to see if the call is still
+     alive after waiting for a suitable interval.
 
      This allows the caller to work out if the server is still contactable and
      if the call is still alive on the server whilst waiting for the server to
      process a client operation.
 
-     This function may transmit a PING ACK.
+     The second function causes a ping ACK to be transmitted to try to provoke
+     the peer into responding, which would then cause the value returned by the
+     first function to change.  Note that this must be called in TASK_RUNNING
+     state.
 
  (*) Get reply timestamp.
 
diff --git a/Documentation/userspace-api/spec_ctrl.rst b/Documentation/userspace-api/spec_ctrl.rst
index 32f3d55c54b7..c4dbe6f7cdae 100644
--- a/Documentation/userspace-api/spec_ctrl.rst
+++ b/Documentation/userspace-api/spec_ctrl.rst
@@ -92,3 +92,12 @@ Speculation misfeature controls
    * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0);
    * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
    * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0);
+
+- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes
+                        (Mitigate Spectre V2 style attacks against user processes)
+
+  Invocations:
+   * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0);
+   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0);
+   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0);
+   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index 7727db8f94bc..5e9b826b5f62 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -61,18 +61,6 @@ Protocol 2.12:	(Kernel 3.8) Added the xloadflags field and extension fields
                 to struct boot_params for loading bzImage and ramdisk
                 above 4G in 64bit.
 
-Protocol 2.13:  (Kernel 3.14) Support 32- and 64-bit flags being set in
-                xloadflags to support booting a 64-bit kernel from 32-bit
-                EFI
-
-Protocol 2.14:  (Kernel 4.20) Added acpi_rsdp_addr holding the physical
-                address of the ACPI RSDP table.
-                The bootloader updates version with:
-                0x8000 | min(kernel-version, bootloader-version)
-                kernel-version being the protocol version supported by
-                the kernel and bootloader-version the protocol version
-                supported by the bootloader.
-
 **** MEMORY LAYOUT
 
 The traditional memory map for the kernel loader, used for Image or
@@ -209,7 +197,6 @@ Offset	Proto	Name		Meaning
 0258/8  2.10+   pref_address    Preferred loading address
 0260/4  2.10+   init_size       Linear memory required during initialization
 0264/4  2.11+   handover_offset Offset of handover entry point
-0268/8  2.14+   acpi_rsdp_addr  Physical address of RSDP table
 
 (1) For backwards compatibility, if the setup_sects field contains 0, the
     real value is 4.
@@ -322,7 +309,7 @@ Protocol:	2.00+
   Contains the magic number "HdrS" (0x53726448).
 
 Field name:     version
-Type:           modify
+Type:           read
 Offset/size:    0x206/2
 Protocol:       2.00+
 
@@ -330,12 +317,6 @@ Protocol:	2.00+
   e.g. 0x0204 for version 2.04, and 0x0a11 for a hypothetical version
   10.17.
 
-  Up to protocol version 2.13 this information is only read by the
-  bootloader. From protocol version 2.14 onwards the bootloader will
-  write the used protocol version or-ed with 0x8000 to the field. The
-  used protocol version will be the minimum of the supported protocol
-  versions of the bootloader and the kernel.
-
 Field name:     realmode_swtch
 Type:           modify (optional)
 Offset/size:    0x208/4
@@ -763,17 +744,6 @@ Offset/size:	0x264/4
 
   See EFI HANDOVER PROTOCOL below for more details.
 
-Field name:     acpi_rsdp_addr
-Type:           write
-Offset/size:    0x268/8
-Protocol:       2.14+
-
-  This field can be set by the boot loader to tell the kernel the
-  physical address of the ACPI RSDP table.
-
-  A value of 0 indicates the kernel should fall back to the standard
-  methods to locate the RSDP.
-
 
 **** THE IMAGE CHECKSUM
 
diff --git a/MAINTAINERS b/MAINTAINERS
index b755a89fa325..6682420421c1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -180,6 +180,7 @@ F:	drivers/net/hamradio/6pack.c
 
 8169 10/100/1000 GIGABIT ETHERNET DRIVER
 M:      Realtek linux nic maintainers <nic_swsd@realtek.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/realtek/r8169.c
@@ -717,7 +718,7 @@ F:	include/linux/mfd/altera-a10sr.h
 F:      include/dt-bindings/reset/altr,rst-mgr-a10sr.h
 
 ALTERA TRIPLE SPEED ETHERNET DRIVER
-M:      Vince Bridgers <vbridger@opensource.altera.com>
+M:      Thor Thayer <thor.thayer@linux.intel.com>
 L:      netdev@vger.kernel.org
 L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
 S:      Maintained
@@ -1922,7 +1923,6 @@ ARM/QUALCOMM SUPPORT
 M:      Andy Gross <andy.gross@linaro.org>
 M:      David Brown <david.brown@linaro.org>
 L:      linux-arm-msm@vger.kernel.org
-L:      linux-soc@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/soc/qcom/
 F:      arch/arm/boot/dts/qcom-*.dts
@@ -2490,7 +2490,7 @@ F:	drivers/net/wireless/ath/*
 ATHEROS ATH5K WIRELESS DRIVER
 M:      Jiri Slaby <jirislaby@gmail.com>
 M:      Nick Kossifidis <mickflemm@gmail.com>
-M:      "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath5k
 S:      Maintained
@@ -2800,7 +2800,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
 Q:      https://patchwork.ozlabs.org/project/netdev/list/?delegate=77147
 S:      Supported
-F:      arch/x86/net/bpf_jit*
+F:      arch/*/net/*
 F:      Documentation/networking/filter.txt
 F:      Documentation/bpf/
 F:      include/linux/bpf*
@@ -2820,6 +2820,67 @@ F:	tools/bpf/
 F:      tools/lib/bpf/
 F:      tools/testing/selftests/bpf/
 
+BPF JIT for ARM
+M:      Shubham Bansal <illusionist.neo@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/arm/net/
+
+BPF JIT for ARM64
+M:      Daniel Borkmann <daniel@iogearbox.net>
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Zi Shen Lim <zlim.lnx@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      arch/arm64/net/
+
+BPF JIT for MIPS (32-BIT AND 64-BIT)
+M:      Paul Burton <paul.burton@mips.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/mips/net/
+
+BPF JIT for NFP NICs
+M:      Jakub Kicinski <jakub.kicinski@netronome.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/ethernet/netronome/nfp/bpf/
+
+BPF JIT for POWERPC (32-BIT AND 64-BIT)
+M:      Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+M:      Sandipan Das <sandipan@linux.ibm.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/powerpc/net/
+
+BPF JIT for S390
+M:      Martin Schwidefsky <schwidefsky@de.ibm.com>
+M:      Heiko Carstens <heiko.carstens@de.ibm.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/s390/net/
+X:      arch/s390/net/pnet.c
+
+BPF JIT for SPARC (32-BIT AND 64-BIT)
+M:      David S. Miller <davem@davemloft.net>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/sparc/net/
+
+BPF JIT for X86 32-BIT
+M:      Wang YanQing <udknight@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      arch/x86/net/bpf_jit_comp32.c
+
+BPF JIT for X86 64-BIT
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      arch/x86/net/
+X:      arch/x86/net/bpf_jit_comp32.c
+
 BROADCOM B44 10/100 ETHERNET DRIVER
 M:      Michael Chan <michael.chan@broadcom.com>
 L:      netdev@vger.kernel.org
@@ -2860,7 +2921,7 @@ F:	drivers/staging/vc04_services
 BROADCOM BCM47XX MIPS ARCHITECTURE
 M:      Hauke Mehrtens <hauke@hauke-m.de>
 M:      Rafał Miłecki <zajec5@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/mips/brcm/
 F:      arch/mips/bcm47xx/*
@@ -2869,7 +2930,6 @@ F:	arch/mips/include/asm/mach-bcm47xx/*
 BROADCOM BCM5301X ARM ARCHITECTURE
 M:      Hauke Mehrtens <hauke@hauke-m.de>
 M:      Rafał Miłecki <zajec5@gmail.com>
-M:      Jon Mason <jonmason@broadcom.com>
 M:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
@@ -2924,7 +2984,7 @@ F:	drivers/cpufreq/bmips-cpufreq.c
 BROADCOM BMIPS MIPS ARCHITECTURE
 M:      Kevin Cernekee <cernekee@gmail.com>
 M:      Florian Fainelli <f.fainelli@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 T:      git git://github.com/broadcom/stblinux.git
 S:      Maintained
 F:      arch/mips/bmips/*
@@ -3015,7 +3075,6 @@ F:	drivers/net/ethernet/broadcom/genet/
 BROADCOM IPROC ARM ARCHITECTURE
 M:      Ray Jui <rjui@broadcom.com>
 M:      Scott Branden <sbranden@broadcom.com>
-M:      Jon Mason <jonmason@broadcom.com>
 M:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 T:      git git://github.com/broadcom/cygnus-linux.git
@@ -3062,7 +3121,7 @@ F:	include/uapi/rdma/bnxt_re-abi.h
 
 BROADCOM NVRAM DRIVER
 M:      Rafał Miłecki <zajec5@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      drivers/firmware/broadcom/*
 
@@ -3276,6 +3335,12 @@ F:	include/uapi/linux/caif/
 F:      include/net/caif/
 F:      net/caif/
 
+CAKE QDISC
+M:      Toke Høiland-Jørgensen <toke@toke.dk>
+L:      cake@lists.bufferbloat.net (moderated for non-subscribers)
+S:      Maintained
+F:      net/sched/sch_cake.c
+
 CALGARY x86-64 IOMMU
 M:      Muli Ben-Yehuda <mulix@mulix.org>
 M:      Jon Mason <jdmason@kudzu.us>
@@ -4158,7 +4223,7 @@ F:	net/decnet/
 
 DECSTATION PLATFORM SUPPORT
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 W:      http://www.linux-mips.org/wiki/DECstation
 S:      Maintained
 F:      arch/mips/dec/
@@ -5249,7 +5314,7 @@ EDAC-CAVIUM OCTEON
 M:      Ralf Baechle <ralf@linux-mips.org>
 M:      David Daney <david.daney@cavium.com>
 L:      linux-edac@vger.kernel.org
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      drivers/edac/octeon_edac*
 
@@ -5528,6 +5593,7 @@ F:	net/bridge/
 ETHERNET PHY LIBRARY
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Florian Fainelli <f.fainelli@gmail.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
@@ -5766,7 +5832,7 @@ F:	include/uapi/linux/firewire*.h
 F:      tools/firewire/
 
 FIRMWARE LOADER (request_firmware)
-M:      Luis R. Rodriguez <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      Documentation/firmware_class/
@@ -6299,6 +6365,7 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
+M:      Bartosz Golaszewski <bgolaszewski@baylibre.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -7436,6 +7503,20 @@ S:	Maintained
 F:      Documentation/fb/intelfb.txt
 F:      drivers/video/fbdev/intelfb/
 
+INTEL GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-ich.c
+F:      drivers/gpio/gpio-intel-mid.c
+F:      drivers/gpio/gpio-lynxpoint.c
+F:      drivers/gpio/gpio-merrifield.c
+F:      drivers/gpio/gpio-ml-ioh.c
+F:      drivers/gpio/gpio-pch.c
+F:      drivers/gpio/gpio-sch.c
+F:      drivers/gpio/gpio-sodaville.c
+
 INTEL GVT-g DRIVERS (Intel GPU Virtualization)
 M:      Zhenyu Wang <zhenyuw@linux.intel.com>
 M:      Zhi Wang <zhi.a.wang@intel.com>
@@ -7446,12 +7527,6 @@ T:	git https://github.com/intel/gvt-linux.git
 S:      Supported
 F:      drivers/gpu/drm/i915/gvt/
 
-INTEL PMIC GPIO DRIVER
-R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-S:      Maintained
-F:      drivers/gpio/gpio-*cove.c
-F:      drivers/gpio/gpio-msic.c
-
 INTEL HID EVENT DRIVER
 M:      Alex Hung <alex.hung@canonical.com>
 L:      platform-driver-x86@vger.kernel.org
@@ -7539,12 +7614,6 @@ W:	https://01.org/linux-acpi
 S:      Supported
 F:      drivers/platform/x86/intel_menlow.c
 
-INTEL MERRIFIELD GPIO DRIVER
-M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-L:      linux-gpio@vger.kernel.org
-S:      Maintained
-F:      drivers/gpio/gpio-merrifield.c
-
 INTEL MIC DRIVERS (mic)
 M:      Sudeep Dutt <sudeep.dutt@intel.com>
 M:      Ashutosh Dixit <ashutosh.dixit@intel.com>
@@ -7577,6 +7646,13 @@ F:	drivers/platform/x86/intel_punit_ipc.c
 F:      arch/x86/include/asm/intel_pmc_ipc.h
 F:      arch/x86/include/asm/intel_punit_ipc.h
 
+INTEL PMIC GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-*cove.c
+F:      drivers/gpio/gpio-msic.c
+
 INTEL MULTIFUNCTION PMIC DEVICE DRIVERS
 R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 S:      Maintained
@@ -7685,7 +7761,7 @@ F:	Documentation/devicetree/bindings/iio/gyroscope/invensense,mpu3050.txt
 
 IOC3 ETHERNET DRIVER
 M:      Ralf Baechle <ralf@linux-mips.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/sgi/ioc3-eth.c
 
@@ -8056,7 +8132,7 @@ F:	tools/testing/selftests/
 F:      Documentation/dev-tools/kselftest*
 
 KERNEL USERMODE HELPER
-M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      kernel/umh.c
@@ -8113,7 +8189,7 @@ F:	arch/arm64/kvm/
 
 KERNEL VIRTUAL MACHINE FOR MIPS (KVM/mips)
 M:      James Hogan <jhogan@kernel.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      arch/mips/include/uapi/asm/kvm*
 F:      arch/mips/include/asm/kvm*
@@ -8232,7 +8308,7 @@ F:	mm/kmemleak.c
 F:      mm/kmemleak-test.c
 
 KMOD KERNEL MODULE LOADER - USERMODE HELPER
-M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      kernel/kmod.c
@@ -8286,7 +8362,7 @@ F:	drivers/net/dsa/lantiq_gswip.c
 
 LANTIQ MIPS ARCHITECTURE
 M:      John Crispin <john@phrozen.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/lantiq
 F:      drivers/soc/lantiq
@@ -8849,7 +8925,7 @@ S:	Maintained
 
 MARDUK (CREATOR CI40) DEVICE TREE SUPPORT
 M:      Rahul Bedarkar <rahulbedarkar89@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/boot/dts/img/pistachio_marduk.dts
 
@@ -9808,7 +9884,7 @@ F:	drivers/dma/at_xdmac.c
 
 MICROSEMI MIPS SOCS
 M:      Alexandre Belloni <alexandre.belloni@bootlin.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/generic/board-ocelot.c
 F:      arch/mips/configs/generic/board-ocelot.config
@@ -9848,7 +9924,7 @@ MIPS
 M:      Ralf Baechle <ralf@linux-mips.org>
 M:      Paul Burton <paul.burton@mips.com>
 M:      James Hogan <jhogan@kernel.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 W:      http://www.linux-mips.org/
 T:      git git://git.linux-mips.org/pub/scm/ralf/linux.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git
@@ -9861,7 +9937,7 @@ F:	drivers/platform/mips/
 
 MIPS BOSTON DEVELOPMENT BOARD
 M:      Paul Burton <paul.burton@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/clock/img,boston-clock.txt
 F:      arch/mips/boot/dts/img/boston.dts
@@ -9871,7 +9947,7 @@ F:	include/dt-bindings/clock/boston-clock.h
 
 MIPS GENERIC PLATFORM
 M:      Paul Burton <paul.burton@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      Documentation/devicetree/bindings/power/mti,mips-cpc.txt
 F:      arch/mips/generic/
@@ -9879,7 +9955,7 @@ F:	arch/mips/tools/generic-board-config.sh
 
 MIPS/LOONGSON1 ARCHITECTURE
 M:      Keguang Zhang <keguang.zhang@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/loongson32/
 F:      arch/mips/include/asm/mach-loongson32/
@@ -9888,7 +9964,7 @@ F:	drivers/*/*/*loongson1*
 
 MIPS/LOONGSON2 ARCHITECTURE
 M:      Jiaxun Yang <jiaxun.yang@flygoat.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/loongson64/fuloong-2e/
 F:      arch/mips/loongson64/lemote-2f/
@@ -9898,7 +9974,7 @@ F:	drivers/*/*/*loongson2*
 
 MIPS/LOONGSON3 ARCHITECTURE
 M:      Huacai Chen <chenhc@lemote.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/loongson64/
 F:      arch/mips/include/asm/mach-loongson64/
@@ -9908,7 +9984,7 @@ F:	drivers/*/*/*loongson3*
 
 MIPS RINT INSTRUCTION EMULATION
 M:      Aleksandar Markovic <aleksandar.markovic@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      arch/mips/math-emu/sp_rint.c
 F:      arch/mips/math-emu/dp_rint.c
@@ -10893,7 +10969,7 @@ F:	include/linux/platform_data/i2c-omap.h
 
 ONION OMEGA2+ BOARD
 M:      Harvey Hunt <harveyhuntnexus@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/boot/dts/ralink/omega2p.dts
 
@@ -11802,7 +11878,7 @@ F:	drivers/pinctrl/spear/
 
 PISTACHIO SOC SUPPORT
 M:      James Hartley <james.hartley@sondrel.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Odd Fixes
 F:      arch/mips/pistachio/
 F:      arch/mips/include/asm/mach-pistachio/
@@ -11982,7 +12058,7 @@ F:	kernel/printk/
 F:      include/linux/printk.h
 
 PRISM54 WIRELESS DRIVER
-M:      "Luis R. Rodriguez" <mcgrof@gmail.com>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/p54
 S:      Obsolete
@@ -11996,9 +12072,10 @@ S:	Maintained
 F:      fs/proc/
 F:      include/linux/proc_fs.h
 F:      tools/testing/selftests/proc/
+F:      Documentation/filesystems/proc.txt
 
 PROC SYSCTL
-M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
+M:      Luis Chamberlain <mcgrof@kernel.org>
 M:      Kees Cook <keescook@chromium.org>
 L:      linux-kernel@vger.kernel.org
 L:      linux-fsdevel@vger.kernel.org
@@ -12461,7 +12538,7 @@ F:	drivers/media/usb/rainshadow-cec/*
 
 RALINK MIPS ARCHITECTURE
 M:      John Crispin <john@phrozen.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/ralink
 
@@ -12481,7 +12558,7 @@ F:	drivers/block/brd.c
 
 RANCHU VIRTUAL BOARD FOR MIPS
 M:      Miodrag Dinic <miodrag.dinic@mips.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Supported
 F:      arch/mips/generic/board-ranchu.c
 F:      arch/mips/configs/generic/board-ranchu.config
@@ -13931,6 +14008,7 @@ S:	Supported
 F:      Documentation/devicetree/bindings/sound/
 F:      Documentation/sound/soc/
 F:      sound/soc/
+F:      include/dt-bindings/sound/
 F:      include/sound/soc*
 
 SOUNDWIRE SUBSYSTEM
@@ -13978,11 +14056,10 @@ F:	drivers/tty/serial/sunzilog.h
 F:      drivers/tty/vcc.c
 
 SPARSE CHECKER
-M:      "Christopher Li" <sparse@chrisli.org>
+M:      "Luc Van Oostenryck" <luc.vanoostenryck@gmail.com>
 L:      linux-sparse@vger.kernel.org
 W:      https://sparse.wiki.kernel.org/
 T:      git git://git.kernel.org/pub/scm/devel/sparse/sparse.git
-T:      git git://git.kernel.org/pub/scm/devel/sparse/chrisl/sparse.git
 S:      Maintained
 F:      include/linux/compiler.h
 
@@ -14079,6 +14156,7 @@ F:	Documentation/devicetree/bindings/iio/proximity/vl53l0x.txt
 
 STABLE BRANCH
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Sasha Levin <sashal@kernel.org>
 L:      stable@vger.kernel.org
 S:      Supported
 F:      Documentation/process/stable-kernel-rules.rst
@@ -15216,7 +15294,7 @@ F:	arch/um/os-Linux/drivers/
 TURBOCHANNEL SUBSYSTEM
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
 M:      Ralf Baechle <ralf@linux-mips.org>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 Q:      http://patchwork.linux-mips.org/project/linux-mips/list/
 S:      Maintained
 F:      drivers/tc/
@@ -16037,7 +16115,7 @@ F:	drivers/net/vmxnet3/
 
 VOCORE VOCORE2 BOARD
 M:      Harvey Hunt <harveyhuntnexus@gmail.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@vger.kernel.org
 S:      Maintained
 F:      arch/mips/boot/dts/ralink/vocore2.dts
 
diff --git a/Makefile b/Makefile
index ddbf627cad8f..e9fd22c8445e 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,8 @@
 VERSION = 4
 PATCHLEVEL = 20
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
-NAME = "People's Front"
+EXTRAVERSION = -rc5
+NAME = Shy Crocodile
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts
index d4d33cd7adad..1e2bb68231ad 100644
--- a/arch/arm/boot/dts/am3517-evm.dts
+++ b/arch/arm/boot/dts/am3517-evm.dts
@@ -228,7 +228,7 @@
         vmmc-supply = <&vmmc_fixed>;
         bus-width = <4>;
         wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>; /* gpio_126 */
-        cd-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>; /* gpio_127 */
+        cd-gpios = <&gpio4 31 GPIO_ACTIVE_LOW>; /* gpio_127 */
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/am3517-som.dtsi b/arch/arm/boot/dts/am3517-som.dtsi
index dae6e458e59f..b1c988eed87c 100644
--- a/arch/arm/boot/dts/am3517-som.dtsi
+++ b/arch/arm/boot/dts/am3517-som.dtsi
@@ -163,7 +163,7 @@
                 compatible = "ti,wl1271";
                 reg = <2>;
                 interrupt-parent = <&gpio6>;
-                interrupts = <10 IRQ_TYPE_LEVEL_HIGH>; /* gpio_170 */
+                interrupts = <10 IRQ_TYPE_EDGE_RISING>; /* gpio_170 */
                 ref-clock-frequency = <26000000>;
                 tcxo-clock-frequency = <26000000>;
         };
diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
index e45a15ceb94b..69d753cac89a 100644
--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
+++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
@@ -492,12 +492,6 @@
         pinctrl-0 = <&pinctrl_i2c2>;
         status = "okay";
 
-        eeprom@50 {
-                compatible = "atmel,24c04";
-                pagesize = <16>;
-                reg = <0x50>;
-        };
-
         hpa1: amp@60 {
                 compatible = "ti,tpa6130a2";
                 reg = <0x60>;
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index ac343330d0c8..98b682a8080c 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -129,7 +129,7 @@
 };
 
 &mmc3 {
-        interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+        interrupts-extended = <&intc 94 &omap3_pmx_core 0x136>;
         pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
         pinctrl-names = "default";
         vmmc-supply = <&wl12xx_vmmc>;
diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
index 9d5d53fbe9c0..c39cf2ca54da 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
@@ -35,7 +35,7 @@
  * jumpering combinations for the long run.
  */
 &mmc3 {
-        interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+        interrupts-extended = <&intc 94 &omap3_pmx_core 0x136>;
         pinctrl-0 = <&mmc3_pins &mmc3_core2_pins>;
         pinctrl-names = "default";
         vmmc-supply = <&wl12xx_vmmc>;
diff --git a/arch/arm/boot/dts/rk3288-veyron.dtsi b/arch/arm/boot/dts/rk3288-veyron.dtsi
index 2075120cfc4d..d8bf939a3aff 100644
--- a/arch/arm/boot/dts/rk3288-veyron.dtsi
+++ b/arch/arm/boot/dts/rk3288-veyron.dtsi
@@ -10,7 +10,11 @@
 #include "rk3288.dtsi"
 
 / {
-        memory@0 {
+        /*
+         * The default coreboot on veyron devices ignores memory@0 nodes
+         * and would instead create another memory node.
+         */
+        memory {
                 device_type = "memory";
                 reg = <0x0 0x0 0x0 0x80000000>;
         };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 843052f14f1c..dd0dda6ed44b 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -314,7 +314,7 @@
                                   0x1 0x0 0x60000000 0x10000000
                                   0x2 0x0 0x70000000 0x10000000
                                   0x3 0x0 0x80000000 0x10000000>;
-                        clocks = <&mck>;
+                        clocks = <&h32ck>;
                         status = "disabled";
 
                         nand_controller: nand-controller {
diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
index 0142fcfcc3d3..bda949fd84e8 100644
--- a/arch/arm/kernel/ftrace.c
+++ b/arch/arm/kernel/ftrace.c
@@ -183,9 +183,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
                            unsigned long frame_pointer)
 {
         unsigned long return_hooker = (unsigned long) &return_to_handler;
-        struct ftrace_graph_ent trace;
         unsigned long old;
-        int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
@@ -193,21 +191,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
         old = *parent;
         *parent = return_hooker;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
+        if (function_graph_enter(old, self_addr, frame_pointer, NULL))
                 *parent = old;
-                return;
-        }
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, NULL);
-        if (err == -EBUSY) {
-                *parent = old;
-                return;
-        }
 }
 
 #ifdef CONFIG_DYNAMIC_FTRACE
diff --git a/arch/arm/mach-davinci/da830.c b/arch/arm/mach-davinci/da830.c
index 0bc5bd2665df..2cc9fe4c3a91 100644
--- a/arch/arm/mach-davinci/da830.c
+++ b/arch/arm/mach-davinci/da830.c
@@ -759,7 +759,9 @@ static struct davinci_id da830_ids[] = {
 };
 
 static struct davinci_gpio_platform_data da830_gpio_platform_data = {
-        .ngpio = 128,
+        .no_auto_base   = true,
+        .base           = 0,
+        .ngpio          = 128,
 };
 
 int __init da830_register_gpio(void)
diff --git a/arch/arm/mach-davinci/da850.c b/arch/arm/mach-davinci/da850.c
index 4528bbf0c861..e7b78df2bfef 100644
--- a/arch/arm/mach-davinci/da850.c
+++ b/arch/arm/mach-davinci/da850.c
@@ -719,7 +719,9 @@ int __init da850_register_vpif_capture(struct vpif_capture_config
 }
 
 static struct davinci_gpio_platform_data da850_gpio_platform_data = {
-        .ngpio = 144,
+        .no_auto_base   = true,
+        .base           = 0,
+        .ngpio          = 144,
 };
 
 int __init da850_register_gpio(void)
diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
index 1fd3619f6a09..cf78da5ab054 100644
--- a/arch/arm/mach-davinci/devices-da8xx.c
+++ b/arch/arm/mach-davinci/devices-da8xx.c
@@ -701,6 +701,46 @@ static struct resource da8xx_gpio_resources[] = {
         },
         { /* interrupt */
                 .start  = IRQ_DA8XX_GPIO0,
+                .end    = IRQ_DA8XX_GPIO0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO1,
+                .end    = IRQ_DA8XX_GPIO1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO2,
+                .end    = IRQ_DA8XX_GPIO2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO3,
+                .end    = IRQ_DA8XX_GPIO3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO4,
+                .end    = IRQ_DA8XX_GPIO4,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO5,
+                .end    = IRQ_DA8XX_GPIO5,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO6,
+                .end    = IRQ_DA8XX_GPIO6,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO7,
+                .end    = IRQ_DA8XX_GPIO7,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DA8XX_GPIO8,
                 .end    = IRQ_DA8XX_GPIO8,
                 .flags  = IORESOURCE_IRQ,
         },
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index 9f7d38d12c88..4c6e0bef4509 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -548,12 +548,44 @@ static struct resource dm355_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_DM355_GPIOBNK0,
+                .end    = IRQ_DM355_GPIOBNK0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK1,
+                .end    = IRQ_DM355_GPIOBNK1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK2,
+                .end    = IRQ_DM355_GPIOBNK2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK3,
+                .end    = IRQ_DM355_GPIOBNK3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK4,
+                .end    = IRQ_DM355_GPIOBNK4,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK5,
+                .end    = IRQ_DM355_GPIOBNK5,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM355_GPIOBNK6,
                 .end    = IRQ_DM355_GPIOBNK6,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm355_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 104,
 };
 
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index abcf2a5ed89b..01fb2b0c82de 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -267,12 +267,49 @@ static struct resource dm365_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_DM365_GPIO0,
+                .end    = IRQ_DM365_GPIO0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO1,
+                .end    = IRQ_DM365_GPIO1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO2,
+                .end    = IRQ_DM365_GPIO2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO3,
+                .end    = IRQ_DM365_GPIO3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO4,
+                .end    = IRQ_DM365_GPIO4,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO5,
+                .end    = IRQ_DM365_GPIO5,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO6,
+                .end    = IRQ_DM365_GPIO6,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM365_GPIO7,
                 .end    = IRQ_DM365_GPIO7,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm365_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 104,
         .gpio_unbanked  = 8,
 };
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 0720da7809a6..38f92b7d413e 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -492,12 +492,34 @@ static struct resource dm644_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_GPIOBNK0,
+                .end    = IRQ_GPIOBNK0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK1,
+                .end    = IRQ_GPIOBNK1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK2,
+                .end    = IRQ_GPIOBNK2,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK3,
+                .end    = IRQ_GPIOBNK3,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_GPIOBNK4,
                 .end    = IRQ_GPIOBNK4,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm644_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 71,
 };
 
diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
index 6bd2ed069d0d..7dc54b2a610f 100644
--- a/arch/arm/mach-davinci/dm646x.c
+++ b/arch/arm/mach-davinci/dm646x.c
@@ -442,12 +442,24 @@ static struct resource dm646x_gpio_resources[] = {
         },
         {       /* interrupt */
                 .start  = IRQ_DM646X_GPIOBNK0,
+                .end    = IRQ_DM646X_GPIOBNK0,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM646X_GPIOBNK1,
+                .end    = IRQ_DM646X_GPIOBNK1,
+                .flags  = IORESOURCE_IRQ,
+        },
+        {
+                .start  = IRQ_DM646X_GPIOBNK2,
                 .end    = IRQ_DM646X_GPIOBNK2,
                 .flags  = IORESOURCE_IRQ,
         },
 };
 
 static struct davinci_gpio_platform_data dm646x_gpio_platform_data = {
+        .no_auto_base   = true,
+        .base           = 0,
         .ngpio          = 43,
 };
 
diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
index 3d191fd52910..17886744dbe6 100644
--- a/arch/arm/mach-omap1/board-ams-delta.c
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -750,6 +750,9 @@ static void modem_pm(struct uart_port *port, unsigned int state, unsigned old)
         struct modem_private_data *priv = port->private_data;
         int ret;
 
+        if (!priv)
+                return;
+
         if (IS_ERR(priv->regulator))
                 return;
 
diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
index 7b95729e8359..38a1be6c3694 100644
--- a/arch/arm/mach-omap2/prm44xx.c
+++ b/arch/arm/mach-omap2/prm44xx.c
@@ -351,7 +351,7 @@ static void omap44xx_prm_reconfigure_io_chain(void)
  * to occur, WAKEUPENABLE bits must be set in the pad mux registers, and
  * omap44xx_prm_reconfigure_io_chain() must be called.  No return value.
  */
-static void __init omap44xx_prm_enable_io_wakeup(void)
+static void omap44xx_prm_enable_io_wakeup(void)
 {
         s32 inst = omap4_prmst_get_prm_dev_inst();
 
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 787d7850e064..ea2ab0330e3a 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -497,6 +497,24 @@ config ARM64_ERRATUM_1188873
 
           If unsure, say Y.
 
+config ARM64_ERRATUM_1286807
+        bool "Cortex-A76: Modification of the translation table for a virtual address might lead to read-after-read ordering violation"
+        default y
+        select ARM64_WORKAROUND_REPEAT_TLBI
+        help
+          This option adds workaround for ARM Cortex-A76 erratum 1286807
+
+          On the affected Cortex-A76 cores (r0p0 to r3p0), if a virtual
+          address for a cacheable mapping of a location is being
+          accessed by a core while another core is remapping the virtual
+          address to a new physical page using the recommended
+          break-before-make sequence, then under very rare circumstances
+          TLBI+DSB completes before a read using the translation being
+          invalidated has been observed by other observers. The
+          workaround repeats the TLBI+DSB operation.
+
+          If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
         bool "Cavium erratum 22375, 24313"
         default y
@@ -566,9 +584,16 @@ config QCOM_FALKOR_ERRATUM_1003
           is unchanged. Work around the erratum by invalidating the walk cache
           entries for the trampoline before entering the kernel proper.
 
+config ARM64_WORKAROUND_REPEAT_TLBI
+        bool
+        help
+          Enable the repeat TLBI workaround for Falkor erratum 1009 and
+          Cortex-A76 erratum 1286807.
+
 config QCOM_FALKOR_ERRATUM_1009
         bool "Falkor E1009: Prematurely complete a DSB after a TLBI"
         default y
+        select ARM64_WORKAROUND_REPEAT_TLBI
         help
           On Falkor v1, the CPU may prematurely complete a DSB following a
           TLBI xxIS invalidate maintenance operation. Repeat the TLBI operation
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
index b4276da1fb0d..11fd1fe8bdb5 100644
--- a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
@@ -241,3 +241,7 @@
                 };
         };
 };
+
+&tlmm {
+        gpio-reserved-ranges = <0 4>, <81 4>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
index eedfaf8922e2..d667eee4e6d0 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
@@ -352,6 +352,10 @@
         status = "okay";
 };
 
+&tlmm {
+        gpio-reserved-ranges = <0 4>, <81 4>;
+};
+
 &uart9 {
         status = "okay";
 };
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
index 2dceeea29b83..1e6a71066c16 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
@@ -153,7 +153,7 @@
 };
 
 &pcie0 {
-        ep-gpios = <&gpio4 RK_PC6 GPIO_ACTIVE_LOW>;
+        ep-gpios = <&gpio4 RK_PC6 GPIO_ACTIVE_HIGH>;
         num-lanes = <4>;
         pinctrl-names = "default";
         pinctrl-0 = <&pcie_clkreqn_cpm>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
index 6c8c4ab044aa..56abbb08c133 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
@@ -57,18 +57,6 @@
                 regulator-always-on;
                 vin-supply = <&vcc_sys>;
         };
-
-        vdd_log: vdd-log {
-                compatible = "pwm-regulator";
-                pwms = <&pwm2 0 25000 0>;
-                regulator-name = "vdd_log";
-                regulator-min-microvolt = <800000>;
-                regulator-max-microvolt = <1400000>;
-                regulator-always-on;
-                regulator-boot-on;
-                vin-supply = <&vcc_sys>;
-        };
-
 };
 
 &cpu_l0 {
diff --git a/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi
index affc3c309353..8d7b47f9dfbf 100644
--- a/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-wakeup.dtsi
@@ -36,7 +36,7 @@
 
         wkup_uart0: serial@42300000 {
                 compatible = "ti,am654-uart";
-                reg = <0x00 0x42300000 0x00 0x100>;
+                reg = <0x42300000 0x100>;
                 reg-shift = <2>;
                 reg-io-width = <4>;
                 interrupts = <GIC_SPI 697 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h
index caa955f10e19..fac54fb050d0 100644
--- a/arch/arm64/include/asm/ftrace.h
+++ b/arch/arm64/include/asm/ftrace.h
@@ -56,6 +56,19 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
 {
         return is_compat_task();
 }
+
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+
+static inline bool arch_syscall_match_sym_name(const char *sym,
+                                               const char *name)
+{
+        /*
+         * Since all syscall functions have __arm64_ prefix, we must skip it.
+         * However, as we described above, we decided to ignore compat
+         * syscalls, so we don't care about __arm64_compat_ prefix here.
+         */
+        return !strcmp(sym + 8, name);
+}
 #endif /* ifndef __ASSEMBLY__ */
 
 #endif /* __ASM_FTRACE_H */
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 0c909c4a932f..842fb9572661 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -468,7 +468,7 @@
                          SCTLR_ELx_SA     | SCTLR_ELx_I    | SCTLR_ELx_WXN | \
                          SCTLR_ELx_DSSBS | ENDIAN_CLEAR_EL2 | SCTLR_EL2_RES0)
 
-#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL2 set/clear bits"
 #endif
 
@@ -509,7 +509,7 @@
                          SCTLR_EL1_UMA | SCTLR_ELx_WXN     | ENDIAN_CLEAR_EL1 |\
                          SCTLR_ELx_DSSBS | SCTLR_EL1_NTWI  | SCTLR_EL1_RES0)
 
-#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL1 set/clear bits"
 #endif
 
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index c3c0387aee18..5dfd23897dea 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -41,14 +41,14 @@
                    ALTERNATIVE("nop\n                   nop",                  \
                                "dsb ish\n               tlbi " #op,            \
                                ARM64_WORKAROUND_REPEAT_TLBI,                   \
-                               CONFIG_QCOM_FALKOR_ERRATUM_1009)                \
+                               CONFIG_ARM64_WORKAROUND_REPEAT_TLBI)            \
                             : : )
 
 #define __TLBI_1(op, arg) asm ("tlbi " #op ", %0\n"                            \
                    ALTERNATIVE("nop\n                   nop",                  \
                                "dsb ish\n               tlbi " #op ", %0",     \
                                ARM64_WORKAROUND_REPEAT_TLBI,                   \
-                               CONFIG_QCOM_FALKOR_ERRATUM_1009)                \
+                               CONFIG_ARM64_WORKAROUND_REPEAT_TLBI)            \
                             : : "r" (arg))
 
 #define __TLBI_N(op, arg, n, ...) __TLBI_##n(op, arg)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index a509e35132d2..6ad715d67df8 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -570,6 +570,20 @@ static const struct midr_range arm64_harden_el2_vectors[] = {
 
 #endif
 
+#ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
+
+static const struct midr_range arm64_repeat_tlbi_cpus[] = {
+#ifdef CONFIG_QCOM_FALKOR_ERRATUM_1009
+        MIDR_RANGE(MIDR_QCOM_FALKOR_V1, 0, 0, 0, 0),
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_1286807
+        MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0),
+#endif
+        {},
+};
+
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #if     defined(CONFIG_ARM64_ERRATUM_826319) || \
         defined(CONFIG_ARM64_ERRATUM_827319) || \
@@ -695,11 +709,11 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                 .matches = is_kryo_midr,
         },
 #endif
-#ifdef CONFIG_QCOM_FALKOR_ERRATUM_1009
+#ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
         {
-                .desc = "Qualcomm Technologies Falkor erratum 1009",
+                .desc = "Qualcomm erratum 1009, ARM erratum 1286807",
                 .capability = ARM64_WORKAROUND_REPEAT_TLBI,
-                ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0),
+                ERRATA_MIDR_RANGE_LIST(arm64_repeat_tlbi_cpus),
         },
 #endif
 #ifdef CONFIG_ARM64_ERRATUM_858921
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index af50064dea51..aec5ecb85737 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1333,7 +1333,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .cpu_enable = cpu_enable_hw_dbm,
         },
 #endif
-#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "CRC32 instructions",
                 .capability = ARM64_HAS_CRC32,
@@ -1343,6 +1342,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .field_pos = ID_AA64ISAR0_CRC32_SHIFT,
                 .min_field_value = 1,
         },
+#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "Speculative Store Bypassing Safe (SSBS)",
                 .capability = ARM64_SSBS,
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 50986e388d2b..57e962290df3 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -216,8 +216,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
 {
         unsigned long return_hooker = (unsigned long)&return_to_handler;
         unsigned long old;
-        struct ftrace_graph_ent trace;
-        int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
@@ -229,18 +227,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
          */
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, NULL);
-        if (err == -EBUSY)
-                return;
-        else
+        if (!function_graph_enter(old, self_addr, frame_pointer, NULL))
                 *parent = return_hooker;
 }
 
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index a6fdaea07c63..89198017e8e6 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -351,7 +351,8 @@ static void build_epilogue(struct jit_ctx *ctx)
  * >0 - successfully JITed a 16-byte eBPF instruction.
  * <0 - failed to JIT.
  */
-static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
+                      bool extra_pass)
 {
         const u8 code = insn->code;
         const u8 dst = bpf2a64[insn->dst_reg];
@@ -625,12 +626,19 @@ emit_cond_jmp:
         case BPF_JMP | BPF_CALL:
         {
                 const u8 r0 = bpf2a64[BPF_REG_0];
-                const u64 func = (u64)__bpf_call_base + imm;
+                bool func_addr_fixed;
+                u64 func_addr;
+                int ret;
 
-                if (ctx->prog->is_func)
-                        emit_addr_mov_i64(tmp, func, ctx);
+                ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass,
+                                            &func_addr, &func_addr_fixed);
+                if (ret < 0)
+                        return ret;
+                if (func_addr_fixed)
+                        /* We can use optimized emission here. */
+                        emit_a64_mov_i64(tmp, func_addr, ctx);
                 else
-                        emit_a64_mov_i64(tmp, func, ctx);
+                        emit_addr_mov_i64(tmp, func_addr, ctx);
                 emit(A64_BLR(tmp), ctx);
                 emit(A64_MOV(1, r0, A64_R(0)), ctx);
                 break;
@@ -753,7 +761,7 @@ emit_cond_jmp:
         return 0;
 }
 
-static int build_body(struct jit_ctx *ctx)
+static int build_body(struct jit_ctx *ctx, bool extra_pass)
 {
         const struct bpf_prog *prog = ctx->prog;
         int i;
@@ -762,7 +770,7 @@ static int build_body(struct jit_ctx *ctx)
                 const struct bpf_insn *insn = &prog->insnsi[i];
                 int ret;
 
-                ret = build_insn(insn, ctx);
+                ret = build_insn(insn, ctx, extra_pass);
                 if (ret > 0) {
                         i++;
                         if (ctx->image == NULL)
@@ -858,7 +866,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
         /* 1. Initial fake pass to compute ctx->idx. */
 
         /* Fake pass to fill in ctx->offset. */
-        if (build_body(&ctx)) {
+        if (build_body(&ctx, extra_pass)) {
                 prog = orig_prog;
                 goto out_off;
         }
@@ -888,7 +896,7 @@ skip_init_ctx:
 
         build_prologue(&ctx, was_classic);
 
-        if (build_body(&ctx)) {
+        if (build_body(&ctx, extra_pass)) {
                 bpf_jit_binary_free(header);
                 prog = orig_prog;
                 goto out_off;
diff --git a/arch/ia64/include/asm/numa.h b/arch/ia64/include/asm/numa.h
index ebef7f40aabb..c5c253cb9bd6 100644
--- a/arch/ia64/include/asm/numa.h
+++ b/arch/ia64/include/asm/numa.h
@@ -59,7 +59,9 @@ extern struct node_cpuid_s node_cpuid[NR_CPUS];
  */
 
 extern u8 numa_slit[MAX_NUMNODES * MAX_NUMNODES];
-#define node_distance(from,to) (numa_slit[(from) * MAX_NUMNODES + (to)])
+#define slit_distance(from,to) (numa_slit[(from) * MAX_NUMNODES + (to)])
+extern int __node_distance(int from, int to);
+#define node_distance(from,to) __node_distance(from, to)
 
 extern int paddr_to_nid(unsigned long paddr);
 
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 1dacbf5e9e09..41eb281709da 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -578,8 +578,8 @@ void __init acpi_numa_fixup(void)
         if (!slit_table) {
                 for (i = 0; i < MAX_NUMNODES; i++)
                         for (j = 0; j < MAX_NUMNODES; j++)
-                                node_distance(i, j) = i == j ? LOCAL_DISTANCE :
-                                                        REMOTE_DISTANCE;
+                                slit_distance(i, j) = i == j ?
+                                        LOCAL_DISTANCE : REMOTE_DISTANCE;
                 return;
         }
 
@@ -592,7 +592,7 @@ void __init acpi_numa_fixup(void)
                         if (!pxm_bit_test(j))
                                 continue;
                         node_to = pxm_to_node(j);
-                        node_distance(node_from, node_to) =
+                        slit_distance(node_from, node_to) =
                             slit_table->entry[i * slit_table->locality_count + j];
                 }
         }
diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c
index 3861d6e32d5f..a03803506b0c 100644
--- a/arch/ia64/mm/numa.c
+++ b/arch/ia64/mm/numa.c
@@ -36,6 +36,12 @@ struct node_cpuid_s node_cpuid[NR_CPUS] =
  */
 u8 numa_slit[MAX_NUMNODES * MAX_NUMNODES];
 
+int __node_distance(int from, int to)
+{
+        return slit_distance(from, to);
+}
+EXPORT_SYMBOL(__node_distance);
+
 /* Identify which cnode a physical address resides on */
 int
 paddr_to_nid(unsigned long paddr)
diff --git a/arch/microblaze/kernel/ftrace.c b/arch/microblaze/kernel/ftrace.c
index d57563c58a26..224eea40e1ee 100644
--- a/arch/microblaze/kernel/ftrace.c
+++ b/arch/microblaze/kernel/ftrace.c
@@ -22,8 +22,7 @@
 void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
 {
         unsigned long old;
-        int faulted, err;
-        struct ftrace_graph_ent trace;
+        int faulted;
         unsigned long return_hooker = (unsigned long)
                                 &return_to_handler;
 
@@ -63,18 +62,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
                 return;
         }
 
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth, 0, NULL);
-        if (err == -EBUSY) {
+        if (function_graph_enter(old, self_addr, 0, NULL))
                 *parent = old;
-                return;
-        }
-
-        trace.func = self_addr;
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
-                *parent = old;
-        }
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig
index 490b12af103c..c52d0efacd14 100644
--- a/arch/mips/configs/cavium_octeon_defconfig
+++ b/arch/mips/configs/cavium_octeon_defconfig
@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_STAGING=y
 CONFIG_OCTEON_ETHERNET=y
+CONFIG_OCTEON_USB=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_RAS=y
 CONFIG_EXT4_FS=y
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 0170602a1e4e..6cf8ffb5367e 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -73,7 +73,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
 #ifdef CONFIG_64BIT
         case 4: case 5: case 6: case 7:
 #ifdef CONFIG_MIPS32_O32
-                if (test_thread_flag(TIF_32BIT_REGS))
+                if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
                         return get_user(*arg, (int *)usp + n);
                 else
 #endif
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 7f3dfdbc3657..b122cbb4aad1 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -322,7 +322,6 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
                            unsigned long fp)
 {
         unsigned long old_parent_ra;
-        struct ftrace_graph_ent trace;
         unsigned long return_hooker = (unsigned long)
             &return_to_handler;
         int faulted, insns;
@@ -369,12 +368,6 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
         if (unlikely(faulted))
                 goto out;
 
-        if (ftrace_push_return_trace(old_parent_ra, self_ra, &trace.depth, fp,
-                                     NULL) == -EBUSY) {
-                *parent_ra_addr = old_parent_ra;
-                return;
-        }
-
         /*
          * Get the recorded ip of the current mcount calling site in the
          * __mcount_loc section, which will be used to filter the function
@@ -382,13 +375,10 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
          */
 
         insns = core_kernel_text(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
-        trace.func = self_ra - (MCOUNT_INSN_SIZE * insns);
+        self_ra -= (MCOUNT_INSN_SIZE * insns);
 
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
+        if (function_graph_enter(old_parent_ra, self_ra, fp, NULL))
                 *parent_ra_addr = old_parent_ra;
-        }
         return;
 out:
         ftrace_graph_stop();
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index ea09ed6a80a9..8c6c48ed786a 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -794,6 +794,7 @@ static void __init arch_mem_init(char **cmdline_p)
 
         /* call board setup routine */
         plat_mem_setup();
+        memblock_set_bottom_up(true);
 
         /*
          * Make sure all kernel memory is in the maps.  The "UP" and
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 0f852e1b5891..15e103c6d799 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2260,10 +2260,8 @@ void __init trap_init(void)
                 unsigned long size = 0x200 + VECTORSPACING*64;
                 phys_addr_t ebase_pa;
 
-                memblock_set_bottom_up(true);
                 ebase = (unsigned long)
                         memblock_alloc_from(size, 1 << fls(size), 0);
-                memblock_set_bottom_up(false);
 
                 /*
                  * Try to ensure ebase resides in KSeg0 if possible.
@@ -2307,6 +2305,7 @@ void __init trap_init(void)
         if (board_ebase_setup)
                 board_ebase_setup();
         per_cpu_trap_init(true);
+        memblock_set_bottom_up(false);
 
         /*
          * Copy the generic exception handlers to their final destination.
diff --git a/arch/mips/loongson64/loongson-3/numa.c b/arch/mips/loongson64/loongson-3/numa.c
index 622761878cd1..60bf0a1cb757 100644
--- a/arch/mips/loongson64/loongson-3/numa.c
+++ b/arch/mips/loongson64/loongson-3/numa.c
@@ -231,6 +231,8 @@ static __init void prom_meminit(void)
                         cpumask_clear(&__node_data[(node)]->cpumask);
                 }
         }
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
+
         for (cpu = 0; cpu < loongson_sysconf.nr_cpus; cpu++) {
                 node = cpu / loongson_sysconf.cores_per_node;
                 if (node >= num_online_nodes())
@@ -248,19 +250,9 @@ static __init void prom_meminit(void)
 
 void __init paging_init(void)
 {
-        unsigned node;
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long  start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
 #ifdef CONFIG_ZONE_DMA32
         zones_size[ZONE_DMA32] = MAX_DMA32_PFN;
 #endif
diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
index 41b71c4352c2..c1ce6f43642b 100644
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -84,7 +84,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = {
 };
 static struct rt2880_pmx_func nd_sd_grp[] = {
         FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15),
-        FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15)
+        FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13)
 };
 
 static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index d8b8444d6795..813d13f92957 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -435,6 +435,7 @@ void __init prom_meminit(void)
 
         mlreset();
         szmem();
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
 
         for (node = 0; node < MAX_COMPACT_NODES; node++) {
                 if (node_online(node)) {
@@ -455,18 +456,8 @@ extern void setup_zero_pages(void);
 void __init paging_init(void)
 {
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
-        unsigned node;
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
         zones_size[ZONE_NORMAL] = max_low_pfn;
         free_area_init_nodes(zones_size);
 }
diff --git a/arch/nds32/kernel/ftrace.c b/arch/nds32/kernel/ftrace.c
index a0a9679ad5de..8a41372551ff 100644
--- a/arch/nds32/kernel/ftrace.c
+++ b/arch/nds32/kernel/ftrace.c
@@ -211,29 +211,15 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
                            unsigned long frame_pointer)
 {
         unsigned long return_hooker = (unsigned long)&return_to_handler;
-        struct ftrace_graph_ent trace;
         unsigned long old;
-        int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
 
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, NULL);
-
-        if (err == -EBUSY)
-                return;
-
-        *parent = return_hooker;
+        if (!function_graph_enter(old, self_addr, frame_pointer, NULL))
+                *parent = return_hooker;
 }
 
 noinline void ftrace_graph_caller(void)
diff --git a/arch/parisc/kernel/ftrace.c b/arch/parisc/kernel/ftrace.c
index 6fa8535d3cce..e46a4157a894 100644
--- a/arch/parisc/kernel/ftrace.c
+++ b/arch/parisc/kernel/ftrace.c
@@ -30,7 +30,6 @@ static void __hot prepare_ftrace_return(unsigned long *parent,
                                         unsigned long self_addr)
 {
         unsigned long old;
-        struct ftrace_graph_ent trace;
         extern int parisc_return_to_handler;
 
         if (unlikely(ftrace_graph_is_dead()))
@@ -41,19 +40,9 @@ static void __hot prepare_ftrace_return(unsigned long *parent,
 
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        if (ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                     0, NULL) == -EBUSY)
-                return;
-
-        /* activate parisc_return_to_handler() as return point */
-        *parent = (unsigned long) &parisc_return_to_handler;
+        if (!function_graph_enter(old, self_addr, 0, NULL))
+                /* activate parisc_return_to_handler() as return point */
+                *parent = (unsigned long) &parisc_return_to_handler;
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
index 4bf051d3e21e..b65c8a34ad6e 100644
--- a/arch/powerpc/kernel/trace/ftrace.c
+++ b/arch/powerpc/kernel/trace/ftrace.c
@@ -950,7 +950,6 @@ int ftrace_disable_ftrace_graph_caller(void)
  */
 unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 {
-        struct ftrace_graph_ent trace;
         unsigned long return_hooker;
 
         if (unlikely(ftrace_graph_is_dead()))
@@ -961,18 +960,8 @@ unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 
         return_hooker = ppc_function_entry(return_to_handler);
 
-        trace.func = ip;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                goto out;
-
-        if (ftrace_push_return_trace(parent, ip, &trace.depth, 0,
-                                     NULL) == -EBUSY)
-                goto out;
-
-        parent = return_hooker;
+        if (!function_graph_enter(parent, ip, 0, NULL))
+                parent = return_hooker;
 out:
         return parent;
 }
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index d65b961661fb..a56f8413758a 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -983,6 +983,7 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
                 ret = kvmhv_enter_nested_guest(vcpu);
                 if (ret == H_INTERRUPT) {
                         kvmppc_set_gpr(vcpu, 3, 0);
+                        vcpu->arch.hcall_needed = 0;
                         return -EINTR;
                 }
                 break;
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 50b129785aee..17482f5de3e2 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -166,7 +166,33 @@ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
         PPC_BLR();
 }
 
-static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func)
+static void bpf_jit_emit_func_call_hlp(u32 *image, struct codegen_context *ctx,
+                                       u64 func)
+{
+#ifdef PPC64_ELF_ABI_v1
+        /* func points to the function descriptor */
+        PPC_LI64(b2p[TMP_REG_2], func);
+        /* Load actual entry point from function descriptor */
+        PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0);
+        /* ... and move it to LR */
+        PPC_MTLR(b2p[TMP_REG_1]);
+        /*
+         * Load TOC from function descriptor at offset 8.
+         * We can clobber r2 since we get called through a
+         * function pointer (so caller will save/restore r2)
+         * and since we don't use a TOC ourself.
+         */
+        PPC_BPF_LL(2, b2p[TMP_REG_2], 8);
+#else
+        /* We can clobber r12 */
+        PPC_FUNC_ADDR(12, func);
+        PPC_MTLR(12);
+#endif
+        PPC_BLRL();
+}
+
+static void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx,
+                                       u64 func)
 {
         unsigned int i, ctx_idx = ctx->idx;
 
@@ -273,7 +299,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 {
         const struct bpf_insn *insn = fp->insnsi;
         int flen = fp->len;
-        int i;
+        int i, ret;
 
         /* Start of epilogue code - will only be valid 2nd pass onwards */
         u32 exit_addr = addrs[flen];
@@ -284,8 +310,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
                 u32 src_reg = b2p[insn[i].src_reg];
                 s16 off = insn[i].off;
                 s32 imm = insn[i].imm;
+                bool func_addr_fixed;
+                u64 func_addr;
                 u64 imm64;
-                u8 *func;
                 u32 true_cond;
                 u32 tmp_idx;
 
@@ -711,23 +738,15 @@ emit_clear:
                 case BPF_JMP | BPF_CALL:
                         ctx->seen |= SEEN_FUNC;
 
-                        /* bpf function call */
-                        if (insn[i].src_reg == BPF_PSEUDO_CALL)
-                                if (!extra_pass)
-                                        func = NULL;
-                                else if (fp->aux->func && off < fp->aux->func_cnt)
-                                        /* use the subprog id from the off
-                                         * field to lookup the callee address
-                                         */
-                                        func = (u8 *) fp->aux->func[off]->bpf_func;
-                                else
-                                        return -EINVAL;
-                        /* kernel helper call */
-                        else
-                                func = (u8 *) __bpf_call_base + imm;
-
-                        bpf_jit_emit_func_call(image, ctx, (u64)func);
+                        ret = bpf_jit_get_func_addr(fp, &insn[i], extra_pass,
+                                                    &func_addr, &func_addr_fixed);
+                        if (ret < 0)
+                                return ret;
 
+                        if (func_addr_fixed)
+                                bpf_jit_emit_func_call_hlp(image, ctx, func_addr);
+                        else
+                                bpf_jit_emit_func_call_rel(image, ctx, func_addr);
                         /* move return value from r3 to BPF_REG_0 */
                         PPC_MR(b2p[BPF_REG_0], 3);
                         break;
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index 4af153a182b0..4b594f2e4f7e 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -71,6 +71,10 @@ KBUILD_CFLAGS += $(call cc-option,-mstrict-align)
 # arch specific predefines for sparse
 CHECKFLAGS += -D__riscv -D__riscv_xlen=$(BITS)
 
+# Default target when executing plain make
+boot            := arch/riscv/boot
+KBUILD_IMAGE    := $(boot)/Image.gz
+
 head-y := arch/riscv/kernel/head.o
 
 core-y += arch/riscv/kernel/ arch/riscv/mm/
@@ -81,4 +85,13 @@ PHONY += vdso_install
 vdso_install:
         $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
 
-all: vmlinux
+all: Image.gz
+
+Image: vmlinux
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+Image.%: Image
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+zinstall install:
+        $(Q)$(MAKE) $(build)=$(boot) $@
diff --git a/arch/riscv/boot/.gitignore b/arch/riscv/boot/.gitignore
new file mode 100644
index 000000000000..8dab0bb6ae66
--- /dev/null
+++ b/arch/riscv/boot/.gitignore
@@ -0,0 +1,2 @@
+Image
+Image.gz
diff --git a/arch/riscv/boot/Makefile b/arch/riscv/boot/Makefile
new file mode 100644
index 000000000000..0990a9fdbe5d
--- /dev/null
+++ b/arch/riscv/boot/Makefile
@@ -0,0 +1,33 @@
+#
+# arch/riscv/boot/Makefile
+#
+# This file is included by the global makefile so that you can add your own
+# architecture-specific flags and dependencies.
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 2018, Anup Patel.
+# Author: Anup Patel <anup@brainfault.org>
+#
+# Based on the ia64 and arm64 boot/Makefile.
+#
+
+OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S
+
+targets := Image
+
+$(obj)/Image: vmlinux FORCE
+        $(call if_changed,objcopy)
+
+$(obj)/Image.gz: $(obj)/Image FORCE
+        $(call if_changed,gzip)
+
+install:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image System.map "$(INSTALL_PATH)"
+
+zinstall:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image.gz System.map "$(INSTALL_PATH)"
diff --git a/arch/riscv/boot/install.sh b/arch/riscv/boot/install.sh
new file mode 100644
index 000000000000..18c39159c0ff
--- /dev/null
+++ b/arch/riscv/boot/install.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+#
+# arch/riscv/boot/install.sh
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 1995 by Linus Torvalds
+#
+# Adapted from code in arch/i386/boot/Makefile by H. Peter Anvin
+# Adapted from code in arch/i386/boot/install.sh by Russell King
+#
+# "make install" script for the RISC-V Linux port
+#
+# Arguments:
+#   $1 - kernel version
+#   $2 - kernel image file
+#   $3 - kernel map file
+#   $4 - default install path (blank if root directory)
+#
+
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
+
+# User may have a custom install script
+if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
+if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
+
+if [ "$(basename $2)" = "Image.gz" ]; then
+# Compressed install
+  echo "Installing compressed kernel"
+  base=vmlinuz
+else
+# Normal install
+  echo "Installing normal kernel"
+  base=vmlinux
+fi
+
+if [ -f $4/$base-$1 ]; then
+  mv $4/$base-$1 $4/$base-$1.old
+fi
+cat $2 > $4/$base-$1
+
+# Install system map file
+if [ -f $4/System.map-$1 ]; then
+  mv $4/System.map-$1 $4/System.map-$1.old
+fi
+cp $3 $4/System.map-$1
diff --git a/arch/riscv/include/asm/module.h b/arch/riscv/include/asm/module.h
index 349df33808c4..cd2af4b013e3 100644
--- a/arch/riscv/include/asm/module.h
+++ b/arch/riscv/include/asm/module.h
@@ -8,6 +8,7 @@
 
 #define MODULE_ARCH_VERMAGIC    "riscv"
 
+struct module;
 u64 module_emit_got_entry(struct module *mod, u64 val);
 u64 module_emit_plt_entry(struct module *mod, u64 val);
 
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index 473cfc84e412..8c3e3e3c8be1 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to,
 static inline unsigned long
 raw_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        return __asm_copy_to_user(to, from, n);
+        return __asm_copy_from_user(to, from, n);
 }
 
 static inline unsigned long
 raw_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        return __asm_copy_from_user(to, from, n);
+        return __asm_copy_to_user(to, from, n);
 }
 
 extern long strncpy_from_user(char *dest, const char __user *src, long count);
diff --git a/arch/riscv/include/asm/unistd.h b/arch/riscv/include/asm/unistd.h
index eff7aa9aa163..fef96f117b4d 100644
--- a/arch/riscv/include/asm/unistd.h
+++ b/arch/riscv/include/asm/unistd.h
@@ -13,10 +13,9 @@
 
 /*
  * There is explicitly no include guard here because this file is expected to
- * be included multiple times.  See uapi/asm/syscalls.h for more info.
+ * be included multiple times.
  */
 
-#define __ARCH_WANT_NEW_STAT
 #define __ARCH_WANT_SYS_CLONE
+
 #include <uapi/asm/unistd.h>
-#include <uapi/asm/syscalls.h>
diff --git a/arch/riscv/include/uapi/asm/syscalls.h b/arch/riscv/include/uapi/asm/unistd.h
index 206dc4b0f6ea..1f3bd3ebbb0d 100644
--- a/arch/riscv/include/uapi/asm/syscalls.h
+++ b/arch/riscv/include/uapi/asm/unistd.h
@@ -1,13 +1,25 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /*
- * Copyright (C) 2017-2018 SiFive
+ * Copyright (C) 2018 David Abdurachmanov <david.abdurachmanov@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * There is explicitly no include guard here because this file is expected to
- * be included multiple times in order to define the syscall macros via
- * __SYSCALL.
- */
+#ifdef __LP64__
+#define __ARCH_WANT_NEW_STAT
+#endif /* __LP64__ */
+
+#include <asm-generic/unistd.h>
 
 /*
  * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
index 3a5a2ee31547..b4a7d4427fbb 100644
--- a/arch/riscv/kernel/cpu.c
+++ b/arch/riscv/kernel/cpu.c
@@ -64,7 +64,7 @@ int riscv_of_processor_hartid(struct device_node *node)
 
 static void print_isa(struct seq_file *f, const char *orig_isa)
 {
-        static const char *ext = "mafdc";
+        static const char *ext = "mafdcsu";
         const char *isa = orig_isa;
         const char *e;
 
@@ -88,11 +88,14 @@ static void print_isa(struct seq_file *f, const char *orig_isa)
         /*
          * Check the rest of the ISA string for valid extensions, printing those
          * we find.  RISC-V ISA strings define an order, so we only print the
-         * extension bits when they're in order.
+         * extension bits when they're in order. Hide the supervisor (S)
+         * extension from userspace as it's not accessible from there.
          */
         for (e = ext; *e != '\0'; ++e) {
                 if (isa[0] == e[0]) {
-                        seq_write(f, isa, 1);
+                        if (isa[0] != 's')
+                                seq_write(f, isa, 1);
+
                         isa++;
                 }
         }
diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
index 1157b6b52d25..c433f6d3dd64 100644
--- a/arch/riscv/kernel/ftrace.c
+++ b/arch/riscv/kernel/ftrace.c
@@ -132,7 +132,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
 {
         unsigned long return_hooker = (unsigned long)&return_to_handler;
         unsigned long old;
-        struct ftrace_graph_ent trace;
         int err;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
@@ -144,17 +143,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
          */
         old = *parent;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        if (!ftrace_graph_entry(&trace))
-                return;
-
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                       frame_pointer, parent);
-        if (err == -EBUSY)
-                return;
-        *parent = return_hooker;
+        if (function_graph_enter(old, self_addr, frame_pointer, parent))
+                *parent = return_hooker;
 }
 
 #ifdef CONFIG_DYNAMIC_FTRACE
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 711190d473d4..fe884cd69abd 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -44,6 +44,16 @@ ENTRY(_start)
         amoadd.w a3, a2, (a3)
         bnez a3, .Lsecondary_start
 
+        /* Clear BSS for flat non-ELF images */
+        la a3, __bss_start
+        la a4, __bss_stop
+        ble a4, a3, clear_bss_done
+clear_bss:
+        REG_S zero, (a3)
+        add a3, a3, RISCV_SZPTR
+        blt a3, a4, clear_bss
+clear_bss_done:
+
         /* Save hart ID and DTB physical address */
         mv s0, a0
         mv s1, a1
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index ece84991609c..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -74,7 +74,7 @@ SECTIONS
                 *(.sbss*)
         }
 
-        BSS_SECTION(0, 0, 0)
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
 
         EXCEPTION_TABLE(0x10)
         NOTES
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 84be7f02d0c2..39b13d71a8fe 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -203,22 +203,13 @@ device_initcall(ftrace_plt_init);
  */
 unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 {
-        struct ftrace_graph_ent trace;
-
         if (unlikely(ftrace_graph_is_dead()))
                 goto out;
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 goto out;
         ip -= MCOUNT_INSN_SIZE;
-        trace.func = ip;
-        trace.depth = current->curr_ret_stack + 1;
-        /* Only trace if the calling function expects to. */
-        if (!ftrace_graph_entry(&trace))
-                goto out;
-        if (ftrace_push_return_trace(parent, ip, &trace.depth, 0,
-                                     NULL) == -EBUSY)
-                goto out;
-        parent = (unsigned long) return_to_handler;
+        if (!function_graph_enter(parent, ip, 0, NULL))
+                parent = (unsigned long) return_to_handler;
 out:
         return parent;
 }
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 74091fd3101e..d5523adeddbf 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -346,6 +346,8 @@ static int __hw_perf_event_init(struct perf_event *event)
                 break;
 
         case PERF_TYPE_HARDWARE:
+                if (is_sampling_event(event))   /* No sampling support */
+                        return -ENOENT;
                 ev = attr->config;
                 /* Count user space (problem-state) only */
                 if (!attr->exclude_user && attr->exclude_kernel) {
diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index 814f26520aa2..6791562779ee 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -131,6 +131,7 @@ void crst_table_downgrade(struct mm_struct *mm)
         }
 
         pgd = mm->pgd;
+        mm_dec_nr_pmds(mm);
         mm->pgd = (pgd_t *) (pgd_val(*pgd) & _REGION_ENTRY_ORIGIN);
         mm->context.asce_limit = _REGION3_SIZE;
         mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
diff --git a/arch/sh/kernel/ftrace.c b/arch/sh/kernel/ftrace.c
index 96dd9f7da250..1b04270e5460 100644
--- a/arch/sh/kernel/ftrace.c
+++ b/arch/sh/kernel/ftrace.c
@@ -321,8 +321,7 @@ int ftrace_disable_ftrace_graph_caller(void)
 void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
 {
         unsigned long old;
-        int faulted, err;
-        struct ftrace_graph_ent trace;
+        int faulted;
         unsigned long return_hooker = (unsigned long)&return_to_handler;
 
         if (unlikely(ftrace_graph_is_dead()))
@@ -365,18 +364,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
                 return;
         }
 
-        err = ftrace_push_return_trace(old, self_addr, &trace.depth, 0, NULL);
-        if (err == -EBUSY) {
+        if (function_graph_enter(old, self_addr, 0, NULL))
                 __raw_writel(old, parent);
-                return;
-        }
-
-        trace.func = self_addr;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
-                __raw_writel(old, parent);
-        }
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/sparc/kernel/ftrace.c b/arch/sparc/kernel/ftrace.c
index 915dda4ae412..684b84ce397f 100644
--- a/arch/sparc/kernel/ftrace.c
+++ b/arch/sparc/kernel/ftrace.c
@@ -126,20 +126,11 @@ unsigned long prepare_ftrace_return(unsigned long parent,
                                     unsigned long frame_pointer)
 {
         unsigned long return_hooker = (unsigned long) &return_to_handler;
-        struct ftrace_graph_ent trace;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return parent + 8UL;
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace))
-                return parent + 8UL;
-
-        if (ftrace_push_return_trace(parent, self_addr, &trace.depth,
-                                     frame_pointer, NULL) == -EBUSY)
+        if (function_graph_enter(parent, self_addr, frame_pointer, NULL))
                 return parent + 8UL;
 
         return return_hooker;
diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
index 222785af550b..5fda4f7bf15d 100644
--- a/arch/sparc/net/bpf_jit_comp_64.c
+++ b/arch/sparc/net/bpf_jit_comp_64.c
@@ -791,7 +791,7 @@ static int emit_compare_and_branch(const u8 code, const u8 dst, u8 src,
 }
 
 /* Just skip the save instruction and the ctx register move.  */
-#define BPF_TAILCALL_PROLOGUE_SKIP      16
+#define BPF_TAILCALL_PROLOGUE_SKIP      32
 #define BPF_TAILCALL_CNT_SP_OFF         (STACK_BIAS + 128)
 
 static void build_prologue(struct jit_ctx *ctx)
@@ -824,9 +824,15 @@ static void build_prologue(struct jit_ctx *ctx)
                 const u8 vfp = bpf2sparc[BPF_REG_FP];
 
                 emit(ADD | IMMED | RS1(FP) | S13(STACK_BIAS) | RD(vfp), ctx);
+        } else {
+                emit_nop(ctx);
         }
 
         emit_reg_move(I0, O0, ctx);
+        emit_reg_move(I1, O1, ctx);
+        emit_reg_move(I2, O2, ctx);
+        emit_reg_move(I3, O3, ctx);
+        emit_reg_move(I4, O4, ctx);
         /* If you add anything here, adjust BPF_TAILCALL_PROLOGUE_SKIP above. */
 }
 
@@ -1270,6 +1276,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp2 = bpf2sparc[TMP_REG_2];
                 u32 opcode = 0, rs2;
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 ctx->tmp_2_used = true;
                 emit_loadimm(imm, tmp2, ctx);
 
@@ -1308,6 +1317,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp = bpf2sparc[TMP_REG_1];
                 u32 opcode = 0, rs2;
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 switch (BPF_SIZE(code)) {
                 case BPF_W:
                         opcode = ST32;
@@ -1340,6 +1352,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp2 = bpf2sparc[TMP_REG_2];
                 const u8 tmp3 = bpf2sparc[TMP_REG_3];
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 ctx->tmp_1_used = true;
                 ctx->tmp_2_used = true;
                 ctx->tmp_3_used = true;
@@ -1360,6 +1375,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 const u8 tmp2 = bpf2sparc[TMP_REG_2];
                 const u8 tmp3 = bpf2sparc[TMP_REG_3];
 
+                if (insn->dst_reg == BPF_REG_FP)
+                        ctx->saw_frame_pointer = true;
+
                 ctx->tmp_1_used = true;
                 ctx->tmp_2_used = true;
                 ctx->tmp_3_used = true;
@@ -1425,12 +1443,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
         struct bpf_prog *tmp, *orig_prog = prog;
         struct sparc64_jit_data *jit_data;
         struct bpf_binary_header *header;
+        u32 prev_image_size, image_size;
         bool tmp_blinded = false;
         bool extra_pass = false;
         struct jit_ctx ctx;
-        u32 image_size;
         u8 *image_ptr;
-        int pass;
+        int pass, i;
 
         if (!prog->jit_requested)
                 return orig_prog;
@@ -1461,61 +1479,82 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
                 header = jit_data->header;
                 extra_pass = true;
                 image_size = sizeof(u32) * ctx.idx;
+                prev_image_size = image_size;
+                pass = 1;
                 goto skip_init_ctx;
         }
 
         memset(&ctx, 0, sizeof(ctx));
         ctx.prog = prog;
 
-        ctx.offset = kcalloc(prog->len, sizeof(unsigned int), GFP_KERNEL);
+        ctx.offset = kmalloc_array(prog->len, sizeof(unsigned int), GFP_KERNEL);
         if (ctx.offset == NULL) {
                 prog = orig_prog;
                 goto out_off;
         }
 
-        /* Fake pass to detect features used, and get an accurate assessment
-         * of what the final image size will be.
+        /* Longest sequence emitted is for bswap32, 12 instructions.  Pre-cook
+         * the offset array so that we converge faster.
          */
-        if (build_body(&ctx)) {
-                prog = orig_prog;
-                goto out_off;
-        }
-        build_prologue(&ctx);
-        build_epilogue(&ctx);
-
-        /* Now we know the actual image size. */
-        image_size = sizeof(u32) * ctx.idx;
-        header = bpf_jit_binary_alloc(image_size, &image_ptr,
-                                      sizeof(u32), jit_fill_hole);
-        if (header == NULL) {
-                prog = orig_prog;
-                goto out_off;
-        }
+        for (i = 0; i < prog->len; i++)
+                ctx.offset[i] = i * (12 * 4);
 
-        ctx.image = (u32 *)image_ptr;
-skip_init_ctx:
-        for (pass = 1; pass < 3; pass++) {
+        prev_image_size = ~0U;
+        for (pass = 1; pass < 40; pass++) {
                 ctx.idx = 0;
 
                 build_prologue(&ctx);
-
                 if (build_body(&ctx)) {
-                        bpf_jit_binary_free(header);
                         prog = orig_prog;
                         goto out_off;
                 }
-
                 build_epilogue(&ctx);
 
                 if (bpf_jit_enable > 1)
-                        pr_info("Pass %d: shrink = %d, seen = [%c%c%c%c%c%c]\n", pass,
-                                image_size - (ctx.idx * 4),
+                        pr_info("Pass %d: size = %u, seen = [%c%c%c%c%c%c]\n", pass,
+                                ctx.idx * 4,
                                 ctx.tmp_1_used ? '1' : ' ',
                                 ctx.tmp_2_used ? '2' : ' ',
                                 ctx.tmp_3_used ? '3' : ' ',
                                 ctx.saw_frame_pointer ? 'F' : ' ',
                                 ctx.saw_call ? 'C' : ' ',
                                 ctx.saw_tail_call ? 'T' : ' ');
+
+                if (ctx.idx * 4 == prev_image_size)
+                        break;
+                prev_image_size = ctx.idx * 4;
+                cond_resched();
+        }
+
+        /* Now we know the actual image size. */
+        image_size = sizeof(u32) * ctx.idx;
+        header = bpf_jit_binary_alloc(image_size, &image_ptr,
+                                      sizeof(u32), jit_fill_hole);
+        if (header == NULL) {
+                prog = orig_prog;
+                goto out_off;
+        }
+
+        ctx.image = (u32 *)image_ptr;
+skip_init_ctx:
+        ctx.idx = 0;
+
+        build_prologue(&ctx);
+
+        if (build_body(&ctx)) {
+                bpf_jit_binary_free(header);
+                prog = orig_prog;
+                goto out_off;
+        }
+
+        build_epilogue(&ctx);
+
+        if (ctx.idx * 4 != prev_image_size) {
+                pr_err("bpf_jit: Failed to converge, prev_size=%u size=%d\n",
+                       prev_image_size, ctx.idx * 4);
+                bpf_jit_binary_free(header);
+                prog = orig_prog;
+                goto out_off;
         }
 
         if (bpf_jit_enable > 1)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9d734f3c8234..8689e794a43c 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -444,10 +444,6 @@ config RETPOLINE
           branches. Requires a compiler with -mindirect-branch=thunk-extern
           support for full protection. The kernel may run slower.
 
-          Without compiler support, at least indirect branches in assembler
-          code are eliminated. Since this includes the syscall entry path,
-          it is not entirely pointless.
-
 config INTEL_RDT
         bool "Intel Resource Director Technology support"
         depends on X86 && CPU_SUP_INTEL
@@ -1004,13 +1000,7 @@ config NR_CPUS
           to the kernel image.
 
 config SCHED_SMT
-        bool "SMT (Hyperthreading) scheduler support"
-        depends on SMP
-        ---help---
-          SMT scheduler support improves the CPU scheduler's decision making
-          when dealing with Intel Pentium 4 chips with HyperThreading at a
-          cost of slightly increased overhead in some places. If unsure say
-          N here.
+        def_bool y if SMP
 
 config SCHED_MC
         def_bool y
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 88398fdf8129..f5d7f4134524 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -220,9 +220,10 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 
 # Avoid indirect branches in kernel to deal with Spectre
 ifdef CONFIG_RETPOLINE
-ifneq ($(RETPOLINE_CFLAGS),)
-  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+ifeq ($(RETPOLINE_CFLAGS),)
+  $(error You are building kernel with non-retpoline compiler, please update your compiler.)
 endif
+  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
 endif
 
 archscripts: scripts_basic
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 4c881c850125..850b8762e889 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -300,7 +300,7 @@ _start:
         # Part 2 of the header, from the old setup.S
 
                 .ascii  "HdrS"          # header signature
-                .word   0x020e          # header version number (>= 0x0105)
+                .word   0x020d          # header version number (>= 0x0105)
                                         # or else old loadlin-1.5 will fail)
                 .globl realmode_swtch
 realmode_swtch: .word   0, 0            # default_switch, SETUPSEG
@@ -558,10 +558,6 @@ pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
 init_size:              .long INIT_SIZE         # kernel initialization size
 handover_offset:        .long 0                 # Filled in by build.c
 
-acpi_rsdp_addr:         .quad 0                 # 64-bit physical pointer to the
-                                                # ACPI RSDP table, added with
-                                                # version 2.14
-
 # End of setup header #####################################################
 
         .section ".entrytext", "ax"
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 106911b603bd..374a19712e20 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -438,26 +438,6 @@ int x86_setup_perfctr(struct perf_event *event)
         if (config == -1LL)
                 return -EINVAL;
 
-        /*
-         * Branch tracing:
-         */
-        if (attr->config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
-            !attr->freq && hwc->sample_period == 1) {
-                /* BTS is not supported by this architecture. */
-                if (!x86_pmu.bts_active)
-                        return -EOPNOTSUPP;
-
-                /* BTS is currently only allowed for user-mode. */
-                if (!attr->exclude_kernel)
-                        return -EOPNOTSUPP;
-
-                /* disallow bts if conflicting events are present */
-                if (x86_add_exclusive(x86_lbr_exclusive_lbr))
-                        return -EBUSY;
-
-                event->destroy = hw_perf_lbr_event_destroy;
-        }
-
         hwc->config |= config;
 
         return 0;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index af8bea9d4006..ecc3e34ca955 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2474,16 +2474,7 @@ done:
 static struct event_constraint *
 intel_bts_constraints(struct perf_event *event)
 {
-        struct hw_perf_event *hwc = &event->hw;
-        unsigned int hw_event, bts_event;
-
-        if (event->attr.freq)
-                return NULL;
-
-        hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
-        bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
-
-        if (unlikely(hw_event == bts_event && hwc->sample_period == 1))
+        if (unlikely(intel_pmu_has_bts(event)))
                 return &bts_constraint;
 
         return NULL;
@@ -3102,6 +3093,43 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
         return flags;
 }
 
+static int intel_pmu_bts_config(struct perf_event *event)
+{
+        struct perf_event_attr *attr = &event->attr;
+
+        if (unlikely(intel_pmu_has_bts(event))) {
+                /* BTS is not supported by this architecture. */
+                if (!x86_pmu.bts_active)
+                        return -EOPNOTSUPP;
+
+                /* BTS is currently only allowed for user-mode. */
+                if (!attr->exclude_kernel)
+                        return -EOPNOTSUPP;
+
+                /* BTS is not allowed for precise events. */
+                if (attr->precise_ip)
+                        return -EOPNOTSUPP;
+
+                /* disallow bts if conflicting events are present */
+                if (x86_add_exclusive(x86_lbr_exclusive_lbr))
+                        return -EBUSY;
+
+                event->destroy = hw_perf_lbr_event_destroy;
+        }
+
+        return 0;
+}
+
+static int core_pmu_hw_config(struct perf_event *event)
+{
+        int ret = x86_pmu_hw_config(event);
+
+        if (ret)
+                return ret;
+
+        return intel_pmu_bts_config(event);
+}
+
 static int intel_pmu_hw_config(struct perf_event *event)
 {
         int ret = x86_pmu_hw_config(event);
@@ -3109,6 +3137,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
         if (ret)
                 return ret;
 
+        ret = intel_pmu_bts_config(event);
+        if (ret)
+                return ret;
+
         if (event->attr.precise_ip) {
                 if (!event->attr.freq) {
                         event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
@@ -3131,7 +3163,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 /*
                  * BTS is set up earlier in this path, so don't account twice
                  */
-                if (!intel_pmu_has_bts(event)) {
+                if (!unlikely(intel_pmu_has_bts(event))) {
                         /* disallow lbr if conflicting events are present */
                         if (x86_add_exclusive(x86_lbr_exclusive_lbr))
                                 return -EBUSY;
@@ -3600,7 +3632,7 @@ static __initconst const struct x86_pmu core_pmu = {
         .enable_all             = core_pmu_enable_all,
         .enable                 = core_pmu_enable_event,
         .disable                = x86_pmu_disable_event,
-        .hw_config              = x86_pmu_hw_config,
+        .hw_config              = core_pmu_hw_config,
         .schedule_events        = x86_schedule_events,
         .eventsel               = MSR_ARCH_PERFMON_EVENTSEL0,
         .perfctr                = MSR_ARCH_PERFMON_PERFCTR0,
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index adae087cecdd..78d7b7031bfc 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -859,11 +859,16 @@ static inline int amd_pmu_init(void)
 
 static inline bool intel_pmu_has_bts(struct perf_event *event)
 {
-        if (event->attr.config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
-            !event->attr.freq && event->hw.sample_period == 1)
-                return true;
+        struct hw_perf_event *hwc = &event->hw;
+        unsigned int hw_event, bts_event;
+
+        if (event->attr.freq)
+                return false;
+
+        hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
+        bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
 
-        return false;
+        return hw_event == bts_event && hwc->sample_period == 1;
 }
 
 int intel_pmu_save_and_restart(struct perf_event *event);
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 5f7290e6e954..69dcdf195b61 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -226,7 +226,7 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
                      "3: movl $-2,%[err]\n\t"                           \
                      "jmp 2b\n\t"                                       \
                      ".popsection\n\t"                                  \
-                     _ASM_EXTABLE_UA(1b, 3b)                            \
+                     _ASM_EXTABLE(1b, 3b)                               \
                      : [err] "=r" (err)                                 \
                      : "D" (st), "m" (*st), "a" (lmask), "d" (hmask)    \
                      : "memory")
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 55e51ff7e421..fbda5a917c5b 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1094,7 +1094,8 @@ struct kvm_x86_ops {
         bool (*has_wbinvd_exit)(void);
 
         u64 (*read_l1_tsc_offset)(struct kvm_vcpu *vcpu);
-        void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
+        /* Returns actual tsc_offset set in active VMCS */
+        u64 (*write_l1_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
 
         void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2);
 
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 80f4a4f38c79..c8f73efb4ece 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -41,9 +41,10 @@
 
 #define MSR_IA32_SPEC_CTRL              0x00000048 /* Speculation Control */
 #define SPEC_CTRL_IBRS                  (1 << 0)   /* Indirect Branch Restricted Speculation */
-#define SPEC_CTRL_STIBP                 (1 << 1)   /* Single Thread Indirect Branch Predictors */
+#define SPEC_CTRL_STIBP_SHIFT           1          /* Single Thread Indirect Branch Predictor (STIBP) bit */
+#define SPEC_CTRL_STIBP                 (1 << SPEC_CTRL_STIBP_SHIFT)    /* STIBP mask */
 #define SPEC_CTRL_SSBD_SHIFT            2          /* Speculative Store Bypass Disable bit */
-#define SPEC_CTRL_SSBD                  (1 << SPEC_CTRL_SSBD_SHIFT)   /* Speculative Store Bypass Disable */
+#define SPEC_CTRL_SSBD                  (1 << SPEC_CTRL_SSBD_SHIFT)     /* Speculative Store Bypass Disable */
 
 #define MSR_IA32_PRED_CMD               0x00000049 /* Prediction Command */
 #define PRED_CMD_IBPB                   (1 << 0)   /* Indirect Branch Prediction Barrier */
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 80dc14422495..032b6009baab 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -3,6 +3,8 @@
 #ifndef _ASM_X86_NOSPEC_BRANCH_H_
 #define _ASM_X86_NOSPEC_BRANCH_H_
 
+#include <linux/static_key.h>
+
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
@@ -162,11 +164,12 @@
         _ASM_PTR " 999b\n\t"                                    \
         ".popsection\n\t"
 
-#if defined(CONFIG_X86_64) && defined(RETPOLINE)
+#ifdef CONFIG_RETPOLINE
+#ifdef CONFIG_X86_64
 
 /*
- * Since the inline asm uses the %V modifier which is only in newer GCC,
- * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE.
+ * Inline asm uses the %V modifier which is only in newer GCC
+ * which is ensured when CONFIG_RETPOLINE is defined.
  */
 # define CALL_NOSPEC                                            \
         ANNOTATE_NOSPEC_ALTERNATIVE                             \
@@ -181,7 +184,7 @@
         X86_FEATURE_RETPOLINE_AMD)
 # define THUNK_TARGET(addr) [thunk_target] "r" (addr)
 
-#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE)
+#else /* CONFIG_X86_32 */
 /*
  * For i386 we use the original ret-equivalent retpoline, because
  * otherwise we'll run out of registers. We don't care about CET
@@ -211,6 +214,7 @@
         X86_FEATURE_RETPOLINE_AMD)
 
 # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+#endif
 #else /* No retpoline for C / inline asm */
 # define CALL_NOSPEC "call *%[thunk_target]\n"
 # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
@@ -219,13 +223,19 @@
 /* The Spectre V2 mitigation variants */
 enum spectre_v2_mitigation {
         SPECTRE_V2_NONE,
-        SPECTRE_V2_RETPOLINE_MINIMAL,
-        SPECTRE_V2_RETPOLINE_MINIMAL_AMD,
         SPECTRE_V2_RETPOLINE_GENERIC,
         SPECTRE_V2_RETPOLINE_AMD,
         SPECTRE_V2_IBRS_ENHANCED,
 };
 
+/* The indirect branch speculation control variants */
+enum spectre_v2_user_mitigation {
+        SPECTRE_V2_USER_NONE,
+        SPECTRE_V2_USER_STRICT,
+        SPECTRE_V2_USER_PRCTL,
+        SPECTRE_V2_USER_SECCOMP,
+};
+
 /* The Speculative Store Bypass disable variants */
 enum ssb_mitigation {
         SPEC_STORE_BYPASS_NONE,
@@ -303,6 +313,10 @@ do {									\
         preempt_enable();                                               \
 } while (0)
 
+DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
+DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
 #endif /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h
index ae7c2c5cd7f0..5393babc0598 100644
--- a/arch/x86/include/asm/spec-ctrl.h
+++ b/arch/x86/include/asm/spec-ctrl.h
@@ -53,12 +53,24 @@ static inline u64 ssbd_tif_to_spec_ctrl(u64 tifn)
         return (tifn & _TIF_SSBD) >> (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
 }
 
+static inline u64 stibp_tif_to_spec_ctrl(u64 tifn)
+{
+        BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
+        return (tifn & _TIF_SPEC_IB) >> (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
+}
+
 static inline unsigned long ssbd_spec_ctrl_to_tif(u64 spec_ctrl)
 {
         BUILD_BUG_ON(TIF_SSBD < SPEC_CTRL_SSBD_SHIFT);
         return (spec_ctrl & SPEC_CTRL_SSBD) << (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
 }
 
+static inline unsigned long stibp_spec_ctrl_to_tif(u64 spec_ctrl)
+{
+        BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
+        return (spec_ctrl & SPEC_CTRL_STIBP) << (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
+}
+
 static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn)
 {
         return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL;
@@ -70,11 +82,7 @@ extern void speculative_store_bypass_ht_init(void);
 static inline void speculative_store_bypass_ht_init(void) { }
 #endif
 
-extern void speculative_store_bypass_update(unsigned long tif);
-
-static inline void speculative_store_bypass_update_current(void)
-{
-        speculative_store_bypass_update(current_thread_info()->flags);
-}
+extern void speculation_ctrl_update(unsigned long tif);
+extern void speculation_ctrl_update_current(void);
 
 #endif
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
index 36bd243843d6..7cf1a270d891 100644
--- a/arch/x86/include/asm/switch_to.h
+++ b/arch/x86/include/asm/switch_to.h
@@ -11,9 +11,6 @@ struct task_struct *__switch_to_asm(struct task_struct *prev,
 
 __visible struct task_struct *__switch_to(struct task_struct *prev,
                                           struct task_struct *next);
-struct tss_struct;
-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
-                      struct tss_struct *tss);
 
 /* This runs runs on the previous thread's stack. */
 static inline void prepare_switch_to(struct task_struct *next)
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 2ff2a30a264f..82b73b75d67c 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -79,10 +79,12 @@ struct thread_info {
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_SINGLESTEP          4       /* reenable singlestep on user return*/
-#define TIF_SSBD                        5       /* Reduced data speculation */
+#define TIF_SSBD                5       /* Speculative store bypass disable */
 #define TIF_SYSCALL_EMU         6       /* syscall emulation active */
 #define TIF_SYSCALL_AUDIT       7       /* syscall auditing active */
 #define TIF_SECCOMP             8       /* secure computing */
+#define TIF_SPEC_IB             9       /* Indirect branch speculation mitigation */
+#define TIF_SPEC_FORCE_UPDATE   10      /* Force speculation MSR update in context switch */
 #define TIF_USER_RETURN_NOTIFY  11      /* notify kernel of userspace return */
 #define TIF_UPROBE              12      /* breakpointed or singlestepping */
 #define TIF_PATCH_PENDING       13      /* pending live patching update */
@@ -110,6 +112,8 @@ struct thread_info {
 #define _TIF_SYSCALL_EMU        (1 << TIF_SYSCALL_EMU)
 #define _TIF_SYSCALL_AUDIT      (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP            (1 << TIF_SECCOMP)
+#define _TIF_SPEC_IB            (1 << TIF_SPEC_IB)
+#define _TIF_SPEC_FORCE_UPDATE  (1 << TIF_SPEC_FORCE_UPDATE)
 #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
 #define _TIF_UPROBE             (1 << TIF_UPROBE)
 #define _TIF_PATCH_PENDING      (1 << TIF_PATCH_PENDING)
@@ -145,8 +149,18 @@ struct thread_info {
          _TIF_FSCHECK)
 
 /* flags to check in __switch_to() */
-#define _TIF_WORK_CTXSW                                                 \
-        (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|_TIF_SSBD)
+#define _TIF_WORK_CTXSW_BASE                                            \
+        (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|         \
+         _TIF_SSBD | _TIF_SPEC_FORCE_UPDATE)
+
+/*
+ * Avoid calls to __switch_to_xtra() on UP as STIBP is not evaluated.
+ */
+#ifdef CONFIG_SMP
+# define _TIF_WORK_CTXSW        (_TIF_WORK_CTXSW_BASE | _TIF_SPEC_IB)
+#else
+# define _TIF_WORK_CTXSW        (_TIF_WORK_CTXSW_BASE)
+#endif
 
 #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
 #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index d760611cfc35..f4204bf377fc 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -169,10 +169,14 @@ struct tlb_state {
 
 #define LOADED_MM_SWITCHING ((struct mm_struct *)1)
 
+        /* Last user mm for optimizing IBPB */
+        union {
+                struct mm_struct        *last_user_mm;
+                unsigned long           last_user_mm_ibpb;
+        };
+
         u16 loaded_mm_asid;
         u16 next_asid;
-        /* last user mm's ctx id */
-        u64 last_ctx_id;
 
         /*
          * We can be in one of several states:
diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
index 0f842104862c..b85a7c54c6a1 100644
--- a/arch/x86/include/asm/x86_init.h
+++ b/arch/x86/include/asm/x86_init.h
@@ -303,6 +303,4 @@ extern void x86_init_noop(void);
 extern void x86_init_uint_noop(unsigned int unused);
 extern bool x86_pnpbios_disabled(void);
 
-void x86_verify_bootdata_version(void);
-
 #endif
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 22f89d040ddd..60733f137e9a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -16,9 +16,6 @@
 #define RAMDISK_PROMPT_FLAG             0x8000
 #define RAMDISK_LOAD_FLAG               0x4000
 
-/* version flags */
-#define VERSION_WRITTEN 0x8000
-
 /* loadflags */
 #define LOADED_HIGH     (1<<0)
 #define KASLR_FLAG      (1<<1)
@@ -89,7 +86,6 @@ struct setup_header {
         __u64   pref_address;
         __u32   init_size;
         __u32   handover_offset;
-        __u64   acpi_rsdp_addr;
 } __attribute__((packed));
 
 struct sys_desc_table {
@@ -159,7 +155,8 @@ struct boot_params {
         __u8  _pad2[4];                                 /* 0x054 */
         __u64  tboot_addr;                              /* 0x058 */
         struct ist_info ist_info;                       /* 0x060 */
-        __u8  _pad3[16];                                /* 0x070 */
+        __u64 acpi_rsdp_addr;                           /* 0x070 */
+        __u8  _pad3[8];                                 /* 0x078 */
         __u8  hd0_info[16];     /* obsolete! */         /* 0x080 */
         __u8  hd1_info[16];     /* obsolete! */         /* 0x090 */
         struct sys_desc_table sys_desc_table; /* obsolete! */   /* 0x0a0 */
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 92c76bf97ad8..06635fbca81c 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1776,5 +1776,5 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size)
 
 u64 x86_default_get_root_pointer(void)
 {
-        return boot_params.hdr.acpi_rsdp_addr;
+        return boot_params.acpi_rsdp_addr;
 }
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index c37e66e493bf..500278f5308e 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/nospec.h>
 #include <linux/prctl.h>
+#include <linux/sched/smt.h>
 
 #include <asm/spec-ctrl.h>
 #include <asm/cmdline.h>
@@ -53,6 +54,13 @@ static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
 u64 __ro_after_init x86_amd_ls_cfg_base;
 u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
 
+/* Control conditional STIPB in switch_to() */
+DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
+/* Control conditional IBPB in switch_mm() */
+DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+/* Control unconditional IBPB in switch_mm() */
+DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
 void __init check_bugs(void)
 {
         identify_boot_cpu();
@@ -123,31 +131,6 @@ void __init check_bugs(void)
 #endif
 }
 
-/* The kernel command line selection */
-enum spectre_v2_mitigation_cmd {
-        SPECTRE_V2_CMD_NONE,
-        SPECTRE_V2_CMD_AUTO,
-        SPECTRE_V2_CMD_FORCE,
-        SPECTRE_V2_CMD_RETPOLINE,
-        SPECTRE_V2_CMD_RETPOLINE_GENERIC,
-        SPECTRE_V2_CMD_RETPOLINE_AMD,
-};
-
-static const char *spectre_v2_strings[] = {
-        [SPECTRE_V2_NONE]                       = "Vulnerable",
-        [SPECTRE_V2_RETPOLINE_MINIMAL]          = "Vulnerable: Minimal generic ASM retpoline",
-        [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
-        [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
-        [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
-        [SPECTRE_V2_IBRS_ENHANCED]              = "Mitigation: Enhanced IBRS",
-};
-
-#undef pr_fmt
-#define pr_fmt(fmt)     "Spectre V2 : " fmt
-
-static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
-        SPECTRE_V2_NONE;
-
 void
 x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
 {
@@ -169,6 +152,10 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
                     static_cpu_has(X86_FEATURE_AMD_SSBD))
                         hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
 
+                /* Conditional STIBP enabled? */
+                if (static_branch_unlikely(&switch_to_cond_stibp))
+                        hostval |= stibp_tif_to_spec_ctrl(ti->flags);
+
                 if (hostval != guestval) {
                         msrval = setguest ? guestval : hostval;
                         wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
@@ -202,7 +189,7 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
                 tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) :
                                  ssbd_spec_ctrl_to_tif(hostval);
 
-                speculative_store_bypass_update(tif);
+                speculation_ctrl_update(tif);
         }
 }
 EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl);
@@ -217,6 +204,15 @@ static void x86_amd_ssb_disable(void)
                 wrmsrl(MSR_AMD64_LS_CFG, msrval);
 }
 
+#undef pr_fmt
+#define pr_fmt(fmt)     "Spectre V2 : " fmt
+
+static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+        SPECTRE_V2_NONE;
+
+static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
+        SPECTRE_V2_USER_NONE;
+
 #ifdef RETPOLINE
 static bool spectre_v2_bad_module;
 
@@ -238,67 +234,217 @@ static inline const char *spectre_v2_module_string(void)
 static inline const char *spectre_v2_module_string(void) { return ""; }
 #endif
 
-static void __init spec2_print_if_insecure(const char *reason)
+static inline bool match_option(const char *arg, int arglen, const char *opt)
 {
-        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
-                pr_info("%s selected on command line.\n", reason);
+        int len = strlen(opt);
+
+        return len == arglen && !strncmp(arg, opt, len);
 }
 
-static void __init spec2_print_if_secure(const char *reason)
+/* The kernel command line selection for spectre v2 */
+enum spectre_v2_mitigation_cmd {
+        SPECTRE_V2_CMD_NONE,
+        SPECTRE_V2_CMD_AUTO,
+        SPECTRE_V2_CMD_FORCE,
+        SPECTRE_V2_CMD_RETPOLINE,
+        SPECTRE_V2_CMD_RETPOLINE_GENERIC,
+        SPECTRE_V2_CMD_RETPOLINE_AMD,
+};
+
+enum spectre_v2_user_cmd {
+        SPECTRE_V2_USER_CMD_NONE,
+        SPECTRE_V2_USER_CMD_AUTO,
+        SPECTRE_V2_USER_CMD_FORCE,
+        SPECTRE_V2_USER_CMD_PRCTL,
+        SPECTRE_V2_USER_CMD_PRCTL_IBPB,
+        SPECTRE_V2_USER_CMD_SECCOMP,
+        SPECTRE_V2_USER_CMD_SECCOMP_IBPB,
+};
+
+static const char * const spectre_v2_user_strings[] = {
+        [SPECTRE_V2_USER_NONE]          = "User space: Vulnerable",
+        [SPECTRE_V2_USER_STRICT]        = "User space: Mitigation: STIBP protection",
+        [SPECTRE_V2_USER_PRCTL]         = "User space: Mitigation: STIBP via prctl",
+        [SPECTRE_V2_USER_SECCOMP]       = "User space: Mitigation: STIBP via seccomp and prctl",
+};
+
+static const struct {
+        const char                      *option;
+        enum spectre_v2_user_cmd        cmd;
+        bool                            secure;
+} v2_user_options[] __initdata = {
+        { "auto",               SPECTRE_V2_USER_CMD_AUTO,               false },
+        { "off",                SPECTRE_V2_USER_CMD_NONE,               false },
+        { "on",                 SPECTRE_V2_USER_CMD_FORCE,              true  },
+        { "prctl",              SPECTRE_V2_USER_CMD_PRCTL,              false },
+        { "prctl,ibpb",         SPECTRE_V2_USER_CMD_PRCTL_IBPB,         false },
+        { "seccomp",            SPECTRE_V2_USER_CMD_SECCOMP,            false },
+        { "seccomp,ibpb",       SPECTRE_V2_USER_CMD_SECCOMP_IBPB,       false },
+};
+
+static void __init spec_v2_user_print_cond(const char *reason, bool secure)
 {
-        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
-                pr_info("%s selected on command line.\n", reason);
+        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
+                pr_info("spectre_v2_user=%s forced on command line.\n", reason);
 }
 
-static inline bool retp_compiler(void)
+static enum spectre_v2_user_cmd __init
+spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
 {
-        return __is_defined(RETPOLINE);
+        char arg[20];
+        int ret, i;
+
+        switch (v2_cmd) {
+        case SPECTRE_V2_CMD_NONE:
+                return SPECTRE_V2_USER_CMD_NONE;
+        case SPECTRE_V2_CMD_FORCE:
+                return SPECTRE_V2_USER_CMD_FORCE;
+        default:
+                break;
+        }
+
+        ret = cmdline_find_option(boot_command_line, "spectre_v2_user",
+                                  arg, sizeof(arg));
+        if (ret < 0)
+                return SPECTRE_V2_USER_CMD_AUTO;
+
+        for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) {
+                if (match_option(arg, ret, v2_user_options[i].option)) {
+                        spec_v2_user_print_cond(v2_user_options[i].option,
+                                                v2_user_options[i].secure);
+                        return v2_user_options[i].cmd;
+                }
+        }
+
+        pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg);
+        return SPECTRE_V2_USER_CMD_AUTO;
 }
 
-static inline bool match_option(const char *arg, int arglen, const char *opt)
+static void __init
+spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
 {
-        int len = strlen(opt);
+        enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
+        bool smt_possible = IS_ENABLED(CONFIG_SMP);
+        enum spectre_v2_user_cmd cmd;
 
-        return len == arglen && !strncmp(arg, opt, len);
+        if (!boot_cpu_has(X86_FEATURE_IBPB) && !boot_cpu_has(X86_FEATURE_STIBP))
+                return;
+
+        if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
+            cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
+                smt_possible = false;
+
+        cmd = spectre_v2_parse_user_cmdline(v2_cmd);
+        switch (cmd) {
+        case SPECTRE_V2_USER_CMD_NONE:
+                goto set_mode;
+        case SPECTRE_V2_USER_CMD_FORCE:
+                mode = SPECTRE_V2_USER_STRICT;
+                break;
+        case SPECTRE_V2_USER_CMD_PRCTL:
+        case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+                mode = SPECTRE_V2_USER_PRCTL;
+                break;
+        case SPECTRE_V2_USER_CMD_AUTO:
+        case SPECTRE_V2_USER_CMD_SECCOMP:
+        case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+                if (IS_ENABLED(CONFIG_SECCOMP))
+                        mode = SPECTRE_V2_USER_SECCOMP;
+                else
+                        mode = SPECTRE_V2_USER_PRCTL;
+                break;
+        }
+
+        /* Initialize Indirect Branch Prediction Barrier */
+        if (boot_cpu_has(X86_FEATURE_IBPB)) {
+                setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+
+                switch (cmd) {
+                case SPECTRE_V2_USER_CMD_FORCE:
+                case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+                case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+                        static_branch_enable(&switch_mm_always_ibpb);
+                        break;
+                case SPECTRE_V2_USER_CMD_PRCTL:
+                case SPECTRE_V2_USER_CMD_AUTO:
+                case SPECTRE_V2_USER_CMD_SECCOMP:
+                        static_branch_enable(&switch_mm_cond_ibpb);
+                        break;
+                default:
+                        break;
+                }
+
+                pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+                        static_key_enabled(&switch_mm_always_ibpb) ?
+                        "always-on" : "conditional");
+        }
+
+        /* If enhanced IBRS is enabled no STIPB required */
+        if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+                return;
+
+        /*
+         * If SMT is not possible or STIBP is not available clear the STIPB
+         * mode.
+         */
+        if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP))
+                mode = SPECTRE_V2_USER_NONE;
+set_mode:
+        spectre_v2_user = mode;
+        /* Only print the STIBP mode when SMT possible */
+        if (smt_possible)
+                pr_info("%s\n", spectre_v2_user_strings[mode]);
 }
 
+static const char * const spectre_v2_strings[] = {
+        [SPECTRE_V2_NONE]                       = "Vulnerable",
+        [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
+        [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
+        [SPECTRE_V2_IBRS_ENHANCED]              = "Mitigation: Enhanced IBRS",
+};
+
 static const struct {
         const char *option;
         enum spectre_v2_mitigation_cmd cmd;
         bool secure;
-} mitigation_options[] = {
-        { "off",               SPECTRE_V2_CMD_NONE,              false },
-        { "on",                SPECTRE_V2_CMD_FORCE,             true },
-        { "retpoline",         SPECTRE_V2_CMD_RETPOLINE,         false },
-        { "retpoline,amd",     SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
-        { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
-        { "auto",              SPECTRE_V2_CMD_AUTO,              false },
+} mitigation_options[] __initdata = {
+        { "off",                SPECTRE_V2_CMD_NONE,              false },
+        { "on",                 SPECTRE_V2_CMD_FORCE,             true  },
+        { "retpoline",          SPECTRE_V2_CMD_RETPOLINE,         false },
+        { "retpoline,amd",      SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
+        { "retpoline,generic",  SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
+        { "auto",               SPECTRE_V2_CMD_AUTO,              false },
 };
 
+static void __init spec_v2_print_cond(const char *reason, bool secure)
+{
+        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
+                pr_info("%s selected on command line.\n", reason);
+}
+
 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 {
+        enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
         char arg[20];
         int ret, i;
-        enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
 
         if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
                 return SPECTRE_V2_CMD_NONE;
-        else {
-                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
-                if (ret < 0)
-                        return SPECTRE_V2_CMD_AUTO;
 
-                for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
-                        if (!match_option(arg, ret, mitigation_options[i].option))
-                                continue;
-                        cmd = mitigation_options[i].cmd;
-                        break;
-                }
+        ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
+        if (ret < 0)
+                return SPECTRE_V2_CMD_AUTO;
 
-                if (i >= ARRAY_SIZE(mitigation_options)) {
-                        pr_err("unknown option (%s). Switching to AUTO select\n", arg);
-                        return SPECTRE_V2_CMD_AUTO;
-                }
+        for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
+                if (!match_option(arg, ret, mitigation_options[i].option))
+                        continue;
+                cmd = mitigation_options[i].cmd;
+                break;
+        }
+
+        if (i >= ARRAY_SIZE(mitigation_options)) {
+                pr_err("unknown option (%s). Switching to AUTO select\n", arg);
+                return SPECTRE_V2_CMD_AUTO;
         }
 
         if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
@@ -316,54 +462,11 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
                 return SPECTRE_V2_CMD_AUTO;
         }
 
-        if (mitigation_options[i].secure)
-                spec2_print_if_secure(mitigation_options[i].option);
-        else
-                spec2_print_if_insecure(mitigation_options[i].option);
-
+        spec_v2_print_cond(mitigation_options[i].option,
+                           mitigation_options[i].secure);
         return cmd;
 }
 
-static bool stibp_needed(void)
-{
-        if (spectre_v2_enabled == SPECTRE_V2_NONE)
-                return false;
-
-        if (!boot_cpu_has(X86_FEATURE_STIBP))
-                return false;
-
-        return true;
-}
-
-static void update_stibp_msr(void *info)
-{
-        wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
-}
-
-void arch_smt_update(void)
-{
-        u64 mask;
-
-        if (!stibp_needed())
-                return;
-
-        mutex_lock(&spec_ctrl_mutex);
-        mask = x86_spec_ctrl_base;
-        if (cpu_smt_control == CPU_SMT_ENABLED)
-                mask |= SPEC_CTRL_STIBP;
-        else
-                mask &= ~SPEC_CTRL_STIBP;
-
-        if (mask != x86_spec_ctrl_base) {
-                pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
-                                cpu_smt_control == CPU_SMT_ENABLED ?
-                                "Enabling" : "Disabling");
-                x86_spec_ctrl_base = mask;
-                on_each_cpu(update_stibp_msr, NULL, 1);
-        }
-        mutex_unlock(&spec_ctrl_mutex);
-}
-
 static void __init spectre_v2_select_mitigation(void)
 {
         enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -417,14 +520,12 @@ retpoline_auto:
                         pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
                         goto retpoline_generic;
                 }
-                mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
-                                         SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
+                mode = SPECTRE_V2_RETPOLINE_AMD;
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
         } else {
         retpoline_generic:
-                mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
-                                         SPECTRE_V2_RETPOLINE_MINIMAL;
+                mode = SPECTRE_V2_RETPOLINE_GENERIC;
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
         }
 
@@ -443,12 +544,6 @@ specv2_set_mode:
         setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
         pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
 
-        /* Initialize Indirect Branch Prediction Barrier if supported */
-        if (boot_cpu_has(X86_FEATURE_IBPB)) {
-                setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
-                pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
-        }
-
         /*
          * Retpoline means the kernel is safe because it has no indirect
          * branches. Enhanced IBRS protects firmware too, so, enable restricted
@@ -465,10 +560,67 @@ specv2_set_mode:
                 pr_info("Enabling Restricted Speculation for firmware calls\n");
         }
 
+        /* Set up IBPB and STIBP depending on the general spectre V2 command */
+        spectre_v2_user_select_mitigation(cmd);
+
         /* Enable STIBP if appropriate */
         arch_smt_update();
 }
 
+static void update_stibp_msr(void * __unused)
+{
+        wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+}
+
+/* Update x86_spec_ctrl_base in case SMT state changed. */
+static void update_stibp_strict(void)
+{
+        u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
+
+        if (sched_smt_active())
+                mask |= SPEC_CTRL_STIBP;
+
+        if (mask == x86_spec_ctrl_base)
+                return;
+
+        pr_info("Update user space SMT mitigation: STIBP %s\n",
+                mask & SPEC_CTRL_STIBP ? "always-on" : "off");
+        x86_spec_ctrl_base = mask;
+        on_each_cpu(update_stibp_msr, NULL, 1);
+}
+
+/* Update the static key controlling the evaluation of TIF_SPEC_IB */
+static void update_indir_branch_cond(void)
+{
+        if (sched_smt_active())
+                static_branch_enable(&switch_to_cond_stibp);
+        else
+                static_branch_disable(&switch_to_cond_stibp);
+}
+
+void arch_smt_update(void)
+{
+        /* Enhanced IBRS implies STIBP. No update required. */
+        if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+                return;
+
+        mutex_lock(&spec_ctrl_mutex);
+
+        switch (spectre_v2_user) {
+        case SPECTRE_V2_USER_NONE:
+                break;
+        case SPECTRE_V2_USER_STRICT:
+                update_stibp_strict();
+                break;
+        case SPECTRE_V2_USER_PRCTL:
+        case SPECTRE_V2_USER_SECCOMP:
+                update_indir_branch_cond();
+                break;
+        }
+
+        mutex_unlock(&spec_ctrl_mutex);
+}
+
 #undef pr_fmt
 #define pr_fmt(fmt)     "Speculative Store Bypass: " fmt
 
@@ -483,7 +635,7 @@ enum ssb_mitigation_cmd {
         SPEC_STORE_BYPASS_CMD_SECCOMP,
 };
 
-static const char *ssb_strings[] = {
+static const char * const ssb_strings[] = {
         [SPEC_STORE_BYPASS_NONE]        = "Vulnerable",
         [SPEC_STORE_BYPASS_DISABLE]     = "Mitigation: Speculative Store Bypass disabled",
         [SPEC_STORE_BYPASS_PRCTL]       = "Mitigation: Speculative Store Bypass disabled via prctl",
@@ -493,7 +645,7 @@ static const char *ssb_strings[] = {
 static const struct {
         const char *option;
         enum ssb_mitigation_cmd cmd;
-} ssb_mitigation_options[] = {
+} ssb_mitigation_options[]  __initdata = {
         { "auto",       SPEC_STORE_BYPASS_CMD_AUTO },    /* Platform decides */
         { "on",         SPEC_STORE_BYPASS_CMD_ON },      /* Disable Speculative Store Bypass */
         { "off",        SPEC_STORE_BYPASS_CMD_NONE },    /* Don't touch Speculative Store Bypass */
@@ -604,10 +756,25 @@ static void ssb_select_mitigation(void)
 #undef pr_fmt
 #define pr_fmt(fmt)     "Speculation prctl: " fmt
 
-static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+static void task_update_spec_tif(struct task_struct *tsk)
 {
-        bool update;
+        /* Force the update of the real TIF bits */
+        set_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE);
 
+        /*
+         * Immediately update the speculation control MSRs for the current
+         * task, but for a non-current task delay setting the CPU
+         * mitigation until it is scheduled next.
+         *
+         * This can only happen for SECCOMP mitigation. For PRCTL it's
+         * always the current task.
+         */
+        if (tsk == current)
+                speculation_ctrl_update_current();
+}
+
+static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+{
         if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
             ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
                 return -ENXIO;
@@ -618,28 +785,56 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
                 if (task_spec_ssb_force_disable(task))
                         return -EPERM;
                 task_clear_spec_ssb_disable(task);
-                update = test_and_clear_tsk_thread_flag(task, TIF_SSBD);
+                task_update_spec_tif(task);
                 break;
         case PR_SPEC_DISABLE:
                 task_set_spec_ssb_disable(task);
-                update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
+                task_update_spec_tif(task);
                 break;
         case PR_SPEC_FORCE_DISABLE:
                 task_set_spec_ssb_disable(task);
                 task_set_spec_ssb_force_disable(task);
-                update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
+                task_update_spec_tif(task);
                 break;
         default:
                 return -ERANGE;
         }
+        return 0;
+}
 
-        /*
-         * If being set on non-current task, delay setting the CPU
-         * mitigation until it is next scheduled.
-         */
-        if (task == current && update)
-                speculative_store_bypass_update_current();
-
+static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+{
+        switch (ctrl) {
+        case PR_SPEC_ENABLE:
+                if (spectre_v2_user == SPECTRE_V2_USER_NONE)
+                        return 0;
+                /*
+                 * Indirect branch speculation is always disabled in strict
+                 * mode.
+                 */
+                if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
+                        return -EPERM;
+                task_clear_spec_ib_disable(task);
+                task_update_spec_tif(task);
+                break;
+        case PR_SPEC_DISABLE:
+        case PR_SPEC_FORCE_DISABLE:
+                /*
+                 * Indirect branch speculation is always allowed when
+                 * mitigation is force disabled.
+                 */
+                if (spectre_v2_user == SPECTRE_V2_USER_NONE)
+                        return -EPERM;
+                if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
+                        return 0;
+                task_set_spec_ib_disable(task);
+                if (ctrl == PR_SPEC_FORCE_DISABLE)
+                        task_set_spec_ib_force_disable(task);
+                task_update_spec_tif(task);
+                break;
+        default:
+                return -ERANGE;
+        }
         return 0;
 }
 
@@ -649,6 +844,8 @@ int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
         switch (which) {
         case PR_SPEC_STORE_BYPASS:
                 return ssb_prctl_set(task, ctrl);
+        case PR_SPEC_INDIRECT_BRANCH:
+                return ib_prctl_set(task, ctrl);
         default:
                 return -ENODEV;
         }
@@ -659,6 +856,8 @@ void arch_seccomp_spec_mitigate(struct task_struct *task)
 {
         if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
                 ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+        if (spectre_v2_user == SPECTRE_V2_USER_SECCOMP)
+                ib_prctl_set(task, PR_SPEC_FORCE_DISABLE);
 }
 #endif
 
@@ -681,11 +880,35 @@ static int ssb_prctl_get(struct task_struct *task)
         }
 }
 
+static int ib_prctl_get(struct task_struct *task)
+{
+        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+                return PR_SPEC_NOT_AFFECTED;
+
+        switch (spectre_v2_user) {
+        case SPECTRE_V2_USER_NONE:
+                return PR_SPEC_ENABLE;
+        case SPECTRE_V2_USER_PRCTL:
+        case SPECTRE_V2_USER_SECCOMP:
+                if (task_spec_ib_force_disable(task))
+                        return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
+                if (task_spec_ib_disable(task))
+                        return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
+                return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
+        case SPECTRE_V2_USER_STRICT:
+                return PR_SPEC_DISABLE;
+        default:
+                return PR_SPEC_NOT_AFFECTED;
+        }
+}
+
 int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
 {
         switch (which) {
         case PR_SPEC_STORE_BYPASS:
                 return ssb_prctl_get(task);
+        case PR_SPEC_INDIRECT_BRANCH:
+                return ib_prctl_get(task);
         default:
                 return -ENODEV;
         }
@@ -823,7 +1046,7 @@ early_param("l1tf", l1tf_cmdline);
 #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
 
 #if IS_ENABLED(CONFIG_KVM_INTEL)
-static const char *l1tf_vmx_states[] = {
+static const char * const l1tf_vmx_states[] = {
         [VMENTER_L1D_FLUSH_AUTO]                = "auto",
         [VMENTER_L1D_FLUSH_NEVER]               = "vulnerable",
         [VMENTER_L1D_FLUSH_COND]                = "conditional cache flushes",
@@ -839,13 +1062,14 @@ static ssize_t l1tf_show_state(char *buf)
 
         if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
             (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
-             cpu_smt_control == CPU_SMT_ENABLED))
+             sched_smt_active())) {
                 return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
                                l1tf_vmx_states[l1tf_vmx_mitigation]);
+        }
 
         return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
                        l1tf_vmx_states[l1tf_vmx_mitigation],
-                       cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled");
+                       sched_smt_active() ? "vulnerable" : "disabled");
 }
 #else
 static ssize_t l1tf_show_state(char *buf)
@@ -854,11 +1078,39 @@ static ssize_t l1tf_show_state(char *buf)
 }
 #endif
 
+static char *stibp_state(void)
+{
+        if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+                return "";
+
+        switch (spectre_v2_user) {
+        case SPECTRE_V2_USER_NONE:
+                return ", STIBP: disabled";
+        case SPECTRE_V2_USER_STRICT:
+                return ", STIBP: forced";
+        case SPECTRE_V2_USER_PRCTL:
+        case SPECTRE_V2_USER_SECCOMP:
+                if (static_key_enabled(&switch_to_cond_stibp))
+                        return ", STIBP: conditional";
+        }
+        return "";
+}
+
+static char *ibpb_state(void)
+{
+        if (boot_cpu_has(X86_FEATURE_IBPB)) {
+                if (static_key_enabled(&switch_mm_always_ibpb))
+                        return ", IBPB: always-on";
+                if (static_key_enabled(&switch_mm_cond_ibpb))
+                        return ", IBPB: conditional";
+                return ", IBPB: disabled";
+        }
+        return "";
+}
+
 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
                                char *buf, unsigned int bug)
 {
-        int ret;
-
         if (!boot_cpu_has_bug(bug))
                 return sprintf(buf, "Not affected\n");
 
@@ -876,13 +1128,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
                 return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 
         case X86_BUG_SPECTRE_V2:
-                ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
-                               boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+                return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+                               ibpb_state(),
                                boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
-                               (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+                               stibp_state(),
                                boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
                                spectre_v2_module_string());
-                return ret;
 
         case X86_BUG_SPEC_STORE_BYPASS:
                 return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index dd33c357548f..e12454e21b8a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -56,7 +56,7 @@
 /* Threshold LVT offset is at MSR0xC0000410[15:12] */
 #define SMCA_THR_LVT_OFF        0xF000
 
-static bool thresholding_en;
+static bool thresholding_irq_en;
 
 static const char * const th_names[] = {
         "load_store",
@@ -534,9 +534,8 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr,
 
 set_offset:
         offset = setup_APIC_mce_threshold(offset, new);
-
-        if ((offset == new) && (mce_threshold_vector != amd_threshold_interrupt))
-                mce_threshold_vector = amd_threshold_interrupt;
+        if (offset == new)
+                thresholding_irq_en = true;
 
 done:
         mce_threshold_block_init(&b, offset);
@@ -1357,9 +1356,6 @@ int mce_threshold_remove_device(unsigned int cpu)
 {
         unsigned int bank;
 
-        if (!thresholding_en)
-                return 0;
-
         for (bank = 0; bank < mca_cfg.banks; ++bank) {
                 if (!(per_cpu(bank_map, cpu) & (1 << bank)))
                         continue;
@@ -1377,9 +1373,6 @@ int mce_threshold_create_device(unsigned int cpu)
         struct threshold_bank **bp;
         int err = 0;
 
-        if (!thresholding_en)
-                return 0;
-
         bp = per_cpu(threshold_banks, cpu);
         if (bp)
                 return 0;
@@ -1408,9 +1401,6 @@ static __init int threshold_init_device(void)
 {
         unsigned lcpu = 0;
 
-        if (mce_threshold_vector == amd_threshold_interrupt)
-                thresholding_en = true;
-
         /* to hit CPUs online before the notifier is up */
         for_each_online_cpu(lcpu) {
                 int err = mce_threshold_create_device(lcpu);
@@ -1419,6 +1409,9 @@ static __init int threshold_init_device(void)
                         return err;
         }
 
+        if (thresholding_irq_en)
+                mce_threshold_vector = amd_threshold_interrupt;
+
         return 0;
 }
 /*
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 61a949d84dfa..d99a8ee9e185 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -344,10 +344,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
                         sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
                 }
 
+                local_bh_disable();
                 fpu->initialized = 1;
-                preempt_disable();
                 fpu__restore(fpu);
-                preempt_enable();
+                local_bh_enable();
 
                 return err;
         } else {
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 01ebcb6f263e..7ee8067cbf45 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -994,7 +994,6 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
 {
         unsigned long old;
         int faulted;
-        struct ftrace_graph_ent trace;
         unsigned long return_hooker = (unsigned long)
                                 &return_to_handler;
 
@@ -1046,19 +1045,7 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
                 return;
         }
 
-        trace.func = self_addr;
-        trace.depth = current->curr_ret_stack + 1;
-
-        /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
+        if (function_graph_enter(old, self_addr, frame_pointer, parent))
                 *parent = old;
-                return;
-        }
-
-        if (ftrace_push_return_trace(old, self_addr, &trace.depth,
-                                     frame_pointer, parent) == -EBUSY) {
-                *parent = old;
-                return;
-        }
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index 76fa3b836598..ec6fefbfd3c0 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -37,7 +37,6 @@ asmlinkage __visible void __init i386_start_kernel(void)
         cr4_init_shadow();
 
         sanitize_boot_params(&boot_params);
-        x86_verify_bootdata_version();
 
         x86_early_init_platform_quirks();
 
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 7663a8eb602b..16b1cbd3a61e 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -457,8 +457,6 @@ void __init x86_64_start_reservations(char *real_mode_data)
         if (!boot_params.hdr.version)
                 copy_bootdata(__va(real_mode_data));
 
-        x86_verify_bootdata_version();
-
         x86_early_init_platform_quirks();
 
         switch (boot_params.hdr.hardware_subarch) {
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index c93fcfdf1673..7d31192296a8 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -40,6 +40,8 @@
 #include <asm/prctl.h>
 #include <asm/spec-ctrl.h>
 
+#include "process.h"
+
 /*
  * per-CPU TSS segments. Threads are completely 'soft' on Linux,
  * no more per-task TSS's. The TSS size is kept cacheline-aligned
@@ -252,11 +254,12 @@ void arch_setup_new_exec(void)
                 enable_cpuid();
 }
 
-static inline void switch_to_bitmap(struct tss_struct *tss,
-                                    struct thread_struct *prev,
+static inline void switch_to_bitmap(struct thread_struct *prev,
                                     struct thread_struct *next,
                                     unsigned long tifp, unsigned long tifn)
 {
+        struct tss_struct *tss = this_cpu_ptr(&cpu_tss_rw);
+
         if (tifn & _TIF_IO_BITMAP) {
                 /*
                  * Copy the relevant range of the IO bitmap.
@@ -395,32 +398,85 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
         wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn));
 }
 
-static __always_inline void intel_set_ssb_state(unsigned long tifn)
+/*
+ * Update the MSRs managing speculation control, during context switch.
+ *
+ * tifp: Previous task's thread flags
+ * tifn: Next task's thread flags
+ */
+static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+                                                      unsigned long tifn)
 {
-        u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+        unsigned long tif_diff = tifp ^ tifn;
+        u64 msr = x86_spec_ctrl_base;
+        bool updmsr = false;
+
+        /*
+         * If TIF_SSBD is different, select the proper mitigation
+         * method. Note that if SSBD mitigation is disabled or permanentely
+         * enabled this branch can't be taken because nothing can set
+         * TIF_SSBD.
+         */
+        if (tif_diff & _TIF_SSBD) {
+                if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
+                        amd_set_ssb_virt_state(tifn);
+                } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
+                        amd_set_core_ssb_state(tifn);
+                } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
+                           static_cpu_has(X86_FEATURE_AMD_SSBD)) {
+                        msr |= ssbd_tif_to_spec_ctrl(tifn);
+                        updmsr  = true;
+                }
+        }
+
+        /*
+         * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled,
+         * otherwise avoid the MSR write.
+         */
+        if (IS_ENABLED(CONFIG_SMP) &&
+            static_branch_unlikely(&switch_to_cond_stibp)) {
+                updmsr |= !!(tif_diff & _TIF_SPEC_IB);
+                msr |= stibp_tif_to_spec_ctrl(tifn);
+        }
 
-        wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+        if (updmsr)
+                wrmsrl(MSR_IA32_SPEC_CTRL, msr);
 }
 
-static __always_inline void __speculative_store_bypass_update(unsigned long tifn)
+static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
 {
-        if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
-                amd_set_ssb_virt_state(tifn);
-        else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
-                amd_set_core_ssb_state(tifn);
-        else
-                intel_set_ssb_state(tifn);
+        if (test_and_clear_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE)) {
+                if (task_spec_ssb_disable(tsk))
+                        set_tsk_thread_flag(tsk, TIF_SSBD);
+                else
+                        clear_tsk_thread_flag(tsk, TIF_SSBD);
+
+                if (task_spec_ib_disable(tsk))
+                        set_tsk_thread_flag(tsk, TIF_SPEC_IB);
+                else
+                        clear_tsk_thread_flag(tsk, TIF_SPEC_IB);
+        }
+        /* Return the updated threadinfo flags*/
+        return task_thread_info(tsk)->flags;
 }
 
-void speculative_store_bypass_update(unsigned long tif)
+void speculation_ctrl_update(unsigned long tif)
 {
+        /* Forced update. Make sure all relevant TIF flags are different */
         preempt_disable();
-        __speculative_store_bypass_update(tif);
+        __speculation_ctrl_update(~tif, tif);
         preempt_enable();
 }
 
-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
-                      struct tss_struct *tss)
+/* Called from seccomp/prctl update */
+void speculation_ctrl_update_current(void)
+{
+        preempt_disable();
+        speculation_ctrl_update(speculation_ctrl_update_tif(current));
+        preempt_enable();
+}
+
+void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
 {
         struct thread_struct *prev, *next;
         unsigned long tifp, tifn;
@@ -430,7 +486,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
 
         tifn = READ_ONCE(task_thread_info(next_p)->flags);
         tifp = READ_ONCE(task_thread_info(prev_p)->flags);
-        switch_to_bitmap(tss, prev, next, tifp, tifn);
+        switch_to_bitmap(prev, next, tifp, tifn);
 
         propagate_user_return_notify(prev_p, next_p);
 
@@ -451,8 +507,15 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
         if ((tifp ^ tifn) & _TIF_NOCPUID)
                 set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
 
-        if ((tifp ^ tifn) & _TIF_SSBD)
-                __speculative_store_bypass_update(tifn);
+        if (likely(!((tifp | tifn) & _TIF_SPEC_FORCE_UPDATE))) {
+                __speculation_ctrl_update(tifp, tifn);
+        } else {
+                speculation_ctrl_update_tif(prev_p);
+                tifn = speculation_ctrl_update_tif(next_p);
+
+                /* Enforce MSR update to ensure consistent state */
+                __speculation_ctrl_update(~tifn, tifn);
+        }
 }
 
 /*
diff --git a/arch/x86/kernel/process.h b/arch/x86/kernel/process.h
new file mode 100644
index 000000000000..898e97cf6629
--- /dev/null
+++ b/arch/x86/kernel/process.h
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0
+//
+// Code shared between 32 and 64 bit
+
+#include <asm/spec-ctrl.h>
+
+void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p);
+
+/*
+ * This needs to be inline to optimize for the common case where no extra
+ * work needs to be done.
+ */
+static inline void switch_to_extra(struct task_struct *prev,
+                                   struct task_struct *next)
+{
+        unsigned long next_tif = task_thread_info(next)->flags;
+        unsigned long prev_tif = task_thread_info(prev)->flags;
+
+        if (IS_ENABLED(CONFIG_SMP)) {
+                /*
+                 * Avoid __switch_to_xtra() invocation when conditional
+                 * STIPB is disabled and the only different bit is
+                 * TIF_SPEC_IB. For CONFIG_SMP=n TIF_SPEC_IB is not
+                 * in the TIF_WORK_CTXSW masks.
+                 */
+                if (!static_branch_likely(&switch_to_cond_stibp)) {
+                        prev_tif &= ~_TIF_SPEC_IB;
+                        next_tif &= ~_TIF_SPEC_IB;
+                }
+        }
+
+        /*
+         * __switch_to_xtra() handles debug registers, i/o bitmaps,
+         * speculation mitigations etc.
+         */
+        if (unlikely(next_tif & _TIF_WORK_CTXSW_NEXT ||
+                     prev_tif & _TIF_WORK_CTXSW_PREV))
+                __switch_to_xtra(prev, next);
+}
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 5046a3c9dec2..d3e593eb189f 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -59,6 +59,8 @@
 #include <asm/intel_rdt_sched.h>
 #include <asm/proto.h>
 
+#include "process.h"
+
 void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
         unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
@@ -232,7 +234,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         struct fpu *prev_fpu = &prev->fpu;
         struct fpu *next_fpu = &next->fpu;
         int cpu = smp_processor_id();
-        struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
 
         /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
 
@@ -264,12 +265,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         if (get_kernel_rpl() && unlikely(prev->iopl != next->iopl))
                 set_iopl_mask(next->iopl);
 
-        /*
-         * Now maybe handle debug registers and/or IO bitmaps
-         */
-        if (unlikely(task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV ||
-                     task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT))
-                __switch_to_xtra(prev_p, next_p, tss);
+        switch_to_extra(prev_p, next_p);
 
         /*
          * Leave lazy mode, flushing any hypercalls made here.
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 0e0b4288a4b2..bbfbf017065c 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -60,6 +60,8 @@
 #include <asm/unistd_32_ia32.h>
 #endif
 
+#include "process.h"
+
 /* Prints also some state that isn't saved in the pt_regs */
 void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
@@ -553,7 +555,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         struct fpu *prev_fpu = &prev->fpu;
         struct fpu *next_fpu = &next->fpu;
         int cpu = smp_processor_id();
-        struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
 
         WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
                      this_cpu_read(irq_count) != -1);
@@ -617,12 +618,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         /* Reload sp0. */
         update_task_stack(next_p);
 
-        /*
-         * Now maybe reload the debug registers and handle I/O bitmaps
-         */
-        if (unlikely(task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT ||
-                     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
-                __switch_to_xtra(prev_p, next_p, tss);
+        switch_to_extra(prev_p, next_p);
 
 #ifdef CONFIG_XEN_PV
         /*
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index b74e7bfed6ab..d494b9bfe618 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1280,23 +1280,6 @@ void __init setup_arch(char **cmdline_p)
         unwind_init();
 }
 
-/*
- * From boot protocol 2.14 onwards we expect the bootloader to set the
- * version to "0x8000 | <used version>". In case we find a version >= 2.14
- * without the 0x8000 we assume the boot loader supports 2.13 only and
- * reset the version accordingly. The 0x8000 flag is removed in any case.
- */
-void __init x86_verify_bootdata_version(void)
-{
-        if (boot_params.hdr.version & VERSION_WRITTEN)
-                boot_params.hdr.version &= ~VERSION_WRITTEN;
-        else if (boot_params.hdr.version >= 0x020e)
-                boot_params.hdr.version = 0x020d;
-
-        if (boot_params.hdr.version < 0x020e)
-                boot_params.hdr.acpi_rsdp_addr = 0;
-}
-
 #ifdef CONFIG_X86_32
 
 static struct resource video_ram_resource = {
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 89db20f8cb70..c4533d05c214 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -55,7 +55,7 @@
 #define PRIo64 "o"
 
 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
-#define apic_debug(fmt, arg...)
+#define apic_debug(fmt, arg...) do {} while (0)
 
 /* 14 is the version for Xeon and Pentium 8.4.8*/
 #define APIC_VERSION                    (0x14UL | ((KVM_APIC_LVT_NUM - 1) << 16))
@@ -576,6 +576,11 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
         rcu_read_lock();
         map = rcu_dereference(kvm->arch.apic_map);
 
+        if (unlikely(!map)) {
+                count = -EOPNOTSUPP;
+                goto out;
+        }
+
         if (min > map->max_apic_id)
                 goto out;
         /* Bits above cluster_size are masked in the caller.  */
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index cf5f572f2305..7c03c0f35444 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -5074,9 +5074,9 @@ static bool need_remote_flush(u64 old, u64 new)
 }
 
 static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
-                                    const u8 *new, int *bytes)
+                                    int *bytes)
 {
-        u64 gentry;
+        u64 gentry = 0;
         int r;
 
         /*
@@ -5088,22 +5088,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
                 /* Handle a 32-bit guest writing two halves of a 64-bit gpte */
                 *gpa &= ~(gpa_t)7;
                 *bytes = 8;
-                r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);
-                if (r)
-                        gentry = 0;
-                new = (const u8 *)&gentry;
         }
 
-        switch (*bytes) {
-        case 4:
-                gentry = *(const u32 *)new;
-                break;
-        case 8:
-                gentry = *(const u64 *)new;
-                break;
-        default:
-                gentry = 0;
-                break;
+        if (*bytes == 4 || *bytes == 8) {
+                r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes);
+                if (r)
+                        gentry = 0;
         }
 
         return gentry;
@@ -5207,8 +5197,6 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
 
         pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
 
-        gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);
-
         /*
          * No need to care whether allocation memory is successful
          * or not since pte prefetch is skiped if it does not have
@@ -5217,6 +5205,9 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
         mmu_topup_memory_caches(vcpu);
 
         spin_lock(&vcpu->kvm->mmu_lock);
+
+        gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes);
+
         ++vcpu->kvm->stat.mmu_pte_write;
         kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 0e21ccc46792..cc6467b35a85 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1446,7 +1446,7 @@ static u64 svm_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
         return vcpu->arch.tsc_offset;
 }
 
-static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
         u64 g_tsc_offset = 0;
@@ -1464,6 +1464,7 @@ static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
         svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
 
         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
+        return svm->vmcb->control.tsc_offset;
 }
 
 static void avic_init_vmcb(struct vcpu_svm *svm)
@@ -1664,20 +1665,23 @@ static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu,
 static int avic_init_access_page(struct kvm_vcpu *vcpu)
 {
         struct kvm *kvm = vcpu->kvm;
-        int ret;
+        int ret = 0;
 
+        mutex_lock(&kvm->slots_lock);
         if (kvm->arch.apic_access_page_done)
-                return 0;
+                goto out;
 
-        ret = x86_set_memory_region(kvm,
-                                    APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
-                                    APIC_DEFAULT_PHYS_BASE,
-                                    PAGE_SIZE);
+        ret = __x86_set_memory_region(kvm,
+                                      APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
+                                      APIC_DEFAULT_PHYS_BASE,
+                                      PAGE_SIZE);
         if (ret)
-                return ret;
+                goto out;
 
         kvm->arch.apic_access_page_done = true;
-        return 0;
+out:
+        mutex_unlock(&kvm->slots_lock);
+        return ret;
 }
 
 static int avic_init_backing_page(struct kvm_vcpu *vcpu)
@@ -2189,21 +2193,31 @@ out:
         return ERR_PTR(err);
 }
 
+static void svm_clear_current_vmcb(struct vmcb *vmcb)
+{
+        int i;
+
+        for_each_online_cpu(i)
+                cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL);
+}
+
 static void svm_free_vcpu(struct kvm_vcpu *vcpu)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
+        /*
+         * The vmcb page can be recycled, causing a false negative in
+         * svm_vcpu_load(). So, ensure that no logical CPU has this
+         * vmcb page recorded as its current vmcb.
+         */
+        svm_clear_current_vmcb(svm->vmcb);
+
         __free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));
         __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
         __free_page(virt_to_page(svm->nested.hsave));
         __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
         kvm_vcpu_uninit(vcpu);
         kmem_cache_free(kvm_vcpu_cache, svm);
-        /*
-         * The vmcb page can be recycled, causing a false negative in
-         * svm_vcpu_load(). So do a full IBPB now.
-         */
-        indirect_branch_prediction_barrier();
 }
 
 static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
@@ -7149,7 +7163,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
         .has_wbinvd_exit = svm_has_wbinvd_exit,
 
         .read_l1_tsc_offset = svm_read_l1_tsc_offset,
-        .write_tsc_offset = svm_write_tsc_offset,
+        .write_l1_tsc_offset = svm_write_l1_tsc_offset,
 
         .set_tdp_cr3 = set_tdp_cr3,
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4555077d69ce..02edd9960e9d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -174,6 +174,7 @@ module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
  * refer SDM volume 3b section 21.6.13 & 22.1.3.
  */
 static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
+module_param(ple_gap, uint, 0444);
 
 static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
 module_param(ple_window, uint, 0444);
@@ -984,6 +985,7 @@ struct vcpu_vmx {
         struct shared_msr_entry *guest_msrs;
         int                   nmsrs;
         int                   save_nmsrs;
+        bool                  guest_msrs_dirty;
         unsigned long         host_idt_base;
 #ifdef CONFIG_X86_64
         u64                   msr_host_kernel_gs_base;
@@ -1306,7 +1308,7 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
 static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
                                             u16 error_code);
 static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu);
-static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
                                                           u32 msr, int type);
 
 static DEFINE_PER_CPU(struct vmcs *, vmxarea);
@@ -1610,12 +1612,6 @@ static int nested_enable_evmcs(struct kvm_vcpu *vcpu,
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
 
-        /* We don't support disabling the feature for simplicity. */
-        if (vmx->nested.enlightened_vmcs_enabled)
-                return 0;
-
-        vmx->nested.enlightened_vmcs_enabled = true;
-
         /*
          * vmcs_version represents the range of supported Enlightened VMCS
          * versions: lower 8 bits is the minimal version, higher 8 bits is the
@@ -1625,6 +1621,12 @@ static int nested_enable_evmcs(struct kvm_vcpu *vcpu,
         if (vmcs_version)
                 *vmcs_version = (KVM_EVMCS_VERSION << 8) | 1;
 
+        /* We don't support disabling the feature for simplicity. */
+        if (vmx->nested.enlightened_vmcs_enabled)
+                return 0;
+
+        vmx->nested.enlightened_vmcs_enabled = true;
+
         vmx->nested.msrs.pinbased_ctls_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
         vmx->nested.msrs.entry_ctls_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
         vmx->nested.msrs.exit_ctls_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
@@ -2897,6 +2899,20 @@ static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
 
         vmx->req_immediate_exit = false;
 
+        /*
+         * Note that guest MSRs to be saved/restored can also be changed
+         * when guest state is loaded. This happens when guest transitions
+         * to/from long-mode by setting MSR_EFER.LMA.
+         */
+        if (!vmx->loaded_cpu_state || vmx->guest_msrs_dirty) {
+                vmx->guest_msrs_dirty = false;
+                for (i = 0; i < vmx->save_nmsrs; ++i)
+                        kvm_set_shared_msr(vmx->guest_msrs[i].index,
+                                           vmx->guest_msrs[i].data,
+                                           vmx->guest_msrs[i].mask);
+
+        }
+
         if (vmx->loaded_cpu_state)
                 return;
 
@@ -2957,11 +2973,6 @@ static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
                 vmcs_writel(HOST_GS_BASE, gs_base);
                 host_state->gs_base = gs_base;
         }
-
-        for (i = 0; i < vmx->save_nmsrs; ++i)
-                kvm_set_shared_msr(vmx->guest_msrs[i].index,
-                                   vmx->guest_msrs[i].data,
-                                   vmx->guest_msrs[i].mask);
 }
 
 static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
@@ -3436,6 +3447,7 @@ static void setup_msrs(struct vcpu_vmx *vmx)
                 move_msr_up(vmx, index, save_nmsrs++);
 
         vmx->save_nmsrs = save_nmsrs;
+        vmx->guest_msrs_dirty = true;
 
         if (cpu_has_vmx_msr_bitmap())
                 vmx_update_msr_bitmap(&vmx->vcpu);
@@ -3452,11 +3464,9 @@ static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
         return vcpu->arch.tsc_offset;
 }
 
-/*
- * writes 'offset' into guest's timestamp counter offset register
- */
-static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
+        u64 active_offset = offset;
         if (is_guest_mode(vcpu)) {
                 /*
                  * We're here if L1 chose not to trap WRMSR to TSC. According
@@ -3464,17 +3474,16 @@ static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
                  * set for L2 remains unchanged, and still needs to be added
                  * to the newly set TSC to get L2's TSC.
                  */
-                struct vmcs12 *vmcs12;
-                /* recalculate vmcs02.TSC_OFFSET: */
-                vmcs12 = get_vmcs12(vcpu);
-                vmcs_write64(TSC_OFFSET, offset +
-                        (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING) ?
-                         vmcs12->tsc_offset : 0));
+                struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+                if (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING))
+                        active_offset += vmcs12->tsc_offset;
         } else {
                 trace_kvm_write_tsc_offset(vcpu->vcpu_id,
                                            vmcs_read64(TSC_OFFSET), offset);
-                vmcs_write64(TSC_OFFSET, offset);
         }
+
+        vmcs_write64(TSC_OFFSET, active_offset);
+        return active_offset;
 }
 
 /*
@@ -5944,7 +5953,7 @@ static void free_vpid(int vpid)
         spin_unlock(&vmx_vpid_lock);
 }
 
-static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
                                                           u32 msr, int type)
 {
         int f = sizeof(unsigned long);
@@ -5982,7 +5991,7 @@ static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bit
         }
 }
 
-static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
                                                          u32 msr, int type)
 {
         int f = sizeof(unsigned long);
@@ -6020,7 +6029,7 @@ static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitm
         }
 }
 
-static void __always_inline vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
+static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
                                                       u32 msr, int type, bool value)
 {
         if (value)
@@ -8664,8 +8673,6 @@ static int copy_enlightened_to_vmcs12(struct vcpu_vmx *vmx)
         struct vmcs12 *vmcs12 = vmx->nested.cached_vmcs12;
         struct hv_enlightened_vmcs *evmcs = vmx->nested.hv_evmcs;
 
-        vmcs12->hdr.revision_id = evmcs->revision_id;
-
         /* HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE */
         vmcs12->tpr_threshold = evmcs->tpr_threshold;
         vmcs12->guest_rip = evmcs->guest_rip;
@@ -9369,7 +9376,30 @@ static int nested_vmx_handle_enlightened_vmptrld(struct kvm_vcpu *vcpu,
 
                 vmx->nested.hv_evmcs = kmap(vmx->nested.hv_evmcs_page);
 
-                if (vmx->nested.hv_evmcs->revision_id != VMCS12_REVISION) {
+                /*
+                 * Currently, KVM only supports eVMCS version 1
+                 * (== KVM_EVMCS_VERSION) and thus we expect guest to set this
+                 * value to first u32 field of eVMCS which should specify eVMCS
+                 * VersionNumber.
+                 *
+                 * Guest should be aware of supported eVMCS versions by host by
+                 * examining CPUID.0x4000000A.EAX[0:15]. Host userspace VMM is
+                 * expected to set this CPUID leaf according to the value
+                 * returned in vmcs_version from nested_enable_evmcs().
+                 *
+                 * However, it turns out that Microsoft Hyper-V fails to comply
+                 * to their own invented interface: When Hyper-V use eVMCS, it
+                 * just sets first u32 field of eVMCS to revision_id specified
+                 * in MSR_IA32_VMX_BASIC. Instead of used eVMCS version number
+                 * which is one of the supported versions specified in
+                 * CPUID.0x4000000A.EAX[0:15].
+                 *
+                 * To overcome Hyper-V bug, we accept here either a supported
+                 * eVMCS version or VMCS12 revision_id as valid values for first
+                 * u32 field of eVMCS.
+                 */
+                if ((vmx->nested.hv_evmcs->revision_id != KVM_EVMCS_VERSION) &&
+                    (vmx->nested.hv_evmcs->revision_id != VMCS12_REVISION)) {
                         nested_release_evmcs(vcpu);
                         return 0;
                 }
@@ -9390,9 +9420,11 @@ static int nested_vmx_handle_enlightened_vmptrld(struct kvm_vcpu *vcpu,
                  * present in struct hv_enlightened_vmcs, ...). Make sure there
                  * are no leftovers.
                  */
-                if (from_launch)
-                        memset(vmx->nested.cached_vmcs12, 0,
-                               sizeof(*vmx->nested.cached_vmcs12));
+                if (from_launch) {
+                        struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+                        memset(vmcs12, 0, sizeof(*vmcs12));
+                        vmcs12->hdr.revision_id = VMCS12_REVISION;
+                }
 
         }
         return 1;
@@ -15062,7 +15094,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
         .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
 
         .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
-        .write_tsc_offset = vmx_write_tsc_offset,
+        .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
 
         .set_tdp_cr3 = vmx_set_cr3,
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 5cd5647120f2..d02937760c3b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1665,8 +1665,7 @@ EXPORT_SYMBOL_GPL(kvm_read_l1_tsc);
 
 static void kvm_vcpu_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
-        kvm_x86_ops->write_tsc_offset(vcpu, offset);
-        vcpu->arch.tsc_offset = offset;
+        vcpu->arch.tsc_offset = kvm_x86_ops->write_l1_tsc_offset(vcpu, offset);
 }
 
 static inline bool kvm_check_tsc_unstable(void)
@@ -1794,7 +1793,8 @@ EXPORT_SYMBOL_GPL(kvm_write_tsc);
 static inline void adjust_tsc_offset_guest(struct kvm_vcpu *vcpu,
                                            s64 adjustment)
 {
-        kvm_vcpu_write_tsc_offset(vcpu, vcpu->arch.tsc_offset + adjustment);
+        u64 tsc_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu);
+        kvm_vcpu_write_tsc_offset(vcpu, tsc_offset + adjustment);
 }
 
 static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
@@ -6918,6 +6918,7 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr,
         clock_pairing.nsec = ts.tv_nsec;
         clock_pairing.tsc = kvm_read_l1_tsc(vcpu, cycle);
         clock_pairing.flags = 0;
+        memset(&clock_pairing.pad, 0, sizeof(clock_pairing.pad));
 
         ret = 0;
         if (kvm_write_guest(vcpu->kvm, paddr, &clock_pairing,
@@ -7455,7 +7456,8 @@ static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
         else {
                 if (vcpu->arch.apicv_active)
                         kvm_x86_ops->sync_pir_to_irr(vcpu);
-                kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
+                if (ioapic_in_kernel(vcpu->kvm))
+                        kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
         }
 
         if (is_guest_mode(vcpu))
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index bddd6b3cee1d..03b6b4c2238d 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -7,7 +7,6 @@
 #include <linux/export.h>
 #include <linux/cpu.h>
 #include <linux/debugfs.h>
-#include <linux/ptrace.h>
 
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
@@ -31,6 +30,12 @@
  */
 
 /*
+ * Use bit 0 to mangle the TIF_SPEC_IB state into the mm pointer which is
+ * stored in cpu_tlb_state.last_user_mm_ibpb.
+ */
+#define LAST_USER_MM_IBPB       0x1UL
+
+/*
  * We get here when we do something requiring a TLB invalidation
  * but could not go invalidate all of the contexts.  We do the
  * necessary invalidation by clearing out the 'ctx_id' which
@@ -181,17 +186,87 @@ static void sync_current_stack_to_mm(struct mm_struct *mm)
         }
 }
 
-static bool ibpb_needed(struct task_struct *tsk, u64 last_ctx_id)
+static inline unsigned long mm_mangle_tif_spec_ib(struct task_struct *next)
+{
+        unsigned long next_tif = task_thread_info(next)->flags;
+        unsigned long ibpb = (next_tif >> TIF_SPEC_IB) & LAST_USER_MM_IBPB;
+
+        return (unsigned long)next->mm | ibpb;
+}
+
+static void cond_ibpb(struct task_struct *next)
 {
+        if (!next || !next->mm)
+                return;
+
         /*
-         * Check if the current (previous) task has access to the memory
-         * of the @tsk (next) task. If access is denied, make sure to
-         * issue a IBPB to stop user->user Spectre-v2 attacks.
-         *
-         * Note: __ptrace_may_access() returns 0 or -ERRNO.
+         * Both, the conditional and the always IBPB mode use the mm
+         * pointer to avoid the IBPB when switching between tasks of the
+         * same process. Using the mm pointer instead of mm->context.ctx_id
+         * opens a hypothetical hole vs. mm_struct reuse, which is more or
+         * less impossible to control by an attacker. Aside of that it
+         * would only affect the first schedule so the theoretically
+         * exposed data is not really interesting.
          */
-        return (tsk && tsk->mm && tsk->mm->context.ctx_id != last_ctx_id &&
-                ptrace_may_access_sched(tsk, PTRACE_MODE_SPEC_IBPB));
+        if (static_branch_likely(&switch_mm_cond_ibpb)) {
+                unsigned long prev_mm, next_mm;
+
+                /*
+                 * This is a bit more complex than the always mode because
+                 * it has to handle two cases:
+                 *
+                 * 1) Switch from a user space task (potential attacker)
+                 *    which has TIF_SPEC_IB set to a user space task
+                 *    (potential victim) which has TIF_SPEC_IB not set.
+                 *
+                 * 2) Switch from a user space task (potential attacker)
+                 *    which has TIF_SPEC_IB not set to a user space task
+                 *    (potential victim) which has TIF_SPEC_IB set.
+                 *
+                 * This could be done by unconditionally issuing IBPB when
+                 * a task which has TIF_SPEC_IB set is either scheduled in
+                 * or out. Though that results in two flushes when:
+                 *
+                 * - the same user space task is scheduled out and later
+                 *   scheduled in again and only a kernel thread ran in
+                 *   between.
+                 *
+                 * - a user space task belonging to the same process is
+                 *   scheduled in after a kernel thread ran in between
+                 *
+                 * - a user space task belonging to the same process is
+                 *   scheduled in immediately.
+                 *
+                 * Optimize this with reasonably small overhead for the
+                 * above cases. Mangle the TIF_SPEC_IB bit into the mm
+                 * pointer of the incoming task which is stored in
+                 * cpu_tlbstate.last_user_mm_ibpb for comparison.
+                 */
+                next_mm = mm_mangle_tif_spec_ib(next);
+                prev_mm = this_cpu_read(cpu_tlbstate.last_user_mm_ibpb);
+
+                /*
+                 * Issue IBPB only if the mm's are different and one or
+                 * both have the IBPB bit set.
+                 */
+                if (next_mm != prev_mm &&
+                    (next_mm | prev_mm) & LAST_USER_MM_IBPB)
+                        indirect_branch_prediction_barrier();
+
+                this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, next_mm);
+        }
+
+        if (static_branch_unlikely(&switch_mm_always_ibpb)) {
+                /*
+                 * Only flush when switching to a user space task with a
+                 * different context than the user space task which ran
+                 * last on this CPU.
+                 */
+                if (this_cpu_read(cpu_tlbstate.last_user_mm) != next->mm) {
+                        indirect_branch_prediction_barrier();
+                        this_cpu_write(cpu_tlbstate.last_user_mm, next->mm);
+                }
+        }
 }
 
 void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
@@ -292,22 +367,12 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 new_asid = prev_asid;
                 need_flush = true;
         } else {
-                u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id);
-
                 /*
                  * Avoid user/user BTB poisoning by flushing the branch
                  * predictor when switching between processes. This stops
                  * one process from doing Spectre-v2 attacks on another.
-                 *
-                 * As an optimization, flush indirect branches only when
-                 * switching into a processes that can't be ptrace by the
-                 * current one (as in such case, attacker has much more
-                 * convenient way how to tamper with the next process than
-                 * branch buffer poisoning).
                  */
-                if (static_cpu_has(X86_FEATURE_USE_IBPB) &&
-                                ibpb_needed(tsk, last_ctx_id))
-                        indirect_branch_prediction_barrier();
+                cond_ibpb(tsk);
 
                 if (IS_ENABLED(CONFIG_VMAP_STACK)) {
                         /*
@@ -365,14 +430,6 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
         }
 
-        /*
-         * Record last user mm's context id, so we can avoid
-         * flushing branch buffer with IBPB if we switch back
-         * to the same user.
-         */
-        if (next != &init_mm)
-                this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
-
         /* Make sure we write CR3 before loaded_mm. */
         barrier();
 
@@ -441,7 +498,7 @@ void initialize_tlbstate_and_flush(void)
         write_cr3(build_cr3(mm->pgd, 0));
 
         /* Reinitialize tlbstate. */
-        this_cpu_write(cpu_tlbstate.last_ctx_id, mm->context.ctx_id);
+        this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, LAST_USER_MM_IBPB);
         this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
         this_cpu_write(cpu_tlbstate.next_asid, 1);
         this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e996e8e744cb..750f46ad018a 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -10,7 +10,6 @@
 #include <xen/xen.h>
 #include <xen/features.h>
 #include <xen/page.h>
-#include <xen/interface/memory.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -346,80 +345,3 @@ void xen_arch_unregister_cpu(int num)
 }
 EXPORT_SYMBOL(xen_arch_unregister_cpu);
 #endif
-
-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
-void __init arch_xen_balloon_init(struct resource *hostmem_resource)
-{
-        struct xen_memory_map memmap;
-        int rc;
-        unsigned int i, last_guest_ram;
-        phys_addr_t max_addr = PFN_PHYS(max_pfn);
-        struct e820_table *xen_e820_table;
-        const struct e820_entry *entry;
-        struct resource *res;
-
-        if (!xen_initial_domain())
-                return;
-
-        xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
-        if (!xen_e820_table)
-                return;
-
-        memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
-        set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
-        rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
-        if (rc) {
-                pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
-                goto out;
-        }
-
-        last_guest_ram = 0;
-        for (i = 0; i < memmap.nr_entries; i++) {
-                if (xen_e820_table->entries[i].addr >= max_addr)
-                        break;
-                if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
-                        last_guest_ram = i;
-        }
-
-        entry = &xen_e820_table->entries[last_guest_ram];
-        if (max_addr >= entry->addr + entry->size)
-                goto out; /* No unallocated host RAM. */
-
-        hostmem_resource->start = max_addr;
-        hostmem_resource->end = entry->addr + entry->size;
-
-        /*
-         * Mark non-RAM regions between the end of dom0 RAM and end of host RAM
-         * as unavailable. The rest of that region can be used for hotplug-based
-         * ballooning.
-         */
-        for (; i < memmap.nr_entries; i++) {
-                entry = &xen_e820_table->entries[i];
-
-                if (entry->type == E820_TYPE_RAM)
-                        continue;
-
-                if (entry->addr >= hostmem_resource->end)
-                        break;
-
-                res = kzalloc(sizeof(*res), GFP_KERNEL);
-                if (!res)
-                        goto out;
-
-                res->name = "Unavailable host RAM";
-                res->start = entry->addr;
-                res->end = (entry->addr + entry->size < hostmem_resource->end) ?
-                            entry->addr + entry->size : hostmem_resource->end;
-                rc = insert_resource(hostmem_resource, res);
-                if (rc) {
-                        pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
-                                __func__, res->start, res->end, rc);
-                        kfree(res);
-                        goto  out;
-                }
-        }
-
- out:
-        kfree(xen_e820_table);
-}
-#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 2bce7958ce8b..0766a08bdf45 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -69,6 +69,11 @@ void xen_mc_flush(void)
 
         trace_xen_mc_flush(b->mcidx, b->argidx, b->cbidx);
 
+#if MC_DEBUG
+        memcpy(b->debug, b->entries,
+               b->mcidx * sizeof(struct multicall_entry));
+#endif
+
         switch (b->mcidx) {
         case 0:
                 /* no-op */
@@ -87,32 +92,34 @@ void xen_mc_flush(void)
                 break;
 
         default:
-#if MC_DEBUG
-                memcpy(b->debug, b->entries,
-                       b->mcidx * sizeof(struct multicall_entry));
-#endif
-
                 if (HYPERVISOR_multicall(b->entries, b->mcidx) != 0)
                         BUG();
                 for (i = 0; i < b->mcidx; i++)
                         if (b->entries[i].result < 0)
                                 ret++;
+        }
 
+        if (WARN_ON(ret)) {
+                pr_err("%d of %d multicall(s) failed: cpu %d\n",
+                       ret, b->mcidx, smp_processor_id());
+                for (i = 0; i < b->mcidx; i++) {
+                        if (b->entries[i].result < 0) {
 #if MC_DEBUG
-                if (ret) {
-                        printk(KERN_ERR "%d multicall(s) failed: cpu %d\n",
-                               ret, smp_processor_id());
-                        dump_stack();
-                        for (i = 0; i < b->mcidx; i++) {
-                                printk(KERN_DEBUG "  call %2d/%d: op=%lu arg=[%lx] result=%ld\t%pF\n",
-                                       i+1, b->mcidx,
+                                pr_err("  call %2d: op=%lu arg=[%lx] result=%ld\t%pF\n",
+                                       i + 1,
                                        b->debug[i].op,
                                        b->debug[i].args[0],
                                        b->entries[i].result,
                                        b->caller[i]);
+#else
+                                pr_err("  call %2d: op=%lu arg=[%lx] result=%ld\n",
+                                       i + 1,
+                                       b->entries[i].op,
+                                       b->entries[i].args[0],
+                                       b->entries[i].result);
+#endif
                         }
                 }
-#endif
         }
 
         b->mcidx = 0;
@@ -126,8 +133,6 @@ void xen_mc_flush(void)
         b->cbidx = 0;
 
         local_irq_restore(flags);
-
-        WARN_ON(ret);
 }
 
 struct multicall_space __xen_mc_entry(size_t args)
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 1163e33121fb..075ed47993bb 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -808,6 +808,7 @@ char * __init xen_memory_setup(void)
         addr = xen_e820_table.entries[0].addr;
         size = xen_e820_table.entries[0].size;
         while (i < xen_e820_table.nr_entries) {
+                bool discard = false;
 
                 chunk_size = size;
                 type = xen_e820_table.entries[i].type;
@@ -823,10 +824,11 @@ char * __init xen_memory_setup(void)
                                 xen_add_extra_mem(pfn_s, n_pfns);
                                 xen_max_p2m_pfn = pfn_s + n_pfns;
                         } else
-                                type = E820_TYPE_UNUSABLE;
+                                discard = true;
                 }
 
-                xen_align_and_add_e820_region(addr, chunk_size, type);
+                if (!discard)
+                        xen_align_and_add_e820_region(addr, chunk_size, type);
 
                 addr += chunk_size;
                 size -= chunk_size;
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 1c8a8816a402..3776122c87cc 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -3,22 +3,17 @@
  * Split spinlock implementation out into its own file, so it can be
  * compiled in a FTRACE-compatible way.
  */
-#include <linux/kernel_stat.h>
+#include <linux/kernel.h>
 #include <linux/spinlock.h>
-#include <linux/debugfs.h>
-#include <linux/log2.h>
-#include <linux/gfp.h>
 #include <linux/slab.h>
 #include <linux/atomic.h>
 
 #include <asm/paravirt.h>
 #include <asm/qspinlock.h>
 
-#include <xen/interface/xen.h>
 #include <xen/events.h>
 
 #include "xen-ops.h"
-#include "debugfs.h"
 
 static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
 static DEFINE_PER_CPU(char *, irq_name);
diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c
index 67904f55f188..120dd746a147 100644
--- a/arch/xtensa/kernel/asm-offsets.c
+++ b/arch/xtensa/kernel/asm-offsets.c
@@ -94,14 +94,14 @@ int main(void)
         DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp));
         DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable));
 #if XTENSA_HAVE_COPROCESSORS
-        DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp));
-        DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp));
+        DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0));
+        DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1));
+        DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2));
+        DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3));
+        DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4));
+        DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5));
+        DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6));
+        DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7));
 #endif
         DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user));
         DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t));
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 483dcfb6e681..4bb68133a72a 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -94,18 +94,21 @@ void coprocessor_release_all(struct thread_info *ti)
 
 void coprocessor_flush_all(struct thread_info *ti)
 {
-        unsigned long cpenable;
+        unsigned long cpenable, old_cpenable;
         int i;
 
         preempt_disable();
 
+        RSR_CPENABLE(old_cpenable);
         cpenable = ti->cpenable;
+        WSR_CPENABLE(cpenable);
 
         for (i = 0; i < XCHAL_CP_MAX; i++) {
                 if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti)
                         coprocessor_flush(ti, i);
                 cpenable >>= 1;
         }
+        WSR_CPENABLE(old_cpenable);
 
         preempt_enable();
 }
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index c0845cb1cbb9..d9541be0605a 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -127,12 +127,37 @@ static int ptrace_setregs(struct task_struct *child, void __user *uregs)
 }
 
 
+#if XTENSA_HAVE_COPROCESSORS
+#define CP_OFFSETS(cp) \
+        { \
+                .elf_xtregs_offset = offsetof(elf_xtregs_t, cp), \
+                .ti_offset = offsetof(struct thread_info, xtregs_cp.cp), \
+                .sz = sizeof(xtregs_ ## cp ## _t), \
+        }
+
+static const struct {
+        size_t elf_xtregs_offset;
+        size_t ti_offset;
+        size_t sz;
+} cp_offsets[] = {
+        CP_OFFSETS(cp0),
+        CP_OFFSETS(cp1),
+        CP_OFFSETS(cp2),
+        CP_OFFSETS(cp3),
+        CP_OFFSETS(cp4),
+        CP_OFFSETS(cp5),
+        CP_OFFSETS(cp6),
+        CP_OFFSETS(cp7),
+};
+#endif
+
 static int ptrace_getxregs(struct task_struct *child, void __user *uregs)
 {
         struct pt_regs *regs = task_pt_regs(child);
         struct thread_info *ti = task_thread_info(child);
         elf_xtregs_t __user *xtregs = uregs;
         int ret = 0;
+        int i __maybe_unused;
 
         if (!access_ok(VERIFY_WRITE, uregs, sizeof(elf_xtregs_t)))
                 return -EIO;
@@ -140,8 +165,13 @@ static int ptrace_getxregs(struct task_struct *child, void __user *uregs)
 #if XTENSA_HAVE_COPROCESSORS
         /* Flush all coprocessor registers to memory. */
         coprocessor_flush_all(ti);
-        ret |= __copy_to_user(&xtregs->cp0, &ti->xtregs_cp,
-                              sizeof(xtregs_coprocessor_t));
+
+        for (i = 0; i < ARRAY_SIZE(cp_offsets); ++i)
+                ret |= __copy_to_user((char __user *)xtregs +
+                                      cp_offsets[i].elf_xtregs_offset,
+                                      (const char *)ti +
+                                      cp_offsets[i].ti_offset,
+                                      cp_offsets[i].sz);
 #endif
         ret |= __copy_to_user(&xtregs->opt, &regs->xtregs_opt,
                               sizeof(xtregs->opt));
@@ -157,6 +187,7 @@ static int ptrace_setxregs(struct task_struct *child, void __user *uregs)
         struct pt_regs *regs = task_pt_regs(child);
         elf_xtregs_t *xtregs = uregs;
         int ret = 0;
+        int i __maybe_unused;
 
         if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
                 return -EFAULT;
@@ -166,8 +197,11 @@ static int ptrace_setxregs(struct task_struct *child, void __user *uregs)
         coprocessor_flush_all(ti);
         coprocessor_release_all(ti);
 
-        ret |= __copy_from_user(&ti->xtregs_cp, &xtregs->cp0,
-                                sizeof(xtregs_coprocessor_t));
+        for (i = 0; i < ARRAY_SIZE(cp_offsets); ++i)
+                ret |= __copy_from_user((char *)ti + cp_offsets[i].ti_offset,
+                                        (const char __user *)xtregs +
+                                        cp_offsets[i].elf_xtregs_offset,
+                                        cp_offsets[i].sz);
 #endif
         ret |= __copy_from_user(&regs->xtregs_opt, &xtregs->opt,
                                 sizeof(xtregs->opt));
diff --git a/block/blk-merge.c b/block/blk-merge.c
index e7696c47489a..7695034f4b87 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -820,7 +820,7 @@ static struct request *attempt_merge(struct request_queue *q,
 
         req->__data_len += blk_rq_bytes(next);
 
-        if (req_op(req) != REQ_OP_DISCARD)
+        if (!blk_discard_mergable(req))
                 elv_merge_requests(q, req, next);
 
         /*
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index eaa60c94205a..1f32caa87686 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = {
         {"PNP0200",  0},        /* AT DMA Controller */
         {"ACPI0009", 0},        /* IOxAPIC */
         {"ACPI000A", 0},        /* IOAPIC */
+        {"SMB0001",  0},        /* ACPI SMBUS virtual device */
         {"", 0},
 };
 
diff --git a/drivers/acpi/acpica/exserial.c b/drivers/acpi/acpica/exserial.c
index 0d42f30e5b25..9920fac6413f 100644
--- a/drivers/acpi/acpica/exserial.c
+++ b/drivers/acpi/acpica/exserial.c
@@ -244,7 +244,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
 {
         acpi_status status;
         u32 buffer_length;
-        u32 data_length;
         void *buffer;
         union acpi_operand_object *buffer_desc;
         u32 function;
@@ -282,14 +281,12 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
         case ACPI_ADR_SPACE_SMBUS:
 
                 buffer_length = ACPI_SMBUS_BUFFER_SIZE;
-                data_length = ACPI_SMBUS_DATA_SIZE;
                 function = ACPI_WRITE | (obj_desc->field.attribute << 16);
                 break;
 
         case ACPI_ADR_SPACE_IPMI:
 
                 buffer_length = ACPI_IPMI_BUFFER_SIZE;
-                data_length = ACPI_IPMI_DATA_SIZE;
                 function = ACPI_WRITE;
                 break;
 
@@ -310,7 +307,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
                 /* Add header length to get the full size of the buffer */
 
                 buffer_length += ACPI_SERIAL_HEADER_SIZE;
-                data_length = source_desc->buffer.pointer[1];
                 function = ACPI_WRITE | (accessor_type << 16);
                 break;
 
@@ -318,20 +314,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
                 return_ACPI_STATUS(AE_AML_INVALID_SPACE_ID);
         }
 
-#if 0
-        OBSOLETE ?
-            /* Check for possible buffer overflow */
-            if (data_length > source_desc->buffer.length) {
-                ACPI_ERROR((AE_INFO,
-                            "Length in buffer header (%u)(%u) is greater than "
-                            "the physical buffer length (%u) and will overflow",
-                            data_length, buffer_length,
-                            source_desc->buffer.length));
-
-                return_ACPI_STATUS(AE_AML_BUFFER_LIMIT);
-        }
-#endif
-
         /* Create the transfer/bidirectional/return buffer */
 
         buffer_desc = acpi_ut_create_buffer_object(buffer_length);
@@ -342,7 +324,8 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
         /* Copy the input buffer data to the transfer buffer */
 
         buffer = buffer_desc->buffer.pointer;
-        memcpy(buffer, source_desc->buffer.pointer, data_length);
+        memcpy(buffer, source_desc->buffer.pointer,
+               min(buffer_length, source_desc->buffer.length));
 
         /* Lock entire transaction if requested */
 
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 2a361e22d38d..70f4e80b9246 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
  */
 static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
 {
-        struct acpi_iort_node *node, *msi_parent;
+        struct acpi_iort_node *node, *msi_parent = NULL;
         struct fwnode_handle *iort_fwnode;
         struct acpi_iort_its_group *its;
         int i;
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cb30a524d16d..9f1000d2a40c 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2974,7 +2974,6 @@ static void binder_transaction(struct binder_proc *proc,
                 t->buffer = NULL;
                 goto err_binder_alloc_buf_failed;
         }
-        t->buffer->allow_user_free = 0;
         t->buffer->debug_id = t->debug_id;
         t->buffer->transaction = t;
         t->buffer->target_node = target_node;
@@ -3510,14 +3509,18 @@ static int binder_thread_write(struct binder_proc *proc,
 
                         buffer = binder_alloc_prepare_to_free(&proc->alloc,
                                                               data_ptr);
-                        if (buffer == NULL) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
-                                break;
-                        }
-                        if (!buffer->allow_user_free) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
+                        if (IS_ERR_OR_NULL(buffer)) {
+                                if (PTR_ERR(buffer) == -EPERM) {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                } else {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx no match\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                }
                                 break;
                         }
                         binder_debug(BINDER_DEBUG_FREE_BUFFER,
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 64fd96eada31..030c98f35cca 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -151,16 +151,12 @@ static struct binder_buffer *binder_alloc_prepare_to_free_locked(
                 else {
                         /*
                          * Guard against user threads attempting to
-                         * free the buffer twice
+                         * free the buffer when in use by kernel or
+                         * after it's already been freed.
                          */
-                        if (buffer->free_in_progress) {
-                                binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
-                                                   "%d:%d FREE_BUFFER u%016llx user freed buffer twice\n",
-                                                   alloc->pid, current->pid,
-                                                   (u64)user_ptr);
-                                return NULL;
-                        }
-                        buffer->free_in_progress = 1;
+                        if (!buffer->allow_user_free)
+                                return ERR_PTR(-EPERM);
+                        buffer->allow_user_free = 0;
                         return buffer;
                 }
         }
@@ -500,7 +496,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
 
         rb_erase(best_fit, &alloc->free_buffers);
         buffer->free = 0;
-        buffer->free_in_progress = 0;
+        buffer->allow_user_free = 0;
         binder_insert_allocated_buffer_locked(alloc, buffer);
         binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
                      "%d: binder_alloc_buf size %zd got %pK\n",
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index 9ef64e563856..fb3238c74c8a 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -50,8 +50,7 @@ struct binder_buffer {
         unsigned free:1;
         unsigned allow_user_free:1;
         unsigned async_transaction:1;
-        unsigned free_in_progress:1;
-        unsigned debug_id:28;
+        unsigned debug_id:29;
 
         struct binder_transaction *transaction;
 
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 4e46dc9e41ad..11e1663bdc4d 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1410,7 +1410,7 @@ static int init_q(struct fs_dev *dev, struct queue *txq, int queue,
 
         func_enter ();
 
-        fs_dprintk (FS_DEBUG_INIT, "Inititing queue at %x: %d entries:\n", 
+        fs_dprintk (FS_DEBUG_INIT, "Initializing queue at %x: %d entries:\n",
                     queue, nentries);
 
         p = aligned_kmalloc (sz, GFP_KERNEL, 0x10);
@@ -1443,7 +1443,7 @@ static int init_fp(struct fs_dev *dev, struct freepool *fp, int queue,
 {
         func_enter ();
 
-        fs_dprintk (FS_DEBUG_INIT, "Inititing free pool at %x:\n", queue);
+        fs_dprintk (FS_DEBUG_INIT, "Initializing free pool at %x:\n", queue);
 
         write_fs (dev, FP_CNF(queue), (bufsize * RBFP_RBS) | RBFP_RBSVAL | RBFP_CME);
         write_fs (dev, FP_SA(queue),  0);
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index 4aaf00d2098b..e038e2b3b7ea 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -26,8 +26,14 @@ struct devres_node {
 
 struct devres {
         struct devres_node              node;
-        /* -- 3 pointers */
-        unsigned long long              data[]; /* guarantee ull alignment */
+        /*
+         * Some archs want to perform DMA into kmalloc caches
+         * and need a guaranteed alignment larger than
+         * the alignment of a 64-bit integer.
+         * Thus we use ARCH_KMALLOC_MINALIGN here and get exactly the same
+         * buffer alignment as if it was allocated by plain kmalloc().
+         */
+        u8 __aligned(ARCH_KMALLOC_MINALIGN) data[];
 };
 
 struct devres_group {
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index 3f0e2a14895a..22b53bf26817 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -201,19 +201,28 @@ static const struct of_device_id ti_cpufreq_of_match[] = {
         {},
 };
 
+static const struct of_device_id *ti_cpufreq_match_node(void)
+{
+        struct device_node *np;
+        const struct of_device_id *match;
+
+        np = of_find_node_by_path("/");
+        match = of_match_node(ti_cpufreq_of_match, np);
+        of_node_put(np);
+
+        return match;
+}
+
 static int ti_cpufreq_probe(struct platform_device *pdev)
 {
         u32 version[VERSION_COUNT];
-        struct device_node *np;
         const struct of_device_id *match;
         struct opp_table *ti_opp_table;
         struct ti_cpufreq_data *opp_data;
         const char * const reg_names[] = {"vdd", "vbb"};
         int ret;
 
-        np = of_find_node_by_path("/");
-        match = of_match_node(ti_cpufreq_of_match, np);
-        of_node_put(np);
+        match = dev_get_platdata(&pdev->dev);
         if (!match)
                 return -ENODEV;
 
@@ -290,7 +299,14 @@ fail_put_node:
 
 static int ti_cpufreq_init(void)
 {
-        platform_device_register_simple("ti-cpufreq", -1, NULL, 0);
+        const struct of_device_id *match;
+
+        /* Check to ensure we are on a compatible platform */
+        match = ti_cpufreq_match_node();
+        if (match)
+                platform_device_register_data(NULL, "ti-cpufreq", -1, match,
+                                              sizeof(*match));
+
         return 0;
 }
 module_init(ti_cpufreq_init);
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 5b44ef226904..fc359ca4503d 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -184,6 +184,7 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
         exp_info.ops  = &udmabuf_ops;
         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
         exp_info.priv = ubuf;
+        exp_info.flags = O_RDWR;
 
         buf = dma_buf_export(&exp_info);
         if (IS_ERR(buf)) {
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 7cbac6e8c113..01d936c9fe89 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1641,6 +1641,12 @@ static void atc_free_chan_resources(struct dma_chan *chan)
         atchan->descs_allocated = 0;
         atchan->status = 0;
 
+        /*
+         * Free atslave allocated in at_dma_xlate()
+         */
+        kfree(chan->private);
+        chan->private = NULL;
+
         dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
 }
 
@@ -1675,7 +1681,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
         dma_cap_zero(mask);
         dma_cap_set(DMA_SLAVE, mask);
 
-        atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL);
+        atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
         if (!atslave)
                 return NULL;
 
@@ -2000,6 +2006,8 @@ static int at_dma_remove(struct platform_device *pdev)
         struct resource         *io;
 
         at_dma_off(atdma);
+        if (pdev->dev.of_node)
+                of_dma_controller_free(pdev->dev.of_node);
         dma_async_device_unregister(&atdma->dma_common);
 
         dma_pool_destroy(atdma->memset_pool);
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index fad7c62cfc0e..415849bab233 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -969,13 +969,33 @@ bool efi_is_table_address(unsigned long phys_addr)
 static DEFINE_SPINLOCK(efi_mem_reserve_persistent_lock);
 static struct linux_efi_memreserve *efi_memreserve_root __ro_after_init;
 
-int efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
+static int __init efi_memreserve_map_root(void)
+{
+        if (efi.mem_reserve == EFI_INVALID_TABLE_ADDR)
+                return -ENODEV;
+
+        efi_memreserve_root = memremap(efi.mem_reserve,
+                                       sizeof(*efi_memreserve_root),
+                                       MEMREMAP_WB);
+        if (WARN_ON_ONCE(!efi_memreserve_root))
+                return -ENOMEM;
+        return 0;
+}
+
+int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
 {
         struct linux_efi_memreserve *rsv;
+        int rc;
 
-        if (!efi_memreserve_root)
+        if (efi_memreserve_root == (void *)ULONG_MAX)
                 return -ENODEV;
 
+        if (!efi_memreserve_root) {
+                rc = efi_memreserve_map_root();
+                if (rc)
+                        return rc;
+        }
+
         rsv = kmalloc(sizeof(*rsv), GFP_ATOMIC);
         if (!rsv)
                 return -ENOMEM;
@@ -993,14 +1013,10 @@ int efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
 
 static int __init efi_memreserve_root_init(void)
 {
-        if (efi.mem_reserve == EFI_INVALID_TABLE_ADDR)
-                return -ENODEV;
-
-        efi_memreserve_root = memremap(efi.mem_reserve,
-                                       sizeof(*efi_memreserve_root),
-                                       MEMREMAP_WB);
-        if (!efi_memreserve_root)
-                return -ENOMEM;
+        if (efi_memreserve_root)
+                return 0;
+        if (efi_memreserve_map_root())
+                efi_memreserve_root = (void *)ULONG_MAX;
         return 0;
 }
 early_initcall(efi_memreserve_root_init);
diff --git a/drivers/fsi/Kconfig b/drivers/fsi/Kconfig
index af3a20dd5aa4..99c99a5d57fe 100644
--- a/drivers/fsi/Kconfig
+++ b/drivers/fsi/Kconfig
@@ -46,6 +46,7 @@ config FSI_MASTER_AST_CF
         tristate "FSI master based on Aspeed ColdFire coprocessor"
         depends on GPIOLIB
         depends on GPIO_ASPEED
+        select GENERIC_ALLOCATOR
         ---help---
         This option enables a FSI master using the AST2400 and AST2500 GPIO
         lines driven by the internal ColdFire coprocessor. This requires
diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
index df94021dd9d1..81dc01ac2351 100644
--- a/drivers/fsi/fsi-scom.c
+++ b/drivers/fsi/fsi-scom.c
@@ -20,7 +20,6 @@
 #include <linux/fs.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
-#include <linux/cdev.h>
 #include <linux/list.h>
 
 #include <uapi/linux/fsi.h>
diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c
index b01ba4438501..31e891f00175 100644
--- a/drivers/gnss/serial.c
+++ b/drivers/gnss/serial.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 
@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
index 79cb98950013..71d014edd167 100644
--- a/drivers/gnss/sirf.c
+++ b/drivers/gnss/sirf.c
@@ -16,6 +16,7 @@
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 5c1564fcc24e..bdb29e51b417 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -258,7 +258,7 @@ static int davinci_gpio_probe(struct platform_device *pdev)
         chips->chip.set = davinci_gpio_set;
 
         chips->chip.ngpio = ngpio;
-        chips->chip.base = -1;
+        chips->chip.base = pdata->no_auto_base ? pdata->base : -1;
 
 #ifdef CONFIG_OF_GPIO
         chips->chip.of_gpio_n_cells = 2;
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 8269cffc2967..6a50f9f59c90 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -35,8 +35,8 @@
 #define gpio_mockup_err(...)    pr_err(GPIO_MOCKUP_NAME ": " __VA_ARGS__)
 
 enum {
-        GPIO_MOCKUP_DIR_OUT = 0,
-        GPIO_MOCKUP_DIR_IN = 1,
+        GPIO_MOCKUP_DIR_IN = 0,
+        GPIO_MOCKUP_DIR_OUT = 1,
 };
 
 /*
@@ -131,7 +131,7 @@ static int gpio_mockup_get_direction(struct gpio_chip *gc, unsigned int offset)
 {
         struct gpio_mockup_chip *chip = gpiochip_get_data(gc);
 
-        return chip->lines[offset].dir;
+        return !chip->lines[offset].dir;
 }
 
 static int gpio_mockup_to_irq(struct gpio_chip *gc, unsigned int offset)
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index bfe4c5c9f41c..e9600b556f39 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -268,8 +268,8 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 
         if (pxa_gpio_has_pinctrl()) {
                 ret = pinctrl_gpio_direction_input(chip->base + offset);
-                if (!ret)
-                        return 0;
+                if (ret)
+                        return ret;
         }
 
         spin_lock_irqsave(&gpio_lock, flags);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 230e41562462..a2cbb474901c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1295,7 +1295,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL);
         if (!gdev->descs) {
                 status = -ENOMEM;
-                goto err_free_gdev;
+                goto err_free_ida;
         }
 
         if (chip->ngpio == 0) {
@@ -1427,8 +1427,9 @@ err_free_label:
         kfree_const(gdev->label);
 err_free_descs:
         kfree(gdev->descs);
-err_free_gdev:
+err_free_ida:
         ida_simple_remove(&gpio_ida, gdev->id);
+err_free_gdev:
         /* failures here can mean systems won't boot... */
         pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
                gdev->base, gdev->base + gdev->ngpio - 1,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index c31a8849e9f8..1580ec60b89f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -501,8 +501,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
 
-        amdgpu_dpm_switch_power_profile(adev,
-                                        PP_SMC_POWER_PROFILE_COMPUTE, !idle);
+        if (adev->powerplay.pp_funcs &&
+            adev->powerplay.pp_funcs->switch_power_profile)
+                amdgpu_dpm_switch_power_profile(adev,
+                                                PP_SMC_POWER_PROFILE_COMPUTE,
+                                                !idle);
 }
 
 bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 6748cd7fc129..686a26de50f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -626,6 +626,13 @@ int amdgpu_display_modeset_create_props(struct amdgpu_device *adev)
                                          "dither",
                                          amdgpu_dither_enum_list, sz);
 
+        if (amdgpu_device_has_dc_support(adev)) {
+                adev->mode_info.max_bpc_property =
+                        drm_property_create_range(adev->ddev, 0, "max bpc", 8, 16);
+                if (!adev->mode_info.max_bpc_property)
+                        return -ENOMEM;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index b9e9e8b02fb7..d1b4d9b6aae0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -339,6 +339,8 @@ struct amdgpu_mode_info {
         struct drm_property *audio_property;
         /* FMT dithering */
         struct drm_property *dither_property;
+        /* maximum number of bits per channel for monitor color */
+        struct drm_property *max_bpc_property;
         /* hardcoded DFP edid from BIOS */
         struct edid *bios_hardcoded_edid;
         int bios_hardcoded_edid_size;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index dad0e2342df9..0877ff9a9594 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -181,7 +181,7 @@ static unsigned amdgpu_vm_num_entries(struct amdgpu_device *adev,
 
         if (level == adev->vm_manager.root_level)
                 /* For the root directory */
-                return round_up(adev->vm_manager.max_pfn, 1 << shift) >> shift;
+                return round_up(adev->vm_manager.max_pfn, 1ULL << shift) >> shift;
         else if (level != AMDGPU_VM_PTB)
                 /* Everything in between */
                 return 512;
@@ -1656,9 +1656,11 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                         if (!amdgpu_vm_pt_descendant(adev, &cursor))
                                 return -ENOENT;
                         continue;
-                } else if (frag >= parent_shift) {
+                } else if (frag >= parent_shift &&
+                           cursor.level - 1 != adev->vm_manager.root_level) {
                         /* If the fragment size is even larger than the parent
-                         * shift we should go up one level and check it again.
+                         * shift we should go up one level and check it again
+                         * unless one level up is the root level.
                          */
                         if (!amdgpu_vm_pt_ancestor(&cursor))
                                 return -ENOENT;
@@ -1666,10 +1668,10 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                 }
 
                 /* Looks good so far, calculate parameters for the update */
-                incr = AMDGPU_GPU_PAGE_SIZE << shift;
+                incr = (uint64_t)AMDGPU_GPU_PAGE_SIZE << shift;
                 mask = amdgpu_vm_entries_mask(adev, cursor.level);
                 pe_start = ((cursor.pfn >> shift) & mask) * 8;
-                entry_end = (mask + 1) << shift;
+                entry_end = (uint64_t)(mask + 1) << shift;
                 entry_end += cursor.pfn & ~(entry_end - 1);
                 entry_end = min(entry_end, end);
 
@@ -1682,7 +1684,7 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                                               flags | AMDGPU_PTE_FRAG(frag));
 
                         pe_start += nptes * 8;
-                        dst += nptes * AMDGPU_GPU_PAGE_SIZE << shift;
+                        dst += (uint64_t)nptes * AMDGPU_GPU_PAGE_SIZE << shift;
 
                         frag_start = upd_end;
                         if (frag_start >= frag_end) {
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 6d7baf59d6e1..21363b2b2ee5 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2440,12 +2440,13 @@ static void gfx_v9_0_rlc_start(struct amdgpu_device *adev)
 #endif
 
         WREG32_FIELD15(GC, 0, RLC_CNTL, RLC_ENABLE_F32, 1);
+        udelay(50);
 
         /* carrizo do enable cp interrupt after cp inited */
-        if (!(adev->flags & AMD_IS_APU))
+        if (!(adev->flags & AMD_IS_APU)) {
                 gfx_v9_0_enable_gui_idle_interrupt(adev, true);
-
-        udelay(50);
+                udelay(50);
+        }
 
 #ifdef AMDGPU_RLC_DEBUG_RETRY
         /* RLC_GPM_GENERAL_6 : RLC Ucode version */
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index e1c2b4e9c7b2..73ad02aea2b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -46,6 +46,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin");
 MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin");
 MODULE_FIRMWARE("amdgpu/verde_mc.bin");
 MODULE_FIRMWARE("amdgpu/oland_mc.bin");
+MODULE_FIRMWARE("amdgpu/hainan_mc.bin");
 MODULE_FIRMWARE("amdgpu/si58_mc.bin");
 
 #define MC_SEQ_MISC0__MT__MASK   0xf0000000
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index bf5e6a413dee..4cc0dcb1a187 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -65,6 +65,13 @@
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL                                                             0x01ba
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL_BASE_IDX                                                    0
 
+/* for Vega20 register name change */
+#define mmHDP_MEM_POWER_CTRL    0x00d4
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK  0x00000001L
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK    0x00000002L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK   0x00010000L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK             0x00020000L
+#define mmHDP_MEM_POWER_CTRL_BASE_IDX   0
 /*
  * Indirect registers accessor
  */
@@ -870,15 +877,33 @@ static void soc15_update_hdp_light_sleep(struct amdgpu_device *adev, bool enable
 {
         uint32_t def, data;
 
-        def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+        if (adev->asic_type == CHIP_VEGA20) {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL));
 
-        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
-                data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
-        else
-                data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK;
+                else
+                        data &= ~(HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK);
 
-        if (def != data)
-                WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL), data);
+        } else {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                else
+                        data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+        }
 }
 
 static void soc15_update_drm_clock_gating(struct amdgpu_device *adev, bool enable)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index c1262f62cd9f..ca925200fe09 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2358,8 +2358,15 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
 static enum dc_color_depth
 convert_color_depth_from_display_info(const struct drm_connector *connector)
 {
+        struct dm_connector_state *dm_conn_state =
+                to_dm_connector_state(connector->state);
         uint32_t bpc = connector->display_info.bpc;
 
+        /* TODO: Remove this when there's support for max_bpc in drm */
+        if (dm_conn_state && bpc > dm_conn_state->max_bpc)
+                /* Round down to nearest even number. */
+                bpc = dm_conn_state->max_bpc - (dm_conn_state->max_bpc & 1);
+
         switch (bpc) {
         case 0:
                 /*
@@ -2943,6 +2950,9 @@ int amdgpu_dm_connector_atomic_set_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 dm_new_state->underscan_enable = val;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                dm_new_state->max_bpc = val;
+                ret = 0;
         }
 
         return ret;
@@ -2985,6 +2995,9 @@ int amdgpu_dm_connector_atomic_get_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 *val = dm_state->underscan_enable;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                *val = dm_state->max_bpc;
+                ret = 0;
         }
         return ret;
 }
@@ -3795,6 +3808,9 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         drm_object_attach_property(&aconnector->base.base,
                                 adev->mode_info.underscan_vborder_property,
                                 0);
+        drm_object_attach_property(&aconnector->base.base,
+                                adev->mode_info.max_bpc_property,
+                                0);
 
 }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index 924a38a1fc44..6e069d777ab2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -204,6 +204,7 @@ struct dm_connector_state {
         enum amdgpu_rmx_type scaling;
         uint8_t underscan_vborder;
         uint8_t underscan_hborder;
+        uint8_t max_bpc;
         bool underscan_enable;
         bool freesync_enable;
         bool freesync_capable;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index d02c32a1039c..1b0d209d8367 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -342,10 +342,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                 master->connector_id);
 
         aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
+        drm_connector_attach_encoder(&aconnector->base,
+                                     &aconnector->mst_encoder->base);
 
-        /*
-         * TODO: understand why this one is needed
-         */
         drm_object_attach_property(
                 &connector->base,
                 dev->mode_config.path_property,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index ed35ec0341e6..88f6b35ea6fe 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -4525,12 +4525,12 @@ static int smu7_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *sclk_table = &(data->dpm_table.sclk_table);
         struct smu7_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.sclk_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -4567,12 +4567,12 @@ static int smu7_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *mclk_table = &(data->dpm_table.mclk_table);
         struct smu7_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mclk_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
-        value = (mclk_table->dpm_levels[mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 8c4db86bb4b7..e2bc6e0c229f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4522,15 +4522,13 @@ static int vega10_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega10_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
-
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels
-                        [golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
                         [golden_sclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
@@ -4575,16 +4573,13 @@ static int vega10_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega10_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 74bc37308dc0..54364444ecd1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -2243,12 +2243,12 @@ static int vega12_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega12_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -2264,16 +2264,13 @@ static int vega12_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega12_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index 99861f32b1f9..b4eadd47f3a4 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -75,7 +75,17 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
         data->phy_clk_quad_eqn_b = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
         data->phy_clk_quad_eqn_c = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
 
-        data->registry_data.disallowed_features = 0x0;
+        /*
+         * Disable the following features for now:
+         *   GFXCLK DS
+         *   SOCLK DS
+         *   LCLK DS
+         *   DCEFCLK DS
+         *   FCLK DS
+         *   MP1CLK DS
+         *   MP0CLK DS
+         */
+        data->registry_data.disallowed_features = 0xE0041C00;
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -1313,12 +1323,13 @@ static int vega20_get_sclk_od(
                         &(data->dpm_table.gfx_table);
         struct vega20_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((sclk_table->dpm_levels[sclk_table->count - 1].value -
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) * 100,
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -1358,12 +1369,13 @@ static int vega20_get_mclk_od(
                         &(data->dpm_table.mem_table);
         struct vega20_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((mclk_table->dpm_levels[mclk_table->count - 1].value -
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) * 100,
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index 69dab82a3771..bf589c53b908 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = {
 
 MODULE_DEVICE_TABLE(pci, pciidlist);
 
+static void ast_kick_out_firmware_fb(struct pci_dev *pdev)
+{
+        struct apertures_struct *ap;
+        bool primary = false;
+
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+
+        ap->ranges[0].base = pci_resource_start(pdev, 0);
+        ap->ranges[0].size = pci_resource_len(pdev, 0);
+
+#ifdef CONFIG_X86
+        primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
+#endif
+        drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary);
+        kfree(ap);
+}
+
 static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        ast_kick_out_firmware_fb(pdev);
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index dac355812adc..373700c05a00 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -583,7 +583,8 @@ void ast_driver_unload(struct drm_device *dev)
         drm_mode_config_cleanup(dev);
 
         ast_mm_fini(ast);
-        pci_iounmap(dev->pdev, ast->ioregs);
+        if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET)
+                pci_iounmap(dev->pdev, ast->ioregs);
         pci_iounmap(dev->pdev, ast->regs);
         kfree(ast);
 }
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 5e77d456d9bb..8bb355d5d43d 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
         }
         ast_bo_unreserve(bo);
 
+        ast_set_offset_reg(crtc);
         ast_set_start_address_crt1(crtc, (u32)gpu_addr);
 
         return 0;
@@ -972,9 +973,21 @@ static int get_clock(void *i2c_priv)
 {
         struct ast_i2c_chan *i2c = i2c_priv;
         struct ast_private *ast = i2c->dev->dev_private;
-        uint32_t val;
+        uint32_t val, val2, count, pass;
+
+        count = 0;
+        pass = 0;
+        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
+        do {
+                val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
+                if (val == val2) {
+                        pass++;
+                } else {
+                        pass = 0;
+                        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
+                }
+        } while ((pass < 5) && (count++ < 0x10000));
 
-        val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4;
         return val & 1 ? 1 : 0;
 }
 
@@ -982,9 +995,21 @@ static int get_data(void *i2c_priv)
 {
         struct ast_i2c_chan *i2c = i2c_priv;
         struct ast_private *ast = i2c->dev->dev_private;
-        uint32_t val;
+        uint32_t val, val2, count, pass;
+
+        count = 0;
+        pass = 0;
+        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
+        do {
+                val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
+                if (val == val2) {
+                        pass++;
+                } else {
+                        pass = 0;
+                        val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
+                }
+        } while ((pass < 5) && (count++ < 0x10000));
 
-        val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5;
         return val & 1 ? 1 : 0;
 }
 
@@ -997,7 +1022,7 @@ static void set_clock(void *i2c_priv, int clock)
 
         for (i = 0; i < 0x10000; i++) {
                 ujcrb7 = ((clock & 0x01) ? 0 : 1);
-                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfe, ujcrb7);
+                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf4, ujcrb7);
                 jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x01);
                 if (ujcrb7 == jtemp)
                         break;
@@ -1013,7 +1038,7 @@ static void set_data(void *i2c_priv, int data)
 
         for (i = 0; i < 0x10000; i++) {
                 ujcrb7 = ((data & 0x01) ? 0 : 1) << 2;
-                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfb, ujcrb7);
+                ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf1, ujcrb7);
                 jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x04);
                 if (ujcrb7 == jtemp)
                         break;
@@ -1254,7 +1279,7 @@ static int ast_cursor_move(struct drm_crtc *crtc,
         ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07));
 
         /* dummy write to fire HWC */
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00);
+        ast_show_cursor(crtc);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index d9c0f7573905..1669c42c40ed 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -142,6 +142,7 @@ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
 
         lockdep_assert_held_once(&dev->master_mutex);
 
+        WARN_ON(fpriv->is_master);
         old_master = fpriv->master;
         fpriv->master = drm_master_create(dev);
         if (!fpriv->master) {
@@ -170,6 +171,7 @@ out_err:
         /* drop references and restore old master on failure */
         drm_master_put(&fpriv->master);
         fpriv->master = old_master;
+        fpriv->is_master = 0;
 
         return ret;
 }
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index a502f3e519fd..dd852a25d375 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -219,6 +219,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
         mutex_lock(&fb_helper->lock);
         drm_connector_list_iter_begin(dev, &conn_iter);
         drm_for_each_connector_iter(connector, &conn_iter) {
+                if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
+                        continue;
+
                 ret = __drm_fb_helper_add_one_connector(fb_helper, connector);
                 if (ret)
                         goto fail;
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index fe754022e356..359d37d5c958 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -61,10 +61,12 @@ static int alloc_gm(struct intel_vgpu *vgpu, bool high_gm)
         }
 
         mutex_lock(&dev_priv->drm.struct_mutex);
+        mmio_hw_access_pre(dev_priv);
         ret = i915_gem_gtt_insert(&dev_priv->ggtt.vm, node,
                                   size, I915_GTT_PAGE_SIZE,
                                   I915_COLOR_UNEVICTABLE,
                                   start, end, flags);
+        mmio_hw_access_post(dev_priv);
         mutex_unlock(&dev_priv->drm.struct_mutex);
         if (ret)
                 gvt_err("fail to alloc %s gm space from host\n",
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 58e166effa45..c7103dd2d8d5 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -2447,10 +2447,11 @@ static void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu)
 
 static void intel_vgpu_destroy_ggtt_mm(struct intel_vgpu *vgpu)
 {
-        struct intel_gvt_partial_pte *pos;
+        struct intel_gvt_partial_pte *pos, *next;
 
-        list_for_each_entry(pos,
-                        &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, list) {
+        list_for_each_entry_safe(pos, next,
+                                 &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list,
+                                 list) {
                 gvt_dbg_mm("partial PTE update on hold 0x%lx : 0x%llx\n",
                         pos->offset, pos->data);
                 kfree(pos);
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 36a5147cd01e..d6e02c15ef97 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -158,6 +158,8 @@ static void load_render_mocs(struct drm_i915_private *dev_priv)
         int ring_id, i;
 
         for (ring_id = 0; ring_id < ARRAY_SIZE(regs); ring_id++) {
+                if (!HAS_ENGINE(dev_priv, ring_id))
+                        continue;
                 offset.reg = regs[ring_id];
                 for (i = 0; i < GEN9_MOCS_SIZE; i++) {
                         gen9_render_mocs.control_table[ring_id][i] =
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 1aaccbe7e1de..d4fac09095f8 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1268,7 +1268,7 @@ relocate_entry(struct i915_vma *vma,
                 else if (gen >= 4)
                         len = 4;
                 else
-                        len = 3;
+                        len = 6;
 
                 batch = reloc_gpu(eb, vma, len);
                 if (IS_ERR(batch))
@@ -1309,6 +1309,11 @@ relocate_entry(struct i915_vma *vma,
                         *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
                         *batch++ = addr;
                         *batch++ = target_offset;
+
+                        /* And again for good measure (blb/pnv) */
+                        *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
+                        *batch++ = addr;
+                        *batch++ = target_offset;
                 }
 
                 goto out;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 47c302543799..07999fe09ad2 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -3413,6 +3413,11 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
                 ggtt->vm.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
                 if (ggtt->vm.clear_range != nop_clear_range)
                         ggtt->vm.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+
+                /* Prevent recursively calling stop_machine() and deadlocks. */
+                dev_info(dev_priv->drm.dev,
+                         "Disabling error capture for VT-d workaround\n");
+                i915_disable_error_state(dev_priv, -ENODEV);
         }
 
         ggtt->invalidate = gen6_ggtt_invalidate;
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 8762d17b6659..3eb33e000d6f 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -648,6 +648,9 @@ int i915_error_state_to_str(struct drm_i915_error_state_buf *m,
                 return 0;
         }
 
+        if (IS_ERR(error))
+                return PTR_ERR(error);
+
         if (*error->error_msg)
                 err_printf(m, "%s\n", error->error_msg);
         err_printf(m, "Kernel: " UTS_RELEASE "\n");
@@ -1859,6 +1862,7 @@ void i915_capture_error_state(struct drm_i915_private *i915,
         error = i915_capture_gpu_state(i915);
         if (!error) {
                 DRM_DEBUG_DRIVER("out of memory, not capturing error state\n");
+                i915_disable_error_state(i915, -ENOMEM);
                 return;
         }
 
@@ -1914,5 +1918,14 @@ void i915_reset_error_state(struct drm_i915_private *i915)
         i915->gpu_error.first_error = NULL;
         spin_unlock_irq(&i915->gpu_error.lock);
 
-        i915_gpu_state_put(error);
+        if (!IS_ERR(error))
+                i915_gpu_state_put(error);
+}
+
+void i915_disable_error_state(struct drm_i915_private *i915, int err)
+{
+        spin_lock_irq(&i915->gpu_error.lock);
+        if (!i915->gpu_error.first_error)
+                i915->gpu_error.first_error = ERR_PTR(err);
+        spin_unlock_irq(&i915->gpu_error.lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.h b/drivers/gpu/drm/i915/i915_gpu_error.h
index 8710fb18ed74..3ec89a504de5 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.h
+++ b/drivers/gpu/drm/i915/i915_gpu_error.h
@@ -343,6 +343,7 @@ static inline void i915_gpu_state_put(struct i915_gpu_state *gpu)
 
 struct i915_gpu_state *i915_first_error_state(struct drm_i915_private *i915);
 void i915_reset_error_state(struct drm_i915_private *i915);
+void i915_disable_error_state(struct drm_i915_private *i915, int err);
 
 #else
 
@@ -355,13 +356,18 @@ static inline void i915_capture_error_state(struct drm_i915_private *dev_priv,
 static inline struct i915_gpu_state *
 i915_first_error_state(struct drm_i915_private *i915)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 static inline void i915_reset_error_state(struct drm_i915_private *i915)
 {
 }
 
+static inline void i915_disable_error_state(struct drm_i915_private *i915,
+                                            int err)
+{
+}
+
 #endif /* IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR) */
 
 #endif /* _I915_GPU_ERROR_H_ */
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a54843fdeb2f..c9878dd1f7cd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2890,6 +2890,7 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
+        intel_state->base.rotation = plane_config->rotation;
         intel_fill_fb_ggtt_view(&intel_state->view, fb,
                                 intel_state->base.rotation);
         intel_state->color_plane[0].stride =
@@ -7882,8 +7883,15 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
                         plane_config->tiling = I915_TILING_X;
                         fb->modifier = I915_FORMAT_MOD_X_TILED;
                 }
+
+                if (val & DISPPLANE_ROTATE_180)
+                        plane_config->rotation = DRM_MODE_ROTATE_180;
         }
 
+        if (IS_CHERRYVIEW(dev_priv) && pipe == PIPE_B &&
+            val & DISPPLANE_MIRROR)
+                plane_config->rotation |= DRM_MODE_REFLECT_X;
+
         pixel_format = val & DISPPLANE_PIXFORMAT_MASK;
         fourcc = i9xx_format_to_fourcc(pixel_format);
         fb->format = drm_format_info(fourcc);
@@ -8952,6 +8960,29 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
                 goto error;
         }
 
+        /*
+         * DRM_MODE_ROTATE_ is counter clockwise to stay compatible with Xrandr
+         * while i915 HW rotation is clockwise, thats why this swapping.
+         */
+        switch (val & PLANE_CTL_ROTATE_MASK) {
+        case PLANE_CTL_ROTATE_0:
+                plane_config->rotation = DRM_MODE_ROTATE_0;
+                break;
+        case PLANE_CTL_ROTATE_90:
+                plane_config->rotation = DRM_MODE_ROTATE_270;
+                break;
+        case PLANE_CTL_ROTATE_180:
+                plane_config->rotation = DRM_MODE_ROTATE_180;
+                break;
+        case PLANE_CTL_ROTATE_270:
+                plane_config->rotation = DRM_MODE_ROTATE_90;
+                break;
+        }
+
+        if (INTEL_GEN(dev_priv) >= 10 &&
+            val & PLANE_CTL_FLIP_HORIZONTAL)
+                plane_config->rotation |= DRM_MODE_REFLECT_X;
+
         base = I915_READ(PLANE_SURF(pipe, plane_id)) & 0xfffff000;
         plane_config->base = base;
 
@@ -15267,6 +15298,14 @@ retry:
                         ret = drm_atomic_add_affected_planes(state, crtc);
                         if (ret)
                                 goto out;
+
+                        /*
+                         * FIXME hack to force a LUT update to avoid the
+                         * plane update forcing the pipe gamma on without
+                         * having a proper LUT loaded. Remove once we
+                         * have readout for pipe gamma enable.
+                         */
+                        crtc_state->color_mgmt_changed = true;
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 8b298e5f012d..db6fa1d0cbda 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -547,6 +547,7 @@ struct intel_initial_plane_config {
         unsigned int tiling;
         int size;
         u32 base;
+        u8 rotation;
 };
 
 #define SKL_MIN_SRC_W 8
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 245f0022bcfd..3fe358db1276 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2493,6 +2493,9 @@ static uint32_t ilk_compute_pri_wm(const struct intel_crtc_state *cstate,
         uint32_t method1, method2;
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2522,6 +2525,9 @@ static uint32_t ilk_compute_spr_wm(const struct intel_crtc_state *cstate,
         uint32_t method1, method2;
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2545,6 +2551,9 @@ static uint32_t ilk_compute_cur_wm(const struct intel_crtc_state *cstate,
 {
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -3008,6 +3017,34 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
         intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
 }
 
+static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
+{
+        /*
+         * On some SNB machines (Thinkpad X220 Tablet at least)
+         * LP3 usage can cause vblank interrupts to be lost.
+         * The DEIIR bit will go high but it looks like the CPU
+         * never gets interrupted.
+         *
+         * It's not clear whether other interrupt source could
+         * be affected or if this is somehow limited to vblank
+         * interrupts only. To play it safe we disable LP3
+         * watermarks entirely.
+         */
+        if (dev_priv->wm.pri_latency[3] == 0 &&
+            dev_priv->wm.spr_latency[3] == 0 &&
+            dev_priv->wm.cur_latency[3] == 0)
+                return;
+
+        dev_priv->wm.pri_latency[3] = 0;
+        dev_priv->wm.spr_latency[3] = 0;
+        dev_priv->wm.cur_latency[3] = 0;
+
+        DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n");
+        intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
+        intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
+        intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+}
+
 static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
 {
         intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
@@ -3024,8 +3061,10 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
         intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
         intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
 
-        if (IS_GEN6(dev_priv))
+        if (IS_GEN6(dev_priv)) {
                 snb_wm_latency_quirk(dev_priv);
+                snb_wm_lp3_irq_quirk(dev_priv);
+        }
 }
 
 static void skl_setup_wm_latency(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
index 05520202c967..191b314f9e9e 100644
--- a/drivers/gpu/drm/meson/meson_crtc.c
+++ b/drivers/gpu/drm/meson/meson_crtc.c
@@ -45,6 +45,7 @@ struct meson_crtc {
         struct drm_crtc base;
         struct drm_pending_vblank_event *event;
         struct meson_drm *priv;
+        bool enabled;
 };
 #define to_meson_crtc(x) container_of(x, struct meson_crtc, base)
 
@@ -80,8 +81,7 @@ static const struct drm_crtc_funcs meson_crtc_funcs = {
 
 };
 
-static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
-                                     struct drm_crtc_state *old_state)
+static void meson_crtc_enable(struct drm_crtc *crtc)
 {
         struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
         struct drm_crtc_state *crtc_state = crtc->state;
@@ -101,6 +101,22 @@ static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
         writel_bits_relaxed(VPP_POSTBLEND_ENABLE, VPP_POSTBLEND_ENABLE,
                             priv->io_base + _REG(VPP_MISC));
 
+        drm_crtc_vblank_on(crtc);
+
+        meson_crtc->enabled = true;
+}
+
+static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+                                     struct drm_crtc_state *old_state)
+{
+        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+        struct meson_drm *priv = meson_crtc->priv;
+
+        DRM_DEBUG_DRIVER("\n");
+
+        if (!meson_crtc->enabled)
+                meson_crtc_enable(crtc);
+
         priv->viu.osd1_enabled = true;
 }
 
@@ -110,6 +126,8 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
         struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
         struct meson_drm *priv = meson_crtc->priv;
 
+        drm_crtc_vblank_off(crtc);
+
         priv->viu.osd1_enabled = false;
         priv->viu.osd1_commit = false;
 
@@ -124,6 +142,8 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
 
                 crtc->state->event = NULL;
         }
+
+        meson_crtc->enabled = false;
 }
 
 static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
@@ -132,6 +152,9 @@ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
         struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
         unsigned long flags;
 
+        if (crtc->state->enable && !meson_crtc->enabled)
+                meson_crtc_enable(crtc);
+
         if (crtc->state->event) {
                 WARN_ON(drm_crtc_vblank_get(crtc) != 0);
 
diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index df7247cd93f9..2cb2ad26d716 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -706,6 +706,7 @@ static const struct regmap_config meson_dw_hdmi_regmap_config = {
         .reg_read = meson_dw_hdmi_reg_read,
         .reg_write = meson_dw_hdmi_reg_write,
         .max_register = 0x10000,
+        .fast_io = true,
 };
 
 static bool meson_hdmi_connector_is_available(struct device *dev)
diff --git a/drivers/gpu/drm/meson/meson_venc.c b/drivers/gpu/drm/meson/meson_venc.c
index acbbad3e322c..be76f3d64bf2 100644
--- a/drivers/gpu/drm/meson/meson_venc.c
+++ b/drivers/gpu/drm/meson/meson_venc.c
@@ -71,6 +71,7 @@
  */
 
 /* HHI Registers */
+#define HHI_GCLK_MPEG2          0x148 /* 0x52 offset in data sheet */
 #define HHI_VDAC_CNTL0          0x2F4 /* 0xbd offset in data sheet */
 #define HHI_VDAC_CNTL1          0x2F8 /* 0xbe offset in data sheet */
 #define HHI_HDMI_PHY_CNTL0      0x3a0 /* 0xe8 offset in data sheet */
@@ -714,6 +715,7 @@ struct meson_hdmi_venc_vic_mode {
         { 5, &meson_hdmi_encp_mode_1080i60 },
         { 20, &meson_hdmi_encp_mode_1080i50 },
         { 32, &meson_hdmi_encp_mode_1080p24 },
+        { 33, &meson_hdmi_encp_mode_1080p50 },
         { 34, &meson_hdmi_encp_mode_1080p30 },
         { 31, &meson_hdmi_encp_mode_1080p50 },
         { 16, &meson_hdmi_encp_mode_1080p60 },
@@ -1530,10 +1532,12 @@ unsigned int meson_venci_get_field(struct meson_drm *priv)
 void meson_venc_enable_vsync(struct meson_drm *priv)
 {
         writel_relaxed(2, priv->io_base + _REG(VENC_INTCTRL));
+        regmap_update_bits(priv->hhi, HHI_GCLK_MPEG2, BIT(25), BIT(25));
 }
 
 void meson_venc_disable_vsync(struct meson_drm *priv)
 {
+        regmap_update_bits(priv->hhi, HHI_GCLK_MPEG2, BIT(25), 0);
         writel_relaxed(0, priv->io_base + _REG(VENC_INTCTRL));
 }
 
diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
index 6bcfa527c180..26a0857878bf 100644
--- a/drivers/gpu/drm/meson/meson_viu.c
+++ b/drivers/gpu/drm/meson/meson_viu.c
@@ -184,18 +184,18 @@ void meson_viu_set_osd_lut(struct meson_drm *priv, enum viu_lut_sel_e lut_sel,
         if (lut_sel == VIU_LUT_OSD_OETF) {
                 writel(0, priv->io_base + _REG(addr_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
                         writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
                 writel(r_map[OSD_OETF_LUT_SIZE - 1] | (g_map[0] << 16),
                         priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
                         writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
                                 priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
                         writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
@@ -211,18 +211,18 @@ void meson_viu_set_osd_lut(struct meson_drm *priv, enum viu_lut_sel_e lut_sel,
         } else if (lut_sel == VIU_LUT_OSD_EOTF) {
                 writel(0, priv->io_base + _REG(addr_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
                         writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
                 writel(r_map[OSD_EOTF_LUT_SIZE - 1] | (g_map[0] << 16),
                         priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
                         writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
                                 priv->io_base + _REG(data_port));
 
-                for (i = 0; i < 20; i++)
+                for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
                         writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
                                 priv->io_base + _REG(data_port));
 
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_group.c b/drivers/gpu/drm/rcar-du/rcar_du_group.c
index d85f0a1c1581..cebf313c6e1f 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_group.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_group.c
@@ -202,10 +202,25 @@ void rcar_du_group_put(struct rcar_du_group *rgrp)
 
 static void __rcar_du_group_start_stop(struct rcar_du_group *rgrp, bool start)
 {
-        struct rcar_du_crtc *rcrtc = &rgrp->dev->crtcs[rgrp->index * 2];
+        struct rcar_du_device *rcdu = rgrp->dev;
+
+        /*
+         * Group start/stop is controlled by the DRES and DEN bits of DSYSR0
+         * for the first group and DSYSR2 for the second group. On most DU
+         * instances, this maps to the first CRTC of the group, and we can just
+         * use rcar_du_crtc_dsysr_clr_set() to access the correct DSYSR. On
+         * M3-N, however, DU2 doesn't exist, but DSYSR2 does. We thus need to
+         * access the register directly using group read/write.
+         */
+        if (rcdu->info->channels_mask & BIT(rgrp->index * 2)) {
+                struct rcar_du_crtc *rcrtc = &rgrp->dev->crtcs[rgrp->index * 2];
 
-        rcar_du_crtc_dsysr_clr_set(rcrtc, DSYSR_DRES | DSYSR_DEN,
-                                   start ? DSYSR_DEN : DSYSR_DRES);
+                rcar_du_crtc_dsysr_clr_set(rcrtc, DSYSR_DRES | DSYSR_DEN,
+                                           start ? DSYSR_DEN : DSYSR_DRES);
+        } else {
+                rcar_du_group_write(rgrp, DSYSR,
+                                    start ? DSYSR_DEN : DSYSR_DRES);
+        }
 }
 
 void rcar_du_group_start_stop(struct rcar_du_group *rgrp, bool start)
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 127468785f74..1f94b9affe4b 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -214,6 +214,12 @@ static int vc4_atomic_commit(struct drm_device *dev,
                 return 0;
         }
 
+        /* We know for sure we don't want an async update here. Set
+         * state->legacy_cursor_update to false to prevent
+         * drm_atomic_helper_setup_commit() from auto-completing
+         * commit->flip_done.
+         */
+        state->legacy_cursor_update = false;
         ret = drm_atomic_helper_setup_commit(state, nonblock);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 9dc3fcbd290b..c6635f23918a 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -807,7 +807,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb)
 static void vc4_plane_atomic_async_update(struct drm_plane *plane,
                                           struct drm_plane_state *state)
 {
-        struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
+        struct vc4_plane_state *vc4_state, *new_vc4_state;
 
         if (plane->state->fb != state->fb) {
                 vc4_plane_async_set_fb(plane, state->fb);
@@ -828,7 +828,18 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
         plane->state->src_y = state->src_y;
 
         /* Update the display list based on the new crtc_x/y. */
-        vc4_plane_atomic_check(plane, plane->state);
+        vc4_plane_atomic_check(plane, state);
+
+        new_vc4_state = to_vc4_plane_state(state);
+        vc4_state = to_vc4_plane_state(plane->state);
+
+        /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
+        vc4_state->dlist[vc4_state->pos0_offset] =
+                new_vc4_state->dlist[vc4_state->pos0_offset];
+        vc4_state->dlist[vc4_state->pos2_offset] =
+                new_vc4_state->dlist[vc4_state->pos2_offset];
+        vc4_state->dlist[vc4_state->ptr0_offset] =
+                new_vc4_state->dlist[vc4_state->ptr0_offset];
 
         /* Note that we can't just call vc4_plane_write_dlist()
          * because that would smash the context data that the HVS is
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index c0d668944dbe..ed35c9a9a110 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -275,6 +275,9 @@
 
 #define USB_VENDOR_ID_CIDC              0x1677
 
+#define I2C_VENDOR_ID_CIRQUE            0x0488
+#define I2C_PRODUCT_ID_CIRQUE_121F      0x121F
+
 #define USB_VENDOR_ID_CJTOUCH           0x24b8
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020  0x0020
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0040  0x0040
@@ -707,6 +710,7 @@
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
 #define USB_DEVICE_ID_LG_MELFAS_MT      0x6007
+#define I2C_DEVICE_ID_LG_8001           0x8001
 
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
@@ -805,6 +809,7 @@
 #define USB_DEVICE_ID_MS_TYPE_COVER_2    0x07a9
 #define USB_DEVICE_ID_MS_POWER_COVER     0x07da
 #define USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER  0x02fd
+#define USB_DEVICE_ID_MS_PIXART_MOUSE    0x00cb
 
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -1043,6 +1048,7 @@
 #define USB_VENDOR_ID_SYMBOL            0x05e0
 #define USB_DEVICE_ID_SYMBOL_SCANNER_1  0x0800
 #define USB_DEVICE_ID_SYMBOL_SCANNER_2  0x1300
+#define USB_DEVICE_ID_SYMBOL_SCANNER_3  0x1200
 
 #define USB_VENDOR_ID_SYNAPTICS         0x06cb
 #define USB_DEVICE_ID_SYNAPTICS_TP      0x0001
@@ -1204,6 +1210,8 @@
 #define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
 #define USB_DEVICE_ID_PRIMAX_REZEL      0x4e72
+#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F  0x4d0f
+#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22  0x4e22
 
 
 #define USB_VENDOR_ID_RISO_KAGAKU       0x1294  /* Riso Kagaku Corp. */
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index a2f74e6adc70..d6fab5798487 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -325,6 +325,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
                 USB_DEVICE_ID_ELECOM_BM084),
           HID_BATTERY_QUIRK_IGNORE },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
+                USB_DEVICE_ID_SYMBOL_SCANNER_3),
+          HID_BATTERY_QUIRK_IGNORE },
         {}
 };
 
@@ -1838,47 +1841,3 @@ void hidinput_disconnect(struct hid_device *hid)
 }
 EXPORT_SYMBOL_GPL(hidinput_disconnect);
 
-/**
- * hid_scroll_counter_handle_scroll() - Send high- and low-resolution scroll
- *                                      events given a high-resolution wheel
- *                                      movement.
- * @counter: a hid_scroll_counter struct describing the wheel.
- * @hi_res_value: the movement of the wheel, in the mouse's high-resolution
- *                units.
- *
- * Given a high-resolution movement, this function converts the movement into
- * microns and emits high-resolution scroll events for the input device. It also
- * uses the multiplier from &struct hid_scroll_counter to emit low-resolution
- * scroll events when appropriate for backwards-compatibility with userspace
- * input libraries.
- */
-void hid_scroll_counter_handle_scroll(struct hid_scroll_counter *counter,
-                                      int hi_res_value)
-{
-        int low_res_value, remainder, multiplier;
-
-        input_report_rel(counter->dev, REL_WHEEL_HI_RES,
-                         hi_res_value * counter->microns_per_hi_res_unit);
-
-        /*
-         * Update the low-res remainder with the high-res value,
-         * but reset if the direction has changed.
-         */
-        remainder = counter->remainder;
-        if ((remainder ^ hi_res_value) < 0)
-                remainder = 0;
-        remainder += hi_res_value;
-
-        /*
-         * Then just use the resolution multiplier to see if
-         * we should send a low-res (aka regular wheel) event.
-         */
-        multiplier = counter->resolution_multiplier;
-        low_res_value = remainder / multiplier;
-        remainder -= low_res_value * multiplier;
-        counter->remainder = remainder;
-
-        if (low_res_value)
-                input_report_rel(counter->dev, REL_WHEEL, low_res_value);
-}
-EXPORT_SYMBOL_GPL(hid_scroll_counter_handle_scroll);
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index f01280898b24..19cc980eebce 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -64,14 +64,6 @@ MODULE_PARM_DESC(disable_tap_to_click,
 #define HIDPP_QUIRK_NO_HIDINPUT                 BIT(23)
 #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS        BIT(24)
 #define HIDPP_QUIRK_UNIFYING                    BIT(25)
-#define HIDPP_QUIRK_HI_RES_SCROLL_1P0           BIT(26)
-#define HIDPP_QUIRK_HI_RES_SCROLL_X2120         BIT(27)
-#define HIDPP_QUIRK_HI_RES_SCROLL_X2121         BIT(28)
-
-/* Convenience constant to check for any high-res support. */
-#define HIDPP_QUIRK_HI_RES_SCROLL       (HIDPP_QUIRK_HI_RES_SCROLL_1P0 | \
-                                         HIDPP_QUIRK_HI_RES_SCROLL_X2120 | \
-                                         HIDPP_QUIRK_HI_RES_SCROLL_X2121)
 
 #define HIDPP_QUIRK_DELAYED_INIT                HIDPP_QUIRK_NO_HIDINPUT
 
@@ -157,7 +149,6 @@ struct hidpp_device {
         unsigned long capabilities;
 
         struct hidpp_battery battery;
-        struct hid_scroll_counter vertical_wheel_counter;
 };
 
 /* HID++ 1.0 error codes */
@@ -409,53 +400,32 @@ static void hidpp_prefix_name(char **name, int name_length)
 #define HIDPP_SET_LONG_REGISTER                         0x82
 #define HIDPP_GET_LONG_REGISTER                         0x83
 
-/**
- * hidpp10_set_register_bit() - Sets a single bit in a HID++ 1.0 register.
- * @hidpp_dev: the device to set the register on.
- * @register_address: the address of the register to modify.
- * @byte: the byte of the register to modify. Should be less than 3.
- * Return: 0 if successful, otherwise a negative error code.
- */
-static int hidpp10_set_register_bit(struct hidpp_device *hidpp_dev,
-        u8 register_address, u8 byte, u8 bit)
+#define HIDPP_REG_GENERAL                               0x00
+
+static int hidpp10_enable_battery_reporting(struct hidpp_device *hidpp_dev)
 {
         struct hidpp_report response;
         int ret;
         u8 params[3] = { 0 };
 
         ret = hidpp_send_rap_command_sync(hidpp_dev,
-                                          REPORT_ID_HIDPP_SHORT,
-                                          HIDPP_GET_REGISTER,
-                                          register_address,
-                                          NULL, 0, &response);
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_GET_REGISTER,
+                                        HIDPP_REG_GENERAL,
+                                        NULL, 0, &response);
         if (ret)
                 return ret;
 
         memcpy(params, response.rap.params, 3);
 
-        params[byte] |= BIT(bit);
+        /* Set the battery bit */
+        params[0] |= BIT(4);
 
         return hidpp_send_rap_command_sync(hidpp_dev,
-                                           REPORT_ID_HIDPP_SHORT,
-                                           HIDPP_SET_REGISTER,
-                                           register_address,
-                                           params, 3, &response);
-}
-
-
-#define HIDPP_REG_GENERAL                               0x00
-
-static int hidpp10_enable_battery_reporting(struct hidpp_device *hidpp_dev)
-{
-        return hidpp10_set_register_bit(hidpp_dev, HIDPP_REG_GENERAL, 0, 4);
-}
-
-#define HIDPP_REG_FEATURES                              0x01
-
-/* On HID++ 1.0 devices, high-res scroll was called "scrolling acceleration". */
-static int hidpp10_enable_scrolling_acceleration(struct hidpp_device *hidpp_dev)
-{
-        return hidpp10_set_register_bit(hidpp_dev, HIDPP_REG_FEATURES, 0, 6);
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_SET_REGISTER,
+                                        HIDPP_REG_GENERAL,
+                                        params, 3, &response);
 }
 
 #define HIDPP_REG_BATTERY_STATUS                        0x07
@@ -1167,100 +1137,6 @@ static int hidpp_battery_get_property(struct power_supply *psy,
 }
 
 /* -------------------------------------------------------------------------- */
-/* 0x2120: Hi-resolution scrolling                                            */
-/* -------------------------------------------------------------------------- */
-
-#define HIDPP_PAGE_HI_RESOLUTION_SCROLLING                      0x2120
-
-#define CMD_HI_RESOLUTION_SCROLLING_SET_HIGHRES_SCROLLING_MODE  0x10
-
-static int hidpp_hrs_set_highres_scrolling_mode(struct hidpp_device *hidpp,
-        bool enabled, u8 *multiplier)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        u8 params[1];
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp,
-                                     HIDPP_PAGE_HI_RESOLUTION_SCROLLING,
-                                     &feature_index,
-                                     &feature_type);
-        if (ret)
-                return ret;
-
-        params[0] = enabled ? BIT(0) : 0;
-        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
-                                          CMD_HI_RESOLUTION_SCROLLING_SET_HIGHRES_SCROLLING_MODE,
-                                          params, sizeof(params), &response);
-        if (ret)
-                return ret;
-        *multiplier = response.fap.params[1];
-        return 0;
-}
-
-/* -------------------------------------------------------------------------- */
-/* 0x2121: HiRes Wheel                                                        */
-/* -------------------------------------------------------------------------- */
-
-#define HIDPP_PAGE_HIRES_WHEEL          0x2121
-
-#define CMD_HIRES_WHEEL_GET_WHEEL_CAPABILITY    0x00
-#define CMD_HIRES_WHEEL_SET_WHEEL_MODE          0x20
-
-static int hidpp_hrw_get_wheel_capability(struct hidpp_device *hidpp,
-        u8 *multiplier)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_HIRES_WHEEL,
-                                     &feature_index, &feature_type);
-        if (ret)
-                goto return_default;
-
-        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
-                                          CMD_HIRES_WHEEL_GET_WHEEL_CAPABILITY,
-                                          NULL, 0, &response);
-        if (ret)
-                goto return_default;
-
-        *multiplier = response.fap.params[0];
-        return 0;
-return_default:
-        hid_warn(hidpp->hid_dev,
-                 "Couldn't get wheel multiplier (error %d), assuming %d.\n",
-                 ret, *multiplier);
-        return ret;
-}
-
-static int hidpp_hrw_set_wheel_mode(struct hidpp_device *hidpp, bool invert,
-        bool high_resolution, bool use_hidpp)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        u8 params[1];
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_HIRES_WHEEL,
-                                     &feature_index, &feature_type);
-        if (ret)
-                return ret;
-
-        params[0] = (invert          ? BIT(2) : 0) |
-                    (high_resolution ? BIT(1) : 0) |
-                    (use_hidpp       ? BIT(0) : 0);
-
-        return hidpp_send_fap_command_sync(hidpp, feature_index,
-                                           CMD_HIRES_WHEEL_SET_WHEEL_MODE,
-                                           params, sizeof(params), &response);
-}
-
-/* -------------------------------------------------------------------------- */
 /* 0x4301: Solar Keyboard                                                     */
 /* -------------------------------------------------------------------------- */
 
@@ -2523,8 +2399,7 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
                 input_report_rel(mydata->input, REL_Y, v);
 
                 v = hid_snto32(data[6], 8);
-                hid_scroll_counter_handle_scroll(
-                                &hidpp->vertical_wheel_counter, v);
+                input_report_rel(mydata->input, REL_WHEEL, v);
 
                 input_sync(mydata->input);
         }
@@ -2653,72 +2528,6 @@ static int g920_get_config(struct hidpp_device *hidpp)
 }
 
 /* -------------------------------------------------------------------------- */
-/* High-resolution scroll wheels                                              */
-/* -------------------------------------------------------------------------- */
-
-/**
- * struct hi_res_scroll_info - Stores info on a device's high-res scroll wheel.
- * @product_id: the HID product ID of the device being described.
- * @microns_per_hi_res_unit: the distance moved by the user's finger for each
- *                         high-resolution unit reported by the device, in
- *                         256ths of a millimetre.
- */
-struct hi_res_scroll_info {
-        __u32 product_id;
-        int microns_per_hi_res_unit;
-};
-
-static struct hi_res_scroll_info hi_res_scroll_devices[] = {
-        { /* Anywhere MX */
-          .product_id = 0x1017, .microns_per_hi_res_unit = 445 },
-        { /* Performance MX */
-          .product_id = 0x101a, .microns_per_hi_res_unit = 406 },
-        { /* M560 */
-          .product_id = 0x402d, .microns_per_hi_res_unit = 435 },
-        { /* MX Master 2S */
-          .product_id = 0x4069, .microns_per_hi_res_unit = 406 },
-};
-
-static int hi_res_scroll_look_up_microns(__u32 product_id)
-{
-        int i;
-        int num_devices = sizeof(hi_res_scroll_devices)
-                          / sizeof(hi_res_scroll_devices[0]);
-        for (i = 0; i < num_devices; i++) {
-                if (hi_res_scroll_devices[i].product_id == product_id)
-                        return hi_res_scroll_devices[i].microns_per_hi_res_unit;
-        }
-        /* We don't have a value for this device, so use a sensible default. */
-        return 406;
-}
-
-static int hi_res_scroll_enable(struct hidpp_device *hidpp)
-{
-        int ret;
-        u8 multiplier = 8;
-
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_X2121) {
-                ret = hidpp_hrw_set_wheel_mode(hidpp, false, true, false);
-                hidpp_hrw_get_wheel_capability(hidpp, &multiplier);
-        } else if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_X2120) {
-                ret = hidpp_hrs_set_highres_scrolling_mode(hidpp, true,
-                                                           &multiplier);
-        } else /* if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_1P0) */
-                ret = hidpp10_enable_scrolling_acceleration(hidpp);
-
-        if (ret)
-                return ret;
-
-        hidpp->vertical_wheel_counter.resolution_multiplier = multiplier;
-        hidpp->vertical_wheel_counter.microns_per_hi_res_unit =
-                hi_res_scroll_look_up_microns(hidpp->hid_dev->product);
-        hid_info(hidpp->hid_dev, "multiplier = %d, microns = %d\n",
-                 multiplier,
-                 hidpp->vertical_wheel_counter.microns_per_hi_res_unit);
-        return 0;
-}
-
-/* -------------------------------------------------------------------------- */
 /* Generic HID++ devices                                                      */
 /* -------------------------------------------------------------------------- */
 
@@ -2763,11 +2572,6 @@ static void hidpp_populate_input(struct hidpp_device *hidpp,
                 wtp_populate_input(hidpp, input, origin_is_hid_core);
         else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
                 m560_populate_input(hidpp, input, origin_is_hid_core);
-
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL) {
-                input_set_capability(input, EV_REL, REL_WHEEL_HI_RES);
-                hidpp->vertical_wheel_counter.dev = input;
-        }
 }
 
 static int hidpp_input_configured(struct hid_device *hdev,
@@ -2886,27 +2690,6 @@ static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
         return 0;
 }
 
-static int hidpp_event(struct hid_device *hdev, struct hid_field *field,
-        struct hid_usage *usage, __s32 value)
-{
-        /* This function will only be called for scroll events, due to the
-         * restriction imposed in hidpp_usages.
-         */
-        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
-        struct hid_scroll_counter *counter = &hidpp->vertical_wheel_counter;
-        /* A scroll event may occur before the multiplier has been retrieved or
-         * the input device set, or high-res scroll enabling may fail. In such
-         * cases we must return early (falling back to default behaviour) to
-         * avoid a crash in hid_scroll_counter_handle_scroll.
-         */
-        if (!(hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL) || value == 0
-            || counter->dev == NULL || counter->resolution_multiplier == 0)
-                return 0;
-
-        hid_scroll_counter_handle_scroll(counter, value);
-        return 1;
-}
-
 static int hidpp_initialize_battery(struct hidpp_device *hidpp)
 {
         static atomic_t battery_no = ATOMIC_INIT(0);
@@ -3118,9 +2901,6 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
         if (hidpp->battery.ps)
                 power_supply_changed(hidpp->battery.ps);
 
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL)
-                hi_res_scroll_enable(hidpp);
-
         if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) || hidpp->delayed_input)
                 /* if the input nodes are already created, we can stop now */
                 return;
@@ -3306,63 +3086,35 @@ static void hidpp_remove(struct hid_device *hdev)
         mutex_destroy(&hidpp->send_mutex);
 }
 
-#define LDJ_DEVICE(product) \
-        HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE, \
-                   USB_VENDOR_ID_LOGITECH, (product))
-
 static const struct hid_device_id hidpp_devices[] = {
         { /* wireless touchpad */
-          LDJ_DEVICE(0x4011),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4011),
           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
                          HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
         { /* wireless touchpad T650 */
-          LDJ_DEVICE(0x4101),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4101),
           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
         { /* wireless touchpad T651 */
           HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
                 USB_DEVICE_ID_LOGITECH_T651),
           .driver_data = HIDPP_QUIRK_CLASS_WTP },
-        { /* Mouse Logitech Anywhere MX */
-          LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
-        { /* Mouse Logitech Cube */
-          LDJ_DEVICE(0x4010), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
-        { /* Mouse Logitech M335 */
-          LDJ_DEVICE(0x4050), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech M515 */
-          LDJ_DEVICE(0x4007), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
         { /* Mouse logitech M560 */
-          LDJ_DEVICE(0x402d),
-          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560
-                | HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
-        { /* Mouse Logitech M705 (firmware RQM17) */
-          LDJ_DEVICE(0x101b), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
-        { /* Mouse Logitech M705 (firmware RQM67) */
-          LDJ_DEVICE(0x406d), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech M720 */
-          LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Anywhere 2 */
-          LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Anywhere 2S */
-          LDJ_DEVICE(0x406a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Master */
-          LDJ_DEVICE(0x4041), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0x4060), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0x4071), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Master 2S */
-          LDJ_DEVICE(0x4069), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech Performance MX */
-          LDJ_DEVICE(0x101a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x402d),
+          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
         { /* Keyboard logitech K400 */
-          LDJ_DEVICE(0x4024),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4024),
           .driver_data = HIDPP_QUIRK_CLASS_K400 },
         { /* Solar Keyboard Logitech K750 */
-          LDJ_DEVICE(0x4002),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4002),
           .driver_data = HIDPP_QUIRK_CLASS_K750 },
 
-        { LDJ_DEVICE(HID_ANY_ID) },
+        { HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
 
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
                 .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
@@ -3371,19 +3123,12 @@ static const struct hid_device_id hidpp_devices[] = {
 
 MODULE_DEVICE_TABLE(hid, hidpp_devices);
 
-static const struct hid_usage_id hidpp_usages[] = {
-        { HID_GD_WHEEL, EV_REL, REL_WHEEL },
-        { HID_ANY_ID - 1, HID_ANY_ID - 1, HID_ANY_ID - 1}
-};
-
 static struct hid_driver hidpp_driver = {
         .name = "logitech-hidpp-device",
         .id_table = hidpp_devices,
         .probe = hidpp_probe,
         .remove = hidpp_remove,
         .raw_event = hidpp_raw_event,
-        .usage_table = hidpp_usages,
-        .event = hidpp_event,
         .input_configured = hidpp_input_configured,
         .input_mapping = hidpp_input_mapping,
         .input_mapped = hidpp_input_mapped,
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f7c6de2b6730..dca0a3a90fb8 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1814,6 +1814,12 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
                         USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
 
+        /* Cirque devices */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+                        I2C_VENDOR_ID_CIRQUE,
+                        I2C_PRODUCT_ID_CIRQUE_121F) },
+
         /* CJTouch panels */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_CJTOUCH,
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 8237dd86fb17..c85a79986b6a 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -107,6 +107,7 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PIXART_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS },
@@ -129,6 +130,8 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index e8a114157f87..bb012bc032e0 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -358,7 +358,7 @@ static ssize_t show_value(struct device *dev, struct device_attribute *attr,
                                                 sensor_inst->hsdev,
                                                 sensor_inst->hsdev->usage,
                                                 usage, report_id,
-                                                SENSOR_HUB_SYNC);
+                                                SENSOR_HUB_SYNC, false);
         } else if (!strncmp(name, "units", strlen("units")))
                 value = sensor_inst->fields[field_index].attribute.units;
         else if (!strncmp(name, "unit-expo", strlen("unit-expo")))
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 2b63487057c2..4256fdc5cd6d 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -299,7 +299,8 @@ EXPORT_SYMBOL_GPL(sensor_hub_get_feature);
 int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                                         u32 usage_id,
                                         u32 attr_usage_id, u32 report_id,
-                                        enum sensor_hub_read_flags flag)
+                                        enum sensor_hub_read_flags flag,
+                                        bool is_signed)
 {
         struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
         unsigned long flags;
@@ -331,10 +332,16 @@ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                                                 &hsdev->pending.ready, HZ*5);
                 switch (hsdev->pending.raw_size) {
                 case 1:
-                        ret_val = *(u8 *)hsdev->pending.raw_data;
+                        if (is_signed)
+                                ret_val = *(s8 *)hsdev->pending.raw_data;
+                        else
+                                ret_val = *(u8 *)hsdev->pending.raw_data;
                         break;
                 case 2:
-                        ret_val = *(u16 *)hsdev->pending.raw_data;
+                        if (is_signed)
+                                ret_val = *(s16 *)hsdev->pending.raw_data;
+                        else
+                                ret_val = *(u16 *)hsdev->pending.raw_data;
                         break;
                 case 4:
                         ret_val = *(u32 *)hsdev->pending.raw_data;
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 0422ec2b13d2..dc4128bfe2ca 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -23,8 +23,9 @@
  * In order to avoid breaking them this driver creates a layered hidraw device,
  * so it can detect when the client is running and then:
  *  - it will not send any command to the controller.
- *  - this input device will be disabled, to avoid double input of the same
+ *  - this input device will be removed, to avoid double input of the same
  *    user action.
+ * When the client is closed, this input device will be created again.
  *
  * For additional functions, such as changing the right-pad margin or switching
  * the led, you can use the user-space tool at:
@@ -113,7 +114,7 @@ struct steam_device {
         spinlock_t lock;
         struct hid_device *hdev, *client_hdev;
         struct mutex mutex;
-        bool client_opened, input_opened;
+        bool client_opened;
         struct input_dev __rcu *input;
         unsigned long quirks;
         struct work_struct work_connect;
@@ -279,18 +280,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
         }
 }
 
-static void steam_update_lizard_mode(struct steam_device *steam)
-{
-        mutex_lock(&steam->mutex);
-        if (!steam->client_opened) {
-                if (steam->input_opened)
-                        steam_set_lizard_mode(steam, false);
-                else
-                        steam_set_lizard_mode(steam, lizard_mode);
-        }
-        mutex_unlock(&steam->mutex);
-}
-
 static int steam_input_open(struct input_dev *dev)
 {
         struct steam_device *steam = input_get_drvdata(dev);
@@ -301,7 +290,6 @@ static int steam_input_open(struct input_dev *dev)
                 return ret;
 
         mutex_lock(&steam->mutex);
-        steam->input_opened = true;
         if (!steam->client_opened && lizard_mode)
                 steam_set_lizard_mode(steam, false);
         mutex_unlock(&steam->mutex);
@@ -313,7 +301,6 @@ static void steam_input_close(struct input_dev *dev)
         struct steam_device *steam = input_get_drvdata(dev);
 
         mutex_lock(&steam->mutex);
-        steam->input_opened = false;
         if (!steam->client_opened && lizard_mode)
                 steam_set_lizard_mode(steam, true);
         mutex_unlock(&steam->mutex);
@@ -400,7 +387,7 @@ static int steam_battery_register(struct steam_device *steam)
         return 0;
 }
 
-static int steam_register(struct steam_device *steam)
+static int steam_input_register(struct steam_device *steam)
 {
         struct hid_device *hdev = steam->hdev;
         struct input_dev *input;
@@ -414,17 +401,6 @@ static int steam_register(struct steam_device *steam)
                 return 0;
         }
 
-        /*
-         * Unlikely, but getting the serial could fail, and it is not so
-         * important, so make up a serial number and go on.
-         */
-        if (steam_get_serial(steam) < 0)
-                strlcpy(steam->serial_no, "XXXXXXXXXX",
-                                sizeof(steam->serial_no));
-
-        hid_info(hdev, "Steam Controller '%s' connected",
-                        steam->serial_no);
-
         input = input_allocate_device();
         if (!input)
                 return -ENOMEM;
@@ -492,11 +468,6 @@ static int steam_register(struct steam_device *steam)
                 goto input_register_fail;
 
         rcu_assign_pointer(steam->input, input);
-
-        /* ignore battery errors, we can live without it */
-        if (steam->quirks & STEAM_QUIRK_WIRELESS)
-                steam_battery_register(steam);
-
         return 0;
 
 input_register_fail:
@@ -504,27 +475,88 @@ input_register_fail:
         return ret;
 }
 
-static void steam_unregister(struct steam_device *steam)
+static void steam_input_unregister(struct steam_device *steam)
 {
         struct input_dev *input;
+        rcu_read_lock();
+        input = rcu_dereference(steam->input);
+        rcu_read_unlock();
+        if (!input)
+                return;
+        RCU_INIT_POINTER(steam->input, NULL);
+        synchronize_rcu();
+        input_unregister_device(input);
+}
+
+static void steam_battery_unregister(struct steam_device *steam)
+{
         struct power_supply *battery;
 
         rcu_read_lock();
-        input = rcu_dereference(steam->input);
         battery = rcu_dereference(steam->battery);
         rcu_read_unlock();
 
-        if (battery) {
-                RCU_INIT_POINTER(steam->battery, NULL);
-                synchronize_rcu();
-                power_supply_unregister(battery);
+        if (!battery)
+                return;
+        RCU_INIT_POINTER(steam->battery, NULL);
+        synchronize_rcu();
+        power_supply_unregister(battery);
+}
+
+static int steam_register(struct steam_device *steam)
+{
+        int ret;
+
+        /*
+         * This function can be called several times in a row with the
+         * wireless adaptor, without steam_unregister() between them, because
+         * another client send a get_connection_status command, for example.
+         * The battery and serial number are set just once per device.
+         */
+        if (!steam->serial_no[0]) {
+                /*
+                 * Unlikely, but getting the serial could fail, and it is not so
+                 * important, so make up a serial number and go on.
+                 */
+                if (steam_get_serial(steam) < 0)
+                        strlcpy(steam->serial_no, "XXXXXXXXXX",
+                                        sizeof(steam->serial_no));
+
+                hid_info(steam->hdev, "Steam Controller '%s' connected",
+                                steam->serial_no);
+
+                /* ignore battery errors, we can live without it */
+                if (steam->quirks & STEAM_QUIRK_WIRELESS)
+                        steam_battery_register(steam);
+
+                mutex_lock(&steam_devices_lock);
+                list_add(&steam->list, &steam_devices);
+                mutex_unlock(&steam_devices_lock);
         }
-        if (input) {
-                RCU_INIT_POINTER(steam->input, NULL);
-                synchronize_rcu();
+
+        mutex_lock(&steam->mutex);
+        if (!steam->client_opened) {
+                steam_set_lizard_mode(steam, lizard_mode);
+                ret = steam_input_register(steam);
+        } else {
+                ret = 0;
+        }
+        mutex_unlock(&steam->mutex);
+
+        return ret;
+}
+
+static void steam_unregister(struct steam_device *steam)
+{
+        steam_battery_unregister(steam);
+        steam_input_unregister(steam);
+        if (steam->serial_no[0]) {
                 hid_info(steam->hdev, "Steam Controller '%s' disconnected",
                                 steam->serial_no);
-                input_unregister_device(input);
+                mutex_lock(&steam_devices_lock);
+                list_del(&steam->list);
+                mutex_unlock(&steam_devices_lock);
+                steam->serial_no[0] = 0;
         }
 }
 
@@ -600,6 +632,9 @@ static int steam_client_ll_open(struct hid_device *hdev)
         mutex_lock(&steam->mutex);
         steam->client_opened = true;
         mutex_unlock(&steam->mutex);
+
+        steam_input_unregister(steam);
+
         return ret;
 }
 
@@ -609,13 +644,13 @@ static void steam_client_ll_close(struct hid_device *hdev)
 
         mutex_lock(&steam->mutex);
         steam->client_opened = false;
-        if (steam->input_opened)
-                steam_set_lizard_mode(steam, false);
-        else
-                steam_set_lizard_mode(steam, lizard_mode);
         mutex_unlock(&steam->mutex);
 
         hid_hw_close(steam->hdev);
+        if (steam->connected) {
+                steam_set_lizard_mode(steam, lizard_mode);
+                steam_input_register(steam);
+        }
 }
 
 static int steam_client_ll_raw_request(struct hid_device *hdev,
@@ -744,11 +779,6 @@ static int steam_probe(struct hid_device *hdev,
                 }
         }
 
-        mutex_lock(&steam_devices_lock);
-        steam_update_lizard_mode(steam);
-        list_add(&steam->list, &steam_devices);
-        mutex_unlock(&steam_devices_lock);
-
         return 0;
 
 hid_hw_open_fail:
@@ -774,10 +804,6 @@ static void steam_remove(struct hid_device *hdev)
                 return;
         }
 
-        mutex_lock(&steam_devices_lock);
-        list_del(&steam->list);
-        mutex_unlock(&steam_devices_lock);
-
         hid_destroy_device(steam->client_hdev);
         steam->client_opened = false;
         cancel_work_sync(&steam->work_connect);
@@ -792,12 +818,14 @@ static void steam_remove(struct hid_device *hdev)
 static void steam_do_connect_event(struct steam_device *steam, bool connected)
 {
         unsigned long flags;
+        bool changed;
 
         spin_lock_irqsave(&steam->lock, flags);
+        changed = steam->connected != connected;
         steam->connected = connected;
         spin_unlock_irqrestore(&steam->lock, flags);
 
-        if (schedule_work(&steam->work_connect) == 0)
+        if (changed && schedule_work(&steam->work_connect) == 0)
                 dbg_hid("%s: connected=%d event already queued\n",
                                 __func__, connected);
 }
@@ -1019,13 +1047,8 @@ static int steam_raw_event(struct hid_device *hdev,
                         return 0;
                 rcu_read_lock();
                 input = rcu_dereference(steam->input);
-                if (likely(input)) {
+                if (likely(input))
                         steam_do_input_event(steam, input, data);
-                } else {
-                        dbg_hid("%s: input data without connect event\n",
-                                        __func__);
-                        steam_do_connect_event(steam, true);
-                }
                 rcu_read_unlock();
                 break;
         case STEAM_EV_CONNECT:
@@ -1074,7 +1097,10 @@ static int steam_param_set_lizard_mode(const char *val,
 
         mutex_lock(&steam_devices_lock);
         list_for_each_entry(steam, &steam_devices, list) {
-                steam_update_lizard_mode(steam);
+                mutex_lock(&steam->mutex);
+                if (!steam->client_opened)
+                        steam_set_lizard_mode(steam, lizard_mode);
+                mutex_unlock(&steam->mutex);
         }
         mutex_unlock(&steam_devices_lock);
         return 0;
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 3cde7c1b9c33..8555ce7e737b 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -177,6 +177,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
         { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
                 I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+        { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 3c5507313606..840634e0f1e3 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -12,6 +12,7 @@
 
 #include <linux/atomic.h>
 #include <linux/compat.h>
+#include <linux/cred.h>
 #include <linux/device.h>
 #include <linux/fs.h>
 #include <linux/hid.h>
@@ -496,12 +497,13 @@ static int uhid_dev_create2(struct uhid_device *uhid,
                 goto err_free;
         }
 
-        len = min(sizeof(hid->name), sizeof(ev->u.create2.name));
-        strlcpy(hid->name, ev->u.create2.name, len);
-        len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys));
-        strlcpy(hid->phys, ev->u.create2.phys, len);
-        len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq));
-        strlcpy(hid->uniq, ev->u.create2.uniq, len);
+        /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
+        len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
+        strncpy(hid->name, ev->u.create2.name, len);
+        len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
+        strncpy(hid->phys, ev->u.create2.phys, len);
+        len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
+        strncpy(hid->uniq, ev->u.create2.uniq, len);
 
         hid->ll_driver = &uhid_hid_driver;
         hid->bus = ev->u.create2.bus;
@@ -722,6 +724,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 
         switch (uhid->input_buf.type) {
         case UHID_CREATE:
+                /*
+                 * 'struct uhid_create_req' contains a __user pointer which is
+                 * copied from, so it's unsafe to allow this with elevated
+                 * privileges (e.g. from a setuid binary) or via kernel_write().
+                 */
+                if (file->f_cred != current_cred() || uaccess_kernel()) {
+                        pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
+                                    task_tgid_vnr(current), current->comm);
+                        ret = -EACCES;
+                        goto unlock;
+                }
                 ret = uhid_dev_create(uhid, &uhid->input_buf);
                 break;
         case UHID_CREATE2:
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index de8193f3b838..fe00b12e4417 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -516,6 +516,14 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
         }
         wait_for_completion(&msginfo->waitevent);
 
+        if (msginfo->response.gpadl_created.creation_status != 0) {
+                pr_err("Failed to establish GPADL: err = 0x%x\n",
+                       msginfo->response.gpadl_created.creation_status);
+
+                ret = -EDQUOT;
+                goto cleanup;
+        }
+
         if (channel->rescind) {
                 ret = -ENODEV;
                 goto cleanup;
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index a7513a8a8e37..d6106e1a0d4a 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -353,6 +353,9 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
 
                 out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
 
+                /* fallthrough */
+
+        case KVP_OP_GET_IP_INFO:
                 utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
                                 MAX_ADAPTER_ID_SIZE,
                                 UTF16_LITTLE_ENDIAN,
@@ -405,7 +408,11 @@ kvp_send_key(struct work_struct *dummy)
                 process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
                 break;
         case KVP_OP_GET_IP_INFO:
-                /* We only need to pass on message->kvp_hdr.operation.  */
+                /*
+                 * We only need to pass on the info of operation, adapter_id
+                 * and addr_family to the userland kvp daemon.
+                 */
+                process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
                 break;
         case KVP_OP_SET:
                 switch (in_msg->body.kvp_set.data.value_type) {
@@ -446,9 +453,9 @@ kvp_send_key(struct work_struct *dummy)
 
                 }
 
-                break;
-
-        case KVP_OP_GET:
+                /*
+                 * The key is always a string - utf16 encoding.
+                 */
                 message->body.kvp_set.data.key_size =
                         utf16s_to_utf8s(
                         (wchar_t *)in_msg->body.kvp_set.data.key,
@@ -456,6 +463,17 @@ kvp_send_key(struct work_struct *dummy)
                         UTF16_LITTLE_ENDIAN,
                         message->body.kvp_set.data.key,
                         HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+
+                break;
+
+        case KVP_OP_GET:
+                message->body.kvp_get.data.key_size =
+                        utf16s_to_utf8s(
+                        (wchar_t *)in_msg->body.kvp_get.data.key,
+                        in_msg->body.kvp_get.data.key_size,
+                        UTF16_LITTLE_ENDIAN,
+                        message->body.kvp_get.data.key,
+                        HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
                 break;
 
         case KVP_OP_DELETE:
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index 71d3445ba869..07ee19573b3f 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -274,7 +274,7 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg,
                 break;
         case INA2XX_CURRENT:
                 /* signed register, result in mA */
-                val = regval * data->current_lsb_uA;
+                val = (s16)regval * data->current_lsb_uA;
                 val = DIV_ROUND_CLOSEST(val, 1000);
                 break;
         case INA2XX_CALIBRATION:
@@ -491,7 +491,7 @@ static int ina2xx_probe(struct i2c_client *client,
         }
 
         data->groups[group++] = &ina2xx_group;
-        if (id->driver_data == ina226)
+        if (chip == ina226)
                 data->groups[group++] = &ina226_group;
 
         hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
@@ -500,7 +500,7 @@ static int ina2xx_probe(struct i2c_client *client,
                 return PTR_ERR(hwmon_dev);
 
         dev_info(dev, "power monitor %s (Rshunt = %li uOhm)\n",
-                 id->name, data->rshunt);
+                 client->name, data->rshunt);
 
         return 0;
 }
diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index de46577c7d5a..d8fa4bea4bc8 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -51,7 +51,7 @@
  */
 #define MLXREG_FAN_GET_RPM(rval, d, s)  (DIV_ROUND_CLOSEST(15000000 * 100, \
                                          ((rval) + (s)) * (d)))
-#define MLXREG_FAN_GET_FAULT(val, mask) (!!((val) ^ (mask)))
+#define MLXREG_FAN_GET_FAULT(val, mask) (!((val) ^ (mask)))
 #define MLXREG_FAN_PWM_DUTY2STATE(duty) (DIV_ROUND_CLOSEST((duty) *     \
                                          MLXREG_FAN_MAX_STATE,          \
                                          MLXREG_FAN_MAX_DUTY))
diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
index be5ba4690895..0d0457245e7d 100644
--- a/drivers/hwmon/raspberrypi-hwmon.c
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -115,7 +115,6 @@ static int rpi_hwmon_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
         struct rpi_hwmon_data *data;
-        int ret;
 
         data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -124,11 +123,6 @@ static int rpi_hwmon_probe(struct platform_device *pdev)
         /* Parent driver assure that firmware is correct */
         data->fw = dev_get_drvdata(dev->parent);
 
-        /* Init throttled */
-        ret = rpi_firmware_property(data->fw, RPI_FIRMWARE_GET_THROTTLED,
-                                    &data->last_throttled,
-                                    sizeof(data->last_throttled));
-
         data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "rpi_volt",
                                                                data,
                                                                &rpi_chip_info,
diff --git a/drivers/hwmon/w83795.c b/drivers/hwmon/w83795.c
index 49276bbdac3d..1bb80f992aa8 100644
--- a/drivers/hwmon/w83795.c
+++ b/drivers/hwmon/w83795.c
@@ -1691,7 +1691,7 @@ store_sf_setup(struct device *dev, struct device_attribute *attr,
  * somewhere else in the code
  */
 #define SENSOR_ATTR_TEMP(index) {                                       \
-        SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 4 ? S_IWUSR : 0), \
+        SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 5 ? S_IWUSR : 0), \
                 show_temp_mode, store_temp_mode, NOT_USED, index - 1),  \
         SENSOR_ATTR_2(temp##index##_input, S_IRUGO, show_temp,          \
                 NULL, TEMP_READ, index - 1),                            \
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 41d97faf5013..38ff374a3ca4 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -149,6 +149,7 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
         struct hid_sensor_hub_device *hsdev =
                                         accel_state->common_attributes.hsdev;
 
@@ -158,12 +159,14 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&accel_state->common_attributes, true);
                 report_id = accel_state->accel[chan->scan_index].report_id;
+                min = accel_state->accel[chan->scan_index].logical_minimum;
                 address = accel_3d_addresses[chan->scan_index];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                         accel_state->common_attributes.hsdev,
                                         hsdev->usage, address, report_id,
-                                        SENSOR_HUB_SYNC);
+                                        SENSOR_HUB_SYNC,
+                                        min < 0);
                 else {
                         *val = 0;
                         hid_sensor_power_state(&accel_state->common_attributes,
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index 36941e69f959..88e857c4baf4 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -111,6 +111,7 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -118,13 +119,15 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&gyro_state->common_attributes, true);
                 report_id = gyro_state->gyro[chan->scan_index].report_id;
+                min = gyro_state->gyro[chan->scan_index].logical_minimum;
                 address = gyro_3d_addresses[chan->scan_index];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                         gyro_state->common_attributes.hsdev,
                                         HID_USAGE_SENSOR_GYRO_3D, address,
                                         report_id,
-                                        SENSOR_HUB_SYNC);
+                                        SENSOR_HUB_SYNC,
+                                        min < 0);
                 else {
                         *val = 0;
                         hid_sensor_power_state(&gyro_state->common_attributes,
diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
index beab6d6fd6e1..4bc95f31c730 100644
--- a/drivers/iio/humidity/hid-sensor-humidity.c
+++ b/drivers/iio/humidity/hid-sensor-humidity.c
@@ -75,7 +75,8 @@ static int humidity_read_raw(struct iio_dev *indio_dev,
                                 HID_USAGE_SENSOR_HUMIDITY,
                                 HID_USAGE_SENSOR_ATMOSPHERIC_HUMIDITY,
                                 humid_st->humidity_attr.report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                humid_st->humidity_attr.logical_minimum < 0);
                 hid_sensor_power_state(&humid_st->common_attributes, false);
 
                 return IIO_VAL_INT;
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 406caaee9a3c..94f33250ba5a 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -93,6 +93,7 @@ static int als_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -102,8 +103,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
                 case  CHANNEL_SCAN_INDEX_INTENSITY:
                 case  CHANNEL_SCAN_INDEX_ILLUM:
                         report_id = als_state->als_illum.report_id;
-                        address =
-                        HID_USAGE_SENSOR_LIGHT_ILLUM;
+                        min = als_state->als_illum.logical_minimum;
+                        address = HID_USAGE_SENSOR_LIGHT_ILLUM;
                         break;
                 default:
                         report_id = -1;
@@ -116,7 +117,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
                                         als_state->common_attributes.hsdev,
                                         HID_USAGE_SENSOR_ALS, address,
                                         report_id,
-                                        SENSOR_HUB_SYNC);
+                                        SENSOR_HUB_SYNC,
+                                        min < 0);
                         hid_sensor_power_state(&als_state->common_attributes,
                                                 false);
                 } else {
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index 45107f7537b5..cf5a0c242609 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -73,6 +73,7 @@ static int prox_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -81,8 +82,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
                 switch (chan->scan_index) {
                 case  CHANNEL_SCAN_INDEX_PRESENCE:
                         report_id = prox_state->prox_attr.report_id;
-                        address =
-                        HID_USAGE_SENSOR_HUMAN_PRESENCE;
+                        min = prox_state->prox_attr.logical_minimum;
+                        address = HID_USAGE_SENSOR_HUMAN_PRESENCE;
                         break;
                 default:
                         report_id = -1;
@@ -95,7 +96,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
                                 prox_state->common_attributes.hsdev,
                                 HID_USAGE_SENSOR_PROX, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                         hid_sensor_power_state(&prox_state->common_attributes,
                                                 false);
                 } else {
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index d55c4885211a..f3c0d41e5a8c 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -163,21 +163,23 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&magn_state->magn_flux_attributes, true);
-                report_id =
-                        magn_state->magn[chan->address].report_id;
+                report_id = magn_state->magn[chan->address].report_id;
+                min = magn_state->magn[chan->address].logical_minimum;
                 address = magn_3d_addresses[chan->address];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                 magn_state->magn_flux_attributes.hsdev,
                                 HID_USAGE_SENSOR_COMPASS_3D, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                 else {
                         *val = 0;
                         hid_sensor_power_state(
diff --git a/drivers/iio/magnetometer/st_magn_buffer.c b/drivers/iio/magnetometer/st_magn_buffer.c
index 0a9e8fadfa9d..37ab30566464 100644
--- a/drivers/iio/magnetometer/st_magn_buffer.c
+++ b/drivers/iio/magnetometer/st_magn_buffer.c
@@ -30,11 +30,6 @@ int st_magn_trig_set_state(struct iio_trigger *trig, bool state)
         return st_sensors_set_dataready_irq(indio_dev, state);
 }
 
-static int st_magn_buffer_preenable(struct iio_dev *indio_dev)
-{
-        return st_sensors_set_enable(indio_dev, true);
-}
-
 static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
 {
         int err;
@@ -50,7 +45,7 @@ static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
         if (err < 0)
                 goto st_magn_buffer_postenable_error;
 
-        return err;
+        return st_sensors_set_enable(indio_dev, true);
 
 st_magn_buffer_postenable_error:
         kfree(mdata->buffer_data);
@@ -63,11 +58,11 @@ static int st_magn_buffer_predisable(struct iio_dev *indio_dev)
         int err;
         struct st_sensor_data *mdata = iio_priv(indio_dev);
 
-        err = iio_triggered_buffer_predisable(indio_dev);
+        err = st_sensors_set_enable(indio_dev, false);
         if (err < 0)
                 goto st_magn_buffer_predisable_error;
 
-        err = st_sensors_set_enable(indio_dev, false);
+        err = iio_triggered_buffer_predisable(indio_dev);
 
 st_magn_buffer_predisable_error:
         kfree(mdata->buffer_data);
@@ -75,7 +70,6 @@ st_magn_buffer_predisable_error:
 }
 
 static const struct iio_buffer_setup_ops st_magn_buffer_setup_ops = {
-        .preenable = &st_magn_buffer_preenable,
         .postenable = &st_magn_buffer_postenable,
         .predisable = &st_magn_buffer_predisable,
 };
diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
index 1e5451d1ff88..bdc5e4554ee4 100644
--- a/drivers/iio/orientation/hid-sensor-incl-3d.c
+++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
@@ -111,21 +111,23 @@ static int incl_3d_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 hid_sensor_power_state(&incl_state->common_attributes, true);
-                report_id =
-                        incl_state->incl[chan->scan_index].report_id;
+                report_id = incl_state->incl[chan->scan_index].report_id;
+                min = incl_state->incl[chan->scan_index].logical_minimum;
                 address = incl_3d_addresses[chan->scan_index];
                 if (report_id >= 0)
                         *val = sensor_hub_input_attr_get_raw_value(
                                 incl_state->common_attributes.hsdev,
                                 HID_USAGE_SENSOR_INCLINOMETER_3D, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                 else {
                         hid_sensor_power_state(&incl_state->common_attributes,
                                                 false);
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 4c437918f1d2..d7b1c00ceb4d 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -77,6 +77,7 @@ static int press_read_raw(struct iio_dev *indio_dev,
         int report_id = -1;
         u32 address;
         int ret_type;
+        s32 min;
 
         *val = 0;
         *val2 = 0;
@@ -85,8 +86,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
                 switch (chan->scan_index) {
                 case  CHANNEL_SCAN_INDEX_PRESSURE:
                         report_id = press_state->press_attr.report_id;
-                        address =
-                        HID_USAGE_SENSOR_ATMOSPHERIC_PRESSURE;
+                        min = press_state->press_attr.logical_minimum;
+                        address = HID_USAGE_SENSOR_ATMOSPHERIC_PRESSURE;
                         break;
                 default:
                         report_id = -1;
@@ -99,7 +100,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
                                 press_state->common_attributes.hsdev,
                                 HID_USAGE_SENSOR_PRESSURE, address,
                                 report_id,
-                                SENSOR_HUB_SYNC);
+                                SENSOR_HUB_SYNC,
+                                min < 0);
                         hid_sensor_power_state(&press_state->common_attributes,
                                                 false);
                 } else {
diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index beaf6fd3e337..b592fc4f007e 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -76,7 +76,8 @@ static int temperature_read_raw(struct iio_dev *indio_dev,
                         HID_USAGE_SENSOR_TEMPERATURE,
                         HID_USAGE_SENSOR_DATA_ENVIRONMENTAL_TEMPERATURE,
                         temp_st->temperature_attr.report_id,
-                        SENSOR_HUB_SYNC);
+                        SENSOR_HUB_SYNC,
+                        temp_st->temperature_attr.logical_minimum < 0);
                 hid_sensor_power_state(
                                 &temp_st->common_attributes,
                                 false);
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index ee366199b169..25d43c8f1c2a 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -767,8 +767,10 @@ static int netdevice_event(struct notifier_block *this, unsigned long event,
 
         case NETDEV_CHANGEADDR:
                 cmds[0] = netdev_del_cmd;
-                cmds[1] = add_default_gid_cmd;
-                cmds[2] = add_cmd;
+                if (ndev->reg_state == NETREG_REGISTERED) {
+                        cmds[1] = add_default_gid_cmd;
+                        cmds[2] = add_cmd;
+                }
                 break;
 
         case NETDEV_CHANGEUPPER:
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 2b4c5e7dd5a1..676c1fd1119d 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -137,15 +137,6 @@ static void ib_umem_notifier_release(struct mmu_notifier *mn,
         up_read(&per_mm->umem_rwsem);
 }
 
-static int invalidate_page_trampoline(struct ib_umem_odp *item, u64 start,
-                                      u64 end, void *cookie)
-{
-        ib_umem_notifier_start_account(item);
-        item->umem.context->invalidate_range(item, start, start + PAGE_SIZE);
-        ib_umem_notifier_end_account(item);
-        return 0;
-}
-
 static int invalidate_range_start_trampoline(struct ib_umem_odp *item,
                                              u64 start, u64 end, void *cookie)
 {
@@ -553,12 +544,13 @@ out:
                 put_page(page);
 
         if (remove_existing_mapping && umem->context->invalidate_range) {
-                invalidate_page_trampoline(
+                ib_umem_notifier_start_account(umem_odp);
+                umem->context->invalidate_range(
                         umem_odp,
-                        ib_umem_start(umem) + (page_index >> umem->page_shift),
-                        ib_umem_start(umem) + ((page_index + 1) >>
-                                               umem->page_shift),
-                        NULL);
+                        ib_umem_start(umem) + (page_index << umem->page_shift),
+                        ib_umem_start(umem) +
+                                ((page_index + 1) << umem->page_shift));
+                ib_umem_notifier_end_account(umem_odp);
                 ret = -EAGAIN;
         }
 
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index cf2282654210..77f095e5fbe3 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1268,6 +1268,7 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
         /* Registered a new RoCE device instance to netdev */
         rc = bnxt_re_register_netdev(rdev);
         if (rc) {
+                rtnl_unlock();
                 pr_err("Failed to register with netedev: %#x\n", rc);
                 return -EINVAL;
         }
@@ -1466,6 +1467,7 @@ static void bnxt_re_task(struct work_struct *work)
                                 "Failed to register with IB: %#x", rc);
                         bnxt_re_remove_one(rdev);
                         bnxt_re_dev_unreg(rdev);
+                        goto exit;
                 }
                 break;
         case NETDEV_UP:
@@ -1489,6 +1491,7 @@ static void bnxt_re_task(struct work_struct *work)
         }
         smp_mb__before_atomic();
         atomic_dec(&rdev->sched_count);
+exit:
         kfree(re_work);
 }
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index a4c62ae23a9a..3beb1523e17c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -1756,10 +1756,9 @@ static int hns_roce_v2_set_mac(struct hns_roce_dev *hr_dev, u8 phy_port,
         return hns_roce_cmq_send(hr_dev, &desc, 1);
 }
 
-static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
-                                  unsigned long mtpt_idx)
+static int set_mtpt_pbl(struct hns_roce_v2_mpt_entry *mpt_entry,
+                        struct hns_roce_mr *mr)
 {
-        struct hns_roce_v2_mpt_entry *mpt_entry;
         struct scatterlist *sg;
         u64 page_addr;
         u64 *pages;
@@ -1767,6 +1766,53 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
         int len;
         int entry;
 
+        mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
+        mpt_entry->pbl_ba_l = cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
+        roce_set_field(mpt_entry->byte_48_mode_ba,
+                       V2_MPT_BYTE_48_PBL_BA_H_M, V2_MPT_BYTE_48_PBL_BA_H_S,
+                       upper_32_bits(mr->pbl_ba >> 3));
+
+        pages = (u64 *)__get_free_page(GFP_KERNEL);
+        if (!pages)
+                return -ENOMEM;
+
+        i = 0;
+        for_each_sg(mr->umem->sg_head.sgl, sg, mr->umem->nmap, entry) {
+                len = sg_dma_len(sg) >> PAGE_SHIFT;
+                for (j = 0; j < len; ++j) {
+                        page_addr = sg_dma_address(sg) +
+                                (j << mr->umem->page_shift);
+                        pages[i] = page_addr >> 6;
+                        /* Record the first 2 entry directly to MTPT table */
+                        if (i >= HNS_ROCE_V2_MAX_INNER_MTPT_NUM - 1)
+                                goto found;
+                        i++;
+                }
+        }
+found:
+        mpt_entry->pa0_l = cpu_to_le32(lower_32_bits(pages[0]));
+        roce_set_field(mpt_entry->byte_56_pa0_h, V2_MPT_BYTE_56_PA0_H_M,
+                       V2_MPT_BYTE_56_PA0_H_S, upper_32_bits(pages[0]));
+
+        mpt_entry->pa1_l = cpu_to_le32(lower_32_bits(pages[1]));
+        roce_set_field(mpt_entry->byte_64_buf_pa1, V2_MPT_BYTE_64_PA1_H_M,
+                       V2_MPT_BYTE_64_PA1_H_S, upper_32_bits(pages[1]));
+        roce_set_field(mpt_entry->byte_64_buf_pa1,
+                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_M,
+                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_S,
+                       mr->pbl_buf_pg_sz + PG_SHIFT_OFFSET);
+
+        free_page((unsigned long)pages);
+
+        return 0;
+}
+
+static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+                                  unsigned long mtpt_idx)
+{
+        struct hns_roce_v2_mpt_entry *mpt_entry;
+        int ret;
+
         mpt_entry = mb_buf;
         memset(mpt_entry, 0, sizeof(*mpt_entry));
 
@@ -1781,7 +1827,6 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
                        mr->pbl_ba_pg_sz + PG_SHIFT_OFFSET);
         roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
                        V2_MPT_BYTE_4_PD_S, mr->pd);
-        mpt_entry->byte_4_pd_hop_st = cpu_to_le32(mpt_entry->byte_4_pd_hop_st);
 
         roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RA_EN_S, 0);
         roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1);
@@ -1796,13 +1841,11 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
                      (mr->access & IB_ACCESS_REMOTE_WRITE ? 1 : 0));
         roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S,
                      (mr->access & IB_ACCESS_LOCAL_WRITE ? 1 : 0));
-        mpt_entry->byte_8_mw_cnt_en = cpu_to_le32(mpt_entry->byte_8_mw_cnt_en);
 
         roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S,
                      mr->type == MR_TYPE_MR ? 0 : 1);
         roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_INNER_PA_VLD_S,
                      1);
-        mpt_entry->byte_12_mw_pa = cpu_to_le32(mpt_entry->byte_12_mw_pa);
 
         mpt_entry->len_l = cpu_to_le32(lower_32_bits(mr->size));
         mpt_entry->len_h = cpu_to_le32(upper_32_bits(mr->size));
@@ -1813,53 +1856,9 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
         if (mr->type == MR_TYPE_DMA)
                 return 0;
 
-        mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
-
-        mpt_entry->pbl_ba_l = cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
-        roce_set_field(mpt_entry->byte_48_mode_ba, V2_MPT_BYTE_48_PBL_BA_H_M,
-                       V2_MPT_BYTE_48_PBL_BA_H_S,
-                       upper_32_bits(mr->pbl_ba >> 3));
-        mpt_entry->byte_48_mode_ba = cpu_to_le32(mpt_entry->byte_48_mode_ba);
-
-        pages = (u64 *)__get_free_page(GFP_KERNEL);
-        if (!pages)
-                return -ENOMEM;
-
-        i = 0;
-        for_each_sg(mr->umem->sg_head.sgl, sg, mr->umem->nmap, entry) {
-                len = sg_dma_len(sg) >> PAGE_SHIFT;
-                for (j = 0; j < len; ++j) {
-                        page_addr = sg_dma_address(sg) +
-                                    (j << mr->umem->page_shift);
-                        pages[i] = page_addr >> 6;
-
-                        /* Record the first 2 entry directly to MTPT table */
-                        if (i >= HNS_ROCE_V2_MAX_INNER_MTPT_NUM - 1)
-                                goto found;
-                        i++;
-                }
-        }
-
-found:
-        mpt_entry->pa0_l = cpu_to_le32(lower_32_bits(pages[0]));
-        roce_set_field(mpt_entry->byte_56_pa0_h, V2_MPT_BYTE_56_PA0_H_M,
-                       V2_MPT_BYTE_56_PA0_H_S,
-                       upper_32_bits(pages[0]));
-        mpt_entry->byte_56_pa0_h = cpu_to_le32(mpt_entry->byte_56_pa0_h);
-
-        mpt_entry->pa1_l = cpu_to_le32(lower_32_bits(pages[1]));
-        roce_set_field(mpt_entry->byte_64_buf_pa1, V2_MPT_BYTE_64_PA1_H_M,
-                       V2_MPT_BYTE_64_PA1_H_S, upper_32_bits(pages[1]));
+        ret = set_mtpt_pbl(mpt_entry, mr);
 
-        free_page((unsigned long)pages);
-
-        roce_set_field(mpt_entry->byte_64_buf_pa1,
-                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_M,
-                       V2_MPT_BYTE_64_PBL_BUF_PG_SZ_S,
-                       mr->pbl_buf_pg_sz + PG_SHIFT_OFFSET);
-        mpt_entry->byte_64_buf_pa1 = cpu_to_le32(mpt_entry->byte_64_buf_pa1);
-
-        return 0;
+        return ret;
 }
 
 static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
@@ -1868,6 +1867,7 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
                                         u64 size, void *mb_buf)
 {
         struct hns_roce_v2_mpt_entry *mpt_entry = mb_buf;
+        int ret = 0;
 
         if (flags & IB_MR_REREG_PD) {
                 roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
@@ -1880,14 +1880,14 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
                              V2_MPT_BYTE_8_BIND_EN_S,
                              (mr_access_flags & IB_ACCESS_MW_BIND ? 1 : 0));
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en,
-                           V2_MPT_BYTE_8_ATOMIC_EN_S,
-                           (mr_access_flags & IB_ACCESS_REMOTE_ATOMIC ? 1 : 0));
+                             V2_MPT_BYTE_8_ATOMIC_EN_S,
+                             mr_access_flags & IB_ACCESS_REMOTE_ATOMIC ? 1 : 0);
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RR_EN_S,
-                             (mr_access_flags & IB_ACCESS_REMOTE_READ ? 1 : 0));
+                             mr_access_flags & IB_ACCESS_REMOTE_READ ? 1 : 0);
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RW_EN_S,
-                            (mr_access_flags & IB_ACCESS_REMOTE_WRITE ? 1 : 0));
+                             mr_access_flags & IB_ACCESS_REMOTE_WRITE ? 1 : 0);
                 roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S,
-                             (mr_access_flags & IB_ACCESS_LOCAL_WRITE ? 1 : 0));
+                             mr_access_flags & IB_ACCESS_LOCAL_WRITE ? 1 : 0);
         }
 
         if (flags & IB_MR_REREG_TRANS) {
@@ -1896,21 +1896,13 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
                 mpt_entry->len_l = cpu_to_le32(lower_32_bits(size));
                 mpt_entry->len_h = cpu_to_le32(upper_32_bits(size));
 
-                mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
-                mpt_entry->pbl_ba_l =
-                                cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
-                roce_set_field(mpt_entry->byte_48_mode_ba,
-                               V2_MPT_BYTE_48_PBL_BA_H_M,
-                               V2_MPT_BYTE_48_PBL_BA_H_S,
-                               upper_32_bits(mr->pbl_ba >> 3));
-                mpt_entry->byte_48_mode_ba =
-                                cpu_to_le32(mpt_entry->byte_48_mode_ba);
-
                 mr->iova = iova;
                 mr->size = size;
+
+                ret = set_mtpt_pbl(mpt_entry, mr);
         }
 
-        return 0;
+        return ret;
 }
 
 static int hns_roce_v2_frmr_write_mtpt(void *mb_buf, struct hns_roce_mr *mr)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e9c428071df3..3569fda07e07 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1094,31 +1094,26 @@ enum mlx5_ib_width {
         MLX5_IB_WIDTH_12X       = 1 << 4
 };
 
-static int translate_active_width(struct ib_device *ibdev, u8 active_width,
+static void translate_active_width(struct ib_device *ibdev, u8 active_width,
                                   u8 *ib_width)
 {
         struct mlx5_ib_dev *dev = to_mdev(ibdev);
-        int err = 0;
 
-        if (active_width & MLX5_IB_WIDTH_1X) {
+        if (active_width & MLX5_IB_WIDTH_1X)
                 *ib_width = IB_WIDTH_1X;
-        } else if (active_width & MLX5_IB_WIDTH_2X) {
-                mlx5_ib_dbg(dev, "active_width %d is not supported by IB spec\n",
-                            (int)active_width);
-                err = -EINVAL;
-        } else if (active_width & MLX5_IB_WIDTH_4X) {
+        else if (active_width & MLX5_IB_WIDTH_4X)
                 *ib_width = IB_WIDTH_4X;
-        } else if (active_width & MLX5_IB_WIDTH_8X) {
+        else if (active_width & MLX5_IB_WIDTH_8X)
                 *ib_width = IB_WIDTH_8X;
-        } else if (active_width & MLX5_IB_WIDTH_12X) {
+        else if (active_width & MLX5_IB_WIDTH_12X)
                 *ib_width = IB_WIDTH_12X;
-        } else {
-                mlx5_ib_dbg(dev, "Invalid active_width %d\n",
+        else {
+                mlx5_ib_dbg(dev, "Invalid active_width %d, setting width to default value: 4x\n",
                             (int)active_width);
-                err = -EINVAL;
+                *ib_width = IB_WIDTH_4X;
         }
 
-        return err;
+        return;
 }
 
 static int mlx5_mtu_to_ib_mtu(int mtu)
@@ -1225,10 +1220,8 @@ static int mlx5_query_hca_port(struct ib_device *ibdev, u8 port,
         if (err)
                 goto out;
 
-        err = translate_active_width(ibdev, ib_link_width_oper,
-                                     &props->active_width);
-        if (err)
-                goto out;
+        translate_active_width(ibdev, ib_link_width_oper, &props->active_width);
+
         err = mlx5_query_port_ib_proto_oper(mdev, &props->active_speed, port);
         if (err)
                 goto out;
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index b04eb6775326..2cc3d69ab6f6 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -674,6 +674,15 @@ next_mr:
                         goto srcu_unlock;
                 }
 
+                if (!mr->umem->is_odp) {
+                        mlx5_ib_dbg(dev, "skipping non ODP MR (lkey=0x%06x) in page fault handler.\n",
+                                    key);
+                        if (bytes_mapped)
+                                *bytes_mapped += bcnt;
+                        ret = 0;
+                        goto srcu_unlock;
+                }
+
                 ret = pagefault_mr(dev, mr, io_virt, bcnt, bytes_mapped);
                 if (ret < 0)
                         goto srcu_unlock;
@@ -735,6 +744,7 @@ next_mr:
                         head = frame;
 
                         bcnt -= frame->bcnt;
+                        offset = 0;
                 }
                 break;
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 6841c0f9237f..3747cc681b18 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -2633,8 +2633,7 @@ static int to_mlx5_access_flags(struct mlx5_ib_qp *qp,
 
         if (access_flags & IB_ACCESS_REMOTE_READ)
                 *hw_access_flags |= MLX5_QP_BIT_RRE;
-        if ((access_flags & IB_ACCESS_REMOTE_ATOMIC) &&
-            qp->ibqp.qp_type == IB_QPT_RC) {
+        if (access_flags & IB_ACCESS_REMOTE_ATOMIC) {
                 int atomic_mode;
 
                 atomic_mode = get_atomic_mode(dev, qp->ibqp.qp_type);
@@ -4678,17 +4677,18 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (wr->opcode == IB_WR_LOCAL_INV ||
-                    wr->opcode == IB_WR_REG_MR) {
+                if (wr->opcode == IB_WR_REG_MR) {
                         fence = dev->umr_fence;
                         next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
-                } else if (wr->send_flags & IB_SEND_FENCE) {
-                        if (qp->next_fence)
-                                fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
-                        else
-                                fence = MLX5_FENCE_MODE_FENCE;
-                } else {
-                        fence = qp->next_fence;
+                } else  {
+                        if (wr->send_flags & IB_SEND_FENCE) {
+                                if (qp->next_fence)
+                                        fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
+                                else
+                                        fence = MLX5_FENCE_MODE_FENCE;
+                        } else {
+                                fence = qp->next_fence;
+                        }
                 }
 
                 switch (ibqp->qp_type) {
diff --git a/drivers/infiniband/sw/rdmavt/ah.c b/drivers/infiniband/sw/rdmavt/ah.c
index 89ec0f64abfc..084bb4baebb5 100644
--- a/drivers/infiniband/sw/rdmavt/ah.c
+++ b/drivers/infiniband/sw/rdmavt/ah.c
@@ -91,13 +91,15 @@ EXPORT_SYMBOL(rvt_check_ah);
  * rvt_create_ah - create an address handle
  * @pd: the protection domain
  * @ah_attr: the attributes of the AH
+ * @udata: pointer to user's input output buffer information.
  *
  * This may be called from interrupt context.
  *
  * Return: newly allocated ah
  */
 struct ib_ah *rvt_create_ah(struct ib_pd *pd,
-                            struct rdma_ah_attr *ah_attr)
+                            struct rdma_ah_attr *ah_attr,
+                            struct ib_udata *udata)
 {
         struct rvt_ah *ah;
         struct rvt_dev_info *dev = ib_to_rvt(pd->device);
diff --git a/drivers/infiniband/sw/rdmavt/ah.h b/drivers/infiniband/sw/rdmavt/ah.h
index 16105af99189..25271b48a683 100644
--- a/drivers/infiniband/sw/rdmavt/ah.h
+++ b/drivers/infiniband/sw/rdmavt/ah.h
@@ -51,7 +51,8 @@
 #include <rdma/rdma_vt.h>
 
 struct ib_ah *rvt_create_ah(struct ib_pd *pd,
-                            struct rdma_ah_attr *ah_attr);
+                            struct rdma_ah_attr *ah_attr,
+                            struct ib_udata *udata);
 int rvt_destroy_ah(struct ib_ah *ibah);
 int rvt_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
 int rvt_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 946b623ba5eb..4ff3d98fa6a4 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -1124,7 +1124,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
                                          IB_MR_CHECK_SIG_STATUS, &mr_status);
                 if (ret) {
                         pr_err("ib_check_mr_status failed, ret %d\n", ret);
-                        goto err;
+                        /* Not a lot we can do, return ambiguous guard error */
+                        *sector = 0;
+                        return 0x1;
                 }
 
                 if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
@@ -1152,9 +1154,6 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
         }
 
         return 0;
-err:
-        /* Not alot we can do here, return ambiguous guard error */
-        return 0x1;
 }
 
 void iser_err_comp(struct ib_wc *wc, const char *type)
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bb2cd29e1658..d8f7000a466a 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
         entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
                     &entry, sizeof(entry));
-        entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
+        entry = (iommu_virt_to_phys(iommu->ga_log_tail) &
+                 (BIT_ULL(52)-1)) & ~7ULL;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
                     &entry, sizeof(entry));
         writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f3ccf025108b..41a4b8808802 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3075,7 +3075,7 @@ static int copy_context_table(struct intel_iommu *iommu,
                         }
 
                         if (old_ce)
-                                iounmap(old_ce);
+                                memunmap(old_ce);
 
                         ret = 0;
                         if (devfn < 0x80)
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index db301efe126d..887150907526 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -595,7 +595,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                         pr_err("%s: Page request without PASID: %08llx %08llx\n",
                                iommu->name, ((unsigned long long *)req)[0],
                                ((unsigned long long *)req)[1]);
-                        goto bad_req;
+                        goto no_pasid;
                 }
 
                 if (!svm || svm->pasid != req->pasid) {
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index b98a03189580..ddf3a492e1d5 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -498,6 +498,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
 
 static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
 {
+        if (!domain->mmu)
+                return;
+
         /*
          * Disable the context. Flush the TLB as required when modifying the
          * context registers.
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 31d1f4ab915e..65a933a21e68 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -807,7 +807,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
         }
 
         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
-                dprintk(1, "%s: transmit queue full\n", __func__);
+                dprintk(2, "%s: transmit queue full\n", __func__);
                 return -EBUSY;
         }
 
@@ -1180,6 +1180,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,
 {
         struct cec_log_addrs *las = &adap->log_addrs;
         struct cec_msg msg = { };
+        const unsigned int max_retries = 2;
+        unsigned int i;
         int err;
 
         if (cec_has_log_addr(adap, log_addr))
@@ -1188,19 +1190,44 @@ static int cec_config_log_addr(struct cec_adapter *adap,
         /* Send poll message */
         msg.len = 1;
         msg.msg[0] = (log_addr << 4) | log_addr;
-        err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        /*
-         * While trying to poll the physical address was reset
-         * and the adapter was unconfigured, so bail out.
-         */
-        if (!adap->is_configuring)
-                return -EINTR;
+        for (i = 0; i < max_retries; i++) {
+                err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        if (err)
-                return err;
+                /*
+                 * While trying to poll the physical address was reset
+                 * and the adapter was unconfigured, so bail out.
+                 */
+                if (!adap->is_configuring)
+                        return -EINTR;
+
+                if (err)
+                        return err;
 
-        if (msg.tx_status & CEC_TX_STATUS_OK)
+                /*
+                 * The message was aborted due to a disconnect or
+                 * unconfigure, just bail out.
+                 */
+                if (msg.tx_status & CEC_TX_STATUS_ABORTED)
+                        return -EINTR;
+                if (msg.tx_status & CEC_TX_STATUS_OK)
+                        return 0;
+                if (msg.tx_status & CEC_TX_STATUS_NACK)
+                        break;
+                /*
+                 * Retry up to max_retries times if the message was neither
+                 * OKed or NACKed. This can happen due to e.g. a Lost
+                 * Arbitration condition.
+                 */
+        }
+
+        /*
+         * If we are unable to get an OK or a NACK after max_retries attempts
+         * (and note that each attempt already consists of four polls), then
+         * then we assume that something is really weird and that it is not a
+         * good idea to try and claim this logical address.
+         */
+        if (i == max_retries)
                 return 0;
 
         /*
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index ca5d92942820..41d470d9ca94 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1918,7 +1918,6 @@ static int tc358743_probe_of(struct tc358743_state *state)
         ret = v4l2_fwnode_endpoint_alloc_parse(of_fwnode_handle(ep), &endpoint);
         if (ret) {
                 dev_err(dev, "failed to parse endpoint\n");
-                ret = ret;
                 goto put_node;
         }
 
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 452eb9b42140..447baaebca44 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1844,14 +1844,12 @@ fail_mutex_destroy:
 static void cio2_pci_remove(struct pci_dev *pci_dev)
 {
         struct cio2_device *cio2 = pci_get_drvdata(pci_dev);
-        unsigned int i;
 
+        media_device_unregister(&cio2->media_dev);
         cio2_notifier_exit(cio2);
+        cio2_queues_exit(cio2);
         cio2_fbpt_exit_dummy(cio2);
-        for (i = 0; i < CIO2_QUEUES; i++)
-                cio2_queue_exit(cio2, &cio2->queue[i]);
         v4l2_device_unregister(&cio2->v4l2_dev);
-        media_device_unregister(&cio2->media_dev);
         media_device_cleanup(&cio2->media_dev);
         mutex_destroy(&cio2->lock);
 }
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 77fb7987b42f..13f2828d880d 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev)
 
 static void isp_unregister_entities(struct isp_device *isp)
 {
+        media_device_unregister(&isp->media_dev);
+
         omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
         omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
         omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp)
         omap3isp_stat_unregister_entities(&isp->isp_hist);
 
         v4l2_device_unregister(&isp->v4l2_dev);
-        media_device_unregister(&isp->media_dev);
         media_device_cleanup(&isp->media_dev);
 }
 
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 1eb9132bfc85..b292cff26c86 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
 #define MAX_WIDTH               4096U
 #define MIN_WIDTH               640U
 #define MAX_HEIGHT              2160U
-#define MIN_HEIGHT              480U
+#define MIN_HEIGHT              360U
 
 #define dprintk(dev, fmt, arg...) \
         v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index af150a0395df..d82db738f174 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1009,7 +1009,7 @@ static const struct v4l2_m2m_ops m2m_ops = {
 
 static const struct media_device_ops m2m_media_ops = {
         .req_validate = vb2_request_validate,
-        .req_queue = vb2_m2m_request_queue,
+        .req_queue = v4l2_m2m_request_queue,
 };
 
 static int vim2m_probe(struct platform_device *pdev)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 6e37950292cd..5f2b033a7a42 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1664,6 +1664,11 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
                     p_mpeg2_slice_params->forward_ref_index >= VIDEO_MAX_FRAME)
                         return -EINVAL;
 
+                if (p_mpeg2_slice_params->pad ||
+                    p_mpeg2_slice_params->picture.pad ||
+                    p_mpeg2_slice_params->sequence.pad)
+                        return -EINVAL;
+
                 return 0;
 
         case V4L2_CTRL_TYPE_MPEG2_QUANTIZATION:
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index a3ef1f50a4b3..481e3c65cf97 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
 }
 EXPORT_SYMBOL_GPL(v4l2_event_pending);
 
+static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
+{
+        struct v4l2_fh *fh = sev->fh;
+        unsigned int i;
+
+        lockdep_assert_held(&fh->subscribe_lock);
+        assert_spin_locked(&fh->vdev->fh_lock);
+
+        /* Remove any pending events for this subscription */
+        for (i = 0; i < sev->in_use; i++) {
+                list_del(&sev->events[sev_pos(sev, i)].list);
+                fh->navailable--;
+        }
+        list_del(&sev->list);
+}
+
 int v4l2_event_subscribe(struct v4l2_fh *fh,
                          const struct v4l2_event_subscription *sub, unsigned elems,
                          const struct v4l2_subscribed_event_ops *ops)
@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
         found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
+        if (!found_ev)
+                list_add(&sev->list, &fh->subscribed);
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
         if (found_ev) {
                 /* Already listening */
                 kvfree(sev);
-                goto out_unlock;
-        }
-
-        if (sev->ops && sev->ops->add) {
+        } else if (sev->ops && sev->ops->add) {
                 ret = sev->ops->add(sev, elems);
                 if (ret) {
+                        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+                        __v4l2_event_unsubscribe(sev);
+                        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
                         kvfree(sev);
-                        goto out_unlock;
                 }
         }
 
-        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-        list_add(&sev->list, &fh->subscribed);
-        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-
-out_unlock:
         mutex_unlock(&fh->subscribe_lock);
 
         return ret;
@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
 {
         struct v4l2_subscribed_event *sev;
         unsigned long flags;
-        int i;
 
         if (sub->type == V4L2_EVENT_ALL) {
                 v4l2_event_unsubscribe_all(fh);
@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
         sev = v4l2_event_subscribed(fh, sub->type, sub->id);
-        if (sev != NULL) {
-                /* Remove any pending events for this subscription */
-                for (i = 0; i < sev->in_use; i++) {
-                        list_del(&sev->events[sev_pos(sev, i)].list);
-                        fh->navailable--;
-                }
-                list_del(&sev->list);
-        }
+        if (sev != NULL)
+                __v4l2_event_unsubscribe(sev);
 
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index d7806db222d8..1ed2465972ac 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -953,7 +953,7 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_buf_queue);
 
-void vb2_m2m_request_queue(struct media_request *req)
+void v4l2_m2m_request_queue(struct media_request *req)
 {
         struct media_request_object *obj, *obj_safe;
         struct v4l2_m2m_ctx *m2m_ctx = NULL;
@@ -997,7 +997,7 @@ void vb2_m2m_request_queue(struct media_request *req)
         if (m2m_ctx)
                 v4l2_m2m_try_schedule(m2m_ctx);
 }
-EXPORT_SYMBOL_GPL(vb2_m2m_request_queue);
+EXPORT_SYMBOL_GPL(v4l2_m2m_request_queue);
 
 /* Videobuf2 ioctl helpers */
 
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index b2a0340f277e..d8e3cc2dc747 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = {
 MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
 #endif
 
-static inline const struct atmel_ssc_platform_data * __init
+static inline const struct atmel_ssc_platform_data *
         atmel_ssc_get_driver_data(struct platform_device *pdev)
 {
         if (pdev->dev.of_node) {
diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
index c824329f7012..0e4193cb08cf 100644
--- a/drivers/misc/mic/scif/scif_rma.c
+++ b/drivers/misc/mic/scif/scif_rma.c
@@ -416,7 +416,7 @@ static int scif_create_remote_lookup(struct scif_dev *remote_dev,
                 if (err)
                         goto error_window;
                 err = scif_map_page(&window->num_pages_lookup.lookup[j],
-                                    vmalloc_dma_phys ?
+                                    vmalloc_num_pages ?
                                     vmalloc_to_page(&window->num_pages[i]) :
                                     virt_to_page(&window->num_pages[i]),
                                     remote_dev);
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 313da3150262..1540a7785e14 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -27,6 +27,9 @@
 #include <linux/delay.h>
 #include <linux/bitops.h>
 #include <asm/uv/uv_hub.h>
+
+#include <linux/nospec.h>
+
 #include "gru.h"
 #include "grutables.h"
 #include "gruhandles.h"
@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg)
         /* Currently, only dump by gid is implemented */
         if (req.gid >= gru_max_gids)
                 return -EINVAL;
+        req.gid = array_index_nospec(req.gid, gru_max_gids);
 
         gru = GID_TO_GRU(req.gid);
         ubuf = req.buf;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 7bfd366d970d..c4115bae5db1 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -12,6 +12,7 @@
  *     - JMicron (hardware and technical support)
  */
 
+#include <linux/bitfield.h>
 #include <linux/string.h>
 #include <linux/delay.h>
 #include <linux/highmem.h>
@@ -462,6 +463,9 @@ struct intel_host {
         u32     dsm_fns;
         int     drv_strength;
         bool    d3_retune;
+        bool    rpm_retune_ok;
+        u32     glk_rx_ctrl1;
+        u32     glk_tun_val;
 };
 
 static const guid_t intel_dsm_guid =
@@ -791,6 +795,77 @@ cleanup:
         return ret;
 }
 
+#ifdef CONFIG_PM
+#define GLK_RX_CTRL1    0x834
+#define GLK_TUN_VAL     0x840
+#define GLK_PATH_PLL    GENMASK(13, 8)
+#define GLK_DLY         GENMASK(6, 0)
+/* Workaround firmware failing to restore the tuning value */
+static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp)
+{
+        struct sdhci_pci_slot *slot = chip->slots[0];
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct sdhci_host *host = slot->host;
+        u32 glk_rx_ctrl1;
+        u32 glk_tun_val;
+        u32 dly;
+
+        if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc))
+                return;
+
+        glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1);
+        glk_tun_val = sdhci_readl(host, GLK_TUN_VAL);
+
+        if (susp) {
+                intel_host->glk_rx_ctrl1 = glk_rx_ctrl1;
+                intel_host->glk_tun_val = glk_tun_val;
+                return;
+        }
+
+        if (!intel_host->glk_tun_val)
+                return;
+
+        if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) {
+                intel_host->rpm_retune_ok = true;
+                return;
+        }
+
+        dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) +
+                                  (intel_host->glk_tun_val << 1));
+        if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1))
+                return;
+
+        glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly;
+        sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1);
+
+        intel_host->rpm_retune_ok = true;
+        chip->rpm_retune = true;
+        mmc_retune_needed(host->mmc);
+        pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc));
+}
+
+static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp)
+{
+        if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
+            !chip->rpm_retune)
+                glk_rpm_retune_wa(chip, susp);
+}
+
+static int glk_runtime_suspend(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, true);
+
+        return sdhci_cqhci_runtime_suspend(chip);
+}
+
+static int glk_runtime_resume(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, false);
+
+        return sdhci_cqhci_runtime_resume(chip);
+}
+#endif
+
 #ifdef CONFIG_ACPI
 static int ni_set_max_freq(struct sdhci_pci_slot *slot)
 {
@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = {
         .resume                 = sdhci_cqhci_resume,
 #endif
 #ifdef CONFIG_PM
-        .runtime_suspend        = sdhci_cqhci_runtime_suspend,
-        .runtime_resume         = sdhci_cqhci_runtime_resume,
+        .runtime_suspend        = glk_runtime_suspend,
+        .runtime_resume         = glk_runtime_resume,
 #endif
         .quirks                 = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC,
         .quirks2                = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
                 device_init_wakeup(&pdev->dev, true);
 
         if (slot->cd_idx >= 0) {
-                ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
+                ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
                                            slot->cd_override_level, 0, NULL);
+                if (ret && ret != -EPROBE_DEFER)
+                        ret = mmc_gpiod_request_cd(host->mmc, NULL,
+                                                   slot->cd_idx,
+                                                   slot->cd_override_level,
+                                                   0, NULL);
                 if (ret == -EPROBE_DEFER)
                         goto remove;
 
diff --git a/drivers/mtd/nand/bbt.c b/drivers/mtd/nand/bbt.c
index 56cde38b92c0..044adf913854 100644
--- a/drivers/mtd/nand/bbt.c
+++ b/drivers/mtd/nand/bbt.c
@@ -27,7 +27,8 @@ int nanddev_bbt_init(struct nand_device *nand)
         unsigned int nwords = DIV_ROUND_UP(nblocks * bits_per_block,
                                            BITS_PER_LONG);
 
-        nand->bbt.cache = kzalloc(nwords, GFP_KERNEL);
+        nand->bbt.cache = kcalloc(nwords, sizeof(*nand->bbt.cache),
+                                  GFP_KERNEL);
         if (!nand->bbt.cache)
                 return -ENOMEM;
 
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index fb33f6be7c4f..ad720494e8f7 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2032,8 +2032,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
         int ret;
 
         nand_np = dev->of_node;
-        nfc_np = of_find_compatible_node(dev->of_node, NULL,
-                                         "atmel,sama5d3-nfc");
+        nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
         if (!nfc_np) {
                 dev_err(dev, "Could not find device node for sama5d3-nfc\n");
                 return -ENODEV;
@@ -2447,15 +2446,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
         }
 
         if (caps->legacy_of_bindings) {
+                struct device_node *nfc_node;
                 u32 ale_offs = 21;
 
                 /*
                  * If we are parsing legacy DT props and the DT contains a
                  * valid NFC node, forward the request to the sama5 logic.
                  */
-                if (of_find_compatible_node(pdev->dev.of_node, NULL,
-                                            "atmel,sama5d3-nfc"))
+                nfc_node = of_get_compatible_child(pdev->dev.of_node,
+                                                   "atmel,sama5d3-nfc");
+                if (nfc_node) {
                         caps = &atmel_sama5_nand_caps;
+                        of_node_put(nfc_node);
+                }
 
                 /*
                  * Even if the compatible says we are dealing with an
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index ef75dfa62a4f..699d3cf49c6d 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -150,15 +150,15 @@
 #define NAND_VERSION_MINOR_SHIFT        16
 
 /* NAND OP_CMDs */
-#define PAGE_READ                       0x2
-#define PAGE_READ_WITH_ECC              0x3
-#define PAGE_READ_WITH_ECC_SPARE        0x4
-#define PROGRAM_PAGE                    0x6
-#define PAGE_PROGRAM_WITH_ECC           0x7
-#define PROGRAM_PAGE_SPARE              0x9
-#define BLOCK_ERASE                     0xa
-#define FETCH_ID                        0xb
-#define RESET_DEVICE                    0xd
+#define OP_PAGE_READ                    0x2
+#define OP_PAGE_READ_WITH_ECC           0x3
+#define OP_PAGE_READ_WITH_ECC_SPARE     0x4
+#define OP_PROGRAM_PAGE                 0x6
+#define OP_PAGE_PROGRAM_WITH_ECC        0x7
+#define OP_PROGRAM_PAGE_SPARE           0x9
+#define OP_BLOCK_ERASE                  0xa
+#define OP_FETCH_ID                     0xb
+#define OP_RESET_DEVICE                 0xd
 
 /* Default Value for NAND_DEV_CMD_VLD */
 #define NAND_DEV_CMD_VLD_VAL            (READ_START_VLD | WRITE_START_VLD | \
@@ -692,11 +692,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
 
         if (read) {
                 if (host->use_ecc)
-                        cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
                 else
-                        cmd = PAGE_READ | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE;
         } else {
-                        cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
+                cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
         }
 
         if (host->use_ecc) {
@@ -1170,7 +1170,7 @@ static int nandc_param(struct qcom_nand_host *host)
          * in use. we configure the controller to perform a raw read of 512
          * bytes to read onfi params
          */
-        nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, 0);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE
@@ -1224,7 +1224,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
         nandc_set_reg(nandc, NAND_FLASH_CMD,
-                      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
+                      OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, page_addr);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0,
@@ -1255,7 +1255,7 @@ static int read_id(struct qcom_nand_host *host, int column)
         if (column == -1)
                 return 0;
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID);
         nandc_set_reg(nandc, NAND_ADDR0, column);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT,
@@ -1276,7 +1276,7 @@ static int reset(struct qcom_nand_host *host)
         struct nand_chip *chip = &host->chip;
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE);
         nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
 
         write_reg_dma(nandc, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index d846428ef038..04cedd3a2bf6 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -644,9 +644,23 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                 ndelay(cqspi->wr_delay);
 
         while (remaining > 0) {
+                size_t write_words, mod_bytes;
+
                 write_bytes = remaining > page_size ? page_size : remaining;
-                iowrite32_rep(cqspi->ahb_base, txbuf,
-                              DIV_ROUND_UP(write_bytes, 4));
+                write_words = write_bytes / 4;
+                mod_bytes = write_bytes % 4;
+                /* Write 4 bytes at a time then single bytes. */
+                if (write_words) {
+                        iowrite32_rep(cqspi->ahb_base, txbuf, write_words);
+                        txbuf += (write_words * 4);
+                }
+                if (mod_bytes) {
+                        unsigned int temp = 0xFFFFFFFF;
+
+                        memcpy(&temp, txbuf, mod_bytes);
+                        iowrite32(temp, cqspi->ahb_base);
+                        txbuf += mod_bytes;
+                }
 
                 if (!wait_for_completion_timeout(&cqspi->transfer_complete,
                                         msecs_to_jiffies(CQSPI_TIMEOUT_MS))) {
@@ -655,7 +669,6 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                         goto failwr;
                 }
 
-                txbuf += write_bytes;
                 remaining -= write_bytes;
 
                 if (remaining > 0)
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 3e54e31889c7..1fdd2834fbcb 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -2156,7 +2156,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the serial flash memory
  * @len:        number of bytes to read
- * @buf:        buffer where the data is copied into
+ * @buf:        buffer where the data is copied into (dma-safe memory)
  *
  * Return: 0 on success, -errno otherwise.
  */
@@ -2522,6 +2522,34 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 }
 
 /**
+ * spi_nor_sort_erase_mask() - sort erase mask
+ * @map:        the erase map of the SPI NOR
+ * @erase_mask: the erase type mask to be sorted
+ *
+ * Replicate the sort done for the map's erase types in BFPT: sort the erase
+ * mask in ascending order with the smallest erase type size starting from
+ * BIT(0) in the sorted erase mask.
+ *
+ * Return: sorted erase mask.
+ */
+static u8 spi_nor_sort_erase_mask(struct spi_nor_erase_map *map, u8 erase_mask)
+{
+        struct spi_nor_erase_type *erase_type = map->erase_type;
+        int i;
+        u8 sorted_erase_mask = 0;
+
+        if (!erase_mask)
+                return 0;
+
+        /* Replicate the sort done for the map's erase types. */
+        for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
+                if (erase_type[i].size && erase_mask & BIT(erase_type[i].idx))
+                        sorted_erase_mask |= BIT(i);
+
+        return sorted_erase_mask;
+}
+
+/**
  * spi_nor_regions_sort_erase_types() - sort erase types in each region
  * @map:        the erase map of the SPI NOR
  *
@@ -2536,19 +2564,13 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 static void spi_nor_regions_sort_erase_types(struct spi_nor_erase_map *map)
 {
         struct spi_nor_erase_region *region = map->regions;
-        struct spi_nor_erase_type *erase_type = map->erase_type;
-        int i;
         u8 region_erase_mask, sorted_erase_mask;
 
         while (region) {
                 region_erase_mask = region->offset & SNOR_ERASE_TYPE_MASK;
 
-                /* Replicate the sort done for the map's erase types. */
-                sorted_erase_mask = 0;
-                for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
-                        if (erase_type[i].size &&
-                            region_erase_mask & BIT(erase_type[i].idx))
-                                sorted_erase_mask |= BIT(i);
+                sorted_erase_mask = spi_nor_sort_erase_mask(map,
+                                                            region_erase_mask);
 
                 /* Overwrite erase mask. */
                 region->offset = (region->offset & ~SNOR_ERASE_TYPE_MASK) |
@@ -2855,52 +2877,84 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings)
  * spi_nor_get_map_in_use() - get the configuration map in use
  * @nor:        pointer to a 'struct spi_nor'
  * @smpt:       pointer to the sector map parameter table
+ * @smpt_len:   sector map parameter table length
+ *
+ * Return: pointer to the map in use, ERR_PTR(-errno) otherwise.
  */
-static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt)
+static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
+                                         u8 smpt_len)
 {
-        const u32 *ret = NULL;
-        u32 i, addr;
+        const u32 *ret;
+        u8 *buf;
+        u32 addr;
         int err;
+        u8 i;
         u8 addr_width, read_opcode, read_dummy;
-        u8 read_data_mask, data_byte, map_id;
+        u8 read_data_mask, map_id;
+
+        /* Use a kmalloc'ed bounce buffer to guarantee it is DMA-able. */
+        buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return ERR_PTR(-ENOMEM);
 
         addr_width = nor->addr_width;
         read_dummy = nor->read_dummy;
         read_opcode = nor->read_opcode;
 
         map_id = 0;
-        i = 0;
         /* Determine if there are any optional Detection Command Descriptors */
-        while (!(smpt[i] & SMPT_DESC_TYPE_MAP)) {
+        for (i = 0; i < smpt_len; i += 2) {
+                if (smpt[i] & SMPT_DESC_TYPE_MAP)
+                        break;
+
                 read_data_mask = SMPT_CMD_READ_DATA(smpt[i]);
                 nor->addr_width = spi_nor_smpt_addr_width(nor, smpt[i]);
                 nor->read_dummy = spi_nor_smpt_read_dummy(nor, smpt[i]);
                 nor->read_opcode = SMPT_CMD_OPCODE(smpt[i]);
                 addr = smpt[i + 1];
 
-                err = spi_nor_read_raw(nor, addr, 1, &data_byte);
-                if (err)
+                err = spi_nor_read_raw(nor, addr, 1, buf);
+                if (err) {
+                        ret = ERR_PTR(err);
                         goto out;
+                }
 
                 /*
                  * Build an index value that is used to select the Sector Map
                  * Configuration that is currently in use.
                  */
-                map_id = map_id << 1 | !!(data_byte & read_data_mask);
-                i = i + 2;
+                map_id = map_id << 1 | !!(*buf & read_data_mask);
         }
 
-        /* Find the matching configuration map */
-        while (SMPT_MAP_ID(smpt[i]) != map_id) {
+        /*
+         * If command descriptors are provided, they always precede map
+         * descriptors in the table. There is no need to start the iteration
+         * over smpt array all over again.
+         *
+         * Find the matching configuration map.
+         */
+        ret = ERR_PTR(-EINVAL);
+        while (i < smpt_len) {
+                if (SMPT_MAP_ID(smpt[i]) == map_id) {
+                        ret = smpt + i;
+                        break;
+                }
+
+                /*
+                 * If there are no more configuration map descriptors and no
+                 * configuration ID matched the configuration identifier, the
+                 * sector address map is unknown.
+                 */
                 if (smpt[i] & SMPT_DESC_END)
-                        goto out;
+                        break;
+
                 /* increment the table index to the next map */
                 i += SMPT_MAP_REGION_COUNT(smpt[i]) + 1;
         }
 
-        ret = smpt + i;
         /* fall through */
 out:
+        kfree(buf);
         nor->addr_width = addr_width;
         nor->read_dummy = read_dummy;
         nor->read_opcode = read_opcode;
@@ -2941,12 +2995,13 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                                               const u32 *smpt)
 {
         struct spi_nor_erase_map *map = &nor->erase_map;
-        const struct spi_nor_erase_type *erase = map->erase_type;
+        struct spi_nor_erase_type *erase = map->erase_type;
         struct spi_nor_erase_region *region;
         u64 offset;
         u32 region_count;
         int i, j;
-        u8 erase_type;
+        u8 uniform_erase_type, save_uniform_erase_type;
+        u8 erase_type, regions_erase_type;
 
         region_count = SMPT_MAP_REGION_COUNT(*smpt);
         /*
@@ -2959,7 +3014,8 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                 return -ENOMEM;
         map->regions = region;
 
-        map->uniform_erase_type = 0xff;
+        uniform_erase_type = 0xff;
+        regions_erase_type = 0;
         offset = 0;
         /* Populate regions. */
         for (i = 0; i < region_count; i++) {
@@ -2974,12 +3030,40 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                  * Save the erase types that are supported in all regions and
                  * can erase the entire flash memory.
                  */
-                map->uniform_erase_type &= erase_type;
+                uniform_erase_type &= erase_type;
+
+                /*
+                 * regions_erase_type mask will indicate all the erase types
+                 * supported in this configuration map.
+                 */
+                regions_erase_type |= erase_type;
 
                 offset = (region[i].offset & ~SNOR_ERASE_FLAGS_MASK) +
                          region[i].size;
         }
 
+        save_uniform_erase_type = map->uniform_erase_type;
+        map->uniform_erase_type = spi_nor_sort_erase_mask(map,
+                                                          uniform_erase_type);
+
+        if (!regions_erase_type) {
+                /*
+                 * Roll back to the previous uniform_erase_type mask, SMPT is
+                 * broken.
+                 */
+                map->uniform_erase_type = save_uniform_erase_type;
+                return -EINVAL;
+        }
+
+        /*
+         * BFPT advertises all the erase types supported by all the possible
+         * map configurations. Mask out the erase types that are not supported
+         * by the current map configuration.
+         */
+        for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
+                if (!(regions_erase_type & BIT(erase[i].idx)))
+                        spi_nor_set_erase_type(&erase[i], 0, 0xFF);
+
         spi_nor_region_mark_end(&region[i - 1]);
 
         return 0;
@@ -3020,9 +3104,9 @@ static int spi_nor_parse_smpt(struct spi_nor *nor,
         for (i = 0; i < smpt_header->length; i++)
                 smpt[i] = le32_to_cpu(smpt[i]);
 
-        sector_map = spi_nor_get_map_in_use(nor, smpt);
-        if (!sector_map) {
-                ret = -EINVAL;
+        sector_map = spi_nor_get_map_in_use(nor, smpt, smpt_header->length);
+        if (IS_ERR(sector_map)) {
+                ret = PTR_ERR(sector_map);
                 goto out;
         }
 
@@ -3125,7 +3209,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         if (err)
                 goto exit;
 
-        /* Parse other parameter headers. */
+        /* Parse optional parameter tables. */
         for (i = 0; i < header.nph; i++) {
                 param_header = &param_headers[i];
 
@@ -3138,8 +3222,17 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
                         break;
                 }
 
-                if (err)
-                        goto exit;
+                if (err) {
+                        dev_warn(dev, "Failed to parse optional parameter table: %04x\n",
+                                 SFDP_PARAM_HEADER_ID(param_header));
+                        /*
+                         * Let's not drop all information we extracted so far
+                         * if optional table parsers fail. In case of failing,
+                         * each optional parser is responsible to roll back to
+                         * the previously known spi_nor data.
+                         */
+                        err = 0;
+                }
         }
 
 exit:
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 49163570a63a..3b3f88ffab53 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -477,6 +477,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(can_put_echo_skb);
 
+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
+{
+        struct can_priv *priv = netdev_priv(dev);
+        struct sk_buff *skb = priv->echo_skb[idx];
+        struct canfd_frame *cf;
+
+        if (idx >= priv->echo_skb_max) {
+                netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
+                           __func__, idx, priv->echo_skb_max);
+                return NULL;
+        }
+
+        if (!skb) {
+                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
+                           __func__, idx);
+                return NULL;
+        }
+
+        /* Using "struct canfd_frame::len" for the frame
+         * length is supported on both CAN and CANFD frames.
+         */
+        cf = (struct canfd_frame *)skb->data;
+        *len_ptr = cf->len;
+        priv->echo_skb[idx] = NULL;
+
+        return skb;
+}
+
 /*
  * Get the skb from the stack and loop it back locally
  *
@@ -486,22 +514,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
  */
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
 {
-        struct can_priv *priv = netdev_priv(dev);
-
-        BUG_ON(idx >= priv->echo_skb_max);
-
-        if (priv->echo_skb[idx]) {
-                struct sk_buff *skb = priv->echo_skb[idx];
-                struct can_frame *cf = (struct can_frame *)skb->data;
-                u8 dlc = cf->can_dlc;
+        struct sk_buff *skb;
+        u8 len;
 
-                netif_rx(priv->echo_skb[idx]);
-                priv->echo_skb[idx] = NULL;
+        skb = __can_get_echo_skb(dev, idx, &len);
+        if (!skb)
+                return 0;
 
-                return dlc;
-        }
+        netif_rx(skb);
 
-        return 0;
+        return len;
 }
 EXPORT_SYMBOL_GPL(can_get_echo_skb);
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 8e972ef08637..75ce11395ee8 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -135,13 +135,12 @@
 
 /* FLEXCAN interrupt flag register (IFLAG) bits */
 /* Errata ERR005829 step7: Reserve first valid MB */
-#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
-#define FLEXCAN_TX_MB_OFF_FIFO          9
+#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO         8
 #define FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP    0
-#define FLEXCAN_TX_MB_OFF_TIMESTAMP             1
-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST       (FLEXCAN_TX_MB_OFF_TIMESTAMP + 1)
-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST        63
-#define FLEXCAN_IFLAG_MB(x)             BIT(x)
+#define FLEXCAN_TX_MB                           63
+#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST       (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1)
+#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST        (FLEXCAN_TX_MB - 1)
+#define FLEXCAN_IFLAG_MB(x)             BIT(x & 0x1f)
 #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW  BIT(7)
 #define FLEXCAN_IFLAG_RX_FIFO_WARN      BIT(6)
 #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5)
@@ -259,9 +258,7 @@ struct flexcan_priv {
         struct can_rx_offload offload;
 
         struct flexcan_regs __iomem *regs;
-        struct flexcan_mb __iomem *tx_mb;
         struct flexcan_mb __iomem *tx_mb_reserved;
-        u8 tx_mb_idx;
         u32 reg_ctrl_default;
         u32 reg_imask1_default;
         u32 reg_imask2_default;
@@ -515,6 +512,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
 static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         const struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct can_frame *cf = (struct can_frame *)skb->data;
         u32 can_id;
         u32 data;
@@ -537,17 +535,17 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
 
         if (cf->can_dlc > 0) {
                 data = be32_to_cpup((__be32 *)&cf->data[0]);
-                priv->write(data, &priv->tx_mb->data[0]);
+                priv->write(data, &regs->mb[FLEXCAN_TX_MB].data[0]);
         }
         if (cf->can_dlc > 4) {
                 data = be32_to_cpup((__be32 *)&cf->data[4]);
-                priv->write(data, &priv->tx_mb->data[1]);
+                priv->write(data, &regs->mb[FLEXCAN_TX_MB].data[1]);
         }
 
         can_put_echo_skb(skb, dev, 0);
 
-        priv->write(can_id, &priv->tx_mb->can_id);
-        priv->write(ctrl, &priv->tx_mb->can_ctrl);
+        priv->write(can_id, &regs->mb[FLEXCAN_TX_MB].can_id);
+        priv->write(ctrl, &regs->mb[FLEXCAN_TX_MB].can_ctrl);
 
         /* Errata ERR005829 step8:
          * Write twice INACTIVE(0x8) code to first MB.
@@ -563,9 +561,13 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
 static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct sk_buff *skb;
         struct can_frame *cf;
         bool rx_errors = false, tx_errors = false;
+        u32 timestamp;
+
+        timestamp = priv->read(&regs->timer) << 16;
 
         skb = alloc_can_err_skb(dev, &cf);
         if (unlikely(!skb))
@@ -612,17 +614,21 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
         if (tx_errors)
                 dev->stats.tx_errors++;
 
-        can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
+        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
 }
 
 static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct sk_buff *skb;
         struct can_frame *cf;
         enum can_state new_state, rx_state, tx_state;
         int flt;
         struct can_berr_counter bec;
+        u32 timestamp;
+
+        timestamp = priv->read(&regs->timer) << 16;
 
         flt = reg_esr & FLEXCAN_ESR_FLT_CONF_MASK;
         if (likely(flt == FLEXCAN_ESR_FLT_CONF_ACTIVE)) {
@@ -652,7 +658,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
         if (unlikely(new_state == CAN_STATE_BUS_OFF))
                 can_bus_off(dev);
 
-        can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
+        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
 }
 
 static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
@@ -720,9 +726,14 @@ static unsigned int flexcan_mailbox_read(struct can_rx_offload *offload,
                         priv->write(BIT(n - 32), &regs->iflag2);
         } else {
                 priv->write(FLEXCAN_IFLAG_RX_FIFO_AVAILABLE, &regs->iflag1);
-                priv->read(&regs->timer);
         }
 
+        /* Read the Free Running Timer. It is optional but recommended
+         * to unlock Mailbox as soon as possible and make it available
+         * for reception.
+         */
+        priv->read(&regs->timer);
+
         return 1;
 }
 
@@ -732,9 +743,9 @@ static inline u64 flexcan_read_reg_iflag_rx(struct flexcan_priv *priv)
         struct flexcan_regs __iomem *regs = priv->regs;
         u32 iflag1, iflag2;
 
-        iflag2 = priv->read(&regs->iflag2) & priv->reg_imask2_default;
-        iflag1 = priv->read(&regs->iflag1) & priv->reg_imask1_default &
-                ~FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
+        iflag2 = priv->read(&regs->iflag2) & priv->reg_imask2_default &
+                ~FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
+        iflag1 = priv->read(&regs->iflag1) & priv->reg_imask1_default;
 
         return (u64)iflag2 << 32 | iflag1;
 }
@@ -746,11 +757,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->regs;
         irqreturn_t handled = IRQ_NONE;
-        u32 reg_iflag1, reg_esr;
+        u32 reg_iflag2, reg_esr;
         enum can_state last_state = priv->can.state;
 
-        reg_iflag1 = priv->read(&regs->iflag1);
-
         /* reception interrupt */
         if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
                 u64 reg_iflag;
@@ -764,6 +773,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                                 break;
                 }
         } else {
+                u32 reg_iflag1;
+
+                reg_iflag1 = priv->read(&regs->iflag1);
                 if (reg_iflag1 & FLEXCAN_IFLAG_RX_FIFO_AVAILABLE) {
                         handled = IRQ_HANDLED;
                         can_rx_offload_irq_offload_fifo(&priv->offload);
@@ -779,17 +791,22 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                 }
         }
 
+        reg_iflag2 = priv->read(&regs->iflag2);
+
         /* transmission complete interrupt */
-        if (reg_iflag1 & FLEXCAN_IFLAG_MB(priv->tx_mb_idx)) {
+        if (reg_iflag2 & FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB)) {
+                u32 reg_ctrl = priv->read(&regs->mb[FLEXCAN_TX_MB].can_ctrl);
+
                 handled = IRQ_HANDLED;
-                stats->tx_bytes += can_get_echo_skb(dev, 0);
+                stats->tx_bytes += can_rx_offload_get_echo_skb(&priv->offload,
+                                                               0, reg_ctrl << 16);
                 stats->tx_packets++;
                 can_led_event(dev, CAN_LED_EVENT_TX);
 
                 /* after sending a RTR frame MB is in RX mode */
                 priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
-                            &priv->tx_mb->can_ctrl);
-                priv->write(FLEXCAN_IFLAG_MB(priv->tx_mb_idx), &regs->iflag1);
+                            &regs->mb[FLEXCAN_TX_MB].can_ctrl);
+                priv->write(FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB), &regs->iflag2);
                 netif_wake_queue(dev);
         }
 
@@ -931,15 +948,13 @@ static int flexcan_chip_start(struct net_device *dev)
         reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
         reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV |
                 FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_SRX_DIS | FLEXCAN_MCR_IRMQ |
-                FLEXCAN_MCR_IDAM_C;
+                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(FLEXCAN_TX_MB);
 
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
                 reg_mcr &= ~FLEXCAN_MCR_FEN;
-                reg_mcr |= FLEXCAN_MCR_MAXMB(priv->offload.mb_last);
-        } else {
-                reg_mcr |= FLEXCAN_MCR_FEN |
-                        FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
-        }
+        else
+                reg_mcr |= FLEXCAN_MCR_FEN;
+
         netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
         priv->write(reg_mcr, &regs->mcr);
 
@@ -982,16 +997,17 @@ static int flexcan_chip_start(struct net_device *dev)
                 priv->write(reg_ctrl2, &regs->ctrl2);
         }
 
-        /* clear and invalidate all mailboxes first */
-        for (i = priv->tx_mb_idx; i < ARRAY_SIZE(regs->mb); i++) {
-                priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
-                            &regs->mb[i].can_ctrl);
-        }
-
         if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
-                for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++)
+                for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) {
                         priv->write(FLEXCAN_MB_CODE_RX_EMPTY,
                                     &regs->mb[i].can_ctrl);
+                }
+        } else {
+                /* clear and invalidate unused mailboxes first */
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) {
+                        priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
+                                    &regs->mb[i].can_ctrl);
+                }
         }
 
         /* Errata ERR005829: mark first TX mailbox as INACTIVE */
@@ -1000,7 +1016,7 @@ static int flexcan_chip_start(struct net_device *dev)
 
         /* mark TX mailbox as INACTIVE */
         priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
-                    &priv->tx_mb->can_ctrl);
+                    &regs->mb[FLEXCAN_TX_MB].can_ctrl);
 
         /* acceptance mask/acceptance code (accept everything) */
         priv->write(0x0, &regs->rxgmask);
@@ -1355,17 +1371,13 @@ static int flexcan_probe(struct platform_device *pdev)
         priv->devtype_data = devtype_data;
         priv->reg_xceiver = reg_xceiver;
 
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
-                priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_TIMESTAMP;
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
                 priv->tx_mb_reserved = &regs->mb[FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP];
-        } else {
-                priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_FIFO;
+        else
                 priv->tx_mb_reserved = &regs->mb[FLEXCAN_TX_MB_RESERVED_OFF_FIFO];
-        }
-        priv->tx_mb = &regs->mb[priv->tx_mb_idx];
 
-        priv->reg_imask1_default = FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
-        priv->reg_imask2_default = 0;
+        priv->reg_imask1_default = 0;
+        priv->reg_imask2_default = FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
 
         priv->offload.mailbox_read = flexcan_mailbox_read;
 
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index 11662f479e76..771a46083739 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -24,6 +24,9 @@
 
 #define RCAR_CAN_DRV_NAME       "rcar_can"
 
+#define RCAR_SUPPORTED_CLOCKS   (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
+                                 BIT(CLKR_CLKEXT))
+
 /* Mailbox configuration:
  * mailbox 60 - 63 - Rx FIFO mailboxes
  * mailbox 56 - 59 - Tx FIFO mailboxes
@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev)
                 goto fail_clk;
         }
 
-        if (clock_select >= ARRAY_SIZE(clock_names)) {
+        if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
                 err = -EINVAL;
                 dev_err(&pdev->dev, "invalid CAN clock selected\n");
                 goto fail_clk;
diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index c7d05027a7a0..2ce4fa8698c7 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -211,7 +211,54 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
 }
 EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo);
 
-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb)
+int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+                                struct sk_buff *skb, u32 timestamp)
+{
+        struct can_rx_offload_cb *cb;
+        unsigned long flags;
+
+        if (skb_queue_len(&offload->skb_queue) >
+            offload->skb_queue_len_max)
+                return -ENOMEM;
+
+        cb = can_rx_offload_get_cb(skb);
+        cb->timestamp = timestamp;
+
+        spin_lock_irqsave(&offload->skb_queue.lock, flags);
+        __skb_queue_add_sort(&offload->skb_queue, skb, can_rx_offload_compare);
+        spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
+
+        can_rx_offload_schedule(offload);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(can_rx_offload_queue_sorted);
+
+unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
+                                         unsigned int idx, u32 timestamp)
+{
+        struct net_device *dev = offload->dev;
+        struct net_device_stats *stats = &dev->stats;
+        struct sk_buff *skb;
+        u8 len;
+        int err;
+
+        skb = __can_get_echo_skb(dev, idx, &len);
+        if (!skb)
+                return 0;
+
+        err = can_rx_offload_queue_sorted(offload, skb, timestamp);
+        if (err) {
+                stats->rx_errors++;
+                stats->tx_fifo_errors++;
+        }
+
+        return len;
+}
+EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb);
+
+int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+                              struct sk_buff *skb)
 {
         if (skb_queue_len(&offload->skb_queue) >
             offload->skb_queue_len_max)
@@ -222,7 +269,7 @@ int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_b
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(can_rx_offload_irq_queue_err_skb);
+EXPORT_SYMBOL_GPL(can_rx_offload_queue_tail);
 
 static int can_rx_offload_init_queue(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight)
 {
diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
index 53e320c92a8b..ddaf46239e39 100644
--- a/drivers/net/can/spi/hi311x.c
+++ b/drivers/net/can/spi/hi311x.c
@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device *net)
 {
         struct hi3110_priv *priv = netdev_priv(net);
         struct spi_device *spi = priv->spi;
-        unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_RISING;
+        unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_HIGH;
         int ret;
 
         ret = open_candev(net);
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
index b939a4c10b84..c89c7d4900d7 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                         context = &priv->tx_contexts[i];
 
                         context->echo_index = i;
-                        can_put_echo_skb(skb, netdev, context->echo_index);
                         ++priv->active_tx_contexts;
                         if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)
                                 netif_stop_queue(netdev);
@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                 dev_kfree_skb(skb);
                 spin_lock_irqsave(&priv->tx_contexts_lock, flags);
 
-                can_free_echo_skb(netdev, context->echo_index);
                 context->echo_index = dev->max_tx_urbs;
                 --priv->active_tx_contexts;
                 netif_wake_queue(netdev);
@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
 
         context->priv = priv;
 
+        can_put_echo_skb(skb, netdev, context->echo_index);
+
         usb_fill_bulk_urb(urb, dev->udev,
                           usb_sndbulkpipe(dev->udev,
                                           dev->bulk_out->bEndpointAddress),
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
index c084bae5ec0a..5fc0be564274 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
@@ -1019,6 +1019,11 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
                                         new_state : CAN_STATE_ERROR_ACTIVE;
 
                         can_change_state(netdev, cf, tx_state, rx_state);
+
+                        if (priv->can.restart_ms &&
+                            old_state >= CAN_STATE_BUS_OFF &&
+                            new_state < CAN_STATE_BUS_OFF)
+                                cf->can_id |= CAN_ERR_RESTARTED;
                 }
 
                 if (new_state == CAN_STATE_BUS_OFF) {
@@ -1028,11 +1033,6 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
 
                         can_bus_off(netdev);
                 }
-
-                if (priv->can.restart_ms &&
-                    old_state >= CAN_STATE_BUS_OFF &&
-                    new_state < CAN_STATE_BUS_OFF)
-                        cf->can_id |= CAN_ERR_RESTARTED;
         }
 
         if (!skb) {
diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c
index 0678a38b1af4..f3d5bda012a1 100644
--- a/drivers/net/can/usb/ucan.c
+++ b/drivers/net/can/usb/ucan.c
@@ -35,10 +35,6 @@
 #include <linux/slab.h>
 #include <linux/usb.h>
 
-#include <linux/can.h>
-#include <linux/can/dev.h>
-#include <linux/can/error.h>
-
 #define UCAN_DRIVER_NAME "ucan"
 #define UCAN_MAX_RX_URBS 8
 /* the CAN controller needs a while to enable/disable the bus */
@@ -1575,11 +1571,8 @@ err_firmware_needs_update:
 /* disconnect the device */
 static void ucan_disconnect(struct usb_interface *intf)
 {
-        struct usb_device *udev;
         struct ucan_priv *up = usb_get_intfdata(intf);
 
-        udev = interface_to_usbdev(intf);
-
         usb_set_intfdata(intf, NULL);
 
         if (up) {
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 18956e7604a3..a70bb1bb90e7 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1848,6 +1848,8 @@ static void ena_down(struct ena_adapter *adapter)
                 rc = ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
                 if (rc)
                         dev_err(&adapter->pdev->dev, "Device reset failed\n");
+                /* stop submitting admin commands on a device that was reset */
+                ena_com_set_admin_running_state(adapter->ena_dev, false);
         }
 
         ena_destroy_all_io_queues(adapter);
@@ -1914,6 +1916,9 @@ static int ena_close(struct net_device *netdev)
 
         netif_dbg(adapter, ifdown, netdev, "%s\n", __func__);
 
+        if (!test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                return 0;
+
         if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                 ena_down(adapter);
 
@@ -2613,9 +2618,7 @@ static void ena_destroy_device(struct ena_adapter *adapter, bool graceful)
                 ena_down(adapter);
 
         /* Stop the device from sending AENQ events (in case reset flag is set
-         *  and device is up, ena_close already reset the device
-         * In case the reset flag is set and the device is up, ena_down()
-         * already perform the reset, so it can be skipped.
+         *  and device is up, ena_down() already reset the device.
          */
         if (!(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags) && dev_up))
                 ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
@@ -2694,8 +2697,8 @@ err_device_destroy:
         ena_com_abort_admin_commands(ena_dev);
         ena_com_wait_for_abort_completion(ena_dev);
         ena_com_admin_destroy(ena_dev);
-        ena_com_mmio_reg_read_request_destroy(ena_dev);
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_DRIVER_INVALID_STATE);
+        ena_com_mmio_reg_read_request_destroy(ena_dev);
 err:
         clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
         clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
@@ -3452,6 +3455,8 @@ err_rss:
         ena_com_rss_destroy(ena_dev);
 err_free_msix:
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_INIT_ERR);
+        /* stop submitting admin commands on a device that was reset */
+        ena_com_set_admin_running_state(ena_dev, false);
         ena_free_mgmnt_irq(adapter);
         ena_disable_msix(adapter);
 err_worker_destroy:
@@ -3498,18 +3503,12 @@ static void ena_remove(struct pci_dev *pdev)
 
         cancel_work_sync(&adapter->reset_task);
 
-        unregister_netdev(netdev);
-
-        /* If the device is running then we want to make sure the device will be
-         * reset to make sure no more events will be issued by the device.
-         */
-        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
-                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-
         rtnl_lock();
         ena_destroy_device(adapter, true);
         rtnl_unlock();
 
+        unregister_netdev(netdev);
+
         free_netdev(netdev);
 
         ena_com_rss_destroy(ena_dev);
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 521873642339..dc8b6173d8d8 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 1
+#define DRV_MODULE_VER_SUBMINOR 2
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
index b4fc0ed5bce8..9d4899826823 100644
--- a/drivers/net/ethernet/amd/sunlance.c
+++ b/drivers/net/ethernet/amd/sunlance.c
@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
 
                         prop = of_get_property(nd, "tpe-link-test?", NULL);
                         if (!prop)
-                                goto no_link_test;
+                                goto node_put;
 
                         if (strcmp(prop, "true")) {
                                 printk(KERN_NOTICE "SunLance: warning: overriding option "
@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
                                        "to ecd@skynet.be\n");
                                 auxio_set_lte(AUXIO_LTE_ON);
                         }
+node_put:
+                        of_node_put(nd);
 no_link_test:
                         lp->auto_select = 1;
                         lp->tpe = 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index be1506169076..0de487a8f0eb 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -2191,6 +2191,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                          E1HVN_MAX)
 
+/* Following is the DMAE channel number allocation for the clients.
+ *   MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively.
+ *   Driver: 0-3 and 8-11 (for PF dmae operations)
+ *           4 and 12 (for stats requests)
+ */
+#define BNX2X_FW_DMAE_C                 13 /* Channel for FW DMAE operations */
+
 /* PCIE link and speed */
 #define PCICFG_LINK_WIDTH               0x1f00000
 #define PCICFG_LINK_WIDTH_SHIFT         20
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 3f4d2c8da21a..a9eaaf3e73a4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
         rdata->sd_vlan_tag      = cpu_to_le16(start_params->sd_vlan_tag);
         rdata->path_id          = BP_PATH(bp);
         rdata->network_cos_mode = start_params->network_cos_mode;
+        rdata->dmae_cmd_id      = BNX2X_FW_DMAE_C;
 
         rdata->vxlan_dst_port   = cpu_to_le16(start_params->vxlan_dst_port);
         rdata->geneve_dst_port  = cpu_to_le16(start_params->geneve_dst_port);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index dd85d790f638..d4c300117529 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1675,7 +1675,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
         } else {
                 if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L4_CS_ERR_BITS) {
                         if (dev->features & NETIF_F_RXCSUM)
-                                cpr->rx_l4_csum_errors++;
+                                bnapi->cp_ring.rx_l4_csum_errors++;
                 }
         }
 
@@ -8714,6 +8714,26 @@ static int bnxt_set_features(struct net_device *dev, netdev_features_t features)
         return rc;
 }
 
+static int bnxt_dbg_hwrm_ring_info_get(struct bnxt *bp, u8 ring_type,
+                                       u32 ring_id, u32 *prod, u32 *cons)
+{
+        struct hwrm_dbg_ring_info_get_output *resp = bp->hwrm_cmd_resp_addr;
+        struct hwrm_dbg_ring_info_get_input req = {0};
+        int rc;
+
+        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_DBG_RING_INFO_GET, -1, -1);
+        req.ring_type = ring_type;
+        req.fw_ring_id = cpu_to_le32(ring_id);
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        if (!rc) {
+                *prod = le32_to_cpu(resp->producer_index);
+                *cons = le32_to_cpu(resp->consumer_index);
+        }
+        mutex_unlock(&bp->hwrm_cmd_lock);
+        return rc;
+}
+
 static void bnxt_dump_tx_sw_state(struct bnxt_napi *bnapi)
 {
         struct bnxt_tx_ring_info *txr = bnapi->tx_ring;
@@ -8821,6 +8841,11 @@ static void bnxt_timer(struct timer_list *t)
                         bnxt_queue_sp_work(bp);
                 }
         }
+
+        if ((bp->flags & BNXT_FLAG_CHIP_P5) && netif_carrier_ok(dev)) {
+                set_bit(BNXT_RING_COAL_NOW_SP_EVENT, &bp->sp_event);
+                bnxt_queue_sp_work(bp);
+        }
 bnxt_restart_timer:
         mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
@@ -8851,6 +8876,44 @@ static void bnxt_reset(struct bnxt *bp, bool silent)
         bnxt_rtnl_unlock_sp(bp);
 }
 
+static void bnxt_chk_missed_irq(struct bnxt *bp)
+{
+        int i;
+
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                return;
+
+        for (i = 0; i < bp->cp_nr_rings; i++) {
+                struct bnxt_napi *bnapi = bp->bnapi[i];
+                struct bnxt_cp_ring_info *cpr;
+                u32 fw_ring_id;
+                int j;
+
+                if (!bnapi)
+                        continue;
+
+                cpr = &bnapi->cp_ring;
+                for (j = 0; j < 2; j++) {
+                        struct bnxt_cp_ring_info *cpr2 = cpr->cp_ring_arr[j];
+                        u32 val[2];
+
+                        if (!cpr2 || cpr2->has_more_work ||
+                            !bnxt_has_work(bp, cpr2))
+                                continue;
+
+                        if (cpr2->cp_raw_cons != cpr2->last_cp_raw_cons) {
+                                cpr2->last_cp_raw_cons = cpr2->cp_raw_cons;
+                                continue;
+                        }
+                        fw_ring_id = cpr2->cp_ring_struct.fw_ring_id;
+                        bnxt_dbg_hwrm_ring_info_get(bp,
+                                DBG_RING_INFO_GET_REQ_RING_TYPE_L2_CMPL,
+                                fw_ring_id, &val[0], &val[1]);
+                        cpr->missed_irqs++;
+                }
+        }
+}
+
 static void bnxt_cfg_ntp_filters(struct bnxt *);
 
 static void bnxt_sp_task(struct work_struct *work)
@@ -8930,6 +8993,9 @@ static void bnxt_sp_task(struct work_struct *work)
         if (test_and_clear_bit(BNXT_FLOW_STATS_SP_EVENT, &bp->sp_event))
                 bnxt_tc_flow_stats_work(bp);
 
+        if (test_and_clear_bit(BNXT_RING_COAL_NOW_SP_EVENT, &bp->sp_event))
+                bnxt_chk_missed_irq(bp);
+
         /* These functions below will clear BNXT_STATE_IN_SP_TASK.  They
          * must be the last functions to be called before exiting.
          */
@@ -10087,6 +10153,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         bnxt_hwrm_func_qcfg(bp);
+        bnxt_hwrm_vnic_qcaps(bp);
         bnxt_hwrm_port_led_qcaps(bp);
         bnxt_ethtool_init(bp);
         bnxt_dcb_init(bp);
@@ -10120,7 +10187,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                                     VNIC_RSS_CFG_REQ_HASH_TYPE_UDP_IPV6;
         }
 
-        bnxt_hwrm_vnic_qcaps(bp);
         if (bnxt_rfs_supported(bp)) {
                 dev->hw_features |= NETIF_F_NTUPLE;
                 if (bnxt_rfs_capable(bp)) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 498b373c992d..9e99d4ab3e06 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -798,6 +798,8 @@ struct bnxt_cp_ring_info {
         u8                      had_work_done:1;
         u8                      has_more_work:1;
 
+        u32                     last_cp_raw_cons;
+
         struct bnxt_coal        rx_ring_coal;
         u64                     rx_packets;
         u64                     rx_bytes;
@@ -816,6 +818,7 @@ struct bnxt_cp_ring_info {
         dma_addr_t              hw_stats_map;
         u32                     hw_stats_ctx_id;
         u64                     rx_l4_csum_errors;
+        u64                     missed_irqs;
 
         struct bnxt_ring_struct cp_ring_struct;
 
@@ -1527,6 +1530,7 @@ struct bnxt {
 #define BNXT_LINK_SPEED_CHNG_SP_EVENT   14
 #define BNXT_FLOW_STATS_SP_EVENT        15
 #define BNXT_UPDATE_PHY_SP_EVENT        16
+#define BNXT_RING_COAL_NOW_SP_EVENT     17
 
         struct bnxt_hw_resc     hw_resc;
         struct bnxt_pf_info     pf;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 48078564f025..6cc69a58478a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -137,7 +137,7 @@ reset_coalesce:
         return rc;
 }
 
-#define BNXT_NUM_STATS  21
+#define BNXT_NUM_STATS  22
 
 #define BNXT_RX_STATS_ENTRY(counter)    \
         { BNXT_RX_STATS_OFFSET(counter), __stringify(counter) }
@@ -384,6 +384,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev,
                 for (k = 0; k < stat_fields; j++, k++)
                         buf[j] = le64_to_cpu(hw_stats[k]);
                 buf[j++] = cpr->rx_l4_csum_errors;
+                buf[j++] = cpr->missed_irqs;
 
                 bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter +=
                         le64_to_cpu(cpr->hw_stats->rx_discard_pkts);
@@ -468,6 +469,8 @@ static void bnxt_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
                         buf += ETH_GSTRING_LEN;
                         sprintf(buf, "[%d]: rx_l4_csum_errors", i);
                         buf += ETH_GSTRING_LEN;
+                        sprintf(buf, "[%d]: missed_irqs", i);
+                        buf += ETH_GSTRING_LEN;
                 }
                 for (i = 0; i < BNXT_NUM_SW_FUNC_STATS; i++) {
                         strcpy(buf, bnxt_sw_func_stats[i].string);
@@ -2942,8 +2945,8 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
         record->asic_state = 0;
         strlcpy(record->system_name, utsname()->nodename,
                 sizeof(record->system_name));
-        record->year = cpu_to_le16(tm.tm_year);
-        record->month = cpu_to_le16(tm.tm_mon);
+        record->year = cpu_to_le16(tm.tm_year + 1900);
+        record->month = cpu_to_le16(tm.tm_mon + 1);
         record->day = cpu_to_le16(tm.tm_mday);
         record->hour = cpu_to_le16(tm.tm_hour);
         record->minute = cpu_to_le16(tm.tm_min);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index beee61292d5e..b59b382d34f9 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -43,6 +43,9 @@ static int bnxt_register_dev(struct bnxt_en_dev *edev, int ulp_id,
         if (ulp_id == BNXT_ROCE_ULP) {
                 unsigned int max_stat_ctxs;
 
+                if (bp->flags & BNXT_FLAG_CHIP_P5)
+                        return -EOPNOTSUPP;
+
                 max_stat_ctxs = bnxt_get_max_func_stat_ctxs(bp);
                 if (max_stat_ctxs <= BNXT_MIN_ROCE_STAT_CTXS ||
                     bp->num_stat_ctxs == max_stat_ctxs)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 89295306f161..432c3b867084 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12422,6 +12422,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 {
         struct tg3 *tp = netdev_priv(dev);
         int i, irq_sync = 0, err = 0;
+        bool reset_phy = false;
 
         if ((ering->rx_pending > tp->rx_std_ring_mask) ||
             (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
@@ -12453,7 +12454,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                err = tg3_restart_hw(tp, false);
+                /* Reset PHY to avoid PHY lock up */
+                if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5720)
+                        reset_phy = true;
+
+                err = tg3_restart_hw(tp, reset_phy);
                 if (!err)
                         tg3_netif_start(tp);
         }
@@ -12487,6 +12494,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 {
         struct tg3 *tp = netdev_priv(dev);
         int err = 0;
+        bool reset_phy = false;
 
         if (tp->link_config.autoneg == AUTONEG_ENABLE)
                 tg3_warn_mgmt_link_flap(tp);
@@ -12556,7 +12564,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
                 if (netif_running(dev)) {
                         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                        err = tg3_restart_hw(tp, false);
+                        /* Reset PHY to avoid PHY lock up */
+                        if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5720)
+                                reset_phy = true;
+
+                        err = tg3_restart_hw(tp, reset_phy);
                         if (!err)
                                 tg3_netif_start(tp);
                 }
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 55af04fa03a7..6c8dcb65ff03 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1441,6 +1441,9 @@ static void nic_remove(struct pci_dev *pdev)
 {
         struct nicpf *nic = pci_get_drvdata(pdev);
 
+        if (!nic)
+                return;
+
         if (nic->flags & NIC_SRIOV_ENABLED)
                 pci_disable_sriov(pdev);
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 768f584f8392..88f8a8fa93cd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1784,6 +1784,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         bool if_up = netif_running(nic->netdev);
         struct bpf_prog *old_prog;
         bool bpf_attached = false;
+        int ret = 0;
 
         /* For now just support only the usual MTU sized frames */
         if (prog && (dev->mtu > 1500)) {
@@ -1817,8 +1818,12 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         if (nic->xdp_prog) {
                 /* Attach BPF program */
                 nic->xdp_prog = bpf_prog_add(nic->xdp_prog, nic->rx_queues - 1);
-                if (!IS_ERR(nic->xdp_prog))
+                if (!IS_ERR(nic->xdp_prog)) {
                         bpf_attached = true;
+                } else {
+                        ret = PTR_ERR(nic->xdp_prog);
+                        nic->xdp_prog = NULL;
+                }
         }
 
         /* Calculate Tx queues needed for XDP and network stack */
@@ -1830,7 +1835,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
                 netif_trans_update(nic->netdev);
         }
 
-        return 0;
+        return ret;
 }
 
 static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 187a249ff2d1..fcaf18fa3904 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -585,10 +585,12 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
         if (!sq->dmem.base)
                 return;
 
-        if (sq->tso_hdrs)
+        if (sq->tso_hdrs) {
                 dma_free_coherent(&nic->pdev->dev,
                                   sq->dmem.q_len * TSO_HEADER_SIZE,
                                   sq->tso_hdrs, sq->tso_hdrs_phys);
+                sq->tso_hdrs = NULL;
+        }
 
         /* Free pending skbs in the queue */
         smp_rmb();
diff --git a/drivers/net/ethernet/chelsio/Kconfig b/drivers/net/ethernet/chelsio/Kconfig
index 75c1c5ed2387..e2cdfa75673f 100644
--- a/drivers/net/ethernet/chelsio/Kconfig
+++ b/drivers/net/ethernet/chelsio/Kconfig
@@ -67,7 +67,6 @@ config CHELSIO_T3
 config CHELSIO_T4
         tristate "Chelsio Communications T4/T5/T6 Ethernet support"
         depends on PCI && (IPV6 || IPV6=n)
-        depends on THERMAL || !THERMAL
         select FW_LOADER
         select MDIO
         select ZLIB_DEFLATE
diff --git a/drivers/net/ethernet/chelsio/cxgb4/Makefile b/drivers/net/ethernet/chelsio/cxgb4/Makefile
index 78e5d17a1d5f..91d8a885deba 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/Makefile
+++ b/drivers/net/ethernet/chelsio/cxgb4/Makefile
@@ -12,6 +12,4 @@ cxgb4-objs := cxgb4_main.o l2t.o smt.o t4_hw.o sge.o clip_tbl.o cxgb4_ethtool.o
 cxgb4-$(CONFIG_CHELSIO_T4_DCB) +=  cxgb4_dcb.o
 cxgb4-$(CONFIG_CHELSIO_T4_FCOE) +=  cxgb4_fcoe.o
 cxgb4-$(CONFIG_DEBUG_FS) += cxgb4_debugfs.o
-ifdef CONFIG_THERMAL
-cxgb4-objs += cxgb4_thermal.o
-endif
+cxgb4-$(CONFIG_THERMAL) += cxgb4_thermal.o
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 05a46926016a..d49db46254cd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5863,7 +5863,7 @@ fw_attach_fail:
         if (!is_t4(adapter->params.chip))
                 cxgb4_ptp_init(adapter);
 
-        if (IS_ENABLED(CONFIG_THERMAL) &&
+        if (IS_REACHABLE(CONFIG_THERMAL) &&
             !is_t4(adapter->params.chip) && (adapter->flags & FW_OK))
                 cxgb4_thermal_init(adapter);
 
@@ -5932,7 +5932,7 @@ static void remove_one(struct pci_dev *pdev)
 
                 if (!is_t4(adapter->params.chip))
                         cxgb4_ptp_stop(adapter);
-                if (IS_ENABLED(CONFIG_THERMAL))
+                if (IS_REACHABLE(CONFIG_THERMAL))
                         cxgb4_thermal_remove(adapter);
 
                 /* If we allocated filters, free up state associated with any
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index ceec467f590d..949103db8a8a 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -660,7 +660,7 @@ static void gmac_clean_txq(struct net_device *netdev, struct gmac_txq *txq,
 
                         u64_stats_update_begin(&port->tx_stats_syncp);
                         port->tx_frag_stats[nfrags]++;
-                        u64_stats_update_end(&port->ir_stats_syncp);
+                        u64_stats_update_end(&port->tx_stats_syncp);
                 }
         }
 
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
index 570caeb8ee9e..084f24daf2b5 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -872,11 +872,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
         struct net_device *netdev = dev_id;
         struct ftmac100 *priv = netdev_priv(netdev);
 
-        if (likely(netif_running(netdev))) {
-                /* Disable interrupts for polling */
-                ftmac100_disable_all_int(priv);
+        /* Disable interrupts for polling */
+        ftmac100_disable_all_int(priv);
+        if (likely(netif_running(netdev)))
                 napi_schedule(&priv->napi);
-        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index be268dcde8fa..f9a4e76c5a8b 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -915,10 +915,8 @@ static int hip04_mac_probe(struct platform_device *pdev)
         }
 
         ret = register_netdev(ndev);
-        if (ret) {
-                free_netdev(ndev);
+        if (ret)
                 goto alloc_fail;
-        }
 
         return 0;
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index c9d5d0a7fbf1..c0203a0d5e3b 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -485,8 +485,8 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
                 for (j = 0; j < rx_pool->size; j++) {
                         if (rx_pool->rx_buff[j].skb) {
-                                dev_kfree_skb_any(rx_pool->rx_buff[i].skb);
-                                rx_pool->rx_buff[i].skb = NULL;
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
                         }
                 }
 
@@ -1103,20 +1103,15 @@ static int ibmvnic_open(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
-
         if (adapter->state != VNIC_CLOSED) {
                 rc = ibmvnic_login(netdev);
-                if (rc) {
-                        mutex_unlock(&adapter->reset_lock);
+                if (rc)
                         return rc;
-                }
 
                 rc = init_resources(adapter);
                 if (rc) {
                         netdev_err(netdev, "failed to initialize resources\n");
                         release_resources(adapter);
-                        mutex_unlock(&adapter->reset_lock);
                         return rc;
                 }
         }
@@ -1124,8 +1119,6 @@ static int ibmvnic_open(struct net_device *netdev)
         rc = __ibmvnic_open(netdev);
         netif_carrier_on(netdev);
 
-        mutex_unlock(&adapter->reset_lock);
-
         return rc;
 }
 
@@ -1269,10 +1262,8 @@ static int ibmvnic_close(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
         rc = __ibmvnic_close(netdev);
         ibmvnic_cleanup(netdev);
-        mutex_unlock(&adapter->reset_lock);
 
         return rc;
 }
@@ -1746,6 +1737,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                     struct ibmvnic_rwi *rwi, u32 reset_state)
 {
         u64 old_num_rx_queues, old_num_tx_queues;
+        u64 old_num_rx_slots, old_num_tx_slots;
         struct net_device *netdev = adapter->netdev;
         int i, rc;
 
@@ -1757,6 +1749,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
+        old_num_rx_slots = adapter->req_rx_add_entries_per_subcrq;
+        old_num_tx_slots = adapter->req_tx_entries_per_subcrq;
 
         ibmvnic_cleanup(netdev);
 
@@ -1819,21 +1813,20 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         if (rc)
                                 return rc;
                 } else if (adapter->req_rx_queues != old_num_rx_queues ||
-                           adapter->req_tx_queues != old_num_tx_queues) {
-                        adapter->map_id = 1;
+                           adapter->req_tx_queues != old_num_tx_queues ||
+                           adapter->req_rx_add_entries_per_subcrq !=
+                                                        old_num_rx_slots ||
+                           adapter->req_tx_entries_per_subcrq !=
+                                                        old_num_tx_slots) {
                         release_rx_pools(adapter);
                         release_tx_pools(adapter);
-                        rc = init_rx_pools(netdev);
-                        if (rc)
-                                return rc;
-                        rc = init_tx_pools(netdev);
-                        if (rc)
-                                return rc;
-
                         release_napi(adapter);
-                        rc = init_napi(adapter);
+                        release_vpd_data(adapter);
+
+                        rc = init_resources(adapter);
                         if (rc)
                                 return rc;
+
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -1917,17 +1910,8 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
                 adapter->state = VNIC_PROBED;
                 return 0;
         }
-        /* netif_set_real_num_xx_queues needs to take rtnl lock here
-         * unless wait_for_reset is set, in which case the rtnl lock
-         * has already been taken before initializing the reset
-         */
-        if (!adapter->wait_for_reset) {
-                rtnl_lock();
-                rc = init_resources(adapter);
-                rtnl_unlock();
-        } else {
-                rc = init_resources(adapter);
-        }
+
+        rc = init_resources(adapter);
         if (rc)
                 return rc;
 
@@ -1986,13 +1970,21 @@ static void __ibmvnic_reset(struct work_struct *work)
         struct ibmvnic_rwi *rwi;
         struct ibmvnic_adapter *adapter;
         struct net_device *netdev;
+        bool we_lock_rtnl = false;
         u32 reset_state;
         int rc = 0;
 
         adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset);
         netdev = adapter->netdev;
 
-        mutex_lock(&adapter->reset_lock);
+        /* netif_set_real_num_xx_queues needs to take rtnl lock here
+         * unless wait_for_reset is set, in which case the rtnl lock
+         * has already been taken before initializing the reset
+         */
+        if (!adapter->wait_for_reset) {
+                rtnl_lock();
+                we_lock_rtnl = true;
+        }
         reset_state = adapter->state;
 
         rwi = get_next_rwi(adapter);
@@ -2020,12 +2012,11 @@ static void __ibmvnic_reset(struct work_struct *work)
         if (rc) {
                 netdev_dbg(adapter->netdev, "Reset failed\n");
                 free_all_rwi(adapter);
-                mutex_unlock(&adapter->reset_lock);
-                return;
         }
 
         adapter->resetting = false;
-        mutex_unlock(&adapter->reset_lock);
+        if (we_lock_rtnl)
+                rtnl_unlock();
 }
 
 static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
@@ -4768,7 +4759,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
-        mutex_init(&adapter->reset_lock);
         mutex_init(&adapter->rwi_lock);
         adapter->resetting = false;
 
@@ -4840,8 +4830,8 @@ static int ibmvnic_remove(struct vio_dev *dev)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
 
         adapter->state = VNIC_REMOVING;
-        unregister_netdev(netdev);
-        mutex_lock(&adapter->reset_lock);
+        rtnl_lock();
+        unregister_netdevice(netdev);
 
         release_resources(adapter);
         release_sub_crqs(adapter, 1);
@@ -4852,7 +4842,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
 
         adapter->state = VNIC_REMOVED;
 
-        mutex_unlock(&adapter->reset_lock);
+        rtnl_unlock();
         device_remove_file(&dev->dev, &dev_attr_failover);
         free_netdev(netdev);
         dev_set_drvdata(&dev->dev, NULL);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 18103b811d4d..99c4f8d331ce 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1075,7 +1075,7 @@ struct ibmvnic_adapter {
         struct tasklet_struct tasklet;
         enum vnic_state state;
         enum ibmvnic_reset_reason reset_reason;
-        struct mutex reset_lock, rwi_lock;
+        struct mutex rwi_lock;
         struct list_head rwi_list;
         struct work_struct ibmvnic_reset;
         bool resetting;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 21c2688d6308..a3f45335437c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1413,7 +1413,7 @@ void __i40e_del_filter(struct i40e_vsi *vsi, struct i40e_mac_filter *f)
         }
 
         vsi->flags |= I40E_VSI_FLAG_FILTER_CHANGED;
-        set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->state);
+        set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->back->state);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index add1e457886d..433c8e688c78 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -33,7 +33,7 @@ static int i40e_alloc_xsk_umems(struct i40e_vsi *vsi)
 }
 
 /**
- * i40e_add_xsk_umem - Store an UMEM for a certain ring/qid
+ * i40e_add_xsk_umem - Store a UMEM for a certain ring/qid
  * @vsi: Current VSI
  * @umem: UMEM to store
  * @qid: Ring/qid to associate with the UMEM
@@ -56,7 +56,7 @@ static int i40e_add_xsk_umem(struct i40e_vsi *vsi, struct xdp_umem *umem,
 }
 
 /**
- * i40e_remove_xsk_umem - Remove an UMEM for a certain ring/qid
+ * i40e_remove_xsk_umem - Remove a UMEM for a certain ring/qid
  * @vsi: Current VSI
  * @qid: Ring/qid associated with the UMEM
  **/
@@ -130,7 +130,7 @@ static void i40e_xsk_umem_dma_unmap(struct i40e_vsi *vsi, struct xdp_umem *umem)
 }
 
 /**
- * i40e_xsk_umem_enable - Enable/associate an UMEM to a certain ring/qid
+ * i40e_xsk_umem_enable - Enable/associate a UMEM to a certain ring/qid
  * @vsi: Current VSI
  * @umem: UMEM
  * @qid: Rx ring to associate UMEM to
@@ -189,7 +189,7 @@ static int i40e_xsk_umem_enable(struct i40e_vsi *vsi, struct xdp_umem *umem,
 }
 
 /**
- * i40e_xsk_umem_disable - Diassociate an UMEM from a certain ring/qid
+ * i40e_xsk_umem_disable - Disassociate a UMEM from a certain ring/qid
  * @vsi: Current VSI
  * @qid: Rx ring to associate UMEM to
  *
@@ -255,12 +255,12 @@ int i40e_xsk_umem_query(struct i40e_vsi *vsi, struct xdp_umem **umem,
 }
 
 /**
- * i40e_xsk_umem_query - Queries a certain ring/qid for its UMEM
+ * i40e_xsk_umem_setup - Enable/disassociate a UMEM to/from a ring/qid
  * @vsi: Current VSI
  * @umem: UMEM to enable/associate to a ring, or NULL to disable
  * @qid: Rx ring to (dis)associate UMEM (from)to
  *
- * This function enables or disables an UMEM to a certain ring.
+ * This function enables or disables a UMEM to a certain ring.
  *
  * Returns 0 on success, <0 on failure
  **/
@@ -276,7 +276,7 @@ int i40e_xsk_umem_setup(struct i40e_vsi *vsi, struct xdp_umem *umem,
  * @rx_ring: Rx ring
  * @xdp: xdp_buff used as input to the XDP program
  *
- * This function enables or disables an UMEM to a certain ring.
+ * This function enables or disables a UMEM to a certain ring.
  *
  * Returns any of I40E_XDP_{PASS, CONSUMED, TX, REDIR}
  **/
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index c54ebedca6da..c393cb2c0f16 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -842,6 +842,7 @@ s32 igb_pll_workaround_i210(struct e1000_hw *hw)
                 nvm_word = E1000_INVM_DEFAULT_AL;
         tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL;
         igb_write_phy_reg_82580(hw, I347AT4_PAGE_SELECT, E1000_PHY_PLL_FREQ_PAGE);
+        phy_word = E1000_PHY_PLL_UNCONF;
         for (i = 0; i < E1000_MAX_PLL_TRIES; i++) {
                 /* check current state directly from internal PHY */
                 igb_read_phy_reg_82580(hw, E1000_PHY_PLL_FREQ_REG, &phy_word);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
index 10dbaf4f6e80..9c42f741ed5e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
@@ -2262,7 +2262,9 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw,
                 *autoneg = false;
 
                 if (hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core0 ||
-                    hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1) {
+                    hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1 ||
+                    hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core0 ||
+                    hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core1) {
                         *speed = IXGBE_LINK_SPEED_1GB_FULL;
                         return 0;
                 }
diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c
index 8c5ba4b81fb7..2d4d10a017e5 100644
--- a/drivers/net/ethernet/lantiq_xrx200.c
+++ b/drivers/net/ethernet/lantiq_xrx200.c
@@ -512,7 +512,8 @@ static int xrx200_probe(struct platform_device *pdev)
         err = register_netdev(net_dev);
         if (err)
                 goto err_unprepare_clk;
-        return err;
+
+        return 0;
 
 err_unprepare_clk:
         clk_disable_unprepare(priv->clk);
@@ -520,7 +521,7 @@ err_unprepare_clk:
 err_uninit_dma:
         xrx200_hw_cleanup(priv);
 
-        return 0;
+        return err;
 }
 
 static int xrx200_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 3ba672e9e353..e5397c8197b9 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3343,7 +3343,6 @@ static void mvneta_validate(struct net_device *ndev, unsigned long *supported,
         if (state->interface != PHY_INTERFACE_MODE_NA &&
             state->interface != PHY_INTERFACE_MODE_QSGMII &&
             state->interface != PHY_INTERFACE_MODE_SGMII &&
-            state->interface != PHY_INTERFACE_MODE_2500BASEX &&
             !phy_interface_mode_is_8023z(state->interface) &&
             !phy_interface_mode_is_rgmii(state->interface)) {
                 bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -3357,14 +3356,9 @@ static void mvneta_validate(struct net_device *ndev, unsigned long *supported,
         /* Asymmetric pause is unsupported */
         phylink_set(mask, Pause);
 
-        /* We cannot use 1Gbps when using the 2.5G interface. */
-        if (state->interface == PHY_INTERFACE_MODE_2500BASEX) {
-                phylink_set(mask, 2500baseT_Full);
-                phylink_set(mask, 2500baseX_Full);
-        } else {
-                phylink_set(mask, 1000baseT_Full);
-                phylink_set(mask, 1000baseX_Full);
-        }
+        /* Half-duplex at speeds higher than 100Mbit is unsupported */
+        phylink_set(mask, 1000baseT_Full);
+        phylink_set(mask, 1000baseX_Full);
 
         if (!phy_interface_mode_is_8023z(state->interface)) {
                 /* 10M and 100M are only supported in non-802.3z mode */
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index deef5a998985..9af34e03892c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -337,7 +337,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
 static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count,
                                   int align, u32 skip_mask, u32 *puid)
 {
-        u32 uid;
+        u32 uid = 0;
         u32 res;
         struct mlx4_zone_allocator *zone_alloc = zone->allocator;
         struct mlx4_zone_entry *curr_node;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index ebcd2778eeb3..23f1b5b512c2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -540,8 +540,8 @@ struct slave_list {
 struct resource_allocator {
         spinlock_t alloc_lock; /* protect quotas */
         union {
-                int res_reserved;
-                int res_port_rsvd[MLX4_MAX_PORTS];
+                unsigned int res_reserved;
+                unsigned int res_port_rsvd[MLX4_MAX_PORTS];
         };
         union {
                 int res_free;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 2e84f10f59ba..1a11bc0e1612 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -363,6 +363,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
                         container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
                                      buf);
 
+                (*mpt_entry)->lkey = 0;
                 err = mlx4_SW2HW_MPT(dev, mailbox, key);
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index d7fbd5b6ac95..118324802926 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -569,6 +569,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        unsigned int           hw_mtu;
 
         struct net_dim         dim; /* Dynamic Interrupt Moderation */
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 023dc4bccd28..4a37713023be 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -88,10 +88,8 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
 
         eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
         *speed = mlx5e_port_ptys2speed(eth_proto_oper);
-        if (!(*speed)) {
-                mlx5_core_warn(mdev, "cannot get port speed\n");
+        if (!(*speed))
                 err = -EINVAL;
-        }
 
         return err;
 }
@@ -258,7 +256,7 @@ static int mlx5e_fec_admin_field(u32 *pplm,
         case 40000:
                 if (!write)
                         *fec_policy = MLX5_GET(pplm_reg, pplm,
-                                               fec_override_cap_10g_40g);
+                                               fec_override_admin_10g_40g);
                 else
                         MLX5_SET(pplm_reg, pplm,
                                  fec_override_admin_10g_40g, *fec_policy);
@@ -310,7 +308,7 @@ static int mlx5e_get_fec_cap_field(u32 *pplm,
         case 10000:
         case 40000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
-                                    fec_override_admin_10g_40g);
+                                    fec_override_cap_10g_40g);
                 break;
         case 25000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
@@ -394,12 +392,12 @@ int mlx5e_get_fec_mode(struct mlx5_core_dev *dev, u32 *fec_mode_active,
 
 int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
 {
+        u8 fec_policy_nofec = BIT(MLX5E_FEC_NOFEC);
         bool fec_mode_not_supp_in_speed = false;
-        u8 no_fec_policy = BIT(MLX5E_FEC_NOFEC);
         u32 out[MLX5_ST_SZ_DW(pplm_reg)] = {};
         u32 in[MLX5_ST_SZ_DW(pplm_reg)] = {};
         int sz = MLX5_ST_SZ_BYTES(pplm_reg);
-        u32 current_fec_speed;
+        u8 fec_policy_auto = 0;
         u8 fec_caps = 0;
         int err;
         int i;
@@ -415,23 +413,19 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
         if (err)
                 return err;
 
-        err = mlx5e_port_linkspeed(dev, &current_fec_speed);
-        if (err)
-                return err;
+        MLX5_SET(pplm_reg, out, local_port, 1);
 
-        memset(in, 0, sz);
-        MLX5_SET(pplm_reg, in, local_port, 1);
-        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS && !!fec_policy; i++) {
+        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS; i++) {
                 mlx5e_get_fec_cap_field(out, &fec_caps, fec_supported_speeds[i]);
-                /* policy supported for link speed */
-                if (!!(fec_caps & fec_policy)) {
-                        mlx5e_fec_admin_field(in, &fec_policy, 1,
+                /* policy supported for link speed, or policy is auto */
+                if (fec_caps & fec_policy || fec_policy == fec_policy_auto) {
+                        mlx5e_fec_admin_field(out, &fec_policy, 1,
                                               fec_supported_speeds[i]);
                 } else {
-                        if (fec_supported_speeds[i] == current_fec_speed)
-                                return -EOPNOTSUPP;
-                        mlx5e_fec_admin_field(in, &no_fec_policy, 1,
-                                              fec_supported_speeds[i]);
+                        /* turn off FEC if supported. Else, leave it the same */
+                        if (fec_caps & fec_policy_nofec)
+                                mlx5e_fec_admin_field(out, &fec_policy_nofec, 1,
+                                                      fec_supported_speeds[i]);
                         fec_mode_not_supp_in_speed = true;
                 }
         }
@@ -441,5 +435,5 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
                               "FEC policy 0x%x is not supported for some speeds",
                               fec_policy);
 
-        return mlx5_core_access_reg(dev, in, sz, out, sz, MLX5_REG_PPLM, 0, 1);
+        return mlx5_core_access_reg(dev, out, sz, out, sz, MLX5_REG_PPLM, 0, 1);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index c047da8752da..eac245a93f91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -130,8 +130,10 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err)
+        if (err) {
+                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
                 return 0;
+        }
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3e770abfd802..25c1c4f96841 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -843,8 +843,7 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported,
                                              Autoneg);
 
-        err = get_fec_supported_advertised(mdev, link_ksettings);
-        if (err)
+        if (get_fec_supported_advertised(mdev, link_ksettings))
                 netdev_dbg(netdev, "%s: FEC caps query failed: %d\n",
                            __func__, err);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 1243edbedc9e..871313d6b34d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -502,6 +502,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         rq->channel = c;
         rq->ix      = c->ix;
         rq->mdev    = mdev;
+        rq->hw_mtu  = MLX5E_SW2HW_MTU(params, params->sw_mtu);
         rq->stats   = &c->priv->channel_stats[c->ix].rq;
 
         rq->xdp_prog = params->xdp_prog ? bpf_prog_inc(params->xdp_prog) : NULL;
@@ -1623,13 +1624,15 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev,
         int err;
         u32 i;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
+        if (err)
+                return err;
+
         err = mlx5_cqwq_create(mdev, &param->wq, param->cqc, &cq->wq,
                                &cq->wq_ctrl);
         if (err)
                 return err;
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
-
         mcq->cqe_sz     = 64;
         mcq->set_ci_db  = cq->wq_ctrl.db.db;
         mcq->arm_db     = cq->wq_ctrl.db.db + 1;
@@ -1687,6 +1690,10 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         int eqn;
         int err;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
+        if (err)
+                return err;
+
         inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
                 sizeof(u64) * cq->wq_ctrl.buf.npages;
         in = kvzalloc(inlen, GFP_KERNEL);
@@ -1700,8 +1707,6 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         mlx5_fill_page_frag_array(&cq->wq_ctrl.buf,
                                   (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas));
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
-
         MLX5_SET(cqc,   cqc, cq_period_mode, param->cq_period_mode);
         MLX5_SET(cqc,   cqc, c_eqn,         eqn);
         MLX5_SET(cqc,   cqc, uar_page,      mdev->priv.uar->index);
@@ -1921,6 +1926,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         int err;
         int eqn;
 
+        err = mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
+        if (err)
+                return err;
+
         c = kvzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
         if (!c)
                 return -ENOMEM;
@@ -1937,7 +1946,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->xdp      = !!params->xdp_prog;
         c->stats    = &priv->channel_stats[ix].ch;
 
-        mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
         c->irq_desc = irq_to_desc(irq);
 
         netif_napi_add(netdev, &c->napi, mlx5e_napi_poll, 64);
@@ -3574,6 +3582,7 @@ static int set_feature_cvlan_filter(struct net_device *netdev, bool enable)
         return 0;
 }
 
+#ifdef CONFIG_MLX5_ESWITCH
 static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -3586,6 +3595,7 @@ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 
         return 0;
 }
+#endif
 
 static int set_feature_rx_all(struct net_device *netdev, bool enable)
 {
@@ -3684,7 +3694,9 @@ static int mlx5e_set_features(struct net_device *netdev,
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER,
                                     set_feature_cvlan_filter);
+#ifdef CONFIG_MLX5_ESWITCH
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_TC, set_feature_tc_num_filters);
+#endif
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXALL, set_feature_rx_all);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXFCS, set_feature_rx_fcs);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan);
@@ -3755,10 +3767,11 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
         }
 
         if (params->rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
+                bool is_linear = mlx5e_rx_mpwqe_is_linear_skb(priv->mdev, &new_channels.params);
                 u8 ppw_old = mlx5e_mpwqe_log_pkts_per_wqe(params);
                 u8 ppw_new = mlx5e_mpwqe_log_pkts_per_wqe(&new_channels.params);
 
-                reset = reset && (ppw_old != ppw_new);
+                reset = reset && (is_linear || (ppw_old != ppw_new));
         }
 
         if (!reset) {
@@ -4678,7 +4691,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
             FT_CAP(modify_root) &&
             FT_CAP(identified_miss_table_mode) &&
             FT_CAP(flow_table_modify)) {
+#ifdef CONFIG_MLX5_ESWITCH
                 netdev->hw_features      |= NETIF_F_HW_TC;
+#endif
 #ifdef CONFIG_MLX5_EN_ARFS
                 netdev->hw_features      |= NETIF_F_NTUPLE;
 #endif
@@ -5004,11 +5019,21 @@ err_free_netdev:
 int mlx5e_attach_netdev(struct mlx5e_priv *priv)
 {
         const struct mlx5e_profile *profile;
+        int max_nch;
         int err;
 
         profile = priv->profile;
         clear_bit(MLX5E_STATE_DESTROYING, &priv->state);
 
+        /* max number of channels may have changed */
+        max_nch = mlx5e_get_max_num_channels(priv->mdev);
+        if (priv->channels.params.num_channels > max_nch) {
+                mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch);
+                priv->channels.params.num_channels = max_nch;
+                mlx5e_build_default_indir_rqt(priv->channels.params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, max_nch);
+        }
+
         err = profile->init_tx(priv);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 79638dcbae78..16985ca3248d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1104,6 +1104,12 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi,
         u32 frag_size;
         bool consumed;
 
+        /* Check packet size. Note LRO doesn't use linear SKB */
+        if (unlikely(cqe_bcnt > rq->hw_mtu)) {
+                rq->stats->oversize_pkts_sw_drop++;
+                return NULL;
+        }
+
         va             = page_address(di->page) + head_offset;
         data           = va + rx_headroom;
         frag_size      = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt32);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 35ded91203f5..4382ef85488c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -98,18 +98,17 @@ static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
         return 1;
 }
 
-#ifdef CONFIG_INET
-/* loopback test */
-#define MLX5E_TEST_PKT_SIZE (MLX5E_RX_MAX_HEAD - NET_IP_ALIGN)
-static const char mlx5e_test_text[ETH_GSTRING_LEN] = "MLX5E SELF TEST";
-#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
-
 struct mlx5ehdr {
         __be32 version;
         __be64 magic;
-        char   text[ETH_GSTRING_LEN];
 };
 
+#ifdef CONFIG_INET
+/* loopback test */
+#define MLX5E_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) +\
+                             sizeof(struct udphdr) + sizeof(struct mlx5ehdr))
+#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
+
 static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
 {
         struct sk_buff *skb = NULL;
@@ -117,10 +116,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         struct ethhdr *ethh;
         struct udphdr *udph;
         struct iphdr *iph;
-        int datalen, iplen;
-
-        datalen = MLX5E_TEST_PKT_SIZE -
-                  (sizeof(*ethh) + sizeof(*iph) + sizeof(*udph));
+        int    iplen;
 
         skb = netdev_alloc_skb(priv->netdev, MLX5E_TEST_PKT_SIZE);
         if (!skb) {
@@ -149,7 +145,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         /* Fill UDP header */
         udph->source = htons(9);
         udph->dest = htons(9); /* Discard Protocol */
-        udph->len = htons(datalen + sizeof(struct udphdr));
+        udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
         udph->check = 0;
 
         /* Fill IP header */
@@ -157,7 +153,8 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         iph->ttl = 32;
         iph->version = 4;
         iph->protocol = IPPROTO_UDP;
-        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen;
+        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) +
+                sizeof(struct mlx5ehdr);
         iph->tot_len = htons(iplen);
         iph->frag_off = 0;
         iph->saddr = 0;
@@ -170,9 +167,6 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         mlxh = skb_put(skb, sizeof(*mlxh));
         mlxh->version = 0;
         mlxh->magic = cpu_to_be64(MLX5E_TEST_MAGIC);
-        strlcpy(mlxh->text, mlx5e_test_text, sizeof(mlxh->text));
-        datalen -= sizeof(*mlxh);
-        skb_put_zero(skb, datalen);
 
         skb->csum = 0;
         skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 1e55b9c27ffc..3e99d0728b2f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -83,6 +83,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_cqes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_strides) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
@@ -161,6 +162,7 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                 s->rx_wqe_err   += rq_stats->wqe_err;
                 s->rx_mpwqe_filler_cqes    += rq_stats->mpwqe_filler_cqes;
                 s->rx_mpwqe_filler_strides += rq_stats->mpwqe_filler_strides;
+                s->rx_oversize_pkts_sw_drop += rq_stats->oversize_pkts_sw_drop;
                 s->rx_buff_alloc_err += rq_stats->buff_alloc_err;
                 s->rx_cqe_compress_blks += rq_stats->cqe_compress_blks;
                 s->rx_cqe_compress_pkts += rq_stats->cqe_compress_pkts;
@@ -1189,6 +1191,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_strides) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 77f74ce11280..3f8e870ef4c9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -96,6 +96,7 @@ struct mlx5e_sw_stats {
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler_cqes;
         u64 rx_mpwqe_filler_strides;
+        u64 rx_oversize_pkts_sw_drop;
         u64 rx_buff_alloc_err;
         u64 rx_cqe_compress_blks;
         u64 rx_cqe_compress_pkts;
@@ -193,6 +194,7 @@ struct mlx5e_rq_stats {
         u64 wqe_err;
         u64 mpwqe_filler_cqes;
         u64 mpwqe_filler_strides;
+        u64 oversize_pkts_sw_drop;
         u64 buff_alloc_err;
         u64 cqe_compress_blks;
         u64 cqe_compress_pkts;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 608025ca5c04..fca6f4132c91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1447,31 +1447,21 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                                          inner_headers);
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
-                struct flow_dissector_key_eth_addrs *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                struct flow_dissector_key_basic *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->key);
-                struct flow_dissector_key_eth_addrs *mask =
+                struct flow_dissector_key_basic *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->mask);
+                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
+                         ntohs(mask->n_proto));
+                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
+                         ntohs(key->n_proto));
 
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             dmac_47_16),
-                                mask->dst);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             dmac_47_16),
-                                key->dst);
-
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             smac_47_16),
-                                mask->src);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             smac_47_16),
-                                key->src);
-
-                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
+                if (mask->n_proto)
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1505,9 +1495,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         *match_level = MLX5_MATCH_L2;
                 }
-        } else {
+        } else if (*match_level != MLX5_MATCH_NONE) {
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1);
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1);
+                *match_level = MLX5_MATCH_L2;
         }
 
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {
@@ -1545,21 +1536,31 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
-                struct flow_dissector_key_basic *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+                struct flow_dissector_key_eth_addrs *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->key);
-                struct flow_dissector_key_basic *mask =
+                struct flow_dissector_key_eth_addrs *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->mask);
-                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
-                         ntohs(mask->n_proto));
-                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
-                         ntohs(key->n_proto));
 
-                if (mask->n_proto)
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             dmac_47_16),
+                                mask->dst);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             dmac_47_16),
+                                key->dst);
+
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             smac_47_16),
+                                mask->src);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             smac_47_16),
+                                key->src);
+
+                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1586,10 +1587,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         /* the HW doesn't need L3 inline to match on frag=no */
                         if (!(key->flags & FLOW_DIS_IS_FRAGMENT))
-                                *match_level = MLX5_INLINE_MODE_L2;
+                                *match_level = MLX5_MATCH_L2;
         /* ***  L2 attributes parsing up to here *** */
                         else
-                                *match_level = MLX5_INLINE_MODE_IP;
+                                *match_level = MLX5_MATCH_L3;
                 }
         }
 
@@ -2979,7 +2980,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         if (!actions_match_supported(priv, exts, parse_attr, flow, extack))
                 return -EOPNOTSUPP;
 
-        if (attr->out_count > 1 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
+        if (attr->mirror_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "current firmware doesn't support split rule for port mirroring");
                 netdev_warn_once(priv->netdev, "current firmware doesn't support split rule for port mirroring\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 515e3d6de051..5a22c5874f3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -83,8 +83,14 @@ struct mlx5_fpga_ipsec_rule {
 };
 
 static const struct rhashtable_params rhash_sa = {
-        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
-        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
+        /* Keep out "cmd" field from the key as it's
+         * value is not constant during the lifetime
+         * of the key object.
+         */
+        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) -
+                   FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
+        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) +
+                      FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
         .head_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hash),
         .automatic_shrinking = true,
         .min_size = 1,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index b59953daf8b4..11dabd62e2c7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -560,9 +560,9 @@ static int mlx5i_close(struct net_device *netdev)
 
         netif_carrier_off(epriv->netdev);
         mlx5_fs_remove_rx_underlay_qpn(mdev, ipriv->qp.qpn);
-        mlx5i_uninit_underlay_qp(epriv);
         mlx5e_deactivate_priv_channels(epriv);
         mlx5e_close_channels(&epriv->channels);
+        mlx5i_uninit_underlay_qp(epriv);
 unlock:
         mutex_unlock(&epriv->state_lock);
         return 0;
diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 867cddba840f..e8ca98c070f6 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1672,7 +1672,7 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
                 netif_wake_queue(adapter->netdev);
         }
 
-        if (!napi_complete_done(napi, weight))
+        if (!napi_complete(napi))
                 goto done;
 
         /* enable isr */
@@ -1681,7 +1681,7 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
         lan743x_csr_read(adapter, INT_STS);
 
 done:
-        return weight;
+        return 0;
 }
 
 static void lan743x_tx_ring_cleanup(struct lan743x_tx *tx)
@@ -1870,9 +1870,9 @@ static int lan743x_tx_open(struct lan743x_tx *tx)
         tx->vector_flags = lan743x_intr_get_vector_flags(adapter,
                                                          INT_BIT_DMA_TX_
                                                          (tx->channel_number));
-        netif_napi_add(adapter->netdev,
-                       &tx->napi, lan743x_tx_napi_poll,
-                       tx->ring_size - 1);
+        netif_tx_napi_add(adapter->netdev,
+                          &tx->napi, lan743x_tx_napi_poll,
+                          tx->ring_size - 1);
         napi_enable(&tx->napi);
 
         data = 0;
@@ -3017,6 +3017,7 @@ static const struct dev_pm_ops lan743x_pm_ops = {
 
 static const struct pci_device_id lan743x_pcidev_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7430) },
+        { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7431) },
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h
index 0e82b6368798..2d6eea18973e 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.h
+++ b/drivers/net/ethernet/microchip/lan743x_main.h
@@ -548,6 +548,7 @@ struct lan743x_adapter;
 /* SMSC acquired EFAR late 1990's, MCHP acquired SMSC 2012 */
 #define PCI_VENDOR_ID_SMSC              PCI_VENDOR_ID_EFAR
 #define PCI_DEVICE_ID_SMSC_LAN7430      (0x7430)
+#define PCI_DEVICE_ID_SMSC_LAN7431      (0x7431)
 
 #define PCI_CONFIG_LENGTH               (0x1000)
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 8e8fa823d611..69966dfc6e3d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -191,7 +191,7 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data)
 static void
 qed_dcbx_set_params(struct qed_dcbx_results *p_data,
                     struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                    bool enable, u8 prio, u8 tc,
+                    bool app_tlv, bool enable, u8 prio, u8 tc,
                     enum dcbx_protocol_type type,
                     enum qed_pci_personality personality)
 {
@@ -210,7 +210,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
                 p_data->arr[type].dont_add_vlan0 = true;
 
         /* QM reconf data */
-        if (p_hwfn->hw_info.personality == personality)
+        if (app_tlv && p_hwfn->hw_info.personality == personality)
                 qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc);
 
         /* Configure dcbx vlan priority in doorbell block for roce EDPM */
@@ -225,7 +225,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
 static void
 qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
                          struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                         bool enable, u8 prio, u8 tc,
+                         bool app_tlv, bool enable, u8 prio, u8 tc,
                          enum dcbx_protocol_type type)
 {
         enum qed_pci_personality personality;
@@ -240,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 
                 personality = qed_dcbx_app_update[i].personality;
 
-                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable,
+                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, app_tlv, enable,
                                     prio, tc, type, personality);
         }
 }
@@ -319,8 +319,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                                 enable = true;
                         }
 
-                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
-                                                 priority, tc, type);
+                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, true,
+                                                 enable, priority, tc, type);
                 }
         }
 
@@ -341,7 +341,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                         continue;
 
                 enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version;
-                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
+                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, false, enable,
                                          priority, tc, type);
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 78a638ec7c0a..979f1e4bc18b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6071,7 +6071,7 @@ static const char * const s_igu_fifo_error_strs[] = {
         "no error",
         "length error",
         "function disabled",
-        "VF sent command to attnetion address",
+        "VF sent command to attention address",
         "host sent prod update command",
         "read of during interrupt register while in MIMD mode",
         "access to PXP BAR reserved address",
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 7ceb2b97538d..88a8576ca9ce 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -185,6 +185,10 @@ void qed_resc_free(struct qed_dev *cdev)
                         qed_iscsi_free(p_hwfn);
                         qed_ooo_free(p_hwfn);
                 }
+
+                if (QED_IS_RDMA_PERSONALITY(p_hwfn))
+                        qed_rdma_info_free(p_hwfn);
+
                 qed_iov_free(p_hwfn);
                 qed_l2_free(p_hwfn);
                 qed_dmae_info_free(p_hwfn);
@@ -481,8 +485,16 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags, sizeof(pq_flags)) > 1)
+        if (bitmap_weight((unsigned long *)&pq_flags,
+                          sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                goto err;
+        }
+
+        if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
+                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
                 goto err;
+        }
 
         switch (pq_flags) {
         case PQ_FLAGS_RLS:
@@ -506,8 +518,7 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         }
 
 err:
-        DP_ERR(p_hwfn, "BAD pq flags %d\n", pq_flags);
-        return NULL;
+        return &qm_info->start_pq;
 }
 
 /* save pq index in qm info */
@@ -531,20 +542,32 @@ u16 qed_get_cm_pq_idx_mcos(struct qed_hwfn *p_hwfn, u8 tc)
 {
         u8 max_tc = qed_init_qm_get_num_tcs(p_hwfn);
 
+        if (max_tc == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_MCOS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (tc > max_tc)
                 DP_ERR(p_hwfn, "tc %d must be smaller than %d\n", tc, max_tc);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + tc;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + (tc % max_tc);
 }
 
 u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf)
 {
         u16 max_vf = qed_init_qm_get_num_vfs(p_hwfn);
 
+        if (max_vf == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_VFS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (vf > max_vf)
                 DP_ERR(p_hwfn, "vf %d must be smaller than %d\n", vf, max_vf);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + vf;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + (vf % max_vf);
 }
 
 u16 qed_get_cm_pq_idx_ofld_mtc(struct qed_hwfn *p_hwfn, u8 tc)
@@ -1081,6 +1104,12 @@ int qed_resc_alloc(struct qed_dev *cdev)
                                 goto alloc_err;
                 }
 
+                if (QED_IS_RDMA_PERSONALITY(p_hwfn)) {
+                        rc = qed_rdma_info_alloc(p_hwfn);
+                        if (rc)
+                                goto alloc_err;
+                }
+
                 /* DMA info initialization */
                 rc = qed_dmae_info_alloc(p_hwfn);
                 if (rc)
@@ -2102,11 +2131,8 @@ int qed_hw_start_fastpath(struct qed_hwfn *p_hwfn)
         if (!p_ptt)
                 return -EAGAIN;
 
-        /* If roce info is allocated it means roce is initialized and should
-         * be enabled in searcher.
-         */
         if (p_hwfn->p_rdma_info &&
-            p_hwfn->b_rdma_enabled_in_prs)
+            p_hwfn->p_rdma_info->active && p_hwfn->b_rdma_enabled_in_prs)
                 qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0x1);
 
         /* Re-open incoming traffic */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index 0f0aba793352..b22f464ea3fa 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -992,6 +992,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
          */
         do {
                 index = p_sb_attn->sb_index;
+                /* finish reading index before the loop condition */
+                dma_rmb();
                 attn_bits = le32_to_cpu(p_sb_attn->atten_bits);
                 attn_acks = le32_to_cpu(p_sb_attn->atten_ack);
         } while (index != p_sb_attn->sb_index);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 35fd0db6a677..fff7f04d4525 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1782,9 +1782,9 @@ static int qed_drain(struct qed_dev *cdev)
                         return -EBUSY;
                 }
                 rc = qed_mcp_drain(hwfn, ptt);
+                qed_ptt_release(hwfn, ptt);
                 if (rc)
                         return rc;
-                qed_ptt_release(hwfn, ptt);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 62113438c880..7873d6dfd91f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -140,22 +140,34 @@ static u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id)
         return FEAT_NUM((struct qed_hwfn *)p_hwfn, QED_PF_L2_QUE) + rel_sb_id;
 }
 
-static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
-                          struct qed_ptt *p_ptt,
-                          struct qed_rdma_start_in_params *params)
+int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn)
 {
         struct qed_rdma_info *p_rdma_info;
-        u32 num_cons, num_tasks;
-        int rc = -ENOMEM;
 
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
-
-        /* Allocate a struct with current pf rdma info */
         p_rdma_info = kzalloc(sizeof(*p_rdma_info), GFP_KERNEL);
         if (!p_rdma_info)
-                return rc;
+                return -ENOMEM;
+
+        spin_lock_init(&p_rdma_info->lock);
 
         p_hwfn->p_rdma_info = p_rdma_info;
+        return 0;
+}
+
+void qed_rdma_info_free(struct qed_hwfn *p_hwfn)
+{
+        kfree(p_hwfn->p_rdma_info);
+        p_hwfn->p_rdma_info = NULL;
+}
+
+static int qed_rdma_alloc(struct qed_hwfn *p_hwfn)
+{
+        struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info;
+        u32 num_cons, num_tasks;
+        int rc = -ENOMEM;
+
+        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
+
         if (QED_IS_IWARP_PERSONALITY(p_hwfn))
                 p_rdma_info->proto = PROTOCOLID_IWARP;
         else
@@ -183,7 +195,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
         /* Allocate a struct with device params and fill it */
         p_rdma_info->dev = kzalloc(sizeof(*p_rdma_info->dev), GFP_KERNEL);
         if (!p_rdma_info->dev)
-                goto free_rdma_info;
+                return rc;
 
         /* Allocate a struct with port params and fill it */
         p_rdma_info->port = kzalloc(sizeof(*p_rdma_info->port), GFP_KERNEL);
@@ -298,8 +310,6 @@ free_rdma_port:
         kfree(p_rdma_info->port);
 free_rdma_dev:
         kfree(p_rdma_info->dev);
-free_rdma_info:
-        kfree(p_rdma_info);
 
         return rc;
 }
@@ -370,8 +380,6 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
 
         kfree(p_rdma_info->port);
         kfree(p_rdma_info->dev);
-
-        kfree(p_rdma_info);
 }
 
 static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
@@ -679,8 +687,6 @@ static int qed_rdma_setup(struct qed_hwfn *p_hwfn,
 
         DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "RDMA setup\n");
 
-        spin_lock_init(&p_hwfn->p_rdma_info->lock);
-
         qed_rdma_init_devinfo(p_hwfn, params);
         qed_rdma_init_port(p_hwfn);
         qed_rdma_init_events(p_hwfn, params);
@@ -727,7 +733,7 @@ static int qed_rdma_stop(void *rdma_cxt)
         /* Disable RoCE search */
         qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0);
         p_hwfn->b_rdma_enabled_in_prs = false;
-
+        p_hwfn->p_rdma_info->active = 0;
         qed_wr(p_hwfn, p_ptt, PRS_REG_ROCE_DEST_QP_MAX_PF, 0);
 
         ll2_ethertype_en = qed_rd(p_hwfn, p_ptt, PRS_REG_LIGHT_L2_ETHERTYPE_EN);
@@ -1236,7 +1242,8 @@ qed_rdma_create_qp(void *rdma_cxt,
         u8 max_stats_queues;
         int rc;
 
-        if (!rdma_cxt || !in_params || !out_params || !p_hwfn->p_rdma_info) {
+        if (!rdma_cxt || !in_params || !out_params ||
+            !p_hwfn->p_rdma_info->active) {
                 DP_ERR(p_hwfn->cdev,
                        "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
                        rdma_cxt, in_params, out_params);
@@ -1802,8 +1809,8 @@ bool qed_rdma_allocated_qps(struct qed_hwfn *p_hwfn)
 {
         bool result;
 
-        /* if rdma info has not been allocated, naturally there are no qps */
-        if (!p_hwfn->p_rdma_info)
+        /* if rdma wasn't activated yet, naturally there are no qps */
+        if (!p_hwfn->p_rdma_info->active)
                 return false;
 
         spin_lock_bh(&p_hwfn->p_rdma_info->lock);
@@ -1849,7 +1856,7 @@ static int qed_rdma_start(void *rdma_cxt,
         if (!p_ptt)
                 goto err;
 
-        rc = qed_rdma_alloc(p_hwfn, p_ptt, params);
+        rc = qed_rdma_alloc(p_hwfn);
         if (rc)
                 goto err1;
 
@@ -1858,6 +1865,7 @@ static int qed_rdma_start(void *rdma_cxt,
                 goto err2;
 
         qed_ptt_release(p_hwfn, p_ptt);
+        p_hwfn->p_rdma_info->active = 1;
 
         return rc;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.h b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
index 6f722ee8ee94..3689fe3e5935 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
@@ -102,6 +102,7 @@ struct qed_rdma_info {
         u16 max_queue_zones;
         enum protocol_type proto;
         struct qed_iwarp_info iwarp;
+        u8 active:1;
 };
 
 struct qed_rdma_qp {
@@ -176,10 +177,14 @@ struct qed_rdma_qp {
 #if IS_ENABLED(CONFIG_QED_RDMA)
 void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
 void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
+int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn);
+void qed_rdma_info_free(struct qed_hwfn *p_hwfn);
 #else
 static inline void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {}
 static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn,
                                     struct qed_ptt *p_ptt) {}
+static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL;}
+static inline void qed_rdma_info_free(struct qed_hwfn *p_hwfn) {}
 #endif
 
 int
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index ef9538ee53d0..82412691ee66 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -3605,7 +3605,7 @@ static const char velocity_gstrings[][ETH_GSTRING_LEN] = {
         "tx_jumbo",
         "rx_mac_control_frames",
         "tx_mac_control_frames",
-        "rx_frame_alignement_errors",
+        "rx_frame_alignment_errors",
         "rx_long_ok",
         "rx_long_err",
         "tx_sqe_errors",
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33265747bf39..0fbcedcdf6e2 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -63,7 +63,7 @@ static void mdio_dir(struct mdiobb_ctrl *ctrl, int dir)
                  * assume the pin serves as pull-up. If direction is
                  * output, the default value is high.
                  */
-                gpiod_set_value(bitbang->mdo, 1);
+                gpiod_set_value_cansleep(bitbang->mdo, 1);
                 return;
         }
 
@@ -78,7 +78,7 @@ static int mdio_get(struct mdiobb_ctrl *ctrl)
         struct mdio_gpio_info *bitbang =
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
-        return gpiod_get_value(bitbang->mdio);
+        return gpiod_get_value_cansleep(bitbang->mdio);
 }
 
 static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
@@ -87,9 +87,9 @@ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
         if (bitbang->mdo)
-                gpiod_set_value(bitbang->mdo, what);
+                gpiod_set_value_cansleep(bitbang->mdo, what);
         else
-                gpiod_set_value(bitbang->mdio, what);
+                gpiod_set_value_cansleep(bitbang->mdio, what);
 }
 
 static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
@@ -97,7 +97,7 @@ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
         struct mdio_gpio_info *bitbang =
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
-        gpiod_set_value(bitbang->mdc, what);
+        gpiod_set_value_cansleep(bitbang->mdc, what);
 }
 
 static const struct mdiobb_ops mdio_gpio_ops = {
diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
index a2e59f4f6f01..7cae17517744 100644
--- a/drivers/net/phy/mscc.c
+++ b/drivers/net/phy/mscc.c
@@ -810,17 +810,13 @@ static int vsc85xx_default_config(struct phy_device *phydev)
 
         phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
         mutex_lock(&phydev->lock);
-        rc = phy_select_page(phydev, MSCC_PHY_PAGE_EXTENDED_2);
-        if (rc < 0)
-                goto out_unlock;
 
-        reg_val = phy_read(phydev, MSCC_PHY_RGMII_CNTL);
-        reg_val &= ~(RGMII_RX_CLK_DELAY_MASK);
-        reg_val |= (RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS);
-        phy_write(phydev, MSCC_PHY_RGMII_CNTL, reg_val);
+        reg_val = RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS;
+
+        rc = phy_modify_paged(phydev, MSCC_PHY_PAGE_EXTENDED_2,
+                              MSCC_PHY_RGMII_CNTL, RGMII_RX_CLK_DELAY_MASK,
+                              reg_val);
 
-out_unlock:
-        rc = phy_restore_page(phydev, rc, rc > 0 ? 0 : rc);
         mutex_unlock(&phydev->lock);
 
         return rc;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index ab33d1777132..23ee3967c166 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -2197,6 +2197,14 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner)
         new_driver->mdiodrv.driver.remove = phy_remove;
         new_driver->mdiodrv.driver.owner = owner;
 
+        /* The following works around an issue where the PHY driver doesn't bind
+         * to the device, resulting in the genphy driver being used instead of
+         * the dedicated driver. The root cause of the issue isn't known yet
+         * and seems to be in the base driver core. Once this is fixed we may
+         * remove this workaround.
+         */
+        new_driver->mdiodrv.driver.probe_type = PROBE_FORCE_SYNCHRONOUS;
+
         retval = driver_register(&new_driver->mdiodrv.driver);
         if (retval) {
                 pr_err("%s: Error %d in registering driver\n",
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index e9f101c9bae2..bfbb39f93554 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -216,9 +216,9 @@ static int rionet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                          * it just report sending a packet to the target
                          * (without actual packet transfer).
                          */
-                        dev_kfree_skb_any(skb);
                         ndev->stats.tx_packets++;
                         ndev->stats.tx_bytes += skb->len;
+                        dev_kfree_skb_any(skb);
                 }
         }
 
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index db633ae9f784..364f514d56d8 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -985,8 +985,6 @@ static void team_port_disable(struct team *team,
         team->en_port_count--;
         team_queue_override_port_del(team, port);
         team_adjust_ops(team);
-        team_notify_peers(team);
-        team_mcast_rejoin(team);
         team_lower_state_changed(port);
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 060135ceaf0e..e244f5d7512a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1536,6 +1536,7 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
 
         if (!rx_batched || (!more && skb_queue_empty(queue))) {
                 local_bh_disable();
+                skb_record_rx_queue(skb, tfile->queue_index);
                 netif_receive_skb(skb);
                 local_bh_enable();
                 return;
@@ -1555,8 +1556,11 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
                 struct sk_buff *nskb;
 
                 local_bh_disable();
-                while ((nskb = __skb_dequeue(&process_queue)))
+                while ((nskb = __skb_dequeue(&process_queue))) {
+                        skb_record_rx_queue(nskb, tfile->queue_index);
                         netif_receive_skb(nskb);
+                }
+                skb_record_rx_queue(skb, tfile->queue_index);
                 netif_receive_skb(skb);
                 local_bh_enable();
         }
@@ -2451,6 +2455,7 @@ build:
         if (!rcu_dereference(tun->steering_prog))
                 rxhash = __skb_get_hash_symmetric(skb);
 
+        skb_record_rx_queue(skb, tfile->queue_index);
         netif_receive_skb(skb);
 
         stats = get_cpu_ptr(tun->pcpu_stats);
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 7275761a1177..3d8a70d3ea9b 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -140,7 +140,6 @@ struct ipheth_device {
         struct usb_device *udev;
         struct usb_interface *intf;
         struct net_device *net;
-        struct sk_buff *tx_skb;
         struct urb *tx_urb;
         struct urb *rx_urb;
         unsigned char *tx_buf;
@@ -230,6 +229,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
         case -ENOENT:
         case -ECONNRESET:
         case -ESHUTDOWN:
+        case -EPROTO:
                 return;
         case 0:
                 break;
@@ -281,7 +281,6 @@ static void ipheth_sndbulk_callback(struct urb *urb)
                 dev_err(&dev->intf->dev, "%s: urb status: %d\n",
                 __func__, status);
 
-        dev_kfree_skb_irq(dev->tx_skb);
         if (status == 0)
                 netif_wake_queue(dev->net);
         else
@@ -423,7 +422,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
         if (skb->len > IPHETH_BUF_SIZE) {
                 WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
                 dev->net->stats.tx_dropped++;
-                dev_kfree_skb_irq(skb);
+                dev_kfree_skb_any(skb);
                 return NETDEV_TX_OK;
         }
 
@@ -443,12 +442,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
                 dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
                         __func__, retval);
                 dev->net->stats.tx_errors++;
-                dev_kfree_skb_irq(skb);
+                dev_kfree_skb_any(skb);
         } else {
-                dev->tx_skb = skb;
-
                 dev->net->stats.tx_packets++;
                 dev->net->stats.tx_bytes += skb->len;
+                dev_consume_skb_any(skb);
                 netif_stop_queue(net);
         }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2c041d76ac..cecfd77c9f3c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -70,7 +70,8 @@ static const unsigned long guest_offloads[] = {
         VIRTIO_NET_F_GUEST_TSO4,
         VIRTIO_NET_F_GUEST_TSO6,
         VIRTIO_NET_F_GUEST_ECN,
-        VIRTIO_NET_F_GUEST_UFO
+        VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_CSUM
 };
 
 struct virtnet_stat_desc {
@@ -2334,9 +2335,6 @@ static int virtnet_clear_guest_offloads(struct virtnet_info *vi)
         if (!vi->guest_offloads)
                 return 0;
 
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads = 1ULL << VIRTIO_NET_F_GUEST_CSUM;
-
         return virtnet_set_guest_offloads(vi, offloads);
 }
 
@@ -2346,8 +2344,6 @@ static int virtnet_restore_guest_offloads(struct virtnet_info *vi)
 
         if (!vi->guest_offloads)
                 return 0;
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads |= 1ULL << VIRTIO_NET_F_GUEST_CSUM;
 
         return virtnet_set_guest_offloads(vi, offloads);
 }
@@ -2365,8 +2361,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
             && (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
-                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO))) {
-                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO, disable LRO first");
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
+                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
                 return -EOPNOTSUPP;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a1c2801ded10..7e49342bae38 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6867,7 +6867,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         u32 bitmap;
 
         if (drop) {
-                if (vif->type == NL80211_IFTYPE_STATION) {
+                if (vif && vif->type == NL80211_IFTYPE_STATION) {
                         bitmap = ~(1 << WMI_MGMT_TID);
                         list_for_each_entry(arvif, &ar->arvifs, list) {
                                 if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1e3b5f4a4cf9..f23cb2f3d296 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1251,6 +1251,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         struct ath_vif *avp = (void *)vif->drv_priv;
         struct ath_node *an = &avp->mcast_node;
 
+        mutex_lock(&sc->mutex);
         if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
                 if (sc->cur_chan->nvifs >= 1) {
                         mutex_unlock(&sc->mutex);
@@ -1259,8 +1260,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 sc->tx99_vif = vif;
         }
 
-        mutex_lock(&sc->mutex);
-
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
         sc->cur_chan->nvifs++;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 230a378c26fc..7f0a5bade70a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6005,7 +6005,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
                          * for subsequent chanspecs.
                          */
                         channel->flags = IEEE80211_CHAN_NO_HT40 |
-                                         IEEE80211_CHAN_NO_80MHZ;
+                                         IEEE80211_CHAN_NO_80MHZ |
+                                         IEEE80211_CHAN_NO_160MHZ;
                         ch.bw = BRCMU_CHAN_BW_20;
                         cfg->d11inf.encchspec(&ch);
                         chaninfo = ch.chspec;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
index e7584b842dce..eb5db94f5745 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_160:
+                ch->bw = BRCMU_CHAN_BW_160;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
                 switch (ch->sb) {
                 case BRCMU_CHAN_SB_LLL:
                         ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 2439e98431ee..7492dfb6729b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,7 +83,7 @@
 #define ACPI_WRDS_WIFI_DATA_SIZE        (ACPI_SAR_TABLE_SIZE + 2)
 #define ACPI_EWRD_WIFI_DATA_SIZE        ((ACPI_SAR_PROFILE_NUM - 1) * \
                                          ACPI_SAR_TABLE_SIZE + 3)
-#define ACPI_WGDS_WIFI_DATA_SIZE        18
+#define ACPI_WGDS_WIFI_DATA_SIZE        19
 #define ACPI_WRDD_WIFI_DATA_SIZE        2
 #define ACPI_SPLC_WIFI_DATA_SIZE        2
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index 6b95d0e75889..2b8b50a77990 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -154,7 +154,11 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
                         const struct iwl_fw_runtime_ops *ops, void *ops_ctx,
                         struct dentry *dbgfs_dir);
 
-void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt);
+static inline void iwl_fw_runtime_free(struct iwl_fw_runtime *fwrt)
+{
+        kfree(fwrt->dump.d3_debug_data);
+        fwrt->dump.d3_debug_data = NULL;
+}
 
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index dade206d5511..2ba890445c35 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -893,7 +893,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
         IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
-                     ACPI_WGDS_TABLE_SIZE !=  ACPI_WGDS_WIFI_DATA_SIZE);
+                     ACPI_WGDS_TABLE_SIZE + 1 !=  ACPI_WGDS_WIFI_DATA_SIZE);
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES);
 
@@ -928,6 +928,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
         return -ENOENT;
 }
 
+static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
+{
+        return -ENOENT;
+}
+
 static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 {
         return 0;
@@ -954,8 +959,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
                 IWL_DEBUG_RADIO(mvm,
                                 "WRDS SAR BIOS table invalid or unavailable. (%d)\n",
                                 ret);
-                /* if not available, don't fail and don't bother with EWRD */
-                return 0;
+                /*
+                 * If not available, don't fail and don't bother with EWRD.
+                 * Return 1 to tell that we can't use WGDS either.
+                 */
+                return 1;
         }
 
         ret = iwl_mvm_sar_get_ewrd_table(mvm);
@@ -968,9 +976,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
         /* choose profile 1 (WRDS) as default for both chains */
         ret = iwl_mvm_sar_select_profile(mvm, 1, 1);
 
-        /* if we don't have profile 0 from BIOS, just skip it */
+        /*
+         * If we don't have profile 0 from BIOS, just skip it.  This
+         * means that SAR Geo will not be enabled either, even if we
+         * have other valid profiles.
+         */
         if (ret == -ENOENT)
-                return 0;
+                return 1;
 
         return ret;
 }
@@ -1168,11 +1180,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
         ret = iwl_mvm_sar_init(mvm);
-        if (ret)
-                goto error;
+        if (ret == 0) {
+                ret = iwl_mvm_sar_geo_init(mvm);
+        } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) {
+                /*
+                 * If basic SAR is not available, we check for WGDS,
+                 * which should *not* be available either.  If it is
+                 * available, issue an error, because we can't use SAR
+                 * Geo without basic SAR.
+                 */
+                IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n");
+        }
 
-        ret = iwl_mvm_sar_geo_init(mvm);
-        if (ret)
+        if (ret < 0)
                 goto error;
 
         iwl_mvm_leds_sync(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 505b0385d800..00f831d88366 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -301,8 +301,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
                 goto out;
         }
 
-        if (changed)
-                *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
+        if (changed) {
+                u32 status = le32_to_cpu(resp->status);
+
+                *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
+                            status == MCC_RESP_ILLEGAL);
+        }
 
         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                       __le32_to_cpu(resp->n_channels),
@@ -4444,10 +4448,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
         }
 
-        if (!fw_has_capa(&mvm->fw->ucode_capa,
-                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
-                return;
-
         /* if beacon filtering isn't on mac80211 does it anyway */
         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
index 3633f27d048a..6fc5cc1f2b5b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
@@ -539,9 +539,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
         }
 
         IWL_DEBUG_LAR(mvm,
-                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n",
-                      status, mcc, mcc >> 8, mcc & 0xff,
-                      !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels);
+                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n",
+                      status, mcc, mcc >> 8, mcc & 0xff, n_channels);
 
 exit:
         iwl_free_resp(&cmd);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 0e2092526fae..af3fba10abc1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -858,6 +858,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         iwl_mvm_thermal_exit(mvm);
  out_free:
         iwl_fw_flush_dump(&mvm->fwrt);
+        iwl_fw_runtime_free(&mvm->fwrt);
 
         if (iwlmvm_mod_params.init_dbg)
                 return op_mode;
@@ -910,6 +911,7 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_mvm_tof_clean(mvm);
 
+        iwl_fw_runtime_free(&mvm->fwrt);
         mutex_destroy(&mvm->mutex);
         mutex_destroy(&mvm->d0i3_suspend_mutex);
 
diff --git a/drivers/net/wireless/mediatek/mt76/Kconfig b/drivers/net/wireless/mediatek/mt76/Kconfig
index 0ccbcd7e887d..c30d8f5bbf2a 100644
--- a/drivers/net/wireless/mediatek/mt76/Kconfig
+++ b/drivers/net/wireless/mediatek/mt76/Kconfig
@@ -1,6 +1,12 @@
 config MT76_CORE
         tristate
 
+config MT76_LEDS
+        bool
+        depends on MT76_CORE
+        depends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS
+        default y
+
 config MT76_USB
         tristate
         depends on MT76_CORE
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 2a699e8b79bf..7d219ff2d480 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -345,9 +345,11 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
         mt76_check_sband(dev, NL80211_BAND_2GHZ);
         mt76_check_sband(dev, NL80211_BAND_5GHZ);
 
-        ret = mt76_led_init(dev);
-        if (ret)
-                return ret;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                ret = mt76_led_init(dev);
+                if (ret)
+                        return ret;
+        }
 
         return ieee80211_register_hw(hw);
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h
index 47c42c607964..7806963b1905 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h
@@ -71,7 +71,6 @@ struct mt76x02_dev {
         struct mac_address macaddr_list[8];
 
         struct mutex phy_mutex;
-        struct mutex mutex;
 
         u8 txdone_seq;
         DECLARE_KFIFO_PTR(txstatus_fifo, struct mt76x02_tx_status);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
index 3824290b219d..fd125722d1fb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
@@ -507,8 +507,10 @@ int mt76x2_register_device(struct mt76x02_dev *dev)
         mt76x2_dfs_init_detector(dev);
 
         /* init led callbacks */
-        dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
-        dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
+                dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        }
 
         ret = mt76_register_device(&dev->mt76, true, mt76x02_rates,
                                    ARRAY_SIZE(mt76x02_rates));
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
index 034a06295668..3f001bd6806c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
@@ -272,9 +272,9 @@ mt76x2_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
         if (val != ~0 && val > 0xffff)
                 return -EINVAL;
 
-        mutex_lock(&dev->mutex);
+        mutex_lock(&dev->mt76.mutex);
         mt76x2_mac_set_tx_protection(dev, val);
-        mutex_unlock(&dev->mutex);
+        mutex_unlock(&dev->mt76.mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 4c2154b9e6a3..bd10165d7eec 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -285,7 +285,7 @@ static int wl1271_probe(struct sdio_func *func,
         struct resource res[2];
         mmc_pm_flag_t mmcflags;
         int ret = -ENOMEM;
-        int irq, wakeirq;
+        int irq, wakeirq, num_irqs;
         const char *chip_family;
 
         /* We are only able to handle the wlan function */
@@ -353,12 +353,17 @@ static int wl1271_probe(struct sdio_func *func,
                        irqd_get_trigger_type(irq_get_irq_data(irq));
         res[0].name = "irq";
 
-        res[1].start = wakeirq;
-        res[1].flags = IORESOURCE_IRQ |
-                       irqd_get_trigger_type(irq_get_irq_data(wakeirq));
-        res[1].name = "wakeirq";
 
-        ret = platform_device_add_resources(glue->core, res, ARRAY_SIZE(res));
+        if (wakeirq > 0) {
+                res[1].start = wakeirq;
+                res[1].flags = IORESOURCE_IRQ |
+                               irqd_get_trigger_type(irq_get_irq_data(wakeirq));
+                res[1].name = "wakeirq";
+                num_irqs = 2;
+        } else {
+                num_irqs = 1;
+        }
+        ret = platform_device_add_resources(glue->core, res, num_irqs);
         if (ret) {
                 dev_err(glue->dev, "can't add resources\n");
                 goto out_dev_put;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 559d567693b8..3cf1b773158e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3314,6 +3314,9 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns, *next;
         LIST_HEAD(ns_list);
 
+        /* prevent racing with ns scanning */
+        flush_work(&ctrl->scan_work);
+
         /*
          * The dead states indicates the controller was not gracefully
          * disconnected. In that case, we won't be able to flush any data while
@@ -3476,7 +3479,6 @@ void nvme_stop_ctrl(struct nvme_ctrl *ctrl)
         nvme_mpath_stop(ctrl);
         nvme_stop_keep_alive(ctrl);
         flush_work(&ctrl->async_event_work);
-        flush_work(&ctrl->scan_work);
         cancel_work_sync(&ctrl->fw_act_work);
         if (ctrl->ops->stop_ctrl)
                 ctrl->ops->stop_ctrl(ctrl);
@@ -3585,7 +3587,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
 
         return 0;
 out_free_name:
-        kfree_const(dev->kobj.name);
+        kfree_const(ctrl->device->kobj.name);
 out_release_instance:
         ida_simple_remove(&nvme_instance_ida, ctrl->instance);
 out:
@@ -3607,7 +3609,7 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         down_read(&ctrl->namespaces_rwsem);
 
         /* Forcibly unquiesce queues to avoid blocking dispatch */
-        if (ctrl->admin_q)
+        if (ctrl->admin_q && !blk_queue_dying(ctrl->admin_q))
                 blk_mq_unquiesce_queue(ctrl->admin_q);
 
         list_for_each_entry(ns, &ctrl->namespaces, list)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 0b70c8bab045..feb86b59170e 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -152,6 +152,7 @@ struct nvme_fc_ctrl {
 
         bool                    ioq_live;
         bool                    assoc_active;
+        atomic_t                err_work_active;
         u64                     association_id;
 
         struct list_head        ctrl_list;      /* rport->ctrl_list */
@@ -160,6 +161,7 @@ struct nvme_fc_ctrl {
         struct blk_mq_tag_set   tag_set;
 
         struct delayed_work     connect_work;
+        struct work_struct      err_work;
 
         struct kref             ref;
         u32                     flags;
@@ -1531,6 +1533,10 @@ nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
         int i;
 
+        /* ensure we've initialized the ops once */
+        if (!(aen_op->flags & FCOP_FLAGS_AEN))
+                return;
+
         for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
                 __nvme_fc_abort_op(ctrl, aen_op);
 }
@@ -1746,12 +1752,12 @@ nvme_fc_init_request(struct blk_mq_tag_set *set, struct request *rq,
         struct nvme_fc_queue *queue = &ctrl->queues[queue_idx];
         int res;
 
-        nvme_req(rq)->ctrl = &ctrl->ctrl;
         res = __nvme_fc_init_request(ctrl, queue, &op->op, rq, queue->rqcnt++);
         if (res)
                 return res;
         op->op.fcp_req.first_sgl = &op->sgl[0];
         op->op.fcp_req.private = &op->priv[0];
+        nvme_req(rq)->ctrl = &ctrl->ctrl;
         return res;
 }
 
@@ -2049,7 +2055,25 @@ nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl)
 static void
 nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
 {
-        /* only proceed if in LIVE state - e.g. on first error */
+        int active;
+
+        /*
+         * if an error (io timeout, etc) while (re)connecting,
+         * it's an error on creating the new association.
+         * Start the error recovery thread if it hasn't already
+         * been started. It is expected there could be multiple
+         * ios hitting this path before things are cleaned up.
+         */
+        if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+                active = atomic_xchg(&ctrl->err_work_active, 1);
+                if (!active && !schedule_work(&ctrl->err_work)) {
+                        atomic_set(&ctrl->err_work_active, 0);
+                        WARN_ON(1);
+                }
+                return;
+        }
+
+        /* Otherwise, only proceed if in LIVE state - e.g. on first error */
         if (ctrl->ctrl.state != NVME_CTRL_LIVE)
                 return;
 
@@ -2814,6 +2838,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
         /*
          * kill the association on the link side.  this will block
@@ -2866,23 +2891,30 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
 }
 
 static void
-nvme_fc_reset_ctrl_work(struct work_struct *work)
+__nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
 {
-        struct nvme_fc_ctrl *ctrl =
-                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
-        int ret;
-
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
+            !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
                         "to CONNECTING\n", ctrl->cnum);
-                return;
-        }
+}
+
+static void
+nvme_fc_reset_ctrl_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
+        int ret;
+
+        __nvme_fc_terminate_io(ctrl);
+
+        nvme_stop_ctrl(&ctrl->ctrl);
 
         if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE)
                 ret = nvme_fc_create_association(ctrl);
@@ -2897,6 +2929,24 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
                         ctrl->cnum);
 }
 
+static void
+nvme_fc_connect_err_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                        container_of(work, struct nvme_fc_ctrl, err_work);
+
+        __nvme_fc_terminate_io(ctrl);
+
+        atomic_set(&ctrl->err_work_active, 0);
+
+        /*
+         * Rescheduling the connection after recovering
+         * from the io error is left to the reconnect work
+         * item, which is what should have stalled waiting on
+         * the io that had the error that scheduled this work.
+         */
+}
+
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
@@ -3007,6 +3057,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         ctrl->cnum = idx;
         ctrl->ioq_live = false;
         ctrl->assoc_active = false;
+        atomic_set(&ctrl->err_work_active, 0);
         init_waitqueue_head(&ctrl->ioabort_wait);
 
         get_device(ctrl->dev);
@@ -3014,6 +3065,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
         INIT_WORK(&ctrl->ctrl.reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
+        INIT_WORK(&ctrl->err_work, nvme_fc_connect_err_work);
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -3103,6 +3155,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 fail_ctrl:
         nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING);
         cancel_work_sync(&ctrl->ctrl.reset_work);
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
 
         ctrl->ctrl.opts = NULL;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index cee79cb388af..081cbdcce880 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -531,6 +531,9 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
 static inline int nvme_mpath_init(struct nvme_ctrl *ctrl,
                 struct nvme_id_ctrl *id)
 {
+        if (ctrl->subsys->cmic & (1 << 3))
+                dev_warn(ctrl->device,
+"Please enable CONFIG_NVME_MULTIPATH for full support of multi-port devices.\n");
         return 0;
 }
 static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index d181cafedc58..ab6ec7295bf9 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
         qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
         if (ib_dma_mapping_error(ibdev, qe->dma)) {
                 kfree(qe->data);
+                qe->data = NULL;
                 return -ENOMEM;
         }
 
@@ -823,6 +824,7 @@ out_free_tagset:
 out_free_async_qe:
         nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
                 sizeof(struct nvme_command), DMA_TO_DEVICE);
+        ctrl->async_event_sqe.data = NULL;
 out_free_queue:
         nvme_rdma_free_queue(&ctrl->queues[0]);
         return error;
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 9b18ce90f907..27f67dfa649d 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -44,6 +44,7 @@ struct nvmem_cell {
         int                     bytes;
         int                     bit_offset;
         int                     nbits;
+        struct device_node      *np;
         struct nvmem_device     *nvmem;
         struct list_head        node;
 };
@@ -298,6 +299,7 @@ static void nvmem_cell_drop(struct nvmem_cell *cell)
         mutex_lock(&nvmem_mutex);
         list_del(&cell->node);
         mutex_unlock(&nvmem_mutex);
+        of_node_put(cell->np);
         kfree(cell->name);
         kfree(cell);
 }
@@ -530,6 +532,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
                         return -ENOMEM;
 
                 cell->nvmem = nvmem;
+                cell->np = of_node_get(child);
                 cell->offset = be32_to_cpup(addr++);
                 cell->bytes = be32_to_cpup(addr);
                 cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
@@ -960,14 +963,13 @@ out:
 
 #if IS_ENABLED(CONFIG_OF)
 static struct nvmem_cell *
-nvmem_find_cell_by_index(struct nvmem_device *nvmem, int index)
+nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
 {
         struct nvmem_cell *cell = NULL;
-        int i = 0;
 
         mutex_lock(&nvmem_mutex);
         list_for_each_entry(cell, &nvmem->cells, node) {
-                if (index == i++)
+                if (np == cell->np)
                         break;
         }
         mutex_unlock(&nvmem_mutex);
@@ -1011,7 +1013,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
-        cell = nvmem_find_cell_by_index(nvmem, index);
+        cell = nvmem_find_cell_by_node(nvmem, cell_np);
         if (!cell) {
                 __nvmem_device_put(nvmem);
                 return ERR_PTR(-ENOENT);
diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index 5a4b47958073..38a08805a30c 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -579,10 +579,8 @@ int dev_pm_opp_of_add_table_indexed(struct device *dev, int index)
                  */
                 count = of_count_phandle_with_args(dev->of_node,
                                                    "operating-points-v2", NULL);
-                if (count != 1)
-                        return -ENODEV;
-
-                index = 0;
+                if (count == 1)
+                        index = 0;
         }
 
         opp_table = dev_pm_opp_get_opp_table_indexed(dev, index);
diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
index 9e5a9a3112c9..1c69c404df11 100644
--- a/drivers/opp/ti-opp-supply.c
+++ b/drivers/opp/ti-opp-supply.c
@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data)
         int ret;
 
         vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data,
-                                          new_supply_vbb->u_volt);
+                                          new_supply_vdd->u_volt);
+
+        if (new_supply_vdd->u_volt_min < vdd_uv)
+                new_supply_vdd->u_volt_min = vdd_uv;
 
         /* Scaling up? Scale voltage before frequency */
         if (freq > old_freq) {
@@ -414,7 +417,6 @@ static struct platform_driver ti_opp_supply_driver = {
         .probe = ti_opp_supply_probe,
         .driver = {
                    .name = "ti_opp_supply",
-                   .owner = THIS_MODULE,
                    .of_match_table = of_match_ptr(ti_opp_supply_of_match),
                    },
 };
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 2cbef2d7c207..88af6bff945f 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -81,8 +81,6 @@ struct imx6_pcie {
 #define PCIE_PL_PFLR_FORCE_LINK                 (1 << 15)
 #define PCIE_PHY_DEBUG_R0 (PL_OFFSET + 0x28)
 #define PCIE_PHY_DEBUG_R1 (PL_OFFSET + 0x2c)
-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_IN_TRAINING (1 << 29)
-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_UP          (1 << 4)
 
 #define PCIE_PHY_CTRL (PL_OFFSET + 0x114)
 #define PCIE_PHY_CTRL_DATA_LOC 0
@@ -711,12 +709,6 @@ static int imx6_pcie_host_init(struct pcie_port *pp)
         return 0;
 }
 
-static int imx6_pcie_link_up(struct dw_pcie *pci)
-{
-        return dw_pcie_readl_dbi(pci, PCIE_PHY_DEBUG_R1) &
-                        PCIE_PHY_DEBUG_R1_XMLH_LINK_UP;
-}
-
 static const struct dw_pcie_host_ops imx6_pcie_host_ops = {
         .host_init = imx6_pcie_host_init,
 };
@@ -749,7 +741,7 @@ static int imx6_add_pcie_port(struct imx6_pcie *imx6_pcie,
 }
 
 static const struct dw_pcie_ops dw_pcie_ops = {
-        .link_up = imx6_pcie_link_up,
+        /* No special ops needed, but pcie-designware still expects this struct */
 };
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/pci/controller/dwc/pci-layerscape.c b/drivers/pci/controller/dwc/pci-layerscape.c
index 3724d3ef7008..7aa9a82b7ebd 100644
--- a/drivers/pci/controller/dwc/pci-layerscape.c
+++ b/drivers/pci/controller/dwc/pci-layerscape.c
@@ -88,7 +88,7 @@ static void ls_pcie_disable_outbound_atus(struct ls_pcie *pcie)
         int i;
 
         for (i = 0; i < PCIE_IATU_NUM; i++)
-                dw_pcie_disable_atu(pcie->pci, DW_PCIE_REGION_OUTBOUND, i);
+                dw_pcie_disable_atu(pcie->pci, i, DW_PCIE_REGION_OUTBOUND);
 }
 
 static int ls1021_pcie_link_up(struct dw_pcie *pci)
diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
index 1e7b02221eac..de8635af4cde 100644
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -440,7 +440,6 @@ int dw_pcie_ep_raise_msix_irq(struct dw_pcie_ep *ep, u8 func_no,
         tbl_offset = dw_pcie_readl_dbi(pci, reg);
         bir = (tbl_offset & PCI_MSIX_TABLE_BIR);
         tbl_offset &= PCI_MSIX_TABLE_OFFSET;
-        tbl_offset >>= 3;
 
         reg = PCI_BASE_ADDRESS_0 + (4 * bir);
         bar_addr_upper = 0;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index d068f11d08a7..c9d8e3c837de 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5556,9 +5556,13 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
         u32 lnkcap2, lnkcap;
 
         /*
-         * PCIe r4.0 sec 7.5.3.18 recommends using the Supported Link
-         * Speeds Vector in Link Capabilities 2 when supported, falling
-         * back to Max Link Speed in Link Capabilities otherwise.
+         * Link Capabilities 2 was added in PCIe r3.0, sec 7.8.18.  The
+         * implementation note there recommends using the Supported Link
+         * Speeds Vector in Link Capabilities 2 when supported.
+         *
+         * Without Link Capabilities 2, i.e., prior to PCIe r3.0, software
+         * should use the Supported Link Speeds field in Link Capabilities,
+         * where only 2.5 GT/s and 5.0 GT/s speeds were defined.
          */
         pcie_capability_read_dword(dev, PCI_EXP_LNKCAP2, &lnkcap2);
         if (lnkcap2) { /* PCIe r3.0-compliant */
@@ -5574,16 +5578,10 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
         }
 
         pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnkcap);
-        if (lnkcap) {
-                if (lnkcap & PCI_EXP_LNKCAP_SLS_16_0GB)
-                        return PCIE_SPEED_16_0GT;
-                else if (lnkcap & PCI_EXP_LNKCAP_SLS_8_0GB)
-                        return PCIE_SPEED_8_0GT;
-                else if (lnkcap & PCI_EXP_LNKCAP_SLS_5_0GB)
-                        return PCIE_SPEED_5_0GT;
-                else if (lnkcap & PCI_EXP_LNKCAP_SLS_2_5GB)
-                        return PCIE_SPEED_2_5GT;
-        }
+        if ((lnkcap & PCI_EXP_LNKCAP_SLS) == PCI_EXP_LNKCAP_SLS_5_0GB)
+                return PCIE_SPEED_5_0GT;
+        else if ((lnkcap & PCI_EXP_LNKCAP_SLS) == PCI_EXP_LNKCAP_SLS_2_5GB)
+                return PCIE_SPEED_2_5GT;
 
         return PCI_SPEED_UNKNOWN;
 }
diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
index 9ce531194f8a..6d4b44b569bc 100644
--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
+++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
@@ -231,6 +231,7 @@ static const struct qusb2_phy_cfg sdm845_phy_cfg = {
         .mask_core_ready = CORE_READY_STATUS,
         .has_pll_override = true,
         .autoresume_en    = BIT(0),
+        .update_tune1_with_efuse = true,
 };
 
 static const char * const qusb2_phy_vreg_names[] = {
@@ -402,10 +403,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 
         /*
          * Read efuse register having TUNE2/1 parameter's high nibble.
-         * If efuse register shows value as 0x0, or if we fail to find
-         * a valid efuse register settings, then use default value
-         * as 0xB for high nibble that we have already set while
-         * configuring phy.
+         * If efuse register shows value as 0x0 (indicating value is not
+         * fused), or if we fail to find a valid efuse register setting,
+         * then use default value for high nibble that we have already
+         * set while configuring the phy.
          */
         val = nvmem_cell_read(qphy->cell, NULL);
         if (IS_ERR(val) || !val[0]) {
@@ -415,12 +416,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 
         /* Fused TUNE1/2 value is the higher nibble only */
         if (cfg->update_tune1_with_efuse)
-                qusb2_setbits(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
-                              val[0] << 0x4);
+                qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
+                                 val[0] << HSTX_TRIM_SHIFT,
+                                 HSTX_TRIM_MASK);
         else
-                qusb2_setbits(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
-                              val[0] << 0x4);
-
+                qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
+                                 val[0] << HSTX_TRIM_SHIFT,
+                                 HSTX_TRIM_MASK);
 }
 
 static int qusb2_phy_set_mode(struct phy *phy, enum phy_mode mode)
diff --git a/drivers/phy/socionext/Kconfig b/drivers/phy/socionext/Kconfig
index 467e8147972b..9c85231a6dbc 100644
--- a/drivers/phy/socionext/Kconfig
+++ b/drivers/phy/socionext/Kconfig
@@ -26,7 +26,8 @@ config PHY_UNIPHIER_USB3
 
 config PHY_UNIPHIER_PCIE
         tristate "Uniphier PHY driver for PCIe controller"
-        depends on (ARCH_UNIPHIER || COMPILE_TEST) && OF
+        depends on ARCH_UNIPHIER || COMPILE_TEST
+        depends on OF && HAS_IOMEM
         default PCIE_UNIPHIER
         select GENERIC_PHY
         help
diff --git a/drivers/rtc/rtc-hid-sensor-time.c b/drivers/rtc/rtc-hid-sensor-time.c
index 2751dba850c6..3e1abb455472 100644
--- a/drivers/rtc/rtc-hid-sensor-time.c
+++ b/drivers/rtc/rtc-hid-sensor-time.c
@@ -213,7 +213,7 @@ static int hid_rtc_read_time(struct device *dev, struct rtc_time *tm)
         /* get a report with all values through requesting one value */
         sensor_hub_input_attr_get_raw_value(time_state->common_attributes.hsdev,
                         HID_USAGE_SENSOR_TIME, hid_time_addresses[0],
-                        time_state->info[0].report_id, SENSOR_HUB_SYNC);
+                        time_state->info[0].report_id, SENSOR_HUB_SYNC, false);
         /* wait for all values (event) */
         ret = wait_for_completion_killable_timeout(
                         &time_state->comp_last_time, HZ*6);
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index fd77e46eb3b2..70a006ba4d05 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -387,8 +387,10 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
                  * orb specified one of the unsupported formats, we defer
                  * checking for IDAWs in unsupported formats to here.
                  */
-                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw))
+                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw)) {
+                        kfree(p);
                         return -EOPNOTSUPP;
+                }
 
                 if ((!ccw_is_chain(ccw)) && (!ccw_is_tic(ccw)))
                         break;
@@ -528,7 +530,7 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
 
         ret = pfn_array_alloc_pin(pat->pat_pa, cp->mdev, ccw->cda, ccw->count);
         if (ret < 0)
-                goto out_init;
+                goto out_unpin;
 
         /* Translate this direct ccw to a idal ccw. */
         idaws = kcalloc(ret, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index f47d16b5810b..a10cec0e86eb 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -22,7 +22,7 @@
 #include "vfio_ccw_private.h"
 
 struct workqueue_struct *vfio_ccw_work_q;
-struct kmem_cache *vfio_ccw_io_region;
+static struct kmem_cache *vfio_ccw_io_region;
 
 /*
  * Helpers
@@ -134,14 +134,14 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
         if (ret)
                 goto out_free;
 
-        ret = vfio_ccw_mdev_reg(sch);
-        if (ret)
-                goto out_disable;
-
         INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo);
         atomic_set(&private->avail, 1);
         private->state = VFIO_CCW_STATE_STANDBY;
 
+        ret = vfio_ccw_mdev_reg(sch);
+        if (ret)
+                goto out_disable;
+
         return 0;
 
 out_disable:
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 048665e4f13d..9f5a201c4c87 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -775,6 +775,8 @@ static int ap_device_probe(struct device *dev)
                 drvres = ap_drv->flags & AP_DRIVER_FLAG_DEFAULT;
                 if (!!devres != !!drvres)
                         return -ENODEV;
+                /* (re-)init queue's state machine */
+                ap_queue_reinit_state(to_ap_queue(dev));
         }
 
         /* Add queue/card to list of active queues/cards */
@@ -807,6 +809,8 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (is_queue_dev(dev))
+                ap_queue_remove(to_ap_queue(dev));
         if (ap_drv->remove)
                 ap_drv->remove(ap_dev);
 
@@ -1444,10 +1448,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Start with a device reset */
-                        spin_lock_bh(&aq->lock);
-                        ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
-                        spin_unlock_bh(&aq->lock);
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 3eed1b36c876..bfc66e4a9de1 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -254,6 +254,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);
 void ap_queue_remove(struct ap_queue *aq);
 void ap_queue_suspend(struct ap_device *ap_dev);
 void ap_queue_resume(struct ap_device *ap_dev);
+void ap_queue_reinit_state(struct ap_queue *aq);
 
 struct ap_card *ap_card_create(int id, int queue_depth, int raw_device_type,
                                int comp_device_type, unsigned int functions);
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 66f7334bcb03..0aa4b3ccc948 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -718,5 +718,20 @@ void ap_queue_remove(struct ap_queue *aq)
 {
         ap_flush_queue(aq);
         del_timer_sync(&aq->timeout);
+
+        /* reset with zero, also clears irq registration */
+        spin_lock_bh(&aq->lock);
+        ap_zapq(aq->qid);
+        aq->state = AP_STATE_BORKED;
+        spin_unlock_bh(&aq->lock);
 }
 EXPORT_SYMBOL(ap_queue_remove);
+
+void ap_queue_reinit_state(struct ap_queue *aq)
+{
+        spin_lock_bh(&aq->lock);
+        aq->state = AP_STATE_RESET_START;
+        ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
+        spin_unlock_bh(&aq->lock);
+}
+EXPORT_SYMBOL(ap_queue_reinit_state);
diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
index 146f54f5cbb8..c50f3e86cc74 100644
--- a/drivers/s390/crypto/zcrypt_cex2a.c
+++ b/drivers/s390/crypto/zcrypt_cex2a.c
@@ -196,7 +196,6 @@ static void zcrypt_cex2a_queue_remove(struct ap_device *ap_dev)
         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
         struct zcrypt_queue *zq = aq->private;
 
-        ap_queue_remove(aq);
         if (zq)
                 zcrypt_queue_unregister(zq);
 }
diff --git a/drivers/s390/crypto/zcrypt_cex2c.c b/drivers/s390/crypto/zcrypt_cex2c.c
index 546f67676734..35c7c6672713 100644
--- a/drivers/s390/crypto/zcrypt_cex2c.c
+++ b/drivers/s390/crypto/zcrypt_cex2c.c
@@ -251,7 +251,6 @@ static void zcrypt_cex2c_queue_remove(struct ap_device *ap_dev)
         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
         struct zcrypt_queue *zq = aq->private;
 
-        ap_queue_remove(aq);
         if (zq)
                 zcrypt_queue_unregister(zq);
 }
diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
index f9d4c6c7521d..582ffa7e0f18 100644
--- a/drivers/s390/crypto/zcrypt_cex4.c
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -275,7 +275,6 @@ static void zcrypt_cex4_queue_remove(struct ap_device *ap_dev)
         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
         struct zcrypt_queue *zq = aq->private;
 
-        ap_queue_remove(aq);
         if (zq)
                 zcrypt_queue_unregister(zq);
 }
diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index f96ec68af2e5..dcbf5c857743 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -415,9 +415,9 @@ static irqreturn_t ism_handle_irq(int irq, void *data)
                         break;
 
                 clear_bit_inv(bit, bv);
+                ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
                 barrier();
                 smcd_handle_irq(ism->smcd, bit + ISM_DMB_BIT_OFFSET);
-                ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
         }
 
         if (ism->sba->e) {
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 4bce5ae65a55..254065271867 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -4518,8 +4518,8 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
 {
         struct qeth_ipa_cmd *cmd;
         struct qeth_arp_query_info *qinfo;
-        struct qeth_snmp_cmd *snmp;
         unsigned char *data;
+        void *snmp_data;
         __u16 data_len;
 
         QETH_CARD_TEXT(card, 3, "snpcmdcb");
@@ -4527,7 +4527,6 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
         cmd = (struct qeth_ipa_cmd *) sdata;
         data = (unsigned char *)((char *)cmd - reply->offset);
         qinfo = (struct qeth_arp_query_info *) reply->param;
-        snmp = &cmd->data.setadapterparms.data.snmp;
 
         if (cmd->hdr.return_code) {
                 QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code);
@@ -4540,10 +4539,15 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
                 return 0;
         }
         data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data));
-        if (cmd->data.setadapterparms.hdr.seq_no == 1)
-                data_len -= (__u16)((char *)&snmp->data - (char *)cmd);
-        else
-                data_len -= (__u16)((char *)&snmp->request - (char *)cmd);
+        if (cmd->data.setadapterparms.hdr.seq_no == 1) {
+                snmp_data = &cmd->data.setadapterparms.data.snmp;
+                data_len -= offsetof(struct qeth_ipa_cmd,
+                                     data.setadapterparms.data.snmp);
+        } else {
+                snmp_data = &cmd->data.setadapterparms.data.snmp.request;
+                data_len -= offsetof(struct qeth_ipa_cmd,
+                                     data.setadapterparms.data.snmp.request);
+        }
 
         /* check if there is enough room in userspace */
         if ((qinfo->udata_len - qinfo->udata_offset) < data_len) {
@@ -4556,16 +4560,9 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
         QETH_CARD_TEXT_(card, 4, "sseqn%i",
                 cmd->data.setadapterparms.hdr.seq_no);
         /*copy entries to user buffer*/
-        if (cmd->data.setadapterparms.hdr.seq_no == 1) {
-                memcpy(qinfo->udata + qinfo->udata_offset,
-                       (char *)snmp,
-                       data_len + offsetof(struct qeth_snmp_cmd, data));
-                qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data);
-        } else {
-                memcpy(qinfo->udata + qinfo->udata_offset,
-                       (char *)&snmp->request, data_len);
-        }
+        memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len);
         qinfo->udata_offset += data_len;
+
         /* check if all replies received ... */
                 QETH_CARD_TEXT_(card, 4, "srtot%i",
                                cmd->data.setadapterparms.hdr.used_total);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 20c85eed1a75..b658b9a5eb1e 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1749,7 +1749,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 static void
 __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
 {
-        int cnt;
+        int cnt, status;
         unsigned long flags;
         srb_t *sp;
         scsi_qla_host_t *vha = qp->vha;
@@ -1799,10 +1799,16 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
                                         if (!sp_get(sp)) {
                                                 spin_unlock_irqrestore
                                                         (qp->qp_lock_ptr, flags);
-                                                qla2xxx_eh_abort(
+                                                status = qla2xxx_eh_abort(
                                                         GET_CMD_SP(sp));
                                                 spin_lock_irqsave
                                                         (qp->qp_lock_ptr, flags);
+                                                /*
+                                                 * Get rid of extra reference caused
+                                                 * by early exit from qla2xxx_eh_abort
+                                                 */
+                                                if (status == FAST_IO_FAIL)
+                                                        atomic_dec(&sp->ref_count);
                                         }
                                 }
                                 sp->done(sp, res);
diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
index 46df707e6f2c..452e19f8fb47 100644
--- a/drivers/scsi/ufs/ufs-hisi.c
+++ b/drivers/scsi/ufs/ufs-hisi.c
@@ -20,6 +20,7 @@
 #include "unipro.h"
 #include "ufs-hisi.h"
 #include "ufshci.h"
+#include "ufs_quirks.h"
 
 static int ufs_hisi_check_hibern8(struct ufs_hba *hba)
 {
@@ -390,6 +391,14 @@ static void ufs_hisi_set_dev_cap(struct ufs_hisi_dev_params *hisi_param)
 
 static void ufs_hisi_pwr_change_pre_change(struct ufs_hba *hba)
 {
+        if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME) {
+                pr_info("ufs flash device must set VS_DebugSaveConfigTime 0x10\n");
+                /* VS_DebugSaveConfigTime */
+                ufshcd_dme_set(hba, UIC_ARG_MIB(0xD0A0), 0x10);
+                /* sync length */
+                ufshcd_dme_set(hba, UIC_ARG_MIB(0x1556), 0x48);
+        }
+
         /* update */
         ufshcd_dme_set(hba, UIC_ARG_MIB(0x15A8), 0x1);
         /* PA_TxSkip */
diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
index 71f73d1d1ad1..5d2dfdb41a6f 100644
--- a/drivers/scsi/ufs/ufs_quirks.h
+++ b/drivers/scsi/ufs/ufs_quirks.h
@@ -131,4 +131,10 @@ struct ufs_dev_fix {
  */
 #define UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME (1 << 8)
 
+/*
+ * Some UFS devices require VS_DebugSaveConfigTime is 0x10,
+ * enabling this quirk ensure this.
+ */
+#define UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME    (1 << 9)
+
 #endif /* UFS_QUIRKS_H_ */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 27db55b0ca7f..f1c57cd33b5b 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -231,6 +231,8 @@ static struct ufs_dev_fix ufs_fixups[] = {
         UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ),
         UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL,
                 UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME),
+        UFS_FIX(UFS_VENDOR_SKHYNIX, "hB8aL1" /*H28U62301AMR*/,
+                UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME),
 
         END_FIX
 };
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 7218fb963d0a..1382a8df6c75 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -777,9 +777,6 @@ static int qcom_slim_ngd_xfer_msg(struct slim_controller *sctrl,
         u8 la = txn->la;
         bool usr_msg = false;
 
-        if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)
-                return -EPROTONOSUPPORT;
-
         if (txn->mt == SLIM_MSG_MT_CORE &&
                 (txn->mc >= SLIM_MSG_MC_BEGIN_RECONFIGURATION &&
                  txn->mc <= SLIM_MSG_MC_RECONFIGURE_NOW))
diff --git a/drivers/slimbus/slimbus.h b/drivers/slimbus/slimbus.h
index 4399d1873e2d..9be41089edde 100644
--- a/drivers/slimbus/slimbus.h
+++ b/drivers/slimbus/slimbus.h
@@ -61,12 +61,6 @@
 #define SLIM_MSG_MC_NEXT_REMOVE_CHANNEL          0x58
 #define SLIM_MSG_MC_RECONFIGURE_NOW              0x5F
 
-/*
- * Clock pause flag to indicate that the reconfig message
- * corresponds to clock pause sequence
- */
-#define SLIM_MSG_CLK_PAUSE_SEQ_FLG              (1U << 8)
-
 /* Clock pause values per SLIMbus spec */
 #define SLIM_CLK_FAST                           0
 #define SLIM_CLK_CONST_PHASE                    1
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 3dc31627c655..0c2867deb36f 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -522,11 +522,11 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
                 mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
                 mtk_spi_setup_packet(master);
 
-                cnt = len / 4;
+                cnt = mdata->xfer_len / 4;
                 iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
                                 trans->tx_buf + mdata->num_xfered, cnt);
 
-                remainder = len % 4;
+                remainder = mdata->xfer_len % 4;
                 if (remainder > 0) {
                         reg_val = 0;
                         memcpy(&reg_val,
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index f024c3fc3679..2fd8881fcd65 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -1540,13 +1540,26 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
 /* work with hotplug and coldplug */
 MODULE_ALIAS("platform:omap2_mcspi");
 
-#ifdef  CONFIG_SUSPEND
-static int omap2_mcspi_suspend_noirq(struct device *dev)
+static int __maybe_unused omap2_mcspi_suspend(struct device *dev)
 {
-        return pinctrl_pm_select_sleep_state(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
+        int error;
+
+        error = pinctrl_pm_select_sleep_state(dev);
+        if (error)
+                dev_warn(mcspi->dev, "%s: failed to set pins: %i\n",
+                         __func__, error);
+
+        error = spi_master_suspend(master);
+        if (error)
+                dev_warn(mcspi->dev, "%s: master suspend failed: %i\n",
+                         __func__, error);
+
+        return pm_runtime_force_suspend(dev);
 }
 
-static int omap2_mcspi_resume_noirq(struct device *dev)
+static int __maybe_unused omap2_mcspi_resume(struct device *dev)
 {
         struct spi_master *master = dev_get_drvdata(dev);
         struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
@@ -1557,17 +1570,17 @@ static int omap2_mcspi_resume_noirq(struct device *dev)
                 dev_warn(mcspi->dev, "%s: failed to set pins: %i\n",
                          __func__, error);
 
-        return 0;
-}
+        error = spi_master_resume(master);
+        if (error)
+                dev_warn(mcspi->dev, "%s: master resume failed: %i\n",
+                         __func__, error);
 
-#else
-#define omap2_mcspi_suspend_noirq       NULL
-#define omap2_mcspi_resume_noirq        NULL
-#endif
+        return pm_runtime_force_resume(dev);
+}
 
 static const struct dev_pm_ops omap2_mcspi_pm_ops = {
-        .suspend_noirq = omap2_mcspi_suspend_noirq,
-        .resume_noirq = omap2_mcspi_resume_noirq,
+        SET_SYSTEM_SLEEP_PM_OPS(omap2_mcspi_suspend,
+                                omap2_mcspi_resume)
         .runtime_resume = omap_mcspi_runtime_resume,
 };
 
diff --git a/drivers/staging/comedi/comedi.h b/drivers/staging/comedi/comedi.h
index e90b17775284..09a940066c0e 100644
--- a/drivers/staging/comedi/comedi.h
+++ b/drivers/staging/comedi/comedi.h
@@ -1005,35 +1005,38 @@ enum i8254_mode {
  * and INSN_DEVICE_CONFIG_GET_ROUTES.
  */
 #define NI_NAMES_BASE   0x8000u
+
+#define _TERM_N(base, n, x)     ((base) + ((x) & ((n) - 1)))
+
 /*
  * not necessarily all allowed 64 PFIs are valid--certainly not for all devices
  */
-#define NI_PFI(x)       (NI_NAMES_BASE        + ((x) & 0x3f))
+#define NI_PFI(x)               _TERM_N(NI_NAMES_BASE, 64, x)
 /* 8 trigger lines by standard, Some devices cannot talk to all eight. */
-#define TRIGGER_LINE(x) (NI_PFI(-1)       + 1 + ((x) & 0x7))
+#define TRIGGER_LINE(x)         _TERM_N(NI_PFI(-1) + 1, 8, x)
 /* 4 RTSI shared MUXes to route signals to/from TRIGGER_LINES on NI hardware */
-#define NI_RTSI_BRD(x)  (TRIGGER_LINE(-1) + 1 + ((x) & 0x3))
+#define NI_RTSI_BRD(x)          _TERM_N(TRIGGER_LINE(-1) + 1, 4, x)
 
 /* *** Counter/timer names : 8 counters max *** */
-#define NI_COUNTER_NAMES_BASE  (NI_RTSI_BRD(-1)  + 1)
-#define NI_MAX_COUNTERS        7
-#define NI_CtrSource(x)        (NI_COUNTER_NAMES_BASE + ((x) & NI_MAX_COUNTERS))
+#define NI_MAX_COUNTERS         8
+#define NI_COUNTER_NAMES_BASE   (NI_RTSI_BRD(-1)  + 1)
+#define NI_CtrSource(x)       _TERM_N(NI_COUNTER_NAMES_BASE, NI_MAX_COUNTERS, x)
 /* Gate, Aux, A,B,Z are all treated, at times as gates */
-#define NI_GATES_NAMES_BASE    (NI_CtrSource(-1) + 1)
-#define NI_CtrGate(x)          (NI_GATES_NAMES_BASE   + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrAux(x)           (NI_CtrGate(-1)   + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrA(x)             (NI_CtrAux(-1)    + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrB(x)             (NI_CtrA(-1)      + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_CtrZ(x)             (NI_CtrB(-1)      + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_GATES_NAMES_MAX     NI_CtrZ(-1)
-#define NI_CtrArmStartTrigger(x) (NI_CtrZ(-1)    + 1  + ((x) & NI_MAX_COUNTERS))
+#define NI_GATES_NAMES_BASE     (NI_CtrSource(-1) + 1)
+#define NI_CtrGate(x)           _TERM_N(NI_GATES_NAMES_BASE, NI_MAX_COUNTERS, x)
+#define NI_CtrAux(x)            _TERM_N(NI_CtrGate(-1)  + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrA(x)              _TERM_N(NI_CtrAux(-1)   + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrB(x)              _TERM_N(NI_CtrA(-1)     + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrZ(x)              _TERM_N(NI_CtrB(-1)     + 1, NI_MAX_COUNTERS, x)
+#define NI_GATES_NAMES_MAX      NI_CtrZ(-1)
+#define NI_CtrArmStartTrigger(x) _TERM_N(NI_CtrZ(-1)    + 1, NI_MAX_COUNTERS, x)
 #define NI_CtrInternalOutput(x) \
-                     (NI_CtrArmStartTrigger(-1)  + 1  + ((x) & NI_MAX_COUNTERS))
+                      _TERM_N(NI_CtrArmStartTrigger(-1) + 1, NI_MAX_COUNTERS, x)
 /** external pin(s) labeled conveniently as Ctr<i>Out. */
-#define NI_CtrOut(x)  (NI_CtrInternalOutput(-1)  + 1  + ((x) & NI_MAX_COUNTERS))
+#define NI_CtrOut(x)   _TERM_N(NI_CtrInternalOutput(-1) + 1, NI_MAX_COUNTERS, x)
 /** For Buffered sampling of ctr -- x series capability. */
-#define NI_CtrSampleClock(x)    (NI_CtrOut(-1)   + 1  + ((x) & NI_MAX_COUNTERS))
-#define NI_COUNTER_NAMES_MAX   NI_CtrSampleClock(-1)
+#define NI_CtrSampleClock(x)    _TERM_N(NI_CtrOut(-1)   + 1, NI_MAX_COUNTERS, x)
+#define NI_COUNTER_NAMES_MAX    NI_CtrSampleClock(-1)
 
 enum ni_common_signal_names {
         /* PXI_Star: this is a non-NI-specific signal */
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 2d1e0325d04d..5edf59ac6706 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2843,7 +2843,8 @@ static int ni_ao_insn_config(struct comedi_device *dev,
                 return ni_ao_arm(dev, s);
         case INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS:
                 /* we don't care about actual channels */
-                data[1] = board->ao_speed;
+                /* data[3] : chanlist_len */
+                data[1] = board->ao_speed * data[3];
                 data[2] = 0;
                 return 0;
         default:
diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
index a53231b08d30..e3425bf082ae 100644
--- a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
+++ b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
@@ -310,6 +310,7 @@ static int ipipeif_hw_setup(struct v4l2_subdev *sd)
                         ipipeif_write(val, ipipeif_base_addr, IPIPEIF_CFG2);
                         break;
                 }
+                /* fall through */
 
         case IPIPEIF_SDRAM_YUV:
                 /* Set clock divider */
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index 82558455384a..c912c70b3ef7 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -108,17 +108,6 @@ static int cedrus_request_validate(struct media_request *req)
         unsigned int count;
         unsigned int i;
 
-        count = vb2_request_buffer_cnt(req);
-        if (!count) {
-                v4l2_info(&ctx->dev->v4l2_dev,
-                          "No buffer was provided with the request\n");
-                return -ENOENT;
-        } else if (count > 1) {
-                v4l2_info(&ctx->dev->v4l2_dev,
-                          "More than one buffer was provided with the request\n");
-                return -EINVAL;
-        }
-
         list_for_each_entry(obj, &req->objects, list) {
                 struct vb2_buffer *vb;
 
@@ -133,6 +122,17 @@ static int cedrus_request_validate(struct media_request *req)
         if (!ctx)
                 return -ENOENT;
 
+        count = vb2_request_buffer_cnt(req);
+        if (!count) {
+                v4l2_info(&ctx->dev->v4l2_dev,
+                          "No buffer was provided with the request\n");
+                return -ENOENT;
+        } else if (count > 1) {
+                v4l2_info(&ctx->dev->v4l2_dev,
+                          "More than one buffer was provided with the request\n");
+                return -EINVAL;
+        }
+
         parent_hdl = &ctx->hdl;
 
         hdl = v4l2_ctrl_request_hdl_find(req, parent_hdl);
@@ -253,7 +253,7 @@ static const struct v4l2_m2m_ops cedrus_m2m_ops = {
 
 static const struct media_device_ops cedrus_m2m_media_ops = {
         .req_validate   = cedrus_request_validate,
-        .req_queue      = vb2_m2m_request_queue,
+        .req_queue      = v4l2_m2m_request_queue,
 };
 
 static int cedrus_probe(struct platform_device *pdev)
diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
index 6a18cf73c85e..18936cdb1083 100644
--- a/drivers/staging/most/core.c
+++ b/drivers/staging/most/core.c
@@ -351,7 +351,7 @@ static ssize_t set_datatype_show(struct device *dev,
 
         for (i = 0; i < ARRAY_SIZE(ch_data_type); i++) {
                 if (c->cfg.data_type & ch_data_type[i].most_ch_data_type)
-                        return snprintf(buf, PAGE_SIZE, ch_data_type[i].name);
+                        return snprintf(buf, PAGE_SIZE, "%s", ch_data_type[i].name);
         }
         return snprintf(buf, PAGE_SIZE, "unconfigured\n");
 }
diff --git a/drivers/staging/mt7621-dma/mtk-hsdma.c b/drivers/staging/mt7621-dma/mtk-hsdma.c
index df6ebf41bdea..5831f816c17b 100644
--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
+++ b/drivers/staging/mt7621-dma/mtk-hsdma.c
@@ -335,6 +335,8 @@ static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
         /* tx desc */
         src = sg->src_addr;
         for (i = 0; i < chan->desc->num_sgs; i++) {
+                tx_desc = &chan->tx_ring[chan->tx_idx];
+
                 if (len > HSDMA_MAX_PLEN)
                         tlen = HSDMA_MAX_PLEN;
                 else
@@ -344,7 +346,6 @@ static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
                         tx_desc->addr1 = src;
                         tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
                 } else {
-                        tx_desc = &chan->tx_ring[chan->tx_idx];
                         tx_desc->addr0 = src;
                         tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
 
diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
index b8566ed898f1..aa98fbb17013 100644
--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
@@ -82,7 +82,7 @@ static int rt2880_pinctrl_dt_node_to_map(struct pinctrl_dev *pctrldev,
         struct property *prop;
         const char *function_name, *group_name;
         int ret;
-        int ngroups;
+        int ngroups = 0;
         unsigned int reserved_maps = 0;
 
         for_each_node_with_property(np_config, "group")
diff --git a/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c b/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
index 85077947b9b8..85aba8a503cd 100644
--- a/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
+++ b/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
@@ -109,12 +109,12 @@ static void update_recvframe_phyinfo(union recv_frame *precvframe,
         rx_bssid = get_hdr_bssid(wlanhdr);
         pkt_info.bssid_match = ((!IsFrameTypeCtrl(wlanhdr)) &&
                                 !pattrib->icv_err && !pattrib->crc_err &&
-                                !ether_addr_equal(rx_bssid, my_bssid));
+                                ether_addr_equal(rx_bssid, my_bssid));
 
         rx_ra = get_ra(wlanhdr);
         my_hwaddr = myid(&padapter->eeprompriv);
         pkt_info.to_self = pkt_info.bssid_match &&
-                !ether_addr_equal(rx_ra, my_hwaddr);
+                ether_addr_equal(rx_ra, my_hwaddr);
 
 
         pkt_info.is_beacon = pkt_info.bssid_match &&
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index af2234798fa8..db553f2e4c0b 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -1277,7 +1277,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy,
 
                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
                 sinfo->tx_packets = psta->sta_stats.tx_pkts;
-
+                sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
         }
 
         /* for Ad-Hoc/AP mode */
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 28bfdbdc6e76..b8631baf128d 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -2289,7 +2289,7 @@ static int rtw_wx_read32(struct net_device *dev,
 exit:
         kfree(ptmp);
 
-        return 0;
+        return ret;
 }
 
 static int rtw_wx_write32(struct net_device *dev,
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index ea789376de0f..45de21c210c1 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1795,6 +1795,7 @@ vchiq_compat_ioctl_await_completion(struct file *file,
         struct vchiq_await_completion32 args32;
         struct vchiq_completion_data32 completion32;
         unsigned int *msgbufcount32;
+        unsigned int msgbufcount_native;
         compat_uptr_t msgbuf32;
         void *msgbuf;
         void **msgbufptr;
@@ -1906,7 +1907,11 @@ vchiq_compat_ioctl_await_completion(struct file *file,
                          sizeof(completion32)))
                 return -EFAULT;
 
-        args32.msgbufcount--;
+        if (get_user(msgbufcount_native, &args->msgbufcount))
+                return -EFAULT;
+
+        if (!msgbufcount_native)
+                args32.msgbufcount--;
 
         msgbufcount32 =
                 &((struct vchiq_await_completion32 __user *)arg)->msgbufcount;
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 52ff854f0d6c..cd96994dc094 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -863,6 +863,30 @@ static ssize_t key_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR(key, 0600, key_show, key_store);
 
+static void nvm_authenticate_start(struct tb_switch *sw)
+{
+        struct pci_dev *root_port;
+
+        /*
+         * During host router NVM upgrade we should not allow root port to
+         * go into D3cold because some root ports cannot trigger PME
+         * itself. To be on the safe side keep the root port in D0 during
+         * the whole upgrade process.
+         */
+        root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
+        if (root_port)
+                pm_runtime_get_noresume(&root_port->dev);
+}
+
+static void nvm_authenticate_complete(struct tb_switch *sw)
+{
+        struct pci_dev *root_port;
+
+        root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
+        if (root_port)
+                pm_runtime_put(&root_port->dev);
+}
+
 static ssize_t nvm_authenticate_show(struct device *dev,
         struct device_attribute *attr, char *buf)
 {
@@ -912,10 +936,18 @@ static ssize_t nvm_authenticate_store(struct device *dev,
 
                 sw->nvm->authenticating = true;
 
-                if (!tb_route(sw))
+                if (!tb_route(sw)) {
+                        /*
+                         * Keep root port from suspending as long as the
+                         * NVM upgrade process is running.
+                         */
+                        nvm_authenticate_start(sw);
                         ret = nvm_authenticate_host(sw);
-                else
+                        if (ret)
+                                nvm_authenticate_complete(sw);
+                } else {
                         ret = nvm_authenticate_device(sw);
+                }
                 pm_runtime_mark_last_busy(&sw->dev);
                 pm_runtime_put_autosuspend(&sw->dev);
         }
@@ -1334,6 +1366,10 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
         if (ret <= 0)
                 return ret;
 
+        /* Now we can allow root port to suspend again */
+        if (!tb_route(sw))
+                nvm_authenticate_complete(sw);
+
         if (status) {
                 tb_sw_info(sw, "switch flash authentication failed\n");
                 tb_switch_set_uuid(sw);
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 85644669fbe7..0a357db4b31b 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -961,6 +961,8 @@ int __uio_register_device(struct module *owner,
         if (ret)
                 goto err_uio_dev_add_attributes;
 
+        info->uio_dev = idev;
+
         if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
                 /*
                  * Note that we deliberately don't use devm_request_irq
@@ -972,11 +974,12 @@ int __uio_register_device(struct module *owner,
                  */
                 ret = request_irq(info->irq, uio_interrupt,
                                   info->irq_flags, info->name, idev);
-                if (ret)
+                if (ret) {
+                        info->uio_dev = NULL;
                         goto err_request_irq;
+                }
         }
 
-        info->uio_dev = idev;
         return 0;
 
 err_request_irq:
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 47d75c20c211..1b68fed464cb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1696,6 +1696,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
         { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
         .driver_info = QUIRK_CONTROL_LINE_STATE, },
         { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index c6077d582d29..0f9381b69a3b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2794,6 +2794,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
         int i, status;
         u16 portchange, portstatus;
         struct usb_port *port_dev = hub->ports[port1 - 1];
+        int reset_recovery_time;
 
         if (!hub_is_superspeed(hub->hdev)) {
                 if (warm) {
@@ -2849,7 +2850,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
                                         USB_PORT_FEAT_C_BH_PORT_RESET);
                         usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_PORT_LINK_STATE);
-                        usb_clear_port_feature(hub->hdev, port1,
+
+                        if (udev)
+                                usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_CONNECTION);
 
                         /*
@@ -2885,11 +2888,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
 
 done:
         if (status == 0) {
-                /* TRSTRCY = 10 ms; plus some extra */
                 if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM)
                         usleep_range(10000, 12000);
-                else
-                        msleep(10 + 40);
+                else {
+                        /* TRSTRCY = 10 ms; plus some extra */
+                        reset_recovery_time = 10 + 40;
+
+                        /* Hub needs extra delay after resetting its port. */
+                        if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET)
+                                reset_recovery_time += 100;
+
+                        msleep(reset_recovery_time);
+                }
 
                 if (udev) {
                         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 178d6c6063c0..0690fcff0ea2 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
                         case 'n':
                                 flags |= USB_QUIRK_DELAY_CTRL_MSG;
                                 break;
+                        case 'o':
+                                flags |= USB_QUIRK_HUB_SLOW_RESET;
+                                break;
                         /* Ignore unrecognized flag characters */
                         }
                 }
@@ -206,6 +209,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+        { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
         { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
@@ -380,6 +386,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Terminus Technology Inc. Hub */
+        { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
+
         /* Corsair K70 RGB */
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -391,6 +400,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
           USB_QUIRK_DELAY_CTRL_MSG },
 
+        /* Corsair K70 LUX RGB */
+        { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Corsair K70 LUX */
         { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -411,6 +423,11 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x2040, 0x7200), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* Raydium Touchscreen */
+        { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
+
+        { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+
         /* DJI CineSSD */
         { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
index d257c541e51b..7afc10872f1f 100644
--- a/drivers/usb/dwc2/pci.c
+++ b/drivers/usb/dwc2/pci.c
@@ -120,6 +120,7 @@ static int dwc2_pci_probe(struct pci_dev *pci,
         dwc2 = platform_device_alloc("dwc2", PLATFORM_DEVID_AUTO);
         if (!dwc2) {
                 dev_err(dev, "couldn't allocate dwc2 device\n");
+                ret = -ENOMEM;
                 goto err;
         }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index becfbb87f791..2f2048aa5fde 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev)
 
 err5:
         dwc3_event_buffers_cleanup(dwc);
+        dwc3_ulpi_exit(dwc);
 
 err4:
         dwc3_free_scratch_buffers(dwc);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 1286076a8890..842795856bf4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -283,8 +283,10 @@ err:
 static void dwc3_pci_remove(struct pci_dev *pci)
 {
         struct dwc3_pci         *dwc = pci_get_drvdata(pci);
+        struct pci_dev          *pdev = dwc->pci;
 
-        gpiod_remove_lookup_table(&platform_bytcr_gpios);
+        if (pdev->device == PCI_DEVICE_ID_INTEL_BYT)
+                gpiod_remove_lookup_table(&platform_bytcr_gpios);
 #ifdef CONFIG_PM
         cancel_work_sync(&dwc->wakeup_work);
 #endif
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 679c12e14522..9f92ee03dde7 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1081,7 +1081,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
                         /* Now prepare one extra TRB to align transfer size */
                         trb = &dep->trb_pool[dep->trb_enqueue];
                         __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
-                                        maxp - rem, false, 0,
+                                        maxp - rem, false, 1,
                                         req->request.stream_id,
                                         req->request.short_not_ok,
                                         req->request.no_interrupt);
@@ -1125,7 +1125,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to align transfer size */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else if (req->request.zero && req->request.length &&
@@ -1141,7 +1141,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to handle ZLP */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else {
@@ -1470,9 +1470,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
                 unsigned transfer_in_flight;
                 unsigned started;
 
-                if (dep->flags & DWC3_EP_STALL)
-                        return 0;
-
                 if (dep->number > 1)
                         trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue);
                 else
@@ -1494,8 +1491,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
                 else
                         dep->flags |= DWC3_EP_STALL;
         } else {
-                if (!(dep->flags & DWC3_EP_STALL))
-                        return 0;
 
                 ret = dwc3_send_clear_stall_ep_cmd(dep);
                 if (ret)
@@ -2259,7 +2254,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
          * with one TRB pending in the ring. We need to manually clear HWO bit
          * from that TRB.
          */
-        if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) {
+        if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
                 trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                 return 1;
         }
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 3ada83d81bda..31e8bf3578c8 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -215,7 +215,6 @@ struct ffs_io_data {
 
         struct mm_struct *mm;
         struct work_struct work;
-        struct work_struct cancellation_work;
 
         struct usb_ep *ep;
         struct usb_request *req;
@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static void ffs_aio_cancel_worker(struct work_struct *work)
-{
-        struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
-                                                   cancellation_work);
-
-        ENTER();
-
-        usb_ep_dequeue(io_data->ep, io_data->req);
-}
-
 static int ffs_aio_cancel(struct kiocb *kiocb)
 {
         struct ffs_io_data *io_data = kiocb->private;
-        struct ffs_data *ffs = io_data->ffs;
+        struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
         int value;
 
         ENTER();
 
-        if (likely(io_data && io_data->ep && io_data->req)) {
-                INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
-                queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
-                value = -EINPROGRESS;
-        } else {
+        spin_lock_irq(&epfile->ffs->eps_lock);
+
+        if (likely(io_data && io_data->ep && io_data->req))
+                value = usb_ep_dequeue(io_data->ep, io_data->req);
+        else
                 value = -EINVAL;
-        }
+
+        spin_unlock_irq(&epfile->ffs->eps_lock);
 
         return value;
 }
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 1000d864929c..0f026d445e31 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -401,12 +401,12 @@ done:
 static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
 {
         struct usb_request      *req;
-        struct usb_request      *tmp;
         unsigned long           flags;
 
         /* fill unused rxq slots with some skb */
         spin_lock_irqsave(&dev->req_lock, flags);
-        list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) {
+        while (!list_empty(&dev->rx_reqs)) {
+                req = list_first_entry(&dev->rx_reqs, struct usb_request, list);
                 list_del_init(&req->list);
                 spin_unlock_irqrestore(&dev->req_lock, flags);
 
@@ -1125,7 +1125,6 @@ void gether_disconnect(struct gether *link)
 {
         struct eth_dev          *dev = link->ioport;
         struct usb_request      *req;
-        struct usb_request      *tmp;
 
         WARN_ON(!dev);
         if (!dev)
@@ -1142,7 +1141,8 @@ void gether_disconnect(struct gether *link)
          */
         usb_ep_disable(link->in_ep);
         spin_lock(&dev->req_lock);
-        list_for_each_entry_safe(req, tmp, &dev->tx_reqs, list) {
+        while (!list_empty(&dev->tx_reqs)) {
+                req = list_first_entry(&dev->tx_reqs, struct usb_request, list);
                 list_del(&req->list);
 
                 spin_unlock(&dev->req_lock);
@@ -1154,7 +1154,8 @@ void gether_disconnect(struct gether *link)
 
         usb_ep_disable(link->out_ep);
         spin_lock(&dev->req_lock);
-        list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) {
+        while (!list_empty(&dev->rx_reqs)) {
+                req = list_first_entry(&dev->rx_reqs, struct usb_request, list);
                 list_del(&req->list);
 
                 spin_unlock(&dev->req_lock);
diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
index 3a16431da321..fcf13ef33b31 100644
--- a/drivers/usb/gadget/udc/omap_udc.c
+++ b/drivers/usb/gadget/udc/omap_udc.c
@@ -2033,6 +2033,7 @@ static inline int machine_without_vbus_sense(void)
 {
         return machine_is_omap_innovator()
                 || machine_is_omap_osk()
+                || machine_is_omap_palmte()
                 || machine_is_sx1()
                 /* No known omap7xx boards with vbus sense */
                 || cpu_is_omap7xx();
@@ -2041,7 +2042,7 @@ static inline int machine_without_vbus_sense(void)
 static int omap_udc_start(struct usb_gadget *g,
                 struct usb_gadget_driver *driver)
 {
-        int             status = -ENODEV;
+        int             status;
         struct omap_ep  *ep;
         unsigned long   flags;
 
@@ -2079,6 +2080,7 @@ static int omap_udc_start(struct usb_gadget *g,
                         goto done;
                 }
         } else {
+                status = 0;
                 if (can_pullup(udc))
                         pullup_enable(udc);
                 else
@@ -2593,9 +2595,22 @@ omap_ep_setup(char *name, u8 addr, u8 type,
 
 static void omap_udc_release(struct device *dev)
 {
-        complete(udc->done);
+        pullup_disable(udc);
+        if (!IS_ERR_OR_NULL(udc->transceiver)) {
+                usb_put_phy(udc->transceiver);
+                udc->transceiver = NULL;
+        }
+        omap_writew(0, UDC_SYSCON1);
+        remove_proc_file();
+        if (udc->dc_clk) {
+                if (udc->clk_requested)
+                        omap_udc_enable_clock(0);
+                clk_put(udc->hhc_clk);
+                clk_put(udc->dc_clk);
+        }
+        if (udc->done)
+                complete(udc->done);
         kfree(udc);
-        udc = NULL;
 }
 
 static int
@@ -2627,6 +2642,7 @@ omap_udc_setup(struct platform_device *odev, struct usb_phy *xceiv)
         udc->gadget.speed = USB_SPEED_UNKNOWN;
         udc->gadget.max_speed = USB_SPEED_FULL;
         udc->gadget.name = driver_name;
+        udc->gadget.quirk_ep_out_aligned_size = 1;
         udc->transceiver = xceiv;
 
         /* ep0 is special; put it right after the SETUP buffer */
@@ -2867,8 +2883,8 @@ bad_on_1710:
                 udc->clr_halt = UDC_RESET_EP;
 
         /* USB general purpose IRQ:  ep0, state changes, dma, etc */
-        status = request_irq(pdev->resource[1].start, omap_udc_irq,
-                        0, driver_name, udc);
+        status = devm_request_irq(&pdev->dev, pdev->resource[1].start,
+                                  omap_udc_irq, 0, driver_name, udc);
         if (status != 0) {
                 ERR("can't get irq %d, err %d\n",
                         (int) pdev->resource[1].start, status);
@@ -2876,20 +2892,20 @@ bad_on_1710:
         }
 
         /* USB "non-iso" IRQ (PIO for all but ep0) */
-        status = request_irq(pdev->resource[2].start, omap_udc_pio_irq,
-                        0, "omap_udc pio", udc);
+        status = devm_request_irq(&pdev->dev, pdev->resource[2].start,
+                                  omap_udc_pio_irq, 0, "omap_udc pio", udc);
         if (status != 0) {
                 ERR("can't get irq %d, err %d\n",
                         (int) pdev->resource[2].start, status);
-                goto cleanup2;
+                goto cleanup1;
         }
 #ifdef  USE_ISO
-        status = request_irq(pdev->resource[3].start, omap_udc_iso_irq,
-                        0, "omap_udc iso", udc);
+        status = devm_request_irq(&pdev->dev, pdev->resource[3].start,
+                                  omap_udc_iso_irq, 0, "omap_udc iso", udc);
         if (status != 0) {
                 ERR("can't get irq %d, err %d\n",
                         (int) pdev->resource[3].start, status);
-                goto cleanup3;
+                goto cleanup1;
         }
 #endif
         if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
@@ -2900,23 +2916,8 @@ bad_on_1710:
         }
 
         create_proc_file();
-        status = usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
-                        omap_udc_release);
-        if (status)
-                goto cleanup4;
-
-        return 0;
-
-cleanup4:
-        remove_proc_file();
-
-#ifdef  USE_ISO
-cleanup3:
-        free_irq(pdev->resource[2].start, udc);
-#endif
-
-cleanup2:
-        free_irq(pdev->resource[1].start, udc);
+        return usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
+                                          omap_udc_release);
 
 cleanup1:
         kfree(udc);
@@ -2943,42 +2944,15 @@ static int omap_udc_remove(struct platform_device *pdev)
 {
         DECLARE_COMPLETION_ONSTACK(done);
 
-        if (!udc)
-                return -ENODEV;
-
-        usb_del_gadget_udc(&udc->gadget);
-        if (udc->driver)
-                return -EBUSY;
-
         udc->done = &done;
 
-        pullup_disable(udc);
-        if (!IS_ERR_OR_NULL(udc->transceiver)) {
-                usb_put_phy(udc->transceiver);
-                udc->transceiver = NULL;
-        }
-        omap_writew(0, UDC_SYSCON1);
-
-        remove_proc_file();
-
-#ifdef  USE_ISO
-        free_irq(pdev->resource[3].start, udc);
-#endif
-        free_irq(pdev->resource[2].start, udc);
-        free_irq(pdev->resource[1].start, udc);
+        usb_del_gadget_udc(&udc->gadget);
 
-        if (udc->dc_clk) {
-                if (udc->clk_requested)
-                        omap_udc_enable_clock(0);
-                clk_put(udc->hhc_clk);
-                clk_put(udc->dc_clk);
-        }
+        wait_for_completion(&done);
 
         release_mem_region(pdev->resource[0].start,
                         pdev->resource[0].end - pdev->resource[0].start + 1);
 
-        wait_for_completion(&done);
-
         return 0;
 }
 
diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
index 27f00160332e..3c4abb5a1c3f 100644
--- a/drivers/usb/host/xhci-histb.c
+++ b/drivers/usb/host/xhci-histb.c
@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
         struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
         struct usb_hcd *hcd = histb->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_wakeup_disable(&dev->dev);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         xhci_histb_host_disable(histb);
         usb_put_hcd(hcd);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 12eea73d9f20..94aca1b5ac8a 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_SUSPEND;
         }
         if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME &&
-                !DEV_SUPERSPEED_ANY(raw_port_status)) {
+                !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) {
                 if ((raw_port_status & PORT_RESET) ||
                                 !(raw_port_status & PORT_PE))
                         return 0xffffffff;
@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         time_left = wait_for_completion_timeout(
                                         &bus_state->rexit_done[wIndex],
                                         msecs_to_jiffies(
-                                                XHCI_MAX_REXIT_TIMEOUT));
+                                                XHCI_MAX_REXIT_TIMEOUT_MS));
                         spin_lock_irqsave(&xhci->lock, flags);
 
                         if (time_left) {
@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         } else {
                                 int port_status = readl(port->addr);
                                 xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
-                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                XHCI_MAX_REXIT_TIMEOUT_MS,
                                                 port_status);
                                 status |= USB_PORT_STAT_SUSPEND;
                                 clear_bit(wIndex, &bus_state->rexit_ports);
@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
         unsigned long flags;
         struct xhci_hub *rhub;
         struct xhci_port **ports;
+        u32 portsc_buf[USB_MAXCHILDREN];
+        bool wake_enabled;
 
         rhub = xhci_get_rhub(hcd);
         ports = rhub->ports;
         max_ports = rhub->num_ports;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
+        wake_enabled = hcd->self.root_hub->do_remote_wakeup;
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        if (hcd->self.root_hub->do_remote_wakeup) {
+        if (wake_enabled) {
                 if (bus_state->resuming_ports ||        /* USB2 */
                     bus_state->port_remote_wakeup) {    /* USB3 */
                         spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                         return -EBUSY;
                 }
         }
-
-        port_index = max_ports;
+        /*
+         * Prepare ports for suspend, but don't write anything before all ports
+         * are checked and we know bus suspend can proceed
+         */
         bus_state->bus_suspended = 0;
+        port_index = max_ports;
         while (port_index--) {
-                /* suspend the port if the port is not suspended */
                 u32 t1, t2;
-                int slot_id;
 
                 t1 = readl(ports[port_index]->addr);
                 t2 = xhci_port_state_to_neutral(t1);
+                portsc_buf[port_index] = 0;
 
-                if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) {
-                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-                                        port_index + 1);
-                        if (slot_id) {
+                /* Bail out if a USB3 port has a new device in link training */
+                if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+                        bus_state->bus_suspended = 0;
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+                        return -EBUSY;
+                }
+
+                /* suspend ports in U0, or bail out for new connect changes */
+                if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+                        if ((t1 & PORT_CSC) && wake_enabled) {
+                                bus_state->bus_suspended = 0;
                                 spin_unlock_irqrestore(&xhci->lock, flags);
-                                xhci_stop_device(xhci, slot_id, 1);
-                                spin_lock_irqsave(&xhci->lock, flags);
+                                xhci_dbg(xhci, "Bus suspend bailout, port connect change\n");
+                                return -EBUSY;
                         }
+                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
                         t2 &= ~PORT_PLS_MASK;
                         t2 |= PORT_LINK_STROBE | XDEV_U3;
                         set_bit(port_index, &bus_state->bus_suspended);
@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup) {
+                if (wake_enabled) {
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
 
                 t1 = xhci_port_state_to_neutral(t1);
                 if (t1 != t2)
-                        writel(t2, ports[port_index]->addr);
+                        portsc_buf[port_index] = t2;
+        }
+
+        /* write port settings, stopping and suspending ports if needed */
+        port_index = max_ports;
+        while (port_index--) {
+                if (!portsc_buf[port_index])
+                        continue;
+                if (test_bit(port_index, &bus_state->bus_suspended)) {
+                        int slot_id;
+
+                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                                                            port_index + 1);
+                        if (slot_id) {
+                                spin_unlock_irqrestore(&xhci->lock, flags);
+                                xhci_stop_device(xhci, slot_id, 1);
+                                spin_lock_irqsave(&xhci->lock, flags);
+                        }
+                }
+                writel(portsc_buf[port_index], ports[port_index]->addr);
         }
         hcd->state = HC_STATE_SUSPENDED;
         bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 71d0d33c3286..60987c787e44 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
         struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
         struct usb_hcd  *hcd = mtk->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd  *shared_hcd = xhci->shared_hcd;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_init_wakeup(&dev->dev, false);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
         usb_put_hcd(hcd);
         xhci_mtk_sch_exit(mtk);
         xhci_mtk_clks_disable(mtk);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 01c57055c0c5..a9515265db4d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -248,6 +248,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
 
+        if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM ||
+             pdev->vendor == PCI_VENDOR_ID_CAVIUM) &&
+             pdev->device == 0x9026)
+                xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
@@ -380,6 +385,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
         if (xhci->shared_hcd) {
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
+                xhci->shared_hcd = NULL;
         }
 
         /* Workaround for spurious wakeups at shutdown with HSW */
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 32b5574ad5c5..ef09cb06212f 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -362,14 +362,16 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
         struct clk *reg_clk = xhci->reg_clk;
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_phy_shutdown(hcd->usb_phy);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         clk_disable_unprepare(clk);
         clk_disable_unprepare(reg_clk);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a8d92c90fb58..65750582133f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1521,6 +1521,35 @@ static void handle_device_notification(struct xhci_hcd *xhci,
                 usb_wakeup_notification(udev->parent, udev->portnum);
 }
 
+/*
+ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI
+ * Controller.
+ * As per ThunderX2errata-129 USB 2 device may come up as USB 1
+ * If a connection to a USB 1 device is followed by another connection
+ * to a USB 2 device.
+ *
+ * Reset the PHY after the USB device is disconnected if device speed
+ * is less than HCD_USB3.
+ * Retry the reset sequence max of 4 times checking the PLL lock status.
+ *
+ */
+static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
+{
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        u32 pll_lock_check;
+        u32 retry_count = 4;
+
+        do {
+                /* Assert PHY reset */
+                writel(0x6F, hcd->regs + 0x1048);
+                udelay(10);
+                /* De-assert the PHY reset */
+                writel(0x7F, hcd->regs + 0x1048);
+                udelay(200);
+                pll_lock_check = readl(hcd->regs + 0x1070);
+        } while (!(pll_lock_check & 0x1) && --retry_count);
+}
+
 static void handle_port_status(struct xhci_hcd *xhci,
                 union xhci_trb *event)
 {
@@ -1556,6 +1585,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
+        /* We might get interrupts after shared_hcd is removed */
+        if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
+                xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
+                bogus_port_status = true;
+                goto cleanup;
+        }
+
         hcd = port->rhub->hcd;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
         hcd_portnum = port->hcd_portnum;
@@ -1639,7 +1675,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
          * RExit to a disconnect state).  If so, let the the driver know it's
          * out of the RExit state.
          */
-        if (!DEV_SUPERSPEED_ANY(portsc) &&
+        if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
                         test_and_clear_bit(hcd_portnum,
                                 &bus_state->rexit_ports)) {
                 complete(&bus_state->rexit_done[hcd_portnum]);
@@ -1647,8 +1683,12 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
-        if (hcd->speed < HCD_USB3)
+        if (hcd->speed < HCD_USB3) {
                 xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+                if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) &&
+                    (portsc & PORT_CSC) && !(portsc & PORT_CONNECT))
+                        xhci_cavium_reset_phy_quirk(xhci);
+        }
 
 cleanup:
         /* Update event ring dequeue pointer before dropping the lock */
@@ -2266,6 +2306,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         goto cleanup;
                 case COMP_RING_UNDERRUN:
                 case COMP_RING_OVERRUN:
+                case COMP_STOPPED_LENGTH_INVALID:
                         goto cleanup;
                 default:
                         xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 6b5db344de30..938ff06c0349 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1303,6 +1303,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
 
         usb_remove_hcd(xhci->shared_hcd);
         usb_put_hcd(xhci->shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_remove_hcd(tegra->hcd);
         usb_put_hcd(tegra->hcd);
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0420eefa647a..c928dbbff881 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
 
         /* Only halt host and free memory after both hcds are removed */
         if (!usb_hcd_is_primary_hcd(hcd)) {
-                /* usb core will free this hcd shortly, unset pointer */
-                xhci->shared_hcd = NULL;
                 mutex_unlock(&xhci->mutex);
                 return;
         }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index bf0b3692dc9a..260b259b72bc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1680,7 +1680,7 @@ struct xhci_bus_state {
  * It can take up to 20 ms to transition from RExit to U0 on the
  * Intel Lynx Point LP xHCI host.
  */
-#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
+#define XHCI_MAX_REXIT_TIMEOUT_MS       20
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
@@ -1849,6 +1849,7 @@ struct xhci_hcd {
 #define XHCI_INTEL_USB_ROLE_SW  BIT_ULL(31)
 #define XHCI_ZERO_64B_REGS      BIT_ULL(32)
 #define XHCI_DEFAULT_PM_RUNTIME_ALLOW   BIT_ULL(33)
+#define XHCI_RESET_PLL_ON_DISCONNECT    BIT_ULL(34)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index bd539f3058bc..85b48c6ddc7e 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = {
         { APPLEDISPLAY_DEVICE(0x9219) },
         { APPLEDISPLAY_DEVICE(0x921c) },
         { APPLEDISPLAY_DEVICE(0x921d) },
+        { APPLEDISPLAY_DEVICE(0x9222) },
         { APPLEDISPLAY_DEVICE(0x9236) },
 
         /* Terminating entry */
diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
index d17cd95b55bb..6b2140f966ef 100644
--- a/drivers/usb/storage/unusual_realtek.h
+++ b/drivers/usb/storage/unusual_realtek.h
@@ -27,4 +27,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999,
                 "USB Card Reader",
                 USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
 
+UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
+                "Realtek",
+                "USB Card Reader",
+                USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
+UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
+                "Realtek",
+                "USB Card Reader",
+                USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
 #endif  /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index fdfc64f5acea..221b7333d067 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -251,25 +251,10 @@ static void release_memory_resource(struct resource *resource)
         kfree(resource);
 }
 
-/*
- * Host memory not allocated to dom0. We can use this range for hotplug-based
- * ballooning.
- *
- * It's a type-less resource. Setting IORESOURCE_MEM will make resource
- * management algorithms (arch_remove_reservations()) look into guest e820,
- * which we don't want.
- */
-static struct resource hostmem_resource = {
-        .name   = "Host RAM",
-};
-
-void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
-{}
-
 static struct resource *additional_memory_resource(phys_addr_t size)
 {
-        struct resource *res, *res_hostmem;
-        int ret = -ENOMEM;
+        struct resource *res;
+        int ret;
 
         res = kzalloc(sizeof(*res), GFP_KERNEL);
         if (!res)
@@ -278,42 +263,13 @@ static struct resource *additional_memory_resource(phys_addr_t size)
         res->name = "System RAM";
         res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
 
-        res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
-        if (res_hostmem) {
-                /* Try to grab a range from hostmem */
-                res_hostmem->name = "Host memory";
-                ret = allocate_resource(&hostmem_resource, res_hostmem,
-                                        size, 0, -1,
-                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
-        }
-
-        if (!ret) {
-                /*
-                 * Insert this resource into iomem. Because hostmem_resource
-                 * tracks portion of guest e820 marked as UNUSABLE noone else
-                 * should try to use it.
-                 */
-                res->start = res_hostmem->start;
-                res->end = res_hostmem->end;
-                ret = insert_resource(&iomem_resource, res);
-                if (ret < 0) {
-                        pr_err("Can't insert iomem_resource [%llx - %llx]\n",
-                                res->start, res->end);
-                        release_memory_resource(res_hostmem);
-                        res_hostmem = NULL;
-                        res->start = res->end = 0;
-                }
-        }
-
-        if (ret) {
-                ret = allocate_resource(&iomem_resource, res,
-                                        size, 0, -1,
-                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
-                if (ret < 0) {
-                        pr_err("Cannot allocate new System RAM resource\n");
-                        kfree(res);
-                        return NULL;
-                }
+        ret = allocate_resource(&iomem_resource, res,
+                                size, 0, -1,
+                                PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+        if (ret < 0) {
+                pr_err("Cannot allocate new System RAM resource\n");
+                kfree(res);
+                return NULL;
         }
 
 #ifdef CONFIG_SPARSEMEM
@@ -325,7 +281,6 @@ static struct resource *additional_memory_resource(phys_addr_t size)
                         pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
                                pfn, limit);
                         release_memory_resource(res);
-                        release_memory_resource(res_hostmem);
                         return NULL;
                 }
         }
@@ -750,8 +705,6 @@ static int __init balloon_init(void)
         set_online_page_callback(&xen_online_page);
         register_memory_notifier(&xen_memory_nb);
         register_sysctl_table(xen_root);
-
-        arch_xen_balloon_init(&hostmem_resource);
 #endif
 
 #ifdef CONFIG_XEN_PV
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 2f11ca72a281..77224d8f3e6f 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -385,8 +385,8 @@ static int create_active(struct sock_mapping *map, int *evtchn)
 out_error:
         if (*evtchn >= 0)
                 xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
-        kfree(map->active.data.in);
-        kfree(map->active.ring);
+        free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
+        free_page((unsigned long)map->active.ring);
         return ret;
 }
 
diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
index 23f1387b3ef7..e7df65d32c91 100644
--- a/drivers/xen/xlate_mmu.c
+++ b/drivers/xen/xlate_mmu.c
@@ -36,6 +36,7 @@
 #include <asm/xen/hypervisor.h>
 
 #include <xen/xen.h>
+#include <xen/xen-ops.h>
 #include <xen/page.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/memory.h>
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 43dea3b00c29..8a2562e3a316 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -1075,8 +1075,6 @@ static void afs_vnode_new_inode(struct afs_fs_cursor *fc,
         if (fc->ac.error < 0)
                 return;
 
-        d_drop(new_dentry);
-
         inode = afs_iget(fc->vnode->vfs_inode.i_sb, fc->key,
                          newfid, newstatus, newcb, fc->cbi);
         if (IS_ERR(inode)) {
@@ -1090,7 +1088,7 @@ static void afs_vnode_new_inode(struct afs_fs_cursor *fc,
         vnode = AFS_FS_I(inode);
         set_bit(AFS_VNODE_NEW_CONTENT, &vnode->flags);
         afs_vnode_commit_status(fc, vnode, 0);
-        d_add(new_dentry, inode);
+        d_instantiate(new_dentry, inode);
 }
 
 /*
diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c
index d049cb459742..fde6b4d4121e 100644
--- a/fs/afs/fs_probe.c
+++ b/fs/afs/fs_probe.c
@@ -61,8 +61,11 @@ void afs_fileserver_probe_result(struct afs_call *call)
                 afs_io_error(call, afs_io_error_fs_probe_fail);
                 goto out;
         case -ECONNRESET: /* Responded, but call expired. */
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -132,12 +135,14 @@ out:
 static int afs_do_probe_fileserver(struct afs_net *net,
                                    struct afs_server *server,
                                    struct key *key,
-                                   unsigned int server_index)
+                                   unsigned int server_index,
+                                   struct afs_error *_e)
 {
         struct afs_addr_cursor ac = {
                 .index = 0,
         };
-        int ret;
+        bool in_progress = false;
+        int err;
 
         _enter("%pU", &server->uuid);
 
@@ -151,15 +156,17 @@ static int afs_do_probe_fileserver(struct afs_net *net,
         server->probe.rtt = UINT_MAX;
 
         for (ac.index = 0; ac.index < ac.alist->nr_addrs; ac.index++) {
-                ret = afs_fs_get_capabilities(net, server, &ac, key, server_index,
+                err = afs_fs_get_capabilities(net, server, &ac, key, server_index,
                                               true);
-                if (ret != -EINPROGRESS) {
-                        afs_fs_probe_done(server);
-                        return ret;
-                }
+                if (err == -EINPROGRESS)
+                        in_progress = true;
+                else
+                        afs_prioritise_error(_e, err, ac.abort_code);
         }
 
-        return 0;
+        if (!in_progress)
+                afs_fs_probe_done(server);
+        return in_progress;
 }
 
 /*
@@ -169,21 +176,23 @@ int afs_probe_fileservers(struct afs_net *net, struct key *key,
                           struct afs_server_list *list)
 {
         struct afs_server *server;
-        int i, ret;
+        struct afs_error e;
+        bool in_progress = false;
+        int i;
 
+        e.error = 0;
+        e.responded = false;
         for (i = 0; i < list->nr_servers; i++) {
                 server = list->servers[i].server;
                 if (test_bit(AFS_SERVER_FL_PROBED, &server->flags))
                         continue;
 
-                if (!test_and_set_bit_lock(AFS_SERVER_FL_PROBING, &server->flags)) {
-                        ret = afs_do_probe_fileserver(net, server, key, i);
-                        if (ret)
-                                return ret;
-                }
+                if (!test_and_set_bit_lock(AFS_SERVER_FL_PROBING, &server->flags) &&
+                    afs_do_probe_fileserver(net, server, key, i, &e))
+                        in_progress = true;
         }
 
-        return 0;
+        return in_progress ? 0 : e.error;
 }
 
 /*
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 4c6d8e1112c2..6b17d3620414 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -382,7 +382,7 @@ void afs_zap_data(struct afs_vnode *vnode)
 int afs_validate(struct afs_vnode *vnode, struct key *key)
 {
         time64_t now = ktime_get_real_seconds();
-        bool valid = false;
+        bool valid;
         int ret;
 
         _enter("{v={%llx:%llu} fl=%lx},%x",
@@ -402,15 +402,21 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
                         vnode->cb_v_break = vnode->volume->cb_v_break;
                         valid = false;
                 } else if (vnode->status.type == AFS_FTYPE_DIR &&
-                           test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) &&
-                           vnode->cb_expires_at - 10 > now) {
-                        valid = true;
-                } else if (!test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) &&
-                           vnode->cb_expires_at - 10 > now) {
+                           (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) ||
+                            vnode->cb_expires_at - 10 <= now)) {
+                        valid = false;
+                } else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) ||
+                           vnode->cb_expires_at - 10 <= now) {
+                        valid = false;
+                } else {
                         valid = true;
                 }
         } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
                 valid = true;
+        } else {
+                vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+                vnode->cb_v_break = vnode->volume->cb_v_break;
+                valid = false;
         }
 
         read_sequnlock_excl(&vnode->cb_lock);
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 5da3b09b7518..8871b9e8645f 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -696,6 +696,14 @@ struct afs_interface {
 };
 
 /*
+ * Error prioritisation and accumulation.
+ */
+struct afs_error {
+        short   error;                  /* Accumulated error */
+        bool    responded;              /* T if server responded */
+};
+
+/*
  * Cursor for iterating over a server's address list.
  */
 struct afs_addr_cursor {
@@ -1015,6 +1023,7 @@ static inline void __afs_stat(atomic_t *s)
  * misc.c
  */
 extern int afs_abort_to_error(u32);
+extern void afs_prioritise_error(struct afs_error *, int, u32);
 
 /*
  * mntpt.c
diff --git a/fs/afs/misc.c b/fs/afs/misc.c
index 700a5fa7f4ec..bbb1fd51b019 100644
--- a/fs/afs/misc.c
+++ b/fs/afs/misc.c
@@ -118,3 +118,55 @@ int afs_abort_to_error(u32 abort_code)
         default:                return -EREMOTEIO;
         }
 }
+
+/*
+ * Select the error to report from a set of errors.
+ */
+void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code)
+{
+        switch (error) {
+        case 0:
+                return;
+        default:
+                if (e->error == -ETIMEDOUT ||
+                    e->error == -ETIME)
+                        return;
+        case -ETIMEDOUT:
+        case -ETIME:
+                if (e->error == -ENOMEM ||
+                    e->error == -ENONET)
+                        return;
+        case -ENOMEM:
+        case -ENONET:
+                if (e->error == -ERFKILL)
+                        return;
+        case -ERFKILL:
+                if (e->error == -EADDRNOTAVAIL)
+                        return;
+        case -EADDRNOTAVAIL:
+                if (e->error == -ENETUNREACH)
+                        return;
+        case -ENETUNREACH:
+                if (e->error == -EHOSTUNREACH)
+                        return;
+        case -EHOSTUNREACH:
+                if (e->error == -EHOSTDOWN)
+                        return;
+        case -EHOSTDOWN:
+                if (e->error == -ECONNREFUSED)
+                        return;
+        case -ECONNREFUSED:
+                if (e->error == -ECONNRESET)
+                        return;
+        case -ECONNRESET: /* Responded, but call expired. */
+                if (e->responded)
+                        return;
+                e->error = error;
+                return;
+
+        case -ECONNABORTED:
+                e->responded = true;
+                e->error = afs_abort_to_error(abort_code);
+                return;
+        }
+}
diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c
index 00504254c1c2..c3ae324781f8 100644
--- a/fs/afs/rotate.c
+++ b/fs/afs/rotate.c
@@ -136,7 +136,8 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc)
         struct afs_addr_list *alist;
         struct afs_server *server;
         struct afs_vnode *vnode = fc->vnode;
-        u32 rtt, abort_code;
+        struct afs_error e;
+        u32 rtt;
         int error = fc->ac.error, i;
 
         _enter("%lx[%d],%lx[%d],%d,%d",
@@ -306,8 +307,11 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc)
                 if (fc->error != -EDESTADDRREQ)
                         goto iterate_address;
                 /* Fall through */
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
                 _debug("no conn");
                 fc->error = error;
@@ -446,50 +450,15 @@ no_more_servers:
         if (fc->flags & AFS_FS_CURSOR_VBUSY)
                 goto restart_from_beginning;
 
-        abort_code = 0;
-        error = -EDESTADDRREQ;
+        e.error = -EDESTADDRREQ;
+        e.responded = false;
         for (i = 0; i < fc->server_list->nr_servers; i++) {
                 struct afs_server *s = fc->server_list->servers[i].server;
-                int probe_error = READ_ONCE(s->probe.error);
 
-                switch (probe_error) {
-                case 0:
-                        continue;
-                default:
-                        if (error == -ETIMEDOUT ||
-                            error == -ETIME)
-                                continue;
-                case -ETIMEDOUT:
-                case -ETIME:
-                        if (error == -ENOMEM ||
-                            error == -ENONET)
-                                continue;
-                case -ENOMEM:
-                case -ENONET:
-                        if (error == -ENETUNREACH)
-                                continue;
-                case -ENETUNREACH:
-                        if (error == -EHOSTUNREACH)
-                                continue;
-                case -EHOSTUNREACH:
-                        if (error == -ECONNREFUSED)
-                                continue;
-                case -ECONNREFUSED:
-                        if (error == -ECONNRESET)
-                                continue;
-                case -ECONNRESET: /* Responded, but call expired. */
-                        if (error == -ECONNABORTED)
-                                continue;
-                case -ECONNABORTED:
-                        abort_code = s->probe.abort_code;
-                        error = probe_error;
-                        continue;
-                }
+                afs_prioritise_error(&e, READ_ONCE(s->probe.error),
+                                     s->probe.abort_code);
         }
 
-        if (error == -ECONNABORTED)
-                error = afs_abort_to_error(abort_code);
-
 failed_set_error:
         fc->error = error;
 failed:
@@ -553,8 +522,11 @@ bool afs_select_current_fileserver(struct afs_fs_cursor *fc)
                 _leave(" = f [abort]");
                 return false;
 
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -633,6 +605,7 @@ int afs_end_vnode_operation(struct afs_fs_cursor *fc)
         struct afs_net *net = afs_v2net(fc->vnode);
 
         if (fc->error == -EDESTADDRREQ ||
+            fc->error == -EADDRNOTAVAIL ||
             fc->error == -ENETUNREACH ||
             fc->error == -EHOSTUNREACH)
                 afs_dump_edestaddrreq(fc);
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 59970886690f..a7b44863d502 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -576,6 +576,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 {
         signed long rtt2, timeout;
         long ret;
+        bool stalled = false;
         u64 rtt;
         u32 life, last_life;
 
@@ -609,12 +610,20 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 
                 life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
                 if (timeout == 0 &&
-                    life == last_life && signal_pending(current))
+                    life == last_life && signal_pending(current)) {
+                        if (stalled)
                                 break;
+                        __set_current_state(TASK_RUNNING);
+                        rxrpc_kernel_probe_life(call->net->socket, call->rxcall);
+                        timeout = rtt2;
+                        stalled = true;
+                        continue;
+                }
 
                 if (life != last_life) {
                         timeout = rtt2;
                         last_life = life;
+                        stalled = false;
                 }
 
                 timeout = schedule_timeout(timeout);
diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c
index c0f616bd70cb..f0b032976487 100644
--- a/fs/afs/vl_probe.c
+++ b/fs/afs/vl_probe.c
@@ -61,8 +61,11 @@ void afs_vlserver_probe_result(struct afs_call *call)
                 afs_io_error(call, afs_io_error_vl_probe_fail);
                 goto out;
         case -ECONNRESET: /* Responded, but call expired. */
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -129,15 +132,17 @@ out:
  * Probe all of a vlserver's addresses to find out the best route and to
  * query its capabilities.
  */
-static int afs_do_probe_vlserver(struct afs_net *net,
-                                 struct afs_vlserver *server,
-                                 struct key *key,
-                                 unsigned int server_index)
+static bool afs_do_probe_vlserver(struct afs_net *net,
+                                  struct afs_vlserver *server,
+                                  struct key *key,
+                                  unsigned int server_index,
+                                  struct afs_error *_e)
 {
         struct afs_addr_cursor ac = {
                 .index = 0,
         };
-        int ret;
+        bool in_progress = false;
+        int err;
 
         _enter("%s", server->name);
 
@@ -151,15 +156,17 @@ static int afs_do_probe_vlserver(struct afs_net *net,
         server->probe.rtt = UINT_MAX;
 
         for (ac.index = 0; ac.index < ac.alist->nr_addrs; ac.index++) {
-                ret = afs_vl_get_capabilities(net, &ac, key, server,
+                err = afs_vl_get_capabilities(net, &ac, key, server,
                                               server_index, true);
-                if (ret != -EINPROGRESS) {
-                        afs_vl_probe_done(server);
-                        return ret;
-                }
+                if (err == -EINPROGRESS)
+                        in_progress = true;
+                else
+                        afs_prioritise_error(_e, err, ac.abort_code);
         }
 
-        return 0;
+        if (!in_progress)
+                afs_vl_probe_done(server);
+        return in_progress;
 }
 
 /*
@@ -169,21 +176,23 @@ int afs_send_vl_probes(struct afs_net *net, struct key *key,
                        struct afs_vlserver_list *vllist)
 {
         struct afs_vlserver *server;
-        int i, ret;
+        struct afs_error e;
+        bool in_progress = false;
+        int i;
 
+        e.error = 0;
+        e.responded = false;
         for (i = 0; i < vllist->nr_servers; i++) {
                 server = vllist->servers[i].server;
                 if (test_bit(AFS_VLSERVER_FL_PROBED, &server->flags))
                         continue;
 
-                if (!test_and_set_bit_lock(AFS_VLSERVER_FL_PROBING, &server->flags)) {
-                        ret = afs_do_probe_vlserver(net, server, key, i);
-                        if (ret)
-                                return ret;
-                }
+                if (!test_and_set_bit_lock(AFS_VLSERVER_FL_PROBING, &server->flags) &&
+                    afs_do_probe_vlserver(net, server, key, i, &e))
+                        in_progress = true;
         }
 
-        return 0;
+        return in_progress ? 0 : e.error;
 }
 
 /*
diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c
index b64a284b99d2..7adde83a0648 100644
--- a/fs/afs/vl_rotate.c
+++ b/fs/afs/vl_rotate.c
@@ -71,8 +71,9 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc)
 {
         struct afs_addr_list *alist;
         struct afs_vlserver *vlserver;
+        struct afs_error e;
         u32 rtt;
-        int error = vc->ac.error, abort_code, i;
+        int error = vc->ac.error, i;
 
         _enter("%lx[%d],%lx[%d],%d,%d",
                vc->untried, vc->index,
@@ -119,8 +120,11 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc)
                         goto failed;
                 }
 
+        case -ERFKILL:
+        case -EADDRNOTAVAIL:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
+        case -EHOSTDOWN:
         case -ECONNREFUSED:
         case -ETIMEDOUT:
         case -ETIME:
@@ -235,50 +239,15 @@ no_more_servers:
         if (vc->flags & AFS_VL_CURSOR_RETRY)
                 goto restart_from_beginning;
 
-        abort_code = 0;
-        error = -EDESTADDRREQ;
+        e.error = -EDESTADDRREQ;
+        e.responded = false;
         for (i = 0; i < vc->server_list->nr_servers; i++) {
                 struct afs_vlserver *s = vc->server_list->servers[i].server;
-                int probe_error = READ_ONCE(s->probe.error);
 
-                switch (probe_error) {
-                case 0:
-                        continue;
-                default:
-                        if (error == -ETIMEDOUT ||
-                            error == -ETIME)
-                                continue;
-                case -ETIMEDOUT:
-                case -ETIME:
-                        if (error == -ENOMEM ||
-                            error == -ENONET)
-                                continue;
-                case -ENOMEM:
-                case -ENONET:
-                        if (error == -ENETUNREACH)
-                                continue;
-                case -ENETUNREACH:
-                        if (error == -EHOSTUNREACH)
-                                continue;
-                case -EHOSTUNREACH:
-                        if (error == -ECONNREFUSED)
-                                continue;
-                case -ECONNREFUSED:
-                        if (error == -ECONNRESET)
-                                continue;
-                case -ECONNRESET: /* Responded, but call expired. */
-                        if (error == -ECONNABORTED)
-                                continue;
-                case -ECONNABORTED:
-                        abort_code = s->probe.abort_code;
-                        error = probe_error;
-                        continue;
-                }
+                afs_prioritise_error(&e, READ_ONCE(s->probe.error),
+                                     s->probe.abort_code);
         }
 
-        if (error == -ECONNABORTED)
-                error = afs_abort_to_error(abort_code);
-
 failed_set_error:
         vc->error = error;
 failed:
@@ -341,6 +310,7 @@ int afs_end_vlserver_operation(struct afs_vl_cursor *vc)
         struct afs_net *net = vc->cell->net;
 
         if (vc->error == -EDESTADDRREQ ||
+            vc->error == -EADDRNOTAVAIL ||
             vc->error == -ENETUNREACH ||
             vc->error == -EHOSTUNREACH)
                 afs_vl_dump_edestaddrreq(vc);
diff --git a/fs/aio.c b/fs/aio.c
index 301e6314183b..97f983592925 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1436,6 +1436,7 @@ static int aio_prep_rw(struct kiocb *req, struct iocb *iocb)
                 ret = ioprio_check_cap(iocb->aio_reqprio);
                 if (ret) {
                         pr_debug("aio ioprio check cap error: %d\n", ret);
+                        fput(req->ki_filp);
                         return ret;
                 }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 3f0b6d1936e8..6d776717d8b3 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -477,9 +477,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
         int mirror_num = 0;
         int failed_mirror = 0;
 
-        clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
         io_tree = &BTRFS_I(fs_info->btree_inode)->io_tree;
         while (1) {
+                clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
                 ret = read_extent_buffer_pages(io_tree, eb, WAIT_COMPLETE,
                                                mirror_num);
                 if (!ret) {
@@ -493,15 +493,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
                                 break;
                 }
 
-                /*
-                 * This buffer's crc is fine, but its contents are corrupted, so
-                 * there is no reason to read the other copies, they won't be
-                 * any less wrong.
-                 */
-                if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags) ||
-                    ret == -EUCLEAN)
-                        break;
-
                 num_copies = btrfs_num_copies(fs_info,
                                               eb->start, eb->len);
                 if (num_copies == 1)
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a3c22e16509b..58e93bce3036 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2089,6 +2089,30 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         atomic_inc(&root->log_batch);
 
         /*
+         * Before we acquired the inode's lock, someone may have dirtied more
+         * pages in the target range. We need to make sure that writeback for
+         * any such pages does not start while we are logging the inode, because
+         * if it does, any of the following might happen when we are not doing a
+         * full inode sync:
+         *
+         * 1) We log an extent after its writeback finishes but before its
+         *    checksums are added to the csum tree, leading to -EIO errors
+         *    when attempting to read the extent after a log replay.
+         *
+         * 2) We can end up logging an extent before its writeback finishes.
+         *    Therefore after the log replay we will have a file extent item
+         *    pointing to an unwritten extent (and no data checksums as well).
+         *
+         * So trigger writeback for any eventual new dirty pages and then we
+         * wait for all ordered extents to complete below.
+         */
+        ret = start_ordered_ops(inode, start, end);
+        if (ret) {
+                inode_unlock(inode);
+                goto out;
+        }
+
+        /*
          * We have to do this here to avoid the priority inversion of waiting on
          * IO of a lower priority task while holding a transaciton open.
          */
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 45868fd76209..f70825af6438 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2659,7 +2659,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
         int i;
         u64 *i_qgroups;
         struct btrfs_fs_info *fs_info = trans->fs_info;
-        struct btrfs_root *quota_root = fs_info->quota_root;
+        struct btrfs_root *quota_root;
         struct btrfs_qgroup *srcgroup;
         struct btrfs_qgroup *dstgroup;
         u32 level_size = 0;
@@ -2669,6 +2669,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
         if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
                 goto out;
 
+        quota_root = fs_info->quota_root;
         if (!quota_root) {
                 ret = -EINVAL;
                 goto out;
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 924116f654a1..a3f75b8926d4 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3959,6 +3959,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 restart:
                 if (update_backref_cache(trans, &rc->backref_cache)) {
                         btrfs_end_transaction(trans);
+                        trans = NULL;
                         continue;
                 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 094cc1444a90..5be83b5a1b43 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -3340,7 +3340,8 @@ static void free_pending_move(struct send_ctx *sctx, struct pending_dir_move *m)
         kfree(m);
 }
 
-static void tail_append_pending_moves(struct pending_dir_move *moves,
+static void tail_append_pending_moves(struct send_ctx *sctx,
+                                      struct pending_dir_move *moves,
                                       struct list_head *stack)
 {
         if (list_empty(&moves->list)) {
@@ -3351,6 +3352,10 @@ static void tail_append_pending_moves(struct pending_dir_move *moves,
                 list_add_tail(&moves->list, stack);
                 list_splice_tail(&list, stack);
         }
+        if (!RB_EMPTY_NODE(&moves->node)) {
+                rb_erase(&moves->node, &sctx->pending_dir_moves);
+                RB_CLEAR_NODE(&moves->node);
+        }
 }
 
 static int apply_children_dir_moves(struct send_ctx *sctx)
@@ -3365,7 +3370,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
                 return 0;
 
         INIT_LIST_HEAD(&stack);
-        tail_append_pending_moves(pm, &stack);
+        tail_append_pending_moves(sctx, pm, &stack);
 
         while (!list_empty(&stack)) {
                 pm = list_first_entry(&stack, struct pending_dir_move, list);
@@ -3376,7 +3381,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
                         goto out;
                 pm = get_pending_dir_moves(sctx, parent_ino);
                 if (pm)
-                        tail_append_pending_moves(pm, &stack);
+                        tail_append_pending_moves(sctx, pm, &stack);
         }
         return 0;
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index cbc9d0d2c12d..645fc81e2a94 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2237,6 +2237,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         vol = memdup_user((void __user *)arg, sizeof(*vol));
         if (IS_ERR(vol))
                 return PTR_ERR(vol);
+        vol->name[BTRFS_PATH_NAME_MAX] = '\0';
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 95983c744164..1645fcfd9691 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -244,11 +244,13 @@ wait_for_old_object:
 
         ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
 
-        cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_retry);
+        cache->cache.ops->put_object(&xobject->fscache,
+                (enum fscache_obj_ref_trace)cachefiles_obj_put_wait_retry);
         goto try_again;
 
 requeue:
-        cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_timeo);
+        cache->cache.ops->put_object(&xobject->fscache,
+                (enum fscache_obj_ref_trace)cachefiles_obj_put_wait_timeo);
         _leave(" = -ETIMEDOUT");
         return -ETIMEDOUT;
 }
@@ -336,7 +338,7 @@ static int cachefiles_bury_object(struct cachefiles_cache *cache,
 try_again:
         /* first step is to make up a grave dentry in the graveyard */
         sprintf(nbuffer, "%08x%08x",
-                (uint32_t) get_seconds(),
+                (uint32_t) ktime_get_real_seconds(),
                 (uint32_t) atomic_inc_return(&cache->gravecounter));
 
         /* do the multiway lock magic */
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 40f7595aad10..8a577409d030 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -535,7 +535,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object,
                                             netpage->index, cachefiles_gfp);
                 if (ret < 0) {
                         if (ret == -EEXIST) {
+                                put_page(backpage);
+                                backpage = NULL;
                                 put_page(netpage);
+                                netpage = NULL;
                                 fscache_retrieval_complete(op, 1);
                                 continue;
                         }
@@ -608,7 +611,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object,
                                             netpage->index, cachefiles_gfp);
                 if (ret < 0) {
                         if (ret == -EEXIST) {
+                                put_page(backpage);
+                                backpage = NULL;
                                 put_page(netpage);
+                                netpage = NULL;
                                 fscache_retrieval_complete(op, 1);
                                 continue;
                         }
@@ -962,11 +968,8 @@ void cachefiles_uncache_page(struct fscache_object *_object, struct page *page)
         __releases(&object->fscache.cookie->lock)
 {
         struct cachefiles_object *object;
-        struct cachefiles_cache *cache;
 
         object = container_of(_object, struct cachefiles_object, fscache);
-        cache = container_of(object->fscache.cache,
-                             struct cachefiles_cache, cache);
 
         _enter("%p,{%lu}", object, page->index);
 
diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index 0a29a00aed2e..511e6c68156a 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -135,7 +135,8 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object,
         struct dentry *dentry = object->dentry;
         int ret;
 
-        ASSERT(dentry);
+        if (!dentry)
+                return -ESTALE;
 
         _enter("%p,#%d", object, auxdata->len);
 
diff --git a/fs/dax.c b/fs/dax.c
index 616e36ea6aaa..9bcce89ea18e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -98,12 +98,6 @@ static void *dax_make_entry(pfn_t pfn, unsigned long flags)
         return xa_mk_value(flags | (pfn_t_to_pfn(pfn) << DAX_SHIFT));
 }
 
-static void *dax_make_page_entry(struct page *page)
-{
-        pfn_t pfn = page_to_pfn_t(page);
-        return dax_make_entry(pfn, PageHead(page) ? DAX_PMD : 0);
-}
-
 static bool dax_is_locked(void *entry)
 {
         return xa_to_value(entry) & DAX_LOCKED;
@@ -116,12 +110,12 @@ static unsigned int dax_entry_order(void *entry)
         return 0;
 }
 
-static int dax_is_pmd_entry(void *entry)
+static unsigned long dax_is_pmd_entry(void *entry)
 {
         return xa_to_value(entry) & DAX_PMD;
 }
 
-static int dax_is_pte_entry(void *entry)
+static bool dax_is_pte_entry(void *entry)
 {
         return !(xa_to_value(entry) & DAX_PMD);
 }
@@ -222,9 +216,8 @@ static void *get_unlocked_entry(struct xa_state *xas)
         ewait.wait.func = wake_exceptional_entry_func;
 
         for (;;) {
-                entry = xas_load(xas);
-                if (!entry || xa_is_internal(entry) ||
-                                WARN_ON_ONCE(!xa_is_value(entry)) ||
+                entry = xas_find_conflict(xas);
+                if (!entry || WARN_ON_ONCE(!xa_is_value(entry)) ||
                                 !dax_is_locked(entry))
                         return entry;
 
@@ -255,6 +248,7 @@ static void dax_unlock_entry(struct xa_state *xas, void *entry)
 {
         void *old;
 
+        BUG_ON(dax_is_locked(entry));
         xas_reset(xas);
         xas_lock_irq(xas);
         old = xas_store(xas, entry);
@@ -352,16 +346,27 @@ static struct page *dax_busy_page(void *entry)
         return NULL;
 }
 
+/*
+ * dax_lock_mapping_entry - Lock the DAX entry corresponding to a page
+ * @page: The page whose entry we want to lock
+ *
+ * Context: Process context.
+ * Return: %true if the entry was locked or does not need to be locked.
+ */
 bool dax_lock_mapping_entry(struct page *page)
 {
         XA_STATE(xas, NULL, 0);
         void *entry;
+        bool locked;
 
+        /* Ensure page->mapping isn't freed while we look at it */
+        rcu_read_lock();
         for (;;) {
                 struct address_space *mapping = READ_ONCE(page->mapping);
 
+                locked = false;
                 if (!dax_mapping(mapping))
-                        return false;
+                        break;
 
                 /*
                  * In the device-dax case there's no need to lock, a
@@ -370,8 +375,9 @@ bool dax_lock_mapping_entry(struct page *page)
                  * otherwise we would not have a valid pfn_to_page()
                  * translation.
                  */
+                locked = true;
                 if (S_ISCHR(mapping->host->i_mode))
-                        return true;
+                        break;
 
                 xas.xa = &mapping->i_pages;
                 xas_lock_irq(&xas);
@@ -382,28 +388,35 @@ bool dax_lock_mapping_entry(struct page *page)
                 xas_set(&xas, page->index);
                 entry = xas_load(&xas);
                 if (dax_is_locked(entry)) {
+                        rcu_read_unlock();
                         entry = get_unlocked_entry(&xas);
-                        /* Did the page move while we slept? */
-                        if (dax_to_pfn(entry) != page_to_pfn(page)) {
-                                xas_unlock_irq(&xas);
-                                continue;
-                        }
+                        xas_unlock_irq(&xas);
+                        put_unlocked_entry(&xas, entry);
+                        rcu_read_lock();
+                        continue;
                 }
                 dax_lock_entry(&xas, entry);
                 xas_unlock_irq(&xas);
-                return true;
+                break;
         }
+        rcu_read_unlock();
+        return locked;
 }
 
 void dax_unlock_mapping_entry(struct page *page)
 {
         struct address_space *mapping = page->mapping;
         XA_STATE(xas, &mapping->i_pages, page->index);
+        void *entry;
 
         if (S_ISCHR(mapping->host->i_mode))
                 return;
 
-        dax_unlock_entry(&xas, dax_make_page_entry(page));
+        rcu_read_lock();
+        entry = xas_load(&xas);
+        rcu_read_unlock();
+        entry = dax_make_entry(page_to_pfn_t(page), dax_is_pmd_entry(entry));
+        dax_unlock_entry(&xas, entry);
 }
 
 /*
@@ -445,11 +458,9 @@ static void *grab_mapping_entry(struct xa_state *xas,
 retry:
         xas_lock_irq(xas);
         entry = get_unlocked_entry(xas);
-        if (xa_is_internal(entry))
-                goto fallback;
 
         if (entry) {
-                if (WARN_ON_ONCE(!xa_is_value(entry))) {
+                if (!xa_is_value(entry)) {
                         xas_set_err(xas, EIO);
                         goto out_unlock;
                 }
@@ -1628,8 +1639,7 @@ dax_insert_pfn_mkwrite(struct vm_fault *vmf, pfn_t pfn, unsigned int order)
         /* Did we race with someone splitting entry or so? */
         if (!entry ||
             (order == 0 && !dax_is_pte_entry(entry)) ||
-            (order == PMD_ORDER && (xa_is_internal(entry) ||
-                                    !dax_is_pmd_entry(entry)))) {
+            (order == PMD_ORDER && !dax_is_pmd_entry(entry))) {
                 put_unlocked_entry(&xas, entry);
                 xas_unlock_irq(&xas);
                 trace_dax_insert_pfn_mkwrite_no_entry(mapping->host, vmf,
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 722d17c88edb..41a0e97252ae 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -325,8 +325,8 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, unsigned int flags)
                  */
                 dio->iocb->ki_pos += transferred;
 
-                if (dio->op == REQ_OP_WRITE)
-                        ret = generic_write_sync(dio->iocb,  transferred);
+                if (ret > 0 && dio->op == REQ_OP_WRITE)
+                        ret = generic_write_sync(dio->iocb, ret);
                 dio->iocb->ki_complete(dio->iocb, ret, 0);
         }
 
diff --git a/fs/exec.c b/fs/exec.c
index fc281b738a98..acc3a5536384 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -62,6 +62,7 @@
 #include <linux/oom.h>
 #include <linux/compat.h>
 #include <linux/vmalloc.h>
+#include <linux/freezer.h>
 
 #include <linux/uaccess.h>
 #include <asm/mmu_context.h>
@@ -1083,7 +1084,7 @@ static int de_thread(struct task_struct *tsk)
         while (sig->notify_count) {
                 __set_current_state(TASK_KILLABLE);
                 spin_unlock_irq(lock);
-                schedule();
+                freezable_schedule();
                 if (unlikely(__fatal_signal_pending(tsk)))
                         goto killed;
                 spin_lock_irq(lock);
@@ -1111,7 +1112,7 @@ static int de_thread(struct task_struct *tsk)
                         __set_current_state(TASK_KILLABLE);
                         write_unlock_irq(&tasklist_lock);
                         cgroup_threadgroup_change_end(tsk);
-                        schedule();
+                        freezable_schedule();
                         if (unlikely(__fatal_signal_pending(tsk)))
                                 goto killed;
                 }
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 645158dc33f1..c69927bed4ef 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -77,7 +77,7 @@ static bool dentry_connected(struct dentry *dentry)
                 struct dentry *parent = dget_parent(dentry);
 
                 dput(dentry);
-                if (IS_ROOT(dentry)) {
+                if (dentry == parent) {
                         dput(parent);
                         return false;
                 }
@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
         tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
         if (IS_ERR(tmp)) {
                 dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
+                err = PTR_ERR(tmp);
                 goto out_err;
         }
         if (tmp != dentry) {
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index cb91baa4275d..eb11502e3fcd 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -892,6 +892,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
         if (sb->s_magic != EXT2_SUPER_MAGIC)
                 goto cantfind_ext2;
 
+        opts.s_mount_opt = 0;
         /* Set defaults before we parse the mount options */
         def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
         if (def_mount_opts & EXT2_DEFM_DEBUG)
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index 62d9a659a8ff..dd8f10db82e9 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -612,9 +612,9 @@ skip_replace:
         }
 
 cleanup:
-        brelse(bh);
         if (!(bh && header == HDR(bh)))
                 kfree(header);
+        brelse(bh);
         up_write(&EXT2_I(inode)->xattr_sem);
 
         return error;
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 9edc920f651f..6d9cb1719de5 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -730,6 +730,9 @@ static const struct fscache_state *fscache_drop_object(struct fscache_object *ob
 
         if (awaken)
                 wake_up_bit(&cookie->flags, FSCACHE_COOKIE_INVALIDATING);
+        if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP, &cookie->flags))
+                wake_up_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP);
+
 
         /* Prevent a race with our last child, which has to signal EV_CLEARED
          * before dropping our spinlock.
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 98b96ffb95ed..19017d296173 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -338,13 +338,14 @@ void hfs_bmap_free(struct hfs_bnode *node)
 
                 nidx -= len * 8;
                 i = node->next;
-                hfs_bnode_put(node);
                 if (!i) {
                         /* panic */;
                         pr_crit("unable to free bnode %u. bmap not found!\n",
                                 node->this);
+                        hfs_bnode_put(node);
                         return;
                 }
+                hfs_bnode_put(node);
                 node = hfs_bnode_find(tree, i);
                 if (IS_ERR(node))
                         return;
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 236efe51eca6..66774f4cb4fd 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -466,14 +466,15 @@ void hfs_bmap_free(struct hfs_bnode *node)
 
                 nidx -= len * 8;
                 i = node->next;
-                hfs_bnode_put(node);
                 if (!i) {
                         /* panic */;
                         pr_crit("unable to free bnode %u. "
                                         "bmap not found!\n",
                                 node->this);
+                        hfs_bnode_put(node);
                         return;
                 }
+                hfs_bnode_put(node);
                 node = hfs_bnode_find(tree, i);
                 if (IS_ERR(node))
                         return;
diff --git a/fs/iomap.c b/fs/iomap.c
index 64ce240217a1..3ffb776fbebe 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -142,13 +142,14 @@ static void
 iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
                 loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
 {
+        loff_t orig_pos = *pos;
+        loff_t isize = i_size_read(inode);
         unsigned block_bits = inode->i_blkbits;
         unsigned block_size = (1 << block_bits);
         unsigned poff = offset_in_page(*pos);
         unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
         unsigned first = poff >> block_bits;
         unsigned last = (poff + plen - 1) >> block_bits;
-        unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
 
         /*
          * If the block size is smaller than the page size we need to check the
@@ -183,8 +184,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
          * handle both halves separately so that we properly zero data in the
          * page cache for blocks that are entirely outside of i_size.
          */
-        if (first <= end && last > end)
-                plen -= (last - end) * block_size;
+        if (orig_pos <= isize && orig_pos + length > isize) {
+                unsigned end = offset_in_page(isize - 1) >> block_bits;
+
+                if (first <= end && last > end)
+                        plen -= (last - end) * block_size;
+        }
 
         *offp = poff;
         *lenp = plen;
@@ -1580,7 +1585,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
         struct bio *bio;
         bool need_zeroout = false;
         bool use_fua = false;
-        int nr_pages, ret;
+        int nr_pages, ret = 0;
         size_t copied = 0;
 
         if ((pos | length | align) & ((1 << blkbits) - 1))
@@ -1596,12 +1601,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
         if (iomap->flags & IOMAP_F_NEW) {
                 need_zeroout = true;
-        } else {
+        } else if (iomap->type == IOMAP_MAPPED) {
                 /*
-                 * Use a FUA write if we need datasync semantics, this
-                 * is a pure data IO that doesn't require any metadata
-                 * updates and the underlying device supports FUA. This
-                 * allows us to avoid cache flushes on IO completion.
+                 * Use a FUA write if we need datasync semantics, this is a pure
+                 * data IO that doesn't require any metadata updates (including
+                 * after IO completion such as unwritten extent conversion) and
+                 * the underlying device supports FUA. This allows us to avoid
+                 * cache flushes on IO completion.
                  */
                 if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
                     (dio->flags & IOMAP_DIO_WRITE_FUA) &&
@@ -1644,8 +1650,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
                 ret = bio_iov_iter_get_pages(bio, &iter);
                 if (unlikely(ret)) {
+                        /*
+                         * We have to stop part way through an IO. We must fall
+                         * through to the sub-block tail zeroing here, otherwise
+                         * this short IO may expose stale data in the tail of
+                         * the block we haven't written data to.
+                         */
                         bio_put(bio);
-                        return copied ? copied : ret;
+                        goto zero_tail;
                 }
 
                 n = bio->bi_iter.bi_size;
@@ -1676,13 +1688,21 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
                 dio->submit.cookie = submit_bio(bio);
         } while (nr_pages);
 
-        if (need_zeroout) {
+        /*
+         * We need to zeroout the tail of a sub-block write if the extent type
+         * requires zeroing or the write extends beyond EOF. If we don't zero
+         * the block tail in the latter case, we can expose stale data via mmap
+         * reads of the EOF block.
+         */
+zero_tail:
+        if (need_zeroout ||
+            ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
                 /* zero out from the end of the write to the end of the block */
                 pad = pos & (fs_block_size - 1);
                 if (pad)
                         iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
         }
-        return copied;
+        return copied ? copied : ret;
 }
 
 static loff_t
@@ -1857,6 +1877,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                                 dio->wait_for_completion = true;
                                 ret = 0;
                         }
+
+                        /*
+                         * Splicing to pipes can fail on a full pipe. We have to
+                         * swallow this to make it look like a short IO
+                         * otherwise the higher splice layers will completely
+                         * mishandle the error and stop moving data.
+                         */
+                        if (ret == -EFAULT)
+                                ret = 0;
                         break;
                 }
                 pos += ret;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 7b861bbc0b43..315967354954 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -686,20 +686,24 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
 {
         struct cb_offloadargs *args = data;
         struct nfs_server *server;
-        struct nfs4_copy_state *copy;
+        struct nfs4_copy_state *copy, *tmp_copy;
         bool found = false;
 
+        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+        if (!copy)
+                return htonl(NFS4ERR_SERVERFAULT);
+
         spin_lock(&cps->clp->cl_lock);
         rcu_read_lock();
         list_for_each_entry_rcu(server, &cps->clp->cl_superblocks,
                                 client_link) {
-                list_for_each_entry(copy, &server->ss_copies, copies) {
+                list_for_each_entry(tmp_copy, &server->ss_copies, copies) {
                         if (memcmp(args->coa_stateid.other,
-                                        copy->stateid.other,
+                                        tmp_copy->stateid.other,
                                         sizeof(args->coa_stateid.other)))
                                 continue;
-                        nfs4_copy_cb_args(copy, args);
-                        complete(&copy->completion);
+                        nfs4_copy_cb_args(tmp_copy, args);
+                        complete(&tmp_copy->completion);
                         found = true;
                         goto out;
                 }
@@ -707,15 +711,11 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
 out:
         rcu_read_unlock();
         if (!found) {
-                copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
-                if (!copy) {
-                        spin_unlock(&cps->clp->cl_lock);
-                        return htonl(NFS4ERR_SERVERFAULT);
-                }
                 memcpy(&copy->stateid, &args->coa_stateid, NFS4_STATEID_SIZE);
                 nfs4_copy_cb_args(copy, args);
                 list_add_tail(&copy->copies, &cps->clp->pending_cb_stateids);
-        }
+        } else
+                kfree(copy);
         spin_unlock(&cps->clp->cl_lock);
 
         return 0;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 86bcba40ca61..74b36ed883ca 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1361,12 +1361,7 @@ static void ff_layout_read_prepare_v4(struct rpc_task *task, void *data)
                                 task))
                 return;
 
-        if (ff_layout_read_prepare_common(task, hdr))
-                return;
-
-        if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
-                        hdr->args.lock_context, FMODE_READ) == -EIO)
-                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
+        ff_layout_read_prepare_common(task, hdr);
 }
 
 static void ff_layout_read_call_done(struct rpc_task *task, void *data)
@@ -1542,12 +1537,7 @@ static void ff_layout_write_prepare_v4(struct rpc_task *task, void *data)
                                 task))
                 return;
 
-        if (ff_layout_write_prepare_common(task, hdr))
-                return;
-
-        if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
-                        hdr->args.lock_context, FMODE_WRITE) == -EIO)
-                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
+        ff_layout_write_prepare_common(task, hdr);
 }
 
 static void ff_layout_write_call_done(struct rpc_task *task, void *data)
@@ -1742,6 +1732,10 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
         fh = nfs4_ff_layout_select_ds_fh(lseg, idx);
         if (fh)
                 hdr->args.fh = fh;
+
+        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+                goto out_failed;
+
         /*
          * Note that if we ever decide to split across DSes,
          * then we may need to handle dense-like offsets.
@@ -1804,6 +1798,9 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         if (fh)
                 hdr->args.fh = fh;
 
+        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+                goto out_failed;
+
         /*
          * Note that if we ever decide to split across DSes,
          * then we may need to handle dense-like offsets.
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 411798346e48..de50a342d5a5 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -215,6 +215,10 @@ unsigned int ff_layout_fetch_ds_ioerr(struct pnfs_layout_hdr *lo,
                 unsigned int maxnum);
 struct nfs_fh *
 nfs4_ff_layout_select_ds_fh(struct pnfs_layout_segment *lseg, u32 mirror_idx);
+int
+nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
+                                u32 mirror_idx,
+                                nfs4_stateid *stateid);
 
 struct nfs4_pnfs_ds *
 nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 74d8d5352438..d23347389626 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -370,6 +370,25 @@ out:
         return fh;
 }
 
+int
+nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
+                                u32 mirror_idx,
+                                nfs4_stateid *stateid)
+{
+        struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, mirror_idx);
+
+        if (!ff_layout_mirror_valid(lseg, mirror, false)) {
+                pr_err_ratelimited("NFS: %s: No data server for mirror offset index %d\n",
+                        __func__, mirror_idx);
+                goto out;
+        }
+
+        nfs4_stateid_copy(stateid, &mirror->stateid);
+        return 1;
+out:
+        return 0;
+}
+
 /**
  * nfs4_ff_layout_prepare_ds - prepare a DS connection for an RPC call
  * @lseg: the layout segment we're operating on
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index ac5b784a1de0..fed06fd9998d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -137,31 +137,32 @@ static int handle_async_copy(struct nfs42_copy_res *res,
                              struct file *dst,
                              nfs4_stateid *src_stateid)
 {
-        struct nfs4_copy_state *copy;
+        struct nfs4_copy_state *copy, *tmp_copy;
         int status = NFS4_OK;
         bool found_pending = false;
         struct nfs_open_context *ctx = nfs_file_open_context(dst);
 
+        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+        if (!copy)
+                return -ENOMEM;
+
         spin_lock(&server->nfs_client->cl_lock);
-        list_for_each_entry(copy, &server->nfs_client->pending_cb_stateids,
+        list_for_each_entry(tmp_copy, &server->nfs_client->pending_cb_stateids,
                                 copies) {
-                if (memcmp(&res->write_res.stateid, &copy->stateid,
+                if (memcmp(&res->write_res.stateid, &tmp_copy->stateid,
                                 NFS4_STATEID_SIZE))
                         continue;
                 found_pending = true;
-                list_del(&copy->copies);
+                list_del(&tmp_copy->copies);
                 break;
         }
         if (found_pending) {
                 spin_unlock(&server->nfs_client->cl_lock);
+                kfree(copy);
+                copy = tmp_copy;
                 goto out;
         }
 
-        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
-        if (!copy) {
-                spin_unlock(&server->nfs_client->cl_lock);
-                return -ENOMEM;
-        }
         memcpy(&copy->stateid, &res->write_res.stateid, NFS4_STATEID_SIZE);
         init_completion(&copy->completion);
         copy->parent_state = ctx->state;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 8d59c9655ec4..1b994b527518 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -41,6 +41,8 @@ enum nfs4_client_state {
         NFS4CLNT_MOVED,
         NFS4CLNT_LEASE_MOVED,
         NFS4CLNT_DELEGATION_EXPIRED,
+        NFS4CLNT_RUN_MANAGER,
+        NFS4CLNT_DELEGRETURN_RUNNING,
 };
 
 #define NFS4_RENEW_TIMEOUT              0x01
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index ffea57885394..d8decf2ec48f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1210,6 +1210,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
         struct task_struct *task;
         char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1];
 
+        set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
         if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                 return;
         __module_get(THIS_MODULE);
@@ -2503,6 +2504,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
 
         /* Ensure exclusive access to NFSv4 state */
         do {
+                clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
                 if (test_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state)) {
                         section = "purge state";
                         status = nfs4_purge_lease(clp);
@@ -2593,14 +2595,18 @@ static void nfs4_state_manager(struct nfs_client *clp)
                 }
 
                 nfs4_end_drain_session(clp);
-                if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
-                        nfs_client_return_marked_delegations(clp);
-                        continue;
+                nfs4_clear_state_manager_bit(clp);
+
+                if (!test_and_set_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state)) {
+                        if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
+                                nfs_client_return_marked_delegations(clp);
+                                set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
+                        }
+                        clear_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state);
                 }
 
-                nfs4_clear_state_manager_bit(clp);
                 /* Did we race with an attempt to give us more work? */
-                if (clp->cl_state == 0)
+                if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state))
                         return;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                         return;
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index de99db518571..f2129a5d9f23 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -266,9 +266,7 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc,
                 return;
 
         if (nbh == NULL) {      /* blocksize == pagesize */
-                xa_lock_irq(&btnc->i_pages);
-                __xa_erase(&btnc->i_pages, newkey);
-                xa_unlock_irq(&btnc->i_pages);
+                xa_erase_irq(&btnc->i_pages, newkey);
                 unlock_page(ctxt->bh->b_page);
         } else
                 brelse(nbh);
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 9f88188060db..4bf8d5854b27 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -125,10 +125,10 @@ check_err:
 
 check_gen:
         if (handle->ih_generation != inode->i_generation) {
-                iput(inode);
                 trace_ocfs2_get_dentry_generation((unsigned long long)blkno,
                                                   handle->ih_generation,
                                                   inode->i_generation);
+                iput(inode);
                 result = ERR_PTR(-ESTALE);
                 goto bail;
         }
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 3f1685d7d43b..1565dd8e8856 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -157,18 +157,14 @@ out:
 }
 
 /*
- * lock allocators, and reserving appropriate number of bits for
- * meta blocks and data clusters.
- *
- * in some cases, we don't need to reserve clusters, just let data_ac
- * be NULL.
+ * lock allocator, and reserve appropriate number of bits for
+ * meta blocks.
  */
-static int ocfs2_lock_allocators_move_extents(struct inode *inode,
+static int ocfs2_lock_meta_allocator_move_extents(struct inode *inode,
                                         struct ocfs2_extent_tree *et,
                                         u32 clusters_to_move,
                                         u32 extents_to_split,
                                         struct ocfs2_alloc_context **meta_ac,
-                                        struct ocfs2_alloc_context **data_ac,
                                         int extra_blocks,
                                         int *credits)
 {
@@ -193,13 +189,6 @@ static int ocfs2_lock_allocators_move_extents(struct inode *inode,
                 goto out;
         }
 
-        if (data_ac) {
-                ret = ocfs2_reserve_clusters(osb, clusters_to_move, data_ac);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-        }
 
         *credits += ocfs2_calc_extend_credits(osb->sb, et->et_root_el);
 
@@ -259,10 +248,10 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
                 }
         }
 
-        ret = ocfs2_lock_allocators_move_extents(inode, &context->et, *len, 1,
-                                                 &context->meta_ac,
-                                                 &context->data_ac,
-                                                 extra_blocks, &credits);
+        ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et,
+                                                *len, 1,
+                                                &context->meta_ac,
+                                                extra_blocks, &credits);
         if (ret) {
                 mlog_errno(ret);
                 goto out;
@@ -285,6 +274,21 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
                 }
         }
 
+        /*
+         * Make sure ocfs2_reserve_cluster is called after
+         * __ocfs2_flush_truncate_log, otherwise, dead lock may happen.
+         *
+         * If ocfs2_reserve_cluster is called
+         * before __ocfs2_flush_truncate_log, dead lock on global bitmap
+         * may happen.
+         *
+         */
+        ret = ocfs2_reserve_clusters(osb, *len, &context->data_ac);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_unlock_mutex;
+        }
+
         handle = ocfs2_start_trans(osb, credits);
         if (IS_ERR(handle)) {
                 ret = PTR_ERR(handle);
@@ -617,9 +621,10 @@ static int ocfs2_move_extent(struct ocfs2_move_extents_context *context,
                 }
         }
 
-        ret = ocfs2_lock_allocators_move_extents(inode, &context->et, len, 1,
-                                                 &context->meta_ac,
-                                                 NULL, extra_blocks, &credits);
+        ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et,
+                                                len, 1,
+                                                &context->meta_ac,
+                                                extra_blocks, &credits);
         if (ret) {
                 mlog_errno(ret);
                 goto out;
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index ffcff6516e89..e02a9039b5ea 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -816,17 +816,14 @@ static int ramoops_probe(struct platform_device *pdev)
 
         cxt->pstore.data = cxt;
         /*
-         * Console can handle any buffer size, so prefer LOG_LINE_MAX. If we
-         * have to handle dumps, we must have at least record_size buffer. And
-         * for ftrace, bufsize is irrelevant (if bufsize is 0, buf will be
-         * ZERO_SIZE_PTR).
+         * Since bufsize is only used for dmesg crash dumps, it
+         * must match the size of the dprz record (after PRZ header
+         * and ECC bytes have been accounted for).
          */
-        if (cxt->console_size)
-                cxt->pstore.bufsize = 1024; /* LOG_LINE_MAX */
-        cxt->pstore.bufsize = max(cxt->record_size, cxt->pstore.bufsize);
-        cxt->pstore.buf = kmalloc(cxt->pstore.bufsize, GFP_KERNEL);
+        cxt->pstore.bufsize = cxt->dprzs[0]->buffer_size;
+        cxt->pstore.buf = kzalloc(cxt->pstore.bufsize, GFP_KERNEL);
         if (!cxt->pstore.buf) {
-                pr_err("cannot allocate pstore buffer\n");
+                pr_err("cannot allocate pstore crash dump buffer\n");
                 err = -ENOMEM;
                 goto fail_clear;
         }
diff --git a/fs/read_write.c b/fs/read_write.c
index bfcb4ced5664..4dae0399c75a 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -2094,17 +2094,18 @@ int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same)
         off = same->src_offset;
         len = same->src_length;
 
-        ret = -EISDIR;
         if (S_ISDIR(src->i_mode))
-                goto out;
+                return -EISDIR;
 
-        ret = -EINVAL;
         if (!S_ISREG(src->i_mode))
-                goto out;
+                return -EINVAL;
+
+        if (!file->f_op->remap_file_range)
+                return -EOPNOTSUPP;
 
         ret = remap_verify_area(file, off, len, false);
         if (ret < 0)
-                goto out;
+                return ret;
         ret = 0;
 
         if (off + len > i_size_read(src))
@@ -2147,10 +2148,8 @@ next_fdput:
                 fdput(dst_fd);
 next_loop:
                 if (fatal_signal_pending(current))
-                        goto out;
+                        break;
         }
-
-out:
         return ret;
 }
 EXPORT_SYMBOL(vfs_dedupe_file_range);
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 499a20a5a010..273736f41be3 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -275,7 +275,7 @@ static int __sysv_write_inode(struct inode *inode, int wait)
                 }
         }
         brelse(bh);
-        return 0;
+        return err;
 }
 
 int sysv_write_inode(struct inode *inode, struct writeback_control *wbc)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 8f2f56d9a1bb..e3d684ea3203 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -827,16 +827,20 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block)
 
 
         ret = udf_dstrCS0toChar(sb, outstr, 31, pvoldesc->volIdent, 32);
-        if (ret < 0)
-                goto out_bh;
-
-        strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
+        if (ret < 0) {
+                strcpy(UDF_SB(sb)->s_volume_ident, "InvalidName");
+                pr_warn("incorrect volume identification, setting to "
+                        "'InvalidName'\n");
+        } else {
+                strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
+        }
         udf_debug("volIdent[] = '%s'\n", UDF_SB(sb)->s_volume_ident);
 
         ret = udf_dstrCS0toChar(sb, outstr, 127, pvoldesc->volSetIdent, 128);
-        if (ret < 0)
+        if (ret < 0) {
+                ret = 0;
                 goto out_bh;
-
+        }
         outstr[ret] = 0;
         udf_debug("volSetIdent[] = '%s'\n", outstr);
 
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index 45234791fec2..5fcfa96463eb 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -351,6 +351,11 @@ try_again:
         return u_len;
 }
 
+/*
+ * Convert CS0 dstring to output charset. Warning: This function may truncate
+ * input string if it is too long as it is used for informational strings only
+ * and it is better to truncate the string than to refuse mounting a media.
+ */
 int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
                       const uint8_t *ocu_i, int i_len)
 {
@@ -359,9 +364,12 @@ int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
         if (i_len > 0) {
                 s_len = ocu_i[i_len - 1];
                 if (s_len >= i_len) {
-                        pr_err("incorrect dstring lengths (%d/%d)\n",
-                               s_len, i_len);
-                        return -EINVAL;
+                        pr_warn("incorrect dstring lengths (%d/%d),"
+                                " truncating\n", s_len, i_len);
+                        s_len = i_len - 1;
+                        /* 2-byte encoding? Need to round properly... */
+                        if (ocu_i[0] == 16)
+                                s_len -= (s_len - 1) & 2;
                 }
         }
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 356d2b8568c1..cd58939dc977 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1361,6 +1361,19 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
                 ret = -EINVAL;
                 if (!vma_can_userfault(cur))
                         goto out_unlock;
+
+                /*
+                 * UFFDIO_COPY will fill file holes even without
+                 * PROT_WRITE. This check enforces that if this is a
+                 * MAP_SHARED, the process has write permission to the backing
+                 * file. If VM_MAYWRITE is set it also enforces that on a
+                 * MAP_SHARED vma: there is no F_WRITE_SEAL and no further
+                 * F_WRITE_SEAL can be taken until the vma is destroyed.
+                 */
+                ret = -EPERM;
+                if (unlikely(!(cur->vm_flags & VM_MAYWRITE)))
+                        goto out_unlock;
+
                 /*
                  * If this vma contains ending address, and huge pages
                  * check alignment.
@@ -1406,6 +1419,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
                 BUG_ON(!vma_can_userfault(vma));
                 BUG_ON(vma->vm_userfaultfd_ctx.ctx &&
                        vma->vm_userfaultfd_ctx.ctx != ctx);
+                WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
 
                 /*
                  * Nothing to do: this vma is already registered into this
@@ -1552,6 +1566,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
                 cond_resched();
 
                 BUG_ON(!vma_can_userfault(vma));
+                WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
 
                 /*
                  * Nothing to do: this vma is already registered into this
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 74d7228e755b..19e921d1586f 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1694,10 +1694,13 @@ xfs_bmap_add_extent_delay_real(
         case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
                 /*
                  * Filling in all of a previously delayed allocation extent.
-                 * The right neighbor is contiguous, the left is not.
+                 * The right neighbor is contiguous, the left is not. Take care
+                 * with delay -> unwritten extent allocation here because the
+                 * delalloc record we are overwriting is always written.
                  */
                 PREV.br_startblock = new->br_startblock;
                 PREV.br_blockcount += RIGHT.br_blockcount;
+                PREV.br_state = new->br_state;
 
                 xfs_iext_next(ifp, &bma->icur);
                 xfs_iext_remove(bma->ip, &bma->icur, state);
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 86c50208a143..7fbf8af0b159 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -538,15 +538,18 @@ xfs_inobt_rec_check_count(
 
 static xfs_extlen_t
 xfs_inobt_max_size(
-        struct xfs_mount        *mp)
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          agno)
 {
+        xfs_agblock_t           agblocks = xfs_ag_block_count(mp, agno);
+
         /* Bail out if we're uninitialized, which can happen in mkfs. */
         if (mp->m_inobt_mxr[0] == 0)
                 return 0;
 
         return xfs_btree_calc_size(mp->m_inobt_mnr,
-                (uint64_t)mp->m_sb.sb_agblocks * mp->m_sb.sb_inopblock /
-                                XFS_INODES_PER_CHUNK);
+                                (uint64_t)agblocks * mp->m_sb.sb_inopblock /
+                                        XFS_INODES_PER_CHUNK);
 }
 
 static int
@@ -594,7 +597,7 @@ xfs_finobt_calc_reserves(
         if (error)
                 return error;
 
-        *ask += xfs_inobt_max_size(mp);
+        *ask += xfs_inobt_max_size(mp, agno);
         *used += tree_len;
         return 0;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 5d263dfdb3bc..404e581f1ea1 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1042,7 +1042,7 @@ out_trans_cancel:
         goto out_unlock;
 }
 
-static int
+int
 xfs_flush_unmap_range(
         struct xfs_inode        *ip,
         xfs_off_t               offset,
@@ -1195,13 +1195,7 @@ xfs_prepare_shift(
          * Writeback and invalidate cache for the remainder of the file as we're
          * about to shift down every extent from offset to EOF.
          */
-        error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
-        if (error)
-                return error;
-        error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
-                                        offset >> PAGE_SHIFT, -1);
-        if (error)
-                return error;
+        error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
 
         /*
          * Clean out anything hanging around in the cow fork now that
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 87363d136bb6..7a78229cf1a7 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -80,4 +80,7 @@ int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
                           int whichfork, xfs_extnum_t *nextents,
                           xfs_filblks_t *count);
 
+int     xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
+                              xfs_off_t len);
+
 #endif  /* __XFS_BMAP_UTIL_H__ */
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 12d8455bfbb2..010db5f8fb00 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1233,9 +1233,23 @@ xfs_buf_iodone(
 }
 
 /*
- * Requeue a failed buffer for writeback
+ * Requeue a failed buffer for writeback.
  *
- * Return true if the buffer has been re-queued properly, false otherwise
+ * We clear the log item failed state here as well, but we have to be careful
+ * about reference counts because the only active reference counts on the buffer
+ * may be the failed log items. Hence if we clear the log item failed state
+ * before queuing the buffer for IO we can release all active references to
+ * the buffer and free it, leading to use after free problems in
+ * xfs_buf_delwri_queue. It makes no difference to the buffer or log items which
+ * order we process them in - the buffer is locked, and we own the buffer list
+ * so nothing on them is going to change while we are performing this action.
+ *
+ * Hence we can safely queue the buffer for IO before we clear the failed log
+ * item state, therefore  always having an active reference to the buffer and
+ * avoiding the transient zero-reference state that leads to use-after-free.
+ *
+ * Return true if the buffer was added to the buffer list, false if it was
+ * already on the buffer list.
  */
 bool
 xfs_buf_resubmit_failed_buffers(
@@ -1243,16 +1257,16 @@ xfs_buf_resubmit_failed_buffers(
         struct list_head        *buffer_list)
 {
         struct xfs_log_item     *lip;
+        bool                    ret;
+
+        ret = xfs_buf_delwri_queue(bp, buffer_list);
 
         /*
-         * Clear XFS_LI_FAILED flag from all items before resubmit
-         *
-         * XFS_LI_FAILED set/clear is protected by ail_lock, caller  this
+         * XFS_LI_FAILED set/clear is protected by ail_lock, caller of this
          * function already have it acquired
          */
         list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
                 xfs_clear_li_failed(lip);
 
-        /* Add this buffer back to the delayed write list */
-        return xfs_buf_delwri_queue(bp, buffer_list);
+        return ret;
 }
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 53c9ab8fb777..e47425071e65 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -920,7 +920,7 @@ out_unlock:
 }
 
 
-loff_t
+STATIC loff_t
 xfs_file_remap_range(
         struct file             *file_in,
         loff_t                  pos_in,
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index ecdb086bc23e..322a852ce284 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -296,6 +296,7 @@ xfs_reflink_reserve_cow(
         if (error)
                 return error;
 
+        xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
         trace_xfs_reflink_cow_alloc(ip, &got);
         return 0;
 }
@@ -1351,10 +1352,19 @@ xfs_reflink_remap_prep(
         if (ret)
                 goto out_unlock;
 
-        /* Zap any page cache for the destination file's range. */
-        truncate_inode_pages_range(&inode_out->i_data,
-                        round_down(pos_out, PAGE_SIZE),
-                        round_up(pos_out + *len, PAGE_SIZE) - 1);
+        /*
+         * If pos_out > EOF, we may have dirtied blocks between EOF and
+         * pos_out. In that case, we need to extend the flush and unmap to cover
+         * from EOF to the end of the copy length.
+         */
+        if (pos_out > XFS_ISIZE(dest)) {
+                loff_t  flen = *len + (pos_out - XFS_ISIZE(dest));
+                ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
+        } else {
+                ret = xfs_flush_unmap_range(dest, pos_out, *len);
+        }
+        if (ret)
+                goto out_unlock;
 
         return 1;
 out_unlock:
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 3043e5ed6495..8a6532aae779 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -280,7 +280,10 @@ DECLARE_EVENT_CLASS(xfs_buf_class,
         ),
         TP_fast_assign(
                 __entry->dev = bp->b_target->bt_dev;
-                __entry->bno = bp->b_bn;
+                if (bp->b_bn == XFS_BUF_DADDR_NULL)
+                        __entry->bno = bp->b_maps[0].bm_bn;
+                else
+                        __entry->bno = bp->b_bn;
                 __entry->nblks = bp->b_length;
                 __entry->hold = atomic_read(&bp->b_hold);
                 __entry->pincount = atomic_read(&bp->b_pin_count);
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index a83e1f632eb7..f01623aef2f7 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -169,6 +169,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
 
 void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
                       unsigned int idx);
+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr);
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
 void can_free_echo_skb(struct net_device *dev, unsigned int idx);
 
diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h
index cb31683bbe15..8268811a697e 100644
--- a/include/linux/can/rx-offload.h
+++ b/include/linux/can/rx-offload.h
@@ -41,7 +41,12 @@ int can_rx_offload_add_timestamp(struct net_device *dev, struct can_rx_offload *
 int can_rx_offload_add_fifo(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight);
 int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 reg);
 int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload);
-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb);
+int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+                                struct sk_buff *skb, u32 timestamp);
+unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
+                                         unsigned int idx, u32 timestamp);
+int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+                              struct sk_buff *skb);
 void can_rx_offload_reset(struct can_rx_offload *offload);
 void can_rx_offload_del(struct can_rx_offload *offload);
 void can_rx_offload_enable(struct can_rx_offload *offload);
diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h
index bd73e7a91410..9e66bfe369aa 100644
--- a/include/linux/dma-direct.h
+++ b/include/linux/dma-direct.h
@@ -5,7 +5,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mem_encrypt.h>
 
-#define DIRECT_MAPPING_ERROR            0
+#define DIRECT_MAPPING_ERROR            (~(dma_addr_t)0)
 
 #ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA
 #include <asm/dma-direct.h>
diff --git a/include/linux/filter.h b/include/linux/filter.h
index de629b706d1d..448dcc448f1f 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -866,6 +866,10 @@ void bpf_jit_binary_free(struct bpf_binary_header *hdr);
 
 void bpf_jit_free(struct bpf_prog *fp);
 
+int bpf_jit_get_func_addr(const struct bpf_prog *prog,
+                          const struct bpf_insn *insn, bool extra_pass,
+                          u64 *func_addr, bool *func_addr_fixed);
+
 struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *fp);
 void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
 
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 34cf0fdd7dc7..610815e3f1aa 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -196,8 +196,7 @@ static inline void fscache_enqueue_retrieval(struct fscache_retrieval *op)
 static inline void fscache_retrieval_complete(struct fscache_retrieval *op,
                                               int n_pages)
 {
-        atomic_sub(n_pages, &op->n_pages);
-        if (atomic_read(&op->n_pages) <= 0)
+        if (atomic_sub_return_relaxed(n_pages, &op->n_pages) <= 0)
                 fscache_op_complete(&op->op, false);
 }
 
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index a397907e8d72..dd16e8218db3 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -777,8 +777,8 @@ struct ftrace_ret_stack {
 extern void return_to_handler(void);
 
 extern int
-ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
-                         unsigned long frame_pointer, unsigned long *retp);
+function_graph_enter(unsigned long ret, unsigned long func,
+                     unsigned long frame_pointer, unsigned long *retp);
 
 unsigned long ftrace_graph_ret_addr(struct task_struct *task, int *idx,
                                     unsigned long ret, unsigned long *retp);
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index 331dc377c275..dc12f5c4b076 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -177,6 +177,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
 * @attr_usage_id:       Attribute usage id as per spec
 * @report_id:   Report id to look for
 * @flag:      Synchronous or asynchronous read
+* @is_signed:   If true then fields < 32 bits will be sign-extended
 *
 * Issues a synchronous or asynchronous read request for an input attribute.
 * Returns data upto 32 bits.
@@ -190,7 +191,8 @@ enum sensor_hub_read_flags {
 int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                                         u32 usage_id,
                                         u32 attr_usage_id, u32 report_id,
-                                        enum sensor_hub_read_flags flag
+                                        enum sensor_hub_read_flags flag,
+                                        bool is_signed
 );
 
 /**
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 387c70df6f29..a355d61940f2 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1139,34 +1139,6 @@ static inline u32 hid_report_len(struct hid_report *report)
 int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
                 int interrupt);
 
-
-/**
- * struct hid_scroll_counter - Utility class for processing high-resolution
- *                             scroll events.
- * @dev: the input device for which events should be reported.
- * @microns_per_hi_res_unit: the amount moved by the user's finger for each
- *                           high-resolution unit reported by the mouse, in
- *                           microns.
- * @resolution_multiplier: the wheel's resolution in high-resolution mode as a
- *                         multiple of its lower resolution. For example, if
- *                         moving the wheel by one "notch" would result in a
- *                         value of 1 in low-resolution mode but 8 in
- *                         high-resolution, the multiplier is 8.
- * @remainder: counts the number of high-resolution units moved since the last
- *             low-resolution event (REL_WHEEL or REL_HWHEEL) was sent. Should
- *             only be used by class methods.
- */
-struct hid_scroll_counter {
-        struct input_dev *dev;
-        int microns_per_hi_res_unit;
-        int resolution_multiplier;
-
-        int remainder;
-};
-
-void hid_scroll_counter_handle_scroll(struct hid_scroll_counter *counter,
-                                      int hi_res_value);
-
 /* HID quirks API */
 unsigned long hid_lookup_quirk(const struct hid_device *hdev);
 int hid_quirks_init(char **quirks_param, __u16 bus, int count);
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index dbff9ff28f2c..34e17e6f8942 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -2473,14 +2473,15 @@ struct mlx5_ifc_xrc_srqc_bits {
 
         u8         wq_signature[0x1];
         u8         cont_srq[0x1];
-        u8         dbr_umem_valid[0x1];
+        u8         reserved_at_22[0x1];
         u8         rlky[0x1];
         u8         basic_cyclic_rcv_wqe[0x1];
         u8         log_rq_stride[0x3];
         u8         xrcd[0x18];
 
         u8         page_offset[0x6];
-        u8         reserved_at_46[0x2];
+        u8         reserved_at_46[0x1];
+        u8         dbr_umem_valid[0x1];
         u8         cqn[0x18];
 
         u8         reserved_at_60[0x20];
@@ -6689,9 +6690,12 @@ struct mlx5_ifc_create_xrc_srq_in_bits {
 
         struct mlx5_ifc_xrc_srqc_bits xrc_srq_context_entry;
 
-        u8         reserved_at_280[0x40];
+        u8         reserved_at_280[0x60];
+
         u8         xrc_srq_umem_valid[0x1];
-        u8         reserved_at_2c1[0x5bf];
+        u8         reserved_at_2e1[0x1f];
+
+        u8         reserved_at_300[0x580];
 
         u8         pas[0][0x40];
 };
diff --git a/include/linux/net_dim.h b/include/linux/net_dim.h
index c79e859408e6..fd458389f7d1 100644
--- a/include/linux/net_dim.h
+++ b/include/linux/net_dim.h
@@ -406,6 +406,8 @@ static inline void net_dim(struct net_dim *dim,
                 }
                 /* fall through */
         case NET_DIM_START_MEASURE:
+                net_dim_sample(end_sample.event_ctr, end_sample.pkt_ctr, end_sample.byte_ctr,
+                               &dim->start_sample);
                 dim->state = NET_DIM_MEASURE_IN_PROGRESS;
                 break;
         case NET_DIM_APPLY_NEW_PROFILE:
diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h
index b8d95564bd53..14edb795ab43 100644
--- a/include/linux/netfilter/nf_conntrack_proto_gre.h
+++ b/include/linux/netfilter/nf_conntrack_proto_gre.h
@@ -21,6 +21,19 @@ struct nf_ct_gre_keymap {
         struct nf_conntrack_tuple tuple;
 };
 
+enum grep_conntrack {
+        GRE_CT_UNREPLIED,
+        GRE_CT_REPLIED,
+        GRE_CT_MAX
+};
+
+struct netns_proto_gre {
+        struct nf_proto_net     nf;
+        rwlock_t                keymap_lock;
+        struct list_head        keymap_list;
+        unsigned int            gre_timeouts[GRE_CT_MAX];
+};
+
 /* add new tuple->key_reply pair to keymap */
 int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
                          struct nf_conntrack_tuple *t);
diff --git a/include/linux/platform_data/gpio-davinci.h b/include/linux/platform_data/gpio-davinci.h
index f92a47e18034..a93841bfb9f7 100644
--- a/include/linux/platform_data/gpio-davinci.h
+++ b/include/linux/platform_data/gpio-davinci.h
@@ -17,6 +17,8 @@
 #define __DAVINCI_GPIO_PLATFORM_H
 
 struct davinci_gpio_platform_data {
+        bool    no_auto_base;
+        u32     base;
         u32     ngpio;
         u32     gpio_unbanked;
 };
diff --git a/include/linux/psi.h b/include/linux/psi.h
index 8e0725aac0aa..7006008d5b72 100644
--- a/include/linux/psi.h
+++ b/include/linux/psi.h
@@ -1,6 +1,7 @@
 #ifndef _LINUX_PSI_H
 #define _LINUX_PSI_H
 
+#include <linux/jump_label.h>
 #include <linux/psi_types.h>
 #include <linux/sched.h>
 
@@ -9,7 +10,7 @@ struct css_set;
 
 #ifdef CONFIG_PSI
 
-extern bool psi_disabled;
+extern struct static_key_false psi_disabled;
 
 void psi_init(void);
 
diff --git a/include/linux/pstore.h b/include/linux/pstore.h
index a15bc4d48752..30fcec375a3a 100644
--- a/include/linux/pstore.h
+++ b/include/linux/pstore.h
@@ -90,7 +90,10 @@ struct pstore_record {
  *
  * @buf_lock:   spinlock to serialize access to @buf
  * @buf:        preallocated crash dump buffer
- * @bufsize:    size of @buf available for crash dump writes
+ * @bufsize:    size of @buf available for crash dump bytes (must match
+ *              smallest number of bytes available for writing to a
+ *              backend entry, since compressed bytes don't take kindly
+ *              to being truncated)
  *
  * @read_mutex: serializes @open, @read, @close, and @erase callbacks
  * @flags:      bitfield of frontends the backend can accept writes for
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 6c2ffed907f5..de20ede2c5c8 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -64,15 +64,12 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
 #define PTRACE_MODE_NOAUDIT     0x04
 #define PTRACE_MODE_FSCREDS     0x08
 #define PTRACE_MODE_REALCREDS   0x10
-#define PTRACE_MODE_SCHED       0x20
-#define PTRACE_MODE_IBPB        0x40
 
 /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
 #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
 #define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS)
 #define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS)
 #define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS)
-#define PTRACE_MODE_SPEC_IBPB (PTRACE_MODE_ATTACH_REALCREDS | PTRACE_MODE_IBPB)
 
 /**
  * ptrace_may_access - check whether the caller is permitted to access
@@ -90,20 +87,6 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
  */
 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
 
-/**
- * ptrace_may_access - check whether the caller is permitted to access
- * a target task.
- * @task: target task
- * @mode: selects type of access and caller credentials
- *
- * Returns true on success, false on denial.
- *
- * Similar to ptrace_may_access(). Only to be called from context switch
- * code. Does not call into audit and the regular LSM hooks due to locking
- * constraints.
- */
-extern bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode);
-
 static inline int ptrace_reparented(struct task_struct *child)
 {
         return !same_thread_group(child->real_parent, child->parent);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a51c13c2b1a0..291a9bd5b97f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1116,6 +1116,7 @@ struct task_struct {
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         /* Index of current stored address in ret_stack: */
         int                             curr_ret_stack;
+        int                             curr_ret_depth;
 
         /* Stack of return addresses for return function tracing: */
         struct ftrace_ret_stack         *ret_stack;
@@ -1453,6 +1454,8 @@ static inline bool is_percpu_thread(void)
 #define PFA_SPREAD_SLAB                 2       /* Spread some slab caches over cpuset */
 #define PFA_SPEC_SSB_DISABLE            3       /* Speculative Store Bypass disabled */
 #define PFA_SPEC_SSB_FORCE_DISABLE      4       /* Speculative Store Bypass force disabled*/
+#define PFA_SPEC_IB_DISABLE             5       /* Indirect branch speculation restricted */
+#define PFA_SPEC_IB_FORCE_DISABLE       6       /* Indirect branch speculation permanently restricted */
 
 #define TASK_PFA_TEST(name, func)                                       \
         static inline bool task_##func(struct task_struct *p)           \
@@ -1484,6 +1487,13 @@ TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ssb_disable)
 TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
 TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
 
+TASK_PFA_TEST(SPEC_IB_DISABLE, spec_ib_disable)
+TASK_PFA_SET(SPEC_IB_DISABLE, spec_ib_disable)
+TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable)
+
+TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
+TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
+
 static inline void
 current_restore_flags(unsigned long orig_flags, unsigned long flags)
 {
diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h
new file mode 100644
index 000000000000..59d3736c454c
--- /dev/null
+++ b/include/linux/sched/smt.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_SCHED_SMT_H
+#define _LINUX_SCHED_SMT_H
+
+#include <linux/static_key.h>
+
+#ifdef CONFIG_SCHED_SMT
+extern struct static_key_false sched_smt_present;
+
+static __always_inline bool sched_smt_active(void)
+{
+        return static_branch_likely(&sched_smt_present);
+}
+#else
+static inline bool sched_smt_active(void) { return false; }
+#endif
+
+void arch_smt_update(void);
+
+#endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0ba687454267..0d1b2c3f127b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1326,6 +1326,22 @@ static inline void skb_zcopy_set(struct sk_buff *skb, struct ubuf_info *uarg)
         }
 }
 
+static inline void skb_zcopy_set_nouarg(struct sk_buff *skb, void *val)
+{
+        skb_shinfo(skb)->destructor_arg = (void *)((uintptr_t) val | 0x1UL);
+        skb_shinfo(skb)->tx_flags |= SKBTX_ZEROCOPY_FRAG;
+}
+
+static inline bool skb_zcopy_is_nouarg(struct sk_buff *skb)
+{
+        return (uintptr_t) skb_shinfo(skb)->destructor_arg & 0x1UL;
+}
+
+static inline void *skb_zcopy_get_nouarg(struct sk_buff *skb)
+{
+        return (void *)((uintptr_t) skb_shinfo(skb)->destructor_arg & ~0x1UL);
+}
+
 /* Release a reference on a zerocopy structure */
 static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
 {
@@ -1335,7 +1351,7 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
                 if (uarg->callback == sock_zerocopy_callback) {
                         uarg->zerocopy = uarg->zerocopy && zerocopy;
                         sock_zerocopy_put(uarg);
-                } else {
+                } else if (!skb_zcopy_is_nouarg(skb)) {
                         uarg->callback(uarg, zerocopy);
                 }
 
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 8ed77bb4ed86..a9b0280687d5 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -196,6 +196,7 @@ struct tcp_sock {
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
         u32     last_oow_ack_time;  /* timestamp of last out-of-window ACK */
+        u32     compressed_ack_rcv_nxt;
 
         u32     tsoffset;       /* timestamp offset */
 
diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
index 40b0b4c1bf7b..df20f8bdbfa3 100644
--- a/include/linux/tracehook.h
+++ b/include/linux/tracehook.h
@@ -83,8 +83,8 @@ static inline int ptrace_report_syscall(struct pt_regs *regs)
  * tracehook_report_syscall_entry - task is about to attempt a system call
  * @regs:               user register state of current task
  *
- * This will be called if %TIF_SYSCALL_TRACE has been set, when the
- * current task has just entered the kernel for a system call.
+ * This will be called if %TIF_SYSCALL_TRACE or %TIF_SYSCALL_EMU have been set,
+ * when the current task has just entered the kernel for a system call.
  * Full user register state is available here.  Changing the values
  * in @regs can affect the system call number and arguments to be tried.
  * It is safe to block here, preventing the system call from beginning.
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 538ba1a58f5b..e9de8ad0bad7 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -166,7 +166,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
                 struct tracepoint_func *it_func_ptr;                    \
                 void *it_func;                                          \
                 void *__data;                                           \
-                int __maybe_unused idx = 0;                             \
+                int __maybe_unused __idx = 0;                           \
                                                                         \
                 if (!(cond))                                            \
                         return;                                         \
@@ -182,7 +182,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
                  * doesn't work from the idle path.                     \
                  */                                                     \
                 if (rcuidle) {                                          \
-                        idx = srcu_read_lock_notrace(&tracepoint_srcu); \
+                        __idx = srcu_read_lock_notrace(&tracepoint_srcu);\
                         rcu_irq_enter_irqson();                         \
                 }                                                       \
                                                                         \
@@ -198,7 +198,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
                                                                         \
                 if (rcuidle) {                                          \
                         rcu_irq_exit_irqson();                          \
-                        srcu_read_unlock_notrace(&tracepoint_srcu, idx);\
+                        srcu_read_unlock_notrace(&tracepoint_srcu, __idx);\
                 }                                                       \
                                                                         \
                 preempt_enable_notrace();                               \
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index b7a99ce56bc9..a1be64c9940f 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -66,4 +66,7 @@
 /* Device needs a pause after every control message. */
 #define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
 
+/* Hub needs extra delay after resetting its port. */
+#define USB_QUIRK_HUB_SLOW_RESET                BIT(14)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index d9514928ddac..564892e19f8c 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -289,9 +289,7 @@ struct xarray {
 void xa_init_flags(struct xarray *, gfp_t flags);
 void *xa_load(struct xarray *, unsigned long index);
 void *xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
-void *xa_cmpxchg(struct xarray *, unsigned long index,
-                        void *old, void *entry, gfp_t);
-int xa_reserve(struct xarray *, unsigned long index, gfp_t);
+void *xa_erase(struct xarray *, unsigned long index);
 void *xa_store_range(struct xarray *, unsigned long first, unsigned long last,
                         void *entry, gfp_t);
 bool xa_get_mark(struct xarray *, unsigned long index, xa_mark_t);
@@ -344,65 +342,6 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 }
 
 /**
- * xa_erase() - Erase this entry from the XArray.
- * @xa: XArray.
- * @index: Index of entry.
- *
- * This function is the equivalent of calling xa_store() with %NULL as
- * the third argument.  The XArray does not need to allocate memory, so
- * the user does not need to provide GFP flags.
- *
- * Context: Process context.  Takes and releases the xa_lock.
- * Return: The entry which used to be at this index.
- */
-static inline void *xa_erase(struct xarray *xa, unsigned long index)
-{
-        return xa_store(xa, index, NULL, 0);
-}
-
-/**
- * xa_insert() - Store this entry in the XArray unless another entry is
- *                      already present.
- * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
- *
- * If you would rather see the existing entry in the array, use xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
- *
- * Context: Process context.  Takes and releases the xa_lock.
- *          May sleep if the @gfp flags permit.
- * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
- * -ENOMEM if memory could not be allocated.
- */
-static inline int xa_insert(struct xarray *xa, unsigned long index,
-                void *entry, gfp_t gfp)
-{
-        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
-}
-
-/**
- * xa_release() - Release a reserved entry.
- * @xa: XArray.
- * @index: Index of entry.
- *
- * After calling xa_reserve(), you can call this function to release the
- * reservation.  If the entry at @index has been stored to, this function
- * will do nothing.
- */
-static inline void xa_release(struct xarray *xa, unsigned long index)
-{
-        xa_cmpxchg(xa, index, NULL, NULL, 0);
-}
-
-/**
  * xa_for_each() - Iterate over a portion of an XArray.
  * @xa: XArray.
  * @entry: Entry retrieved from array.
@@ -455,6 +394,7 @@ void *__xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *__xa_cmpxchg(struct xarray *, unsigned long index, void *old,
                 void *entry, gfp_t);
 int __xa_alloc(struct xarray *, u32 *id, u32 max, void *entry, gfp_t);
+int __xa_reserve(struct xarray *, unsigned long index, gfp_t);
 void __xa_set_mark(struct xarray *, unsigned long index, xa_mark_t);
 void __xa_clear_mark(struct xarray *, unsigned long index, xa_mark_t);
 
@@ -487,6 +427,58 @@ static inline int __xa_insert(struct xarray *xa, unsigned long index,
 }
 
 /**
+ * xa_store_bh() - Store this entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_store() except it disables softirqs
+ * while holding the array lock.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.
+ * Return: The entry which used to be at this index.
+ */
+static inline void *xa_store_bh(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_bh(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock_bh(xa);
+
+        return curr;
+}
+
+/**
+ * xa_store_irq() - Erase this entry from the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_store() except it disables interrupts
+ * while holding the array lock.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.
+ * Return: The entry which used to be at this index.
+ */
+static inline void *xa_store_irq(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_irq(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock_irq(xa);
+
+        return curr;
+}
+
+/**
  * xa_erase_bh() - Erase this entry from the XArray.
  * @xa: XArray.
  * @index: Index of entry.
@@ -495,7 +487,7 @@ static inline int __xa_insert(struct xarray *xa, unsigned long index,
  * the third argument.  The XArray does not need to allocate memory, so
  * the user does not need to provide GFP flags.
  *
- * Context: Process context.  Takes and releases the xa_lock while
+ * Context: Any context.  Takes and releases the xa_lock while
  * disabling softirqs.
  * Return: The entry which used to be at this index.
  */
@@ -535,6 +527,61 @@ static inline void *xa_erase_irq(struct xarray *xa, unsigned long index)
 }
 
 /**
+ * xa_cmpxchg() - Conditionally replace an entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @old: Old value to test against.
+ * @entry: New value to place in array.
+ * @gfp: Memory allocation flags.
+ *
+ * If the entry at @index is the same as @old, replace it with @entry.
+ * If the return value is equal to @old, then the exchange was successful.
+ *
+ * Context: Any context.  Takes and releases the xa_lock.  May sleep
+ * if the @gfp flags permit.
+ * Return: The old value at this index or xa_err() if an error happened.
+ */
+static inline void *xa_cmpxchg(struct xarray *xa, unsigned long index,
+                        void *old, void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock(xa);
+        curr = __xa_cmpxchg(xa, index, old, entry, gfp);
+        xa_unlock(xa);
+
+        return curr;
+}
+
+/**
+ * xa_insert() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * If you would rather see the existing entry in the array, use xa_cmpxchg().
+ * This function is for users who don't care what the entry is, only that
+ * one is present.
+ *
+ * Context: Process context.  Takes and releases the xa_lock.
+ *          May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
+        if (!curr)
+                return 0;
+        if (xa_is_err(curr))
+                return xa_err(curr);
+        return -EEXIST;
+}
+
+/**
  * xa_alloc() - Find somewhere to store this entry in the XArray.
  * @xa: XArray.
  * @id: Pointer to ID.
@@ -575,7 +622,7 @@ static inline int xa_alloc(struct xarray *xa, u32 *id, u32 max, void *entry,
  * Updates the @id pointer with the index, then stores the entry at that
  * index.  A concurrent lookup will not see an uninitialised @id.
  *
- * Context: Process context.  Takes and releases the xa_lock while
+ * Context: Any context.  Takes and releases the xa_lock while
  * disabling softirqs.  May sleep if the @gfp flags permit.
  * Return: 0 on success, -ENOMEM if memory allocation fails or -ENOSPC if
  * there is no more space in the XArray.
@@ -621,6 +668,98 @@ static inline int xa_alloc_irq(struct xarray *xa, u32 *id, u32 max, void *entry,
         return err;
 }
 
+/**
+ * xa_reserve() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * Ensures there is somewhere to store an entry at @index in the array.
+ * If there is already something stored at @index, this function does
+ * nothing.  If there was nothing there, the entry is marked as reserved.
+ * Loading from a reserved entry returns a %NULL pointer.
+ *
+ * If you do not use the entry that you have reserved, call xa_release()
+ * or xa_erase() to free any unnecessary memory.
+ *
+ * Context: Any context.  Takes and releases the xa_lock.
+ * May sleep if the @gfp flags permit.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock(xa);
+
+        return ret;
+}
+
+/**
+ * xa_reserve_bh() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * A softirq-disabling version of xa_reserve().
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve_bh(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock_bh(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock_bh(xa);
+
+        return ret;
+}
+
+/**
+ * xa_reserve_irq() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * An interrupt-disabling version of xa_reserve().
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve_irq(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock_irq(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock_irq(xa);
+
+        return ret;
+}
+
+/**
+ * xa_release() - Release a reserved entry.
+ * @xa: XArray.
+ * @index: Index of entry.
+ *
+ * After calling xa_reserve(), you can call this function to release the
+ * reservation.  If the entry at @index has been stored to, this function
+ * will do nothing.
+ */
+static inline void xa_release(struct xarray *xa, unsigned long index)
+{
+        xa_cmpxchg(xa, index, NULL, NULL, 0);
+}
+
 /* Everything below here is the Advanced API.  Proceed with caution. */
 
 /*
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index 58c1ecf3d648..5467264771ec 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -624,7 +624,7 @@ v4l2_m2m_dst_buf_remove_by_idx(struct v4l2_m2m_ctx *m2m_ctx, unsigned int idx)
 
 /* v4l2 request helper */
 
-void vb2_m2m_request_queue(struct media_request *req);
+void v4l2_m2m_request_queue(struct media_request *req);
 
 /* v4l2 ioctl helpers */
 
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index de587948042a..1adefe42c0a6 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -77,7 +77,8 @@ int rxrpc_kernel_retry_call(struct socket *, struct rxrpc_call *,
                             struct sockaddr_rxrpc *, struct key *);
 int rxrpc_kernel_check_call(struct socket *, struct rxrpc_call *,
                             enum rxrpc_call_completion *, u32 *);
-u32 rxrpc_kernel_check_life(struct socket *, struct rxrpc_call *);
+u32 rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
+void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
 u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
 bool rxrpc_kernel_get_reply_time(struct socket *, struct rxrpc_call *,
                                  ktime_t *);
diff --git a/include/net/netfilter/ipv4/nf_nat_masquerade.h b/include/net/netfilter/ipv4/nf_nat_masquerade.h
index cd24be4c4a99..13d55206bb9f 100644
--- a/include/net/netfilter/ipv4/nf_nat_masquerade.h
+++ b/include/net/netfilter/ipv4/nf_nat_masquerade.h
@@ -9,7 +9,7 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
                        const struct nf_nat_range2 *range,
                        const struct net_device *out);
 
-void nf_nat_masquerade_ipv4_register_notifier(void);
+int nf_nat_masquerade_ipv4_register_notifier(void);
 void nf_nat_masquerade_ipv4_unregister_notifier(void);
 
 #endif /*_NF_NAT_MASQUERADE_IPV4_H_ */
diff --git a/include/net/netfilter/ipv6/nf_nat_masquerade.h b/include/net/netfilter/ipv6/nf_nat_masquerade.h
index 0c3b5ebf0bb8..2917bf95c437 100644
--- a/include/net/netfilter/ipv6/nf_nat_masquerade.h
+++ b/include/net/netfilter/ipv6/nf_nat_masquerade.h
@@ -5,7 +5,7 @@
 unsigned int
 nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
                        const struct net_device *out);
-void nf_nat_masquerade_ipv6_register_notifier(void);
+int nf_nat_masquerade_ipv6_register_notifier(void);
 void nf_nat_masquerade_ipv6_unregister_notifier(void);
 
 #endif /* _NF_NAT_MASQUERADE_IPV6_H_ */
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 8c2caa370e0f..ab9242e51d9e 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -608,4 +608,16 @@ static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
                                  SCTP_DEFAULT_MINSEGMENT));
 }
 
+static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+{
+        __u32 pmtu = sctp_dst_mtu(t->dst);
+
+        if (t->pathmtu == pmtu)
+                return true;
+
+        t->pathmtu = pmtu;
+
+        return false;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index f1dab1f4b194..70c10a8f3e90 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -1192,7 +1192,7 @@ struct snd_soc_pcm_runtime {
              ((i) < rtd->num_codecs) && ((dai) = rtd->codec_dais[i]); \
              (i)++)
 #define for_each_rtd_codec_dai_rollback(rtd, i, dai)            \
-        for (; ((i--) >= 0) && ((dai) = rtd->codec_dais[i]);)
+        for (; ((--i) >= 0) && ((dai) = rtd->codec_dais[i]);)
 
 
 /* mixer control */
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 573d5b901fb1..5b50fe4906d2 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -181,6 +181,7 @@ enum rxrpc_timer_trace {
 enum rxrpc_propose_ack_trace {
         rxrpc_propose_ack_client_tx_end,
         rxrpc_propose_ack_input_data,
+        rxrpc_propose_ack_ping_for_check_life,
         rxrpc_propose_ack_ping_for_keepalive,
         rxrpc_propose_ack_ping_for_lost_ack,
         rxrpc_propose_ack_ping_for_lost_reply,
@@ -380,6 +381,7 @@ enum rxrpc_tx_point {
 #define rxrpc_propose_ack_traces \
         EM(rxrpc_propose_ack_client_tx_end,     "ClTxEnd") \
         EM(rxrpc_propose_ack_input_data,        "DataIn ") \
+        EM(rxrpc_propose_ack_ping_for_check_life, "ChkLife") \
         EM(rxrpc_propose_ack_ping_for_keepalive, "KeepAlv") \
         EM(rxrpc_propose_ack_ping_for_lost_ack, "LostAck") \
         EM(rxrpc_propose_ack_ping_for_lost_reply, "LostRpl") \
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index f07b270d4fc4..9a4bdfadab07 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -107,6 +107,8 @@ DEFINE_EVENT(sched_wakeup_template, sched_wakeup_new,
 #ifdef CREATE_TRACE_POINTS
 static inline long __trace_sched_switch_state(bool preempt, struct task_struct *p)
 {
+        unsigned int state;
+
 #ifdef CONFIG_SCHED_DEBUG
         BUG_ON(p != current);
 #endif /* CONFIG_SCHED_DEBUG */
@@ -118,7 +120,15 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
         if (preempt)
                 return TASK_REPORT_MAX;
 
-        return 1 << task_state_index(p);
+        /*
+         * task_state_index() uses fls() and returns a value from 0-8 range.
+         * Decrement it by 1 (except TASK_RUNNING state i.e 0) before using
+         * it for left shift operation to get the correct task->state
+         * mapping.
+         */
+        state = task_state_index(p);
+
+        return state ? (1 << (state - 1)) : state;
 }
 #endif /* CREATE_TRACE_POINTS */
 
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 6d180cc60a5d..3eb5a4c3d60a 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -716,7 +716,6 @@
  * the situation described above.
  */
 #define REL_RESERVED            0x0a
-#define REL_WHEEL_HI_RES        0x0b
 #define REL_MAX                 0x0f
 #define REL_CNT                 (REL_MAX+1)
 
@@ -753,15 +752,6 @@
 
 #define ABS_MISC                0x28
 
-/*
- * 0x2e is reserved and should not be used in input drivers.
- * It was used by HID as ABS_MISC+6 and userspace needs to detect if
- * the next ABS_* event is correct or is just ABS_MISC + n.
- * We define here ABS_RESERVED so userspace can rely on it and detect
- * the situation described above.
- */
-#define ABS_RESERVED            0x2e
-
 #define ABS_MT_SLOT             0x2f    /* MT slot being modified */
 #define ABS_MT_TOUCH_MAJOR      0x30    /* Major axis of touching ellipse */
 #define ABS_MT_TOUCH_MINOR      0x31    /* Minor axis (omit if circular) */
diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
index c0d7ea0bf5b6..b17201edfa09 100644
--- a/include/uapi/linux/prctl.h
+++ b/include/uapi/linux/prctl.h
@@ -212,6 +212,7 @@ struct prctl_mm_map {
 #define PR_SET_SPECULATION_CTRL         53
 /* Speculation control variants */
 # define PR_SPEC_STORE_BYPASS           0
+# define PR_SPEC_INDIRECT_BRANCH        1
 /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
 # define PR_SPEC_NOT_AFFECTED           0
 # define PR_SPEC_PRCTL                  (1UL << 0)
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 51b095898f4b..998983a6e6b7 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -50,6 +50,8 @@
 #ifndef __LINUX_V4L2_CONTROLS_H
 #define __LINUX_V4L2_CONTROLS_H
 
+#include <linux/types.h>
+
 /* Control classes */
 #define V4L2_CTRL_CLASS_USER            0x00980000      /* Old-style 'user' controls */
 #define V4L2_CTRL_CLASS_MPEG            0x00990000      /* MPEG-compression controls */
@@ -1110,6 +1112,7 @@ struct v4l2_mpeg2_sequence {
         __u8    profile_and_level_indication;
         __u8    progressive_sequence;
         __u8    chroma_format;
+        __u8    pad;
 };
 
 struct v4l2_mpeg2_picture {
@@ -1128,6 +1131,7 @@ struct v4l2_mpeg2_picture {
         __u8    alternate_scan;
         __u8    repeat_first_field;
         __u8    progressive_frame;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_slice_params {
@@ -1142,6 +1146,7 @@ struct v4l2_ctrl_mpeg2_slice_params {
 
         __u8    backward_ref_index;
         __u8    forward_ref_index;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_quantization {
diff --git a/include/xen/balloon.h b/include/xen/balloon.h
index 61f410fd74e4..4914b93a23f2 100644
--- a/include/xen/balloon.h
+++ b/include/xen/balloon.h
@@ -44,8 +44,3 @@ static inline void xen_balloon_init(void)
 {
 }
 #endif
-
-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
-struct resource;
-void arch_xen_balloon_init(struct resource *hostmem_resource);
-#endif
diff --git a/init/Kconfig b/init/Kconfig
index a4112e95724a..cf5b5a0dcbc2 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -509,6 +509,15 @@ config PSI
 
           Say N if unsure.
 
+config PSI_DEFAULT_DISABLED
+        bool "Require boot parameter to enable pressure stall information tracking"
+        default n
+        depends on PSI
+        help
+          If set, pressure stall information tracking will be disabled
+          per default but can be enabled through passing psi_enable=1
+          on the kernel commandline during boot.
+
 endmenu # "CPU/Task time and stats accounting"
 
 config CPU_ISOLATION
diff --git a/init/initramfs.c b/init/initramfs.c
index 640557788026..f6f4a1e4cd54 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -291,16 +291,6 @@ static int __init do_reset(void)
         return 1;
 }
 
-static int __init maybe_link(void)
-{
-        if (nlink >= 2) {
-                char *old = find_link(major, minor, ino, mode, collected);
-                if (old)
-                        return (ksys_link(old, collected) < 0) ? -1 : 1;
-        }
-        return 0;
-}
-
 static void __init clean_path(char *path, umode_t fmode)
 {
         struct kstat st;
@@ -313,6 +303,18 @@ static void __init clean_path(char *path, umode_t fmode)
         }
 }
 
+static int __init maybe_link(void)
+{
+        if (nlink >= 2) {
+                char *old = find_link(major, minor, ino, mode, collected);
+                if (old) {
+                        clean_path(collected, 0);
+                        return (ksys_link(old, collected) < 0) ? -1 : 1;
+                }
+        }
+        return 0;
+}
+
 static __initdata int wfd;
 
 static int __init do_name(void)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 1a796e0799ec..b1a3545d0ec8 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -672,6 +672,40 @@ void __weak bpf_jit_free(struct bpf_prog *fp)
         bpf_prog_unlock_free(fp);
 }
 
+int bpf_jit_get_func_addr(const struct bpf_prog *prog,
+                          const struct bpf_insn *insn, bool extra_pass,
+                          u64 *func_addr, bool *func_addr_fixed)
+{
+        s16 off = insn->off;
+        s32 imm = insn->imm;
+        u8 *addr;
+
+        *func_addr_fixed = insn->src_reg != BPF_PSEUDO_CALL;
+        if (!*func_addr_fixed) {
+                /* Place-holder address till the last pass has collected
+                 * all addresses for JITed subprograms in which case we
+                 * can pick them up from prog->aux.
+                 */
+                if (!extra_pass)
+                        addr = NULL;
+                else if (prog->aux->func &&
+                         off >= 0 && off < prog->aux->func_cnt)
+                        addr = (u8 *)prog->aux->func[off]->bpf_func;
+                else
+                        return -EINVAL;
+        } else {
+                /* Address of a BPF helper call. Since part of the core
+                 * kernel, it's always at a fixed location. __bpf_call_base
+                 * and the helper with imm relative to it are both in core
+                 * kernel.
+                 */
+                addr = (u8 *)__bpf_call_base + imm;
+        }
+
+        *func_addr = (unsigned long)addr;
+        return 0;
+}
+
 static int bpf_jit_blind_insn(const struct bpf_insn *from,
                               const struct bpf_insn *aux,
                               struct bpf_insn *to_buff)
diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
index c97a8f968638..bed9d48a7ae9 100644
--- a/kernel/bpf/local_storage.c
+++ b/kernel/bpf/local_storage.c
@@ -139,7 +139,8 @@ static int cgroup_storage_update_elem(struct bpf_map *map, void *_key,
                 return -ENOENT;
 
         new = kmalloc_node(sizeof(struct bpf_storage_buffer) +
-                           map->value_size, __GFP_ZERO | GFP_USER,
+                           map->value_size,
+                           __GFP_ZERO | GFP_ATOMIC | __GFP_NOWARN,
                            map->numa_node);
         if (!new)
                 return -ENOMEM;
diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
index 8bbd72d3a121..b384ea9f3254 100644
--- a/kernel/bpf/queue_stack_maps.c
+++ b/kernel/bpf/queue_stack_maps.c
@@ -7,6 +7,7 @@
 #include <linux/bpf.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/capability.h>
 #include "percpu_freelist.h"
 
 #define QUEUE_STACK_CREATE_FLAG_MASK \
@@ -45,8 +46,12 @@ static bool queue_stack_map_is_full(struct bpf_queue_stack *qs)
 /* Called from syscall */
 static int queue_stack_map_alloc_check(union bpf_attr *attr)
 {
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 0 ||
+            attr->value_size == 0 ||
             attr->map_flags & ~QUEUE_STACK_CREATE_FLAG_MASK)
                 return -EINVAL;
 
@@ -63,15 +68,10 @@ static struct bpf_map *queue_stack_map_alloc(union bpf_attr *attr)
 {
         int ret, numa_node = bpf_map_attr_numa_node(attr);
         struct bpf_queue_stack *qs;
-        u32 size, value_size;
-        u64 queue_size, cost;
-
-        size = attr->max_entries + 1;
-        value_size = attr->value_size;
-
-        queue_size = sizeof(*qs) + (u64) value_size * size;
+        u64 size, queue_size, cost;
 
-        cost = queue_size;
+        size = (u64) attr->max_entries + 1;
+        cost = queue_size = sizeof(*qs) + size * attr->value_size;
         if (cost >= U32_MAX - PAGE_SIZE)
                 return ERR_PTR(-E2BIG);
 
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1971ca325fb4..6dd419550aba 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5650,7 +5650,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len
                 return;
         /* NOTE: fake 'exit' subprog should be updated as well. */
         for (i = 0; i <= env->subprog_cnt; i++) {
-                if (env->subprog_info[i].start < off)
+                if (env->subprog_info[i].start <= off)
                         continue;
                 env->subprog_info[i].start += len - 1;
         }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 3c7f3b4c453c..91d5c38eb7e5 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -10,6 +10,7 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/hotplug.h>
 #include <linux/sched/task.h>
+#include <linux/sched/smt.h>
 #include <linux/unistd.h>
 #include <linux/cpu.h>
 #include <linux/oom.h>
@@ -367,6 +368,12 @@ static void lockdep_release_cpus_lock(void)
 
 #endif  /* CONFIG_HOTPLUG_CPU */
 
+/*
+ * Architectures that need SMT-specific errata handling during SMT hotplug
+ * should override this.
+ */
+void __weak arch_smt_update(void) { }
+
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
 EXPORT_SYMBOL_GPL(cpu_smt_control);
@@ -1011,6 +1018,7 @@ out:
          * concurrent CPU hotplug via cpu_add_remove_lock.
          */
         lockup_detector_cleanup();
+        arch_smt_update();
         return ret;
 }
 
@@ -1139,6 +1147,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target)
         ret = cpuhp_up_callbacks(cpu, st, target);
 out:
         cpus_write_unlock();
+        arch_smt_update();
         return ret;
 }
 
@@ -2055,12 +2064,6 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
         kobject_uevent(&dev->kobj, KOBJ_ONLINE);
 }
 
-/*
- * Architectures that need SMT-specific errata handling during SMT hotplug
- * should override this.
- */
-void __weak arch_smt_update(void) { };
-
 static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
 {
         int cpu, ret = 0;
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index 5731daa09a32..045930e32c0e 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -679,7 +679,8 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
         }
 
         if (!dev_is_dma_coherent(dev) &&
-            (attrs & DMA_ATTR_SKIP_CPU_SYNC) == 0)
+            (attrs & DMA_ATTR_SKIP_CPU_SYNC) == 0 &&
+            dev_addr != DIRECT_MAPPING_ERROR)
                 arch_sync_dma_for_device(dev, phys, size, dir);
 
         return dev_addr;
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 96d4bee83489..322e97bbb437 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -829,7 +829,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
         BUG_ON((uprobe->offset & ~PAGE_MASK) +
                         UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
 
-        smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
+        smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
         set_bit(UPROBE_COPY_INSN, &uprobe->flags);
 
  out:
@@ -2178,10 +2178,18 @@ static void handle_swbp(struct pt_regs *regs)
          * After we hit the bp, _unregister + _register can install the
          * new and not-yet-analyzed uprobe at the same address, restart.
          */
-        smp_rmb(); /* pairs with wmb() in install_breakpoint() */
         if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
                 goto out;
 
+        /*
+         * Pairs with the smp_wmb() in prepare_uprobe().
+         *
+         * Guarantees that if we see the UPROBE_COPY_INSN bit set, then
+         * we must also see the stores to &uprobe->arch performed by the
+         * prepare_uprobe() call.
+         */
+        smp_rmb();
+
         /* Tracing handlers use ->utask to communicate with fetch methods */
         if (!get_utask())
                 goto out;
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 3ebd09efe72a..97959d7b77e2 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -56,7 +56,7 @@ struct kcov {
         struct task_struct      *t;
 };
 
-static bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
+static notrace bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
 {
         unsigned int mode;
 
@@ -78,7 +78,7 @@ static bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
         return mode == needed_mode;
 }
 
-static unsigned long canonicalize_ip(unsigned long ip)
+static notrace unsigned long canonicalize_ip(unsigned long ip)
 {
 #ifdef CONFIG_RANDOMIZE_BASE
         ip -= kaslr_offset();
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 80b34dffdfb9..c2cee9db5204 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -261,9 +261,6 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
 
 static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 {
-        if (mode & PTRACE_MODE_SCHED)
-                return false;
-
         if (mode & PTRACE_MODE_NOAUDIT)
                 return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
         else
@@ -331,16 +328,9 @@ ok:
              !ptrace_has_cap(mm->user_ns, mode)))
             return -EPERM;
 
-        if (mode & PTRACE_MODE_SCHED)
-                return 0;
         return security_ptrace_access_check(task, mode);
 }
 
-bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode)
-{
-        return __ptrace_may_access(task, mode | PTRACE_MODE_SCHED);
-}
-
 bool ptrace_may_access(struct task_struct *task, unsigned int mode)
 {
         int err;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 091e089063be..6fedf3a98581 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5738,15 +5738,10 @@ int sched_cpu_activate(unsigned int cpu)
 
 #ifdef CONFIG_SCHED_SMT
         /*
-         * The sched_smt_present static key needs to be evaluated on every
-         * hotplug event because at boot time SMT might be disabled when
-         * the number of booted CPUs is limited.
-         *
-         * If then later a sibling gets hotplugged, then the key would stay
-         * off and SMT scheduling would never be functional.
+         * When going up, increment the number of cores with SMT present.
          */
-        if (cpumask_weight(cpu_smt_mask(cpu)) > 1)
-                static_branch_enable_cpuslocked(&sched_smt_present);
+        if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
+                static_branch_inc_cpuslocked(&sched_smt_present);
 #endif
         set_cpu_active(cpu, true);
 
@@ -5790,6 +5785,14 @@ int sched_cpu_deactivate(unsigned int cpu)
          */
         synchronize_rcu_mult(call_rcu, call_rcu_sched);
 
+#ifdef CONFIG_SCHED_SMT
+        /*
+         * When going down, decrement the number of cores with SMT present.
+         */
+        if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
+                static_branch_dec_cpuslocked(&sched_smt_present);
+#endif
+
         if (!sched_smp_initialized)
                 return 0;
 
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 3d7355d7c3e3..fe24de3fbc93 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -136,8 +136,18 @@
 
 static int psi_bug __read_mostly;
 
-bool psi_disabled __read_mostly;
-core_param(psi_disabled, psi_disabled, bool, 0644);
+DEFINE_STATIC_KEY_FALSE(psi_disabled);
+
+#ifdef CONFIG_PSI_DEFAULT_DISABLED
+bool psi_enable;
+#else
+bool psi_enable = true;
+#endif
+static int __init setup_psi(char *str)
+{
+        return kstrtobool(str, &psi_enable) == 0;
+}
+__setup("psi=", setup_psi);
 
 /* Running averages - we need to be higher-res than loadavg */
 #define PSI_FREQ        (2*HZ+1)        /* 2 sec intervals */
@@ -169,8 +179,10 @@ static void group_init(struct psi_group *group)
 
 void __init psi_init(void)
 {
-        if (psi_disabled)
+        if (!psi_enable) {
+                static_branch_enable(&psi_disabled);
                 return;
+        }
 
         psi_period = jiffies_to_nsecs(PSI_FREQ);
         group_init(&psi_system);
@@ -549,7 +561,7 @@ void psi_memstall_enter(unsigned long *flags)
         struct rq_flags rf;
         struct rq *rq;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         *flags = current->flags & PF_MEMSTALL;
@@ -579,7 +591,7 @@ void psi_memstall_leave(unsigned long *flags)
         struct rq_flags rf;
         struct rq *rq;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (*flags)
@@ -600,7 +612,7 @@ void psi_memstall_leave(unsigned long *flags)
 #ifdef CONFIG_CGROUPS
 int psi_cgroup_alloc(struct cgroup *cgroup)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return 0;
 
         cgroup->psi.pcpu = alloc_percpu(struct psi_group_cpu);
@@ -612,7 +624,7 @@ int psi_cgroup_alloc(struct cgroup *cgroup)
 
 void psi_cgroup_free(struct cgroup *cgroup)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         cancel_delayed_work_sync(&cgroup->psi.clock_work);
@@ -637,7 +649,7 @@ void cgroup_move_task(struct task_struct *task, struct css_set *to)
         struct rq_flags rf;
         struct rq *rq;
 
-        if (psi_disabled) {
+        if (static_branch_likely(&psi_disabled)) {
                 /*
                  * Lame to do this here, but the scheduler cannot be locked
                  * from the outside, so we move cgroups from inside sched/.
@@ -673,7 +685,7 @@ int psi_show(struct seq_file *m, struct psi_group *group, enum psi_res res)
 {
         int full;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return -EOPNOTSUPP;
 
         update_stats(group);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 618577fc9aa8..4e524ab589c9 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -23,6 +23,7 @@
 #include <linux/sched/prio.h>
 #include <linux/sched/rt.h>
 #include <linux/sched/signal.h>
+#include <linux/sched/smt.h>
 #include <linux/sched/stat.h>
 #include <linux/sched/sysctl.h>
 #include <linux/sched/task.h>
@@ -936,9 +937,6 @@ static inline int cpu_of(struct rq *rq)
 
 
 #ifdef CONFIG_SCHED_SMT
-
-extern struct static_key_false sched_smt_present;
-
 extern void __update_idle_core(struct rq *rq);
 
 static inline void update_idle_core(struct rq *rq)
diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
index 4904c4677000..aa0de240fb41 100644
--- a/kernel/sched/stats.h
+++ b/kernel/sched/stats.h
@@ -66,7 +66,7 @@ static inline void psi_enqueue(struct task_struct *p, bool wakeup)
 {
         int clear = 0, set = TSK_RUNNING;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (!wakeup || p->sched_psi_wake_requeue) {
@@ -86,7 +86,7 @@ static inline void psi_dequeue(struct task_struct *p, bool sleep)
 {
         int clear = TSK_RUNNING, set = 0;
 
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (!sleep) {
@@ -102,7 +102,7 @@ static inline void psi_dequeue(struct task_struct *p, bool sleep)
 
 static inline void psi_ttwu_dequeue(struct task_struct *p)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
         /*
          * Is the task being migrated during a wakeup? Make sure to
@@ -128,7 +128,7 @@ static inline void psi_ttwu_dequeue(struct task_struct *p)
 
 static inline void psi_task_tick(struct rq *rq)
 {
-        if (psi_disabled)
+        if (static_branch_likely(&psi_disabled))
                 return;
 
         if (unlikely(rq->curr->flags & PF_MEMSTALL))
diff --git a/kernel/stackleak.c b/kernel/stackleak.c
index e42892926244..08cb57eed389 100644
--- a/kernel/stackleak.c
+++ b/kernel/stackleak.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/stackleak.h>
+#include <linux/kprobes.h>
 
 #ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
 #include <linux/jump_label.h>
@@ -47,7 +48,7 @@ int stack_erasing_sysctl(struct ctl_table *table, int write,
 #define skip_erasing()  false
 #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
 
-asmlinkage void stackleak_erase(void)
+asmlinkage void notrace stackleak_erase(void)
 {
         /* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
         unsigned long kstack_ptr = current->lowest_stack;
@@ -101,6 +102,7 @@ asmlinkage void stackleak_erase(void)
         /* Reset the 'lowest_stack' value for the next syscall */
         current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64;
 }
+NOKPROBE_SYMBOL(stackleak_erase);
 
 void __used stackleak_track_stack(void)
 {
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 08fcfe440c63..9864a35c8bb5 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -196,11 +196,13 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
                         i++;
                 } else if (fmt[i] == 'p' || fmt[i] == 's') {
                         mod[fmt_cnt]++;
-                        i++;
-                        if (!isspace(fmt[i]) && !ispunct(fmt[i]) && fmt[i] != 0)
+                        /* disallow any further format extensions */
+                        if (fmt[i + 1] != 0 &&
+                            !isspace(fmt[i + 1]) &&
+                            !ispunct(fmt[i + 1]))
                                 return -EINVAL;
                         fmt_cnt++;
-                        if (fmt[i - 1] == 's') {
+                        if (fmt[i] == 's') {
                                 if (str_seen)
                                         /* allow only one '%s' per fmt string */
                                         return -EINVAL;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f536f601bd46..77734451cb05 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -817,7 +817,7 @@ function_profile_call(unsigned long ip, unsigned long parent_ip,
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 static int profile_graph_entry(struct ftrace_graph_ent *trace)
 {
-        int index = trace->depth;
+        int index = current->curr_ret_stack;
 
         function_profile_call(trace->func, 0, NULL, NULL);
 
@@ -852,7 +852,7 @@ static void profile_graph_return(struct ftrace_graph_ret *trace)
         if (!fgraph_graph_time) {
                 int index;
 
-                index = trace->depth;
+                index = current->curr_ret_stack;
 
                 /* Append this call time to the parent time to subtract */
                 if (index)
@@ -6814,6 +6814,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
                         atomic_set(&t->tracing_graph_pause, 0);
                         atomic_set(&t->trace_overrun, 0);
                         t->curr_ret_stack = -1;
+                        t->curr_ret_depth = -1;
                         /* Make sure the tasks see the -1 first: */
                         smp_wmb();
                         t->ret_stack = ret_stack_list[start++];
@@ -7038,6 +7039,7 @@ graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
 void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
 {
         t->curr_ret_stack = -1;
+        t->curr_ret_depth = -1;
         /*
          * The idle task has no parent, it either has its own
          * stack or no stack at all.
@@ -7068,6 +7070,7 @@ void ftrace_graph_init_task(struct task_struct *t)
         /* Make sure we do not use the parent ret_stack */
         t->ret_stack = NULL;
         t->curr_ret_stack = -1;
+        t->curr_ret_depth = -1;
 
         if (ftrace_graph_active) {
                 struct ftrace_ret_stack *ret_stack;
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 3b8c0e24ab30..447bd96ee658 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -512,12 +512,44 @@ enum {
  * can only be modified by current, we can reuse trace_recursion.
  */
         TRACE_IRQ_BIT,
+
+        /* Set if the function is in the set_graph_function file */
+        TRACE_GRAPH_BIT,
+
+        /*
+         * In the very unlikely case that an interrupt came in
+         * at a start of graph tracing, and we want to trace
+         * the function in that interrupt, the depth can be greater
+         * than zero, because of the preempted start of a previous
+         * trace. In an even more unlikely case, depth could be 2
+         * if a softirq interrupted the start of graph tracing,
+         * followed by an interrupt preempting a start of graph
+         * tracing in the softirq, and depth can even be 3
+         * if an NMI came in at the start of an interrupt function
+         * that preempted a softirq start of a function that
+         * preempted normal context!!!! Luckily, it can't be
+         * greater than 3, so the next two bits are a mask
+         * of what the depth is when we set TRACE_GRAPH_BIT
+         */
+
+        TRACE_GRAPH_DEPTH_START_BIT,
+        TRACE_GRAPH_DEPTH_END_BIT,
 };
 
 #define trace_recursion_set(bit)        do { (current)->trace_recursion |= (1<<(bit)); } while (0)
 #define trace_recursion_clear(bit)      do { (current)->trace_recursion &= ~(1<<(bit)); } while (0)
 #define trace_recursion_test(bit)       ((current)->trace_recursion & (1<<(bit)))
 
+#define trace_recursion_depth() \
+        (((current)->trace_recursion >> TRACE_GRAPH_DEPTH_START_BIT) & 3)
+#define trace_recursion_set_depth(depth) \
+        do {                                                            \
+                current->trace_recursion &=                             \
+                        ~(3 << TRACE_GRAPH_DEPTH_START_BIT);            \
+                current->trace_recursion |=                             \
+                        ((depth) & 3) << TRACE_GRAPH_DEPTH_START_BIT;   \
+        } while (0)
+
 #define TRACE_CONTEXT_BITS      4
 
 #define TRACE_FTRACE_START      TRACE_FTRACE_BIT
@@ -843,8 +875,9 @@ extern void __trace_graph_return(struct trace_array *tr,
 extern struct ftrace_hash *ftrace_graph_hash;
 extern struct ftrace_hash *ftrace_graph_notrace_hash;
 
-static inline int ftrace_graph_addr(unsigned long addr)
+static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
 {
+        unsigned long addr = trace->func;
         int ret = 0;
 
         preempt_disable_notrace();
@@ -855,6 +888,14 @@ static inline int ftrace_graph_addr(unsigned long addr)
         }
 
         if (ftrace_lookup_ip(ftrace_graph_hash, addr)) {
+
+                /*
+                 * This needs to be cleared on the return functions
+                 * when the depth is zero.
+                 */
+                trace_recursion_set(TRACE_GRAPH_BIT);
+                trace_recursion_set_depth(trace->depth);
+
                 /*
                  * If no irqs are to be traced, but a set_graph_function
                  * is set, and called by an interrupt handler, we still
@@ -872,6 +913,13 @@ out:
         return ret;
 }
 
+static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
+{
+        if (trace_recursion_test(TRACE_GRAPH_BIT) &&
+            trace->depth == trace_recursion_depth())
+                trace_recursion_clear(TRACE_GRAPH_BIT);
+}
+
 static inline int ftrace_graph_notrace_addr(unsigned long addr)
 {
         int ret = 0;
@@ -885,7 +933,7 @@ static inline int ftrace_graph_notrace_addr(unsigned long addr)
         return ret;
 }
 #else
-static inline int ftrace_graph_addr(unsigned long addr)
+static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
 {
         return 1;
 }
@@ -894,6 +942,8 @@ static inline int ftrace_graph_notrace_addr(unsigned long addr)
 {
         return 0;
 }
+static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
+{ }
 #endif /* CONFIG_DYNAMIC_FTRACE */
 
 extern unsigned int fgraph_max_depth;
@@ -901,7 +951,8 @@ extern unsigned int fgraph_max_depth;
 static inline bool ftrace_graph_ignore_func(struct ftrace_graph_ent *trace)
 {
         /* trace it when it is-nested-in or is a function enabled. */
-        return !(trace->depth || ftrace_graph_addr(trace->func)) ||
+        return !(trace_recursion_test(TRACE_GRAPH_BIT) ||
+                 ftrace_graph_addr(trace)) ||
                 (trace->depth < 0) ||
                 (fgraph_max_depth && trace->depth >= fgraph_max_depth);
 }
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 169b3c44ee97..086af4f5c3e8 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -118,8 +118,8 @@ print_graph_duration(struct trace_array *tr, unsigned long long duration,
                      struct trace_seq *s, u32 flags);
 
 /* Add a function return address to the trace stack on thread info.*/
-int
-ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
+static int
+ftrace_push_return_trace(unsigned long ret, unsigned long func,
                          unsigned long frame_pointer, unsigned long *retp)
 {
         unsigned long long calltime;
@@ -177,9 +177,31 @@ ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
 #ifdef HAVE_FUNCTION_GRAPH_RET_ADDR_PTR
         current->ret_stack[index].retp = retp;
 #endif
-        *depth = current->curr_ret_stack;
+        return 0;
+}
+
+int function_graph_enter(unsigned long ret, unsigned long func,
+                         unsigned long frame_pointer, unsigned long *retp)
+{
+        struct ftrace_graph_ent trace;
+
+        trace.func = func;
+        trace.depth = ++current->curr_ret_depth;
+
+        if (ftrace_push_return_trace(ret, func,
+                                     frame_pointer, retp))
+                goto out;
+
+        /* Only trace if the calling function expects to */
+        if (!ftrace_graph_entry(&trace))
+                goto out_ret;
 
         return 0;
+ out_ret:
+        current->curr_ret_stack--;
+ out:
+        current->curr_ret_depth--;
+        return -EBUSY;
 }
 
 /* Retrieve a function return address to the trace stack on thread info.*/
@@ -241,7 +263,13 @@ ftrace_pop_return_trace(struct ftrace_graph_ret *trace, unsigned long *ret,
         trace->func = current->ret_stack[index].func;
         trace->calltime = current->ret_stack[index].calltime;
         trace->overrun = atomic_read(&current->trace_overrun);
-        trace->depth = index;
+        trace->depth = current->curr_ret_depth--;
+        /*
+         * We still want to trace interrupts coming in if
+         * max_depth is set to 1. Make sure the decrement is
+         * seen before ftrace_graph_return.
+         */
+        barrier();
 }
 
 /*
@@ -255,6 +283,12 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
 
         ftrace_pop_return_trace(&trace, &ret, frame_pointer);
         trace.rettime = trace_clock_local();
+        ftrace_graph_return(&trace);
+        /*
+         * The ftrace_graph_return() may still access the current
+         * ret_stack structure, we need to make sure the update of
+         * curr_ret_stack is after that.
+         */
         barrier();
         current->curr_ret_stack--;
         /*
@@ -267,13 +301,6 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
                 return ret;
         }
 
-        /*
-         * The trace should run after decrementing the ret counter
-         * in case an interrupt were to come in. We don't want to
-         * lose the interrupt if max_depth is set.
-         */
-        ftrace_graph_return(&trace);
-
         if (unlikely(!ret)) {
                 ftrace_graph_stop();
                 WARN_ON(1);
@@ -482,6 +509,8 @@ void trace_graph_return(struct ftrace_graph_ret *trace)
         int cpu;
         int pc;
 
+        ftrace_graph_addr_finish(trace);
+
         local_irq_save(flags);
         cpu = raw_smp_processor_id();
         data = per_cpu_ptr(tr->trace_buffer.data, cpu);
@@ -505,6 +534,8 @@ void set_graph_array(struct trace_array *tr)
 
 static void trace_graph_thresh_return(struct ftrace_graph_ret *trace)
 {
+        ftrace_graph_addr_finish(trace);
+
         if (tracing_thresh &&
             (trace->rettime - trace->calltime < tracing_thresh))
                 return;
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index b7357f9f82a3..98ea6d28df15 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -208,6 +208,8 @@ static void irqsoff_graph_return(struct ftrace_graph_ret *trace)
         unsigned long flags;
         int pc;
 
+        ftrace_graph_addr_finish(trace);
+
         if (!func_prolog_dec(tr, &data, &flags))
                 return;
 
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index a86b303e6c67..7d04b9890755 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -270,6 +270,8 @@ static void wakeup_graph_return(struct ftrace_graph_ret *trace)
         unsigned long flags;
         int pc;
 
+        ftrace_graph_addr_finish(trace);
+
         if (!func_prolog_preempt_disable(tr, &data, &pc))
                 return;
 
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 70935ed91125..14afeeb7d6ef 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -135,7 +135,6 @@ static void fill_pool(void)
                 if (!new)
                         return;
 
-                kmemleak_ignore(new);
                 raw_spin_lock_irqsave(&pool_lock, flags);
                 hlist_add_head(&new->node, &obj_pool);
                 debug_objects_allocated++;
@@ -1128,7 +1127,6 @@ static int __init debug_objects_replace_static_objects(void)
                 obj = kmem_cache_zalloc(obj_cache, GFP_KERNEL);
                 if (!obj)
                         goto free;
-                kmemleak_ignore(obj);
                 hlist_add_head(&obj->node, &objects);
         }
 
@@ -1184,7 +1182,8 @@ void __init debug_objects_mem_init(void)
 
         obj_cache = kmem_cache_create("debug_objects_cache",
                                       sizeof (struct debug_obj), 0,
-                                      SLAB_DEBUG_OBJECTS, NULL);
+                                      SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE,
+                                      NULL);
 
         if (!obj_cache || debug_objects_replace_static_objects()) {
                 debug_objects_enabled = 0;
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 7ebccb5c1637..54c248526b55 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -560,6 +560,38 @@ static size_t copy_pipe_to_iter(const void *addr, size_t bytes,
         return bytes;
 }
 
+static size_t csum_and_copy_to_pipe_iter(const void *addr, size_t bytes,
+                                __wsum *csum, struct iov_iter *i)
+{
+        struct pipe_inode_info *pipe = i->pipe;
+        size_t n, r;
+        size_t off = 0;
+        __wsum sum = *csum, next;
+        int idx;
+
+        if (!sanity(i))
+                return 0;
+
+        bytes = n = push_pipe(i, bytes, &idx, &r);
+        if (unlikely(!n))
+                return 0;
+        for ( ; n; idx = next_idx(idx, pipe), r = 0) {
+                size_t chunk = min_t(size_t, n, PAGE_SIZE - r);
+                char *p = kmap_atomic(pipe->bufs[idx].page);
+                next = csum_partial_copy_nocheck(addr, p + r, chunk, 0);
+                sum = csum_block_add(sum, next, off);
+                kunmap_atomic(p);
+                i->idx = idx;
+                i->iov_offset = r + chunk;
+                n -= chunk;
+                off += chunk;
+                addr += chunk;
+        }
+        i->count -= bytes;
+        *csum = sum;
+        return bytes;
+}
+
 size_t _copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
 {
         const char *from = addr;
@@ -1438,8 +1470,12 @@ size_t csum_and_copy_to_iter(const void *addr, size_t bytes, __wsum *csum,
         const char *from = addr;
         __wsum sum, next;
         size_t off = 0;
+
+        if (unlikely(iov_iter_is_pipe(i)))
+                return csum_and_copy_to_pipe_iter(addr, bytes, csum, i);
+
         sum = *csum;
-        if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
+        if (unlikely(iov_iter_is_discard(i))) {
                 WARN_ON(1);     /* for now */
                 return 0;
         }
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index b984806d7d7b..7cab9a9869ac 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -837,6 +837,7 @@ static ssize_t read_firmware_show(struct device *dev,
         if (req->fw->size > PAGE_SIZE) {
                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
                 rc = -EINVAL;
+                goto out;
         }
         memcpy(buf, req->fw->data, req->fw->size);
 
diff --git a/lib/test_hexdump.c b/lib/test_hexdump.c
index 626f580b4ff7..5144899d3c6b 100644
--- a/lib/test_hexdump.c
+++ b/lib/test_hexdump.c
@@ -99,7 +99,7 @@ static void __init test_hexdump_prepare_test(size_t len, int rowsize,
                 const char *q = *result++;
                 size_t amount = strlen(q);
 
-                strncpy(p, q, amount);
+                memcpy(p, q, amount);
                 p += amount;
 
                 *p++ = ' ';
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index e3ddd836491f..d82d022111e0 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -1214,7 +1214,6 @@ void unregister_test_dev_kmod(struct kmod_test_device *test_dev)
 
         dev_info(test_dev->dev, "removing interface\n");
         misc_deregister(&test_dev->misc_dev);
-        kfree(&test_dev->misc_dev.name);
 
         mutex_unlock(&test_dev->config_mutex);
         mutex_unlock(&test_dev->trigger_mutex);
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index aa47754150ce..0598e86af8fc 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -208,15 +208,19 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                         XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_2));
 
                         /* We should see two elements in the array */
+                        rcu_read_lock();
                         xas_for_each(&xas, entry, ULONG_MAX)
                                 seen++;
+                        rcu_read_unlock();
                         XA_BUG_ON(xa, seen != 2);
 
                         /* One of which is marked */
                         xas_set(&xas, 0);
                         seen = 0;
+                        rcu_read_lock();
                         xas_for_each_marked(&xas, entry, ULONG_MAX, XA_MARK_0)
                                 seen++;
+                        rcu_read_unlock();
                         XA_BUG_ON(xa, seen != 1);
                 }
                 XA_BUG_ON(xa, xa_get_mark(xa, next, XA_MARK_0));
@@ -373,6 +377,12 @@ static noinline void check_reserve(struct xarray *xa)
         xa_erase_index(xa, 12345678);
         XA_BUG_ON(xa, !xa_empty(xa));
 
+        /* And so does xa_insert */
+        xa_reserve(xa, 12345678, GFP_KERNEL);
+        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) != 0);
+        xa_erase_index(xa, 12345678);
+        XA_BUG_ON(xa, !xa_empty(xa));
+
         /* Can iterate through a reserved entry */
         xa_store_index(xa, 5, GFP_KERNEL);
         xa_reserve(xa, 6, GFP_KERNEL);
@@ -436,7 +446,9 @@ static noinline void check_multi_store_1(struct xarray *xa, unsigned long index,
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
         XA_BUG_ON(xa, xa_load(xa, min - 1) != NULL);
 
+        xas_lock(&xas);
         XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(min)) != xa_mk_value(index));
+        xas_unlock(&xas);
         XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_value(min));
         XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_value(min));
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
@@ -452,9 +464,11 @@ static noinline void check_multi_store_2(struct xarray *xa, unsigned long index,
         XA_STATE(xas, xa, index);
         xa_store_order(xa, index, order, xa_mk_value(0), GFP_KERNEL);
 
+        xas_lock(&xas);
         XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(1)) != xa_mk_value(0));
         XA_BUG_ON(xa, xas.xa_index != index);
         XA_BUG_ON(xa, xas_store(&xas, NULL) != xa_mk_value(1));
+        xas_unlock(&xas);
         XA_BUG_ON(xa, !xa_empty(xa));
 }
 #endif
@@ -498,7 +512,7 @@ static noinline void check_multi_store(struct xarray *xa)
         rcu_read_unlock();
 
         /* We can erase multiple values with a single store */
-        xa_store_order(xa, 0, 63, NULL, GFP_KERNEL);
+        xa_store_order(xa, 0, BITS_PER_LONG - 1, NULL, GFP_KERNEL);
         XA_BUG_ON(xa, !xa_empty(xa));
 
         /* Even when the first slot is empty but the others aren't */
@@ -702,7 +716,7 @@ static noinline void check_multi_find_2(struct xarray *xa)
         }
 }
 
-static noinline void check_find(struct xarray *xa)
+static noinline void check_find_1(struct xarray *xa)
 {
         unsigned long i, j, k;
 
@@ -748,6 +762,34 @@ static noinline void check_find(struct xarray *xa)
                 XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_0));
         }
         XA_BUG_ON(xa, !xa_empty(xa));
+}
+
+static noinline void check_find_2(struct xarray *xa)
+{
+        void *entry;
+        unsigned long i, j, index = 0;
+
+        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                XA_BUG_ON(xa, true);
+        }
+
+        for (i = 0; i < 1024; i++) {
+                xa_store_index(xa, index, GFP_KERNEL);
+                j = 0;
+                index = 0;
+                xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                        XA_BUG_ON(xa, xa_mk_value(index) != entry);
+                        XA_BUG_ON(xa, index != j++);
+                }
+        }
+
+        xa_destroy(xa);
+}
+
+static noinline void check_find(struct xarray *xa)
+{
+        check_find_1(xa);
+        check_find_2(xa);
         check_multi_find(xa);
         check_multi_find_2(xa);
 }
@@ -1067,7 +1109,7 @@ static noinline void check_store_range(struct xarray *xa)
                         __check_store_range(xa, 4095 + i, 4095 + j);
                         __check_store_range(xa, 4096 + i, 4096 + j);
                         __check_store_range(xa, 123456 + i, 123456 + j);
-                        __check_store_range(xa, UINT_MAX + i, UINT_MAX + j);
+                        __check_store_range(xa, (1 << 24) + i, (1 << 24) + j);
                 }
         }
 }
@@ -1146,10 +1188,12 @@ static noinline void check_account(struct xarray *xa)
                 XA_STATE(xas, xa, 1 << order);
 
                 xa_store_order(xa, 0, order, xa, GFP_KERNEL);
+                rcu_read_lock();
                 xas_load(&xas);
                 XA_BUG_ON(xa, xas.xa_node->count == 0);
                 XA_BUG_ON(xa, xas.xa_node->count > (1 << order));
                 XA_BUG_ON(xa, xas.xa_node->nr_values != 0);
+                rcu_read_unlock();
 
                 xa_store_order(xa, 1 << order, order, xa_mk_value(1 << order),
                                 GFP_KERNEL);
diff --git a/lib/xarray.c b/lib/xarray.c
index 8b176f009c08..bbacca576593 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -610,8 +610,8 @@ static int xas_expand(struct xa_state *xas, void *head)
  * (see the xa_cmpxchg() implementation for an example).
  *
  * Return: If the slot already existed, returns the contents of this slot.
- * If the slot was newly created, returns NULL.  If it failed to create the
- * slot, returns NULL and indicates the error in @xas.
+ * If the slot was newly created, returns %NULL.  If it failed to create the
+ * slot, returns %NULL and indicates the error in @xas.
  */
 static void *xas_create(struct xa_state *xas)
 {
@@ -1334,44 +1334,31 @@ void *__xa_erase(struct xarray *xa, unsigned long index)
         XA_STATE(xas, xa, index);
         return xas_result(&xas, xas_store(&xas, NULL));
 }
-EXPORT_SYMBOL_GPL(__xa_erase);
+EXPORT_SYMBOL(__xa_erase);
 
 /**
- * xa_store() - Store this entry in the XArray.
+ * xa_erase() - Erase this entry from the XArray.
  * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
+ * @index: Index of entry.
  *
- * After this function returns, loads from this index will return @entry.
- * Storing into an existing multislot entry updates the entry of every index.
- * The marks associated with @index are unaffected unless @entry is %NULL.
+ * This function is the equivalent of calling xa_store() with %NULL as
+ * the third argument.  The XArray does not need to allocate memory, so
+ * the user does not need to provide GFP flags.
  *
- * Context: Process context.  Takes and releases the xa_lock.  May sleep
- * if the @gfp flags permit.
- * Return: The old entry at this index on success, xa_err(-EINVAL) if @entry
- * cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation
- * failed.
+ * Context: Any context.  Takes and releases the xa_lock.
+ * Return: The entry which used to be at this index.
  */
-void *xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
+void *xa_erase(struct xarray *xa, unsigned long index)
 {
-        XA_STATE(xas, xa, index);
-        void *curr;
-
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
-                return XA_ERROR(-EINVAL);
+        void *entry;
 
-        do {
-                xas_lock(&xas);
-                curr = xas_store(&xas, entry);
-                if (xa_track_free(xa) && entry)
-                        xas_clear_mark(&xas, XA_FREE_MARK);
-                xas_unlock(&xas);
-        } while (xas_nomem(&xas, gfp));
+        xa_lock(xa);
+        entry = __xa_erase(xa, index);
+        xa_unlock(xa);
 
-        return xas_result(&xas, curr);
+        return entry;
 }
-EXPORT_SYMBOL(xa_store);
+EXPORT_SYMBOL(xa_erase);
 
 /**
  * __xa_store() - Store this entry in the XArray.
@@ -1395,10 +1382,12 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 
         if (WARN_ON_ONCE(xa_is_internal(entry)))
                 return XA_ERROR(-EINVAL);
+        if (xa_track_free(xa) && !entry)
+                entry = XA_ZERO_ENTRY;
 
         do {
                 curr = xas_store(&xas, entry);
-                if (xa_track_free(xa) && entry)
+                if (xa_track_free(xa))
                         xas_clear_mark(&xas, XA_FREE_MARK);
         } while (__xas_nomem(&xas, gfp));
 
@@ -1407,45 +1396,33 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 EXPORT_SYMBOL(__xa_store);
 
 /**
- * xa_cmpxchg() - Conditionally replace an entry in the XArray.
+ * xa_store() - Store this entry in the XArray.
  * @xa: XArray.
  * @index: Index into array.
- * @old: Old value to test against.
- * @entry: New value to place in array.
+ * @entry: New entry.
  * @gfp: Memory allocation flags.
  *
- * If the entry at @index is the same as @old, replace it with @entry.
- * If the return value is equal to @old, then the exchange was successful.
+ * After this function returns, loads from this index will return @entry.
+ * Storing into an existing multislot entry updates the entry of every index.
+ * The marks associated with @index are unaffected unless @entry is %NULL.
  *
- * Context: Process context.  Takes and releases the xa_lock.  May sleep
- * if the @gfp flags permit.
- * Return: The old value at this index or xa_err() if an error happened.
+ * Context: Any context.  Takes and releases the xa_lock.
+ * May sleep if the @gfp flags permit.
+ * Return: The old entry at this index on success, xa_err(-EINVAL) if @entry
+ * cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation
+ * failed.
  */
-void *xa_cmpxchg(struct xarray *xa, unsigned long index,
-                        void *old, void *entry, gfp_t gfp)
+void *xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 {
-        XA_STATE(xas, xa, index);
         void *curr;
 
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
-                return XA_ERROR(-EINVAL);
-
-        do {
-                xas_lock(&xas);
-                curr = xas_load(&xas);
-                if (curr == XA_ZERO_ENTRY)
-                        curr = NULL;
-                if (curr == old) {
-                        xas_store(&xas, entry);
-                        if (xa_track_free(xa) && entry)
-                                xas_clear_mark(&xas, XA_FREE_MARK);
-                }
-                xas_unlock(&xas);
-        } while (xas_nomem(&xas, gfp));
+        xa_lock(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock(xa);
 
-        return xas_result(&xas, curr);
+        return curr;
 }
-EXPORT_SYMBOL(xa_cmpxchg);
+EXPORT_SYMBOL(xa_store);
 
 /**
  * __xa_cmpxchg() - Store this entry in the XArray.
@@ -1471,6 +1448,8 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 
         if (WARN_ON_ONCE(xa_is_internal(entry)))
                 return XA_ERROR(-EINVAL);
+        if (xa_track_free(xa) && !entry)
+                entry = XA_ZERO_ENTRY;
 
         do {
                 curr = xas_load(&xas);
@@ -1478,7 +1457,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
                         curr = NULL;
                 if (curr == old) {
                         xas_store(&xas, entry);
-                        if (xa_track_free(xa) && entry)
+                        if (xa_track_free(xa))
                                 xas_clear_mark(&xas, XA_FREE_MARK);
                 }
         } while (__xas_nomem(&xas, gfp));
@@ -1488,7 +1467,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 EXPORT_SYMBOL(__xa_cmpxchg);
 
 /**
- * xa_reserve() - Reserve this index in the XArray.
+ * __xa_reserve() - Reserve this index in the XArray.
  * @xa: XArray.
  * @index: Index into array.
  * @gfp: Memory allocation flags.
@@ -1496,33 +1475,32 @@ EXPORT_SYMBOL(__xa_cmpxchg);
  * Ensures there is somewhere to store an entry at @index in the array.
  * If there is already something stored at @index, this function does
  * nothing.  If there was nothing there, the entry is marked as reserved.
- * Loads from @index will continue to see a %NULL pointer until a
- * subsequent store to @index.
+ * Loading from a reserved entry returns a %NULL pointer.
  *
  * If you do not use the entry that you have reserved, call xa_release()
  * or xa_erase() to free any unnecessary memory.
  *
- * Context: Process context.  Takes and releases the xa_lock, IRQ or BH safe
- * if specified in XArray flags.  May sleep if the @gfp flags permit.
+ * Context: Any context.  Expects the xa_lock to be held on entry.  May
+ * release the lock, sleep and reacquire the lock if the @gfp flags permit.
  * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
  */
-int xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
+int __xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
 {
         XA_STATE(xas, xa, index);
-        unsigned int lock_type = xa_lock_type(xa);
         void *curr;
 
         do {
-                xas_lock_type(&xas, lock_type);
                 curr = xas_load(&xas);
-                if (!curr)
+                if (!curr) {
                         xas_store(&xas, XA_ZERO_ENTRY);
-                xas_unlock_type(&xas, lock_type);
-        } while (xas_nomem(&xas, gfp));
+                        if (xa_track_free(xa))
+                                xas_clear_mark(&xas, XA_FREE_MARK);
+                }
+        } while (__xas_nomem(&xas, gfp));
 
         return xas_error(&xas);
 }
-EXPORT_SYMBOL(xa_reserve);
+EXPORT_SYMBOL(__xa_reserve);
 
 #ifdef CONFIG_XARRAY_MULTI
 static void xas_set_range(struct xa_state *xas, unsigned long first,
@@ -1587,8 +1565,9 @@ void *xa_store_range(struct xarray *xa, unsigned long first,
         do {
                 xas_lock(&xas);
                 if (entry) {
-                        unsigned int order = (last == ~0UL) ? 64 :
-                                                ilog2(last + 1);
+                        unsigned int order = BITS_PER_LONG;
+                        if (last + 1)
+                                order = __ffs(last + 1);
                         xas_set_order(&xas, last, order);
                         xas_create(&xas);
                         if (xas_error(&xas))
@@ -1662,7 +1641,7 @@ EXPORT_SYMBOL(__xa_alloc);
  * @index: Index of entry.
  * @mark: Mark number.
  *
- * Attempting to set a mark on a NULL entry does not succeed.
+ * Attempting to set a mark on a %NULL entry does not succeed.
  *
  * Context: Any context.  Expects xa_lock to be held on entry.
  */
@@ -1674,7 +1653,7 @@ void __xa_set_mark(struct xarray *xa, unsigned long index, xa_mark_t mark)
         if (entry)
                 xas_set_mark(&xas, mark);
 }
-EXPORT_SYMBOL_GPL(__xa_set_mark);
+EXPORT_SYMBOL(__xa_set_mark);
 
 /**
  * __xa_clear_mark() - Clear this mark on this entry while locked.
@@ -1692,7 +1671,7 @@ void __xa_clear_mark(struct xarray *xa, unsigned long index, xa_mark_t mark)
         if (entry)
                 xas_clear_mark(&xas, mark);
 }
-EXPORT_SYMBOL_GPL(__xa_clear_mark);
+EXPORT_SYMBOL(__xa_clear_mark);
 
 /**
  * xa_get_mark() - Inquire whether this mark is set on this entry.
@@ -1732,7 +1711,7 @@ EXPORT_SYMBOL(xa_get_mark);
  * @index: Index of entry.
  * @mark: Mark number.
  *
- * Attempting to set a mark on a NULL entry does not succeed.
+ * Attempting to set a mark on a %NULL entry does not succeed.
  *
  * Context: Process context.  Takes and releases the xa_lock.
  */
@@ -1829,6 +1808,8 @@ void *xa_find_after(struct xarray *xa, unsigned long *indexp,
                         entry = xas_find_marked(&xas, max, filter);
                 else
                         entry = xas_find(&xas, max);
+                if (xas.xa_node == XAS_BOUNDS)
+                        break;
                 if (xas.xa_shift) {
                         if (xas.xa_index & ((1UL << xas.xa_shift) - 1))
                                 continue;
@@ -1899,7 +1880,7 @@ static unsigned int xas_extract_marked(struct xa_state *xas, void **dst,
  *
  * The @filter may be an XArray mark value, in which case entries which are
  * marked with that mark will be copied.  It may also be %XA_PRESENT, in
- * which case all entries which are not NULL will be copied.
+ * which case all entries which are not %NULL will be copied.
  *
  * The entries returned may not represent a snapshot of the XArray at a
  * moment in time.  For example, if another thread stores to index 5, then
diff --git a/mm/gup.c b/mm/gup.c
index aa43620a3270..8cb68a50dbdf 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -702,12 +702,11 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 if (!vma || start >= vma->vm_end) {
                         vma = find_extend_vma(mm, start);
                         if (!vma && in_gate_area(mm, start)) {
-                                int ret;
                                 ret = get_gate_page(mm, start & PAGE_MASK,
                                                 gup_flags, &vma,
                                                 pages ? &pages[i] : NULL);
                                 if (ret)
-                                        return i ? : ret;
+                                        goto out;
                                 ctx.page_mask = 0;
                                 goto next_page;
                         }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 55478ab3c83b..622cced74fd9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2350,7 +2350,7 @@ void vma_adjust_trans_huge(struct vm_area_struct *vma,
         }
 }
 
-static void freeze_page(struct page *page)
+static void unmap_page(struct page *page)
 {
         enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
                 TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
@@ -2365,7 +2365,7 @@ static void freeze_page(struct page *page)
         VM_BUG_ON_PAGE(!unmap_success, page);
 }
 
-static void unfreeze_page(struct page *page)
+static void remap_page(struct page *page)
 {
         int i;
         if (PageTransHuge(page)) {
@@ -2402,6 +2402,12 @@ static void __split_huge_page_tail(struct page *head, int tail,
                          (1L << PG_unevictable) |
                          (1L << PG_dirty)));
 
+        /* ->mapping in first tail page is compound_mapcount */
+        VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
+                        page_tail);
+        page_tail->mapping = head->mapping;
+        page_tail->index = head->index + tail;
+
         /* Page flags must be visible before we make the page non-compound. */
         smp_wmb();
 
@@ -2422,12 +2428,6 @@ static void __split_huge_page_tail(struct page *head, int tail,
         if (page_is_idle(head))
                 set_page_idle(page_tail);
 
-        /* ->mapping in first tail page is compound_mapcount */
-        VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
-                        page_tail);
-        page_tail->mapping = head->mapping;
-
-        page_tail->index = head->index + tail;
         page_cpupid_xchg_last(page_tail, page_cpupid_last(head));
 
         /*
@@ -2439,12 +2439,11 @@ static void __split_huge_page_tail(struct page *head, int tail,
 }
 
 static void __split_huge_page(struct page *page, struct list_head *list,
-                unsigned long flags)
+                pgoff_t end, unsigned long flags)
 {
         struct page *head = compound_head(page);
         struct zone *zone = page_zone(head);
         struct lruvec *lruvec;
-        pgoff_t end = -1;
         int i;
 
         lruvec = mem_cgroup_page_lruvec(head, zone->zone_pgdat);
@@ -2452,9 +2451,6 @@ static void __split_huge_page(struct page *page, struct list_head *list,
         /* complete memcg works before add pages to LRU */
         mem_cgroup_split_huge_fixup(head);
 
-        if (!PageAnon(page))
-                end = DIV_ROUND_UP(i_size_read(head->mapping->host), PAGE_SIZE);
-
         for (i = HPAGE_PMD_NR - 1; i >= 1; i--) {
                 __split_huge_page_tail(head, i, lruvec, list);
                 /* Some pages can be beyond i_size: drop them from page cache */
@@ -2483,7 +2479,7 @@ static void __split_huge_page(struct page *page, struct list_head *list,
 
         spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
 
-        unfreeze_page(head);
+        remap_page(head);
 
         for (i = 0; i < HPAGE_PMD_NR; i++) {
                 struct page *subpage = head + i;
@@ -2626,6 +2622,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
         int count, mapcount, extra_pins, ret;
         bool mlocked;
         unsigned long flags;
+        pgoff_t end;
 
         VM_BUG_ON_PAGE(is_huge_zero_page(page), page);
         VM_BUG_ON_PAGE(!PageLocked(page), page);
@@ -2648,6 +2645,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
                         ret = -EBUSY;
                         goto out;
                 }
+                end = -1;
                 mapping = NULL;
                 anon_vma_lock_write(anon_vma);
         } else {
@@ -2661,10 +2659,19 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
 
                 anon_vma = NULL;
                 i_mmap_lock_read(mapping);
+
+                /*
+                 *__split_huge_page() may need to trim off pages beyond EOF:
+                 * but on 32-bit, i_size_read() takes an irq-unsafe seqlock,
+                 * which cannot be nested inside the page tree lock. So note
+                 * end now: i_size itself may be changed at any moment, but
+                 * head page lock is good enough to serialize the trimming.
+                 */
+                end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE);
         }
 
         /*
-         * Racy check if we can split the page, before freeze_page() will
+         * Racy check if we can split the page, before unmap_page() will
          * split PMDs
          */
         if (!can_split_huge_page(head, &extra_pins)) {
@@ -2673,7 +2680,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
         }
 
         mlocked = PageMlocked(page);
-        freeze_page(head);
+        unmap_page(head);
         VM_BUG_ON_PAGE(compound_mapcount(head), head);
 
         /* Make sure the page is not on per-CPU pagevec as it takes pin */
@@ -2707,7 +2714,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
                 if (mapping)
                         __dec_node_page_state(page, NR_SHMEM_THPS);
                 spin_unlock(&pgdata->split_queue_lock);
-                __split_huge_page(page, list, flags);
+                __split_huge_page(page, list, end, flags);
                 if (PageSwapCache(head)) {
                         swp_entry_t entry = { .val = page_private(head) };
 
@@ -2727,7 +2734,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
 fail:           if (mapping)
                         xa_unlock(&mapping->i_pages);
                 spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
-                unfreeze_page(head);
+                remap_page(head);
                 ret = -EBUSY;
         }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7f2a28ab46d5..705a3e9cc910 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4080,7 +4080,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
 
                 /* fallback to copy_from_user outside mmap_sem */
                 if (unlikely(ret)) {
-                        ret = -EFAULT;
+                        ret = -ENOENT;
                         *pagep = page;
                         /* don't free the page */
                         goto out;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index c13625c1ad5e..8e2ff195ecb3 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1287,7 +1287,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
  * collapse_shmem - collapse small tmpfs/shmem pages into huge one.
  *
  * Basic scheme is simple, details are more complex:
- *  - allocate and freeze a new huge page;
+ *  - allocate and lock a new huge page;
  *  - scan page cache replacing old pages with the new one
  *    + swap in pages if necessary;
  *    + fill in gaps;
@@ -1295,11 +1295,11 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
  *  - if replacing succeeds:
  *    + copy data over;
  *    + free old pages;
- *    + unfreeze huge page;
+ *    + unlock huge page;
  *  - if replacing failed;
  *    + put all pages back and unfreeze them;
  *    + restore gaps in the page cache;
- *    + free huge page;
+ *    + unlock and free huge page;
  */
 static void collapse_shmem(struct mm_struct *mm,
                 struct address_space *mapping, pgoff_t start,
@@ -1329,19 +1329,6 @@ static void collapse_shmem(struct mm_struct *mm,
                 goto out;
         }
 
-        new_page->index = start;
-        new_page->mapping = mapping;
-        __SetPageSwapBacked(new_page);
-        __SetPageLocked(new_page);
-        BUG_ON(!page_ref_freeze(new_page, 1));
-
-        /*
-         * At this point the new_page is 'frozen' (page_count() is zero),
-         * locked and not up-to-date. It's safe to insert it into the page
-         * cache, because nobody would be able to map it or use it in other
-         * way until we unfreeze it.
-         */
-
         /* This will be less messy when we use multi-index entries */
         do {
                 xas_lock_irq(&xas);
@@ -1349,19 +1336,44 @@ static void collapse_shmem(struct mm_struct *mm,
                 if (!xas_error(&xas))
                         break;
                 xas_unlock_irq(&xas);
-                if (!xas_nomem(&xas, GFP_KERNEL))
+                if (!xas_nomem(&xas, GFP_KERNEL)) {
+                        mem_cgroup_cancel_charge(new_page, memcg, true);
+                        result = SCAN_FAIL;
                         goto out;
+                }
         } while (1);
 
+        __SetPageLocked(new_page);
+        __SetPageSwapBacked(new_page);
+        new_page->index = start;
+        new_page->mapping = mapping;
+
+        /*
+         * At this point the new_page is locked and not up-to-date.
+         * It's safe to insert it into the page cache, because nobody would
+         * be able to map it or use it in another way until we unlock it.
+         */
+
         xas_set(&xas, start);
         for (index = start; index < end; index++) {
                 struct page *page = xas_next(&xas);
 
                 VM_BUG_ON(index != xas.xa_index);
                 if (!page) {
+                        /*
+                         * Stop if extent has been truncated or hole-punched,
+                         * and is now completely empty.
+                         */
+                        if (index == start) {
+                                if (!xas_next_entry(&xas, end - 1)) {
+                                        result = SCAN_TRUNCATED;
+                                        goto xa_locked;
+                                }
+                                xas_set(&xas, index);
+                        }
                         if (!shmem_charge(mapping->host, 1)) {
                                 result = SCAN_FAIL;
-                                break;
+                                goto xa_locked;
                         }
                         xas_store(&xas, new_page + (index % HPAGE_PMD_NR));
                         nr_none++;
@@ -1376,13 +1388,12 @@ static void collapse_shmem(struct mm_struct *mm,
                                 result = SCAN_FAIL;
                                 goto xa_unlocked;
                         }
-                        xas_lock_irq(&xas);
-                        xas_set(&xas, index);
                 } else if (trylock_page(page)) {
                         get_page(page);
+                        xas_unlock_irq(&xas);
                 } else {
                         result = SCAN_PAGE_LOCK;
-                        break;
+                        goto xa_locked;
                 }
 
                 /*
@@ -1391,17 +1402,24 @@ static void collapse_shmem(struct mm_struct *mm,
                  */
                 VM_BUG_ON_PAGE(!PageLocked(page), page);
                 VM_BUG_ON_PAGE(!PageUptodate(page), page);
-                VM_BUG_ON_PAGE(PageTransCompound(page), page);
+
+                /*
+                 * If file was truncated then extended, or hole-punched, before
+                 * we locked the first page, then a THP might be there already.
+                 */
+                if (PageTransCompound(page)) {
+                        result = SCAN_PAGE_COMPOUND;
+                        goto out_unlock;
+                }
 
                 if (page_mapping(page) != mapping) {
                         result = SCAN_TRUNCATED;
                         goto out_unlock;
                 }
-                xas_unlock_irq(&xas);
 
                 if (isolate_lru_page(page)) {
                         result = SCAN_DEL_PAGE_LRU;
-                        goto out_isolate_failed;
+                        goto out_unlock;
                 }
 
                 if (page_mapped(page))
@@ -1421,7 +1439,9 @@ static void collapse_shmem(struct mm_struct *mm,
                  */
                 if (!page_ref_freeze(page, 3)) {
                         result = SCAN_PAGE_COUNT;
-                        goto out_lru;
+                        xas_unlock_irq(&xas);
+                        putback_lru_page(page);
+                        goto out_unlock;
                 }
 
                 /*
@@ -1433,71 +1453,74 @@ static void collapse_shmem(struct mm_struct *mm,
                 /* Finally, replace with the new page. */
                 xas_store(&xas, new_page + (index % HPAGE_PMD_NR));
                 continue;
-out_lru:
-                xas_unlock_irq(&xas);
-                putback_lru_page(page);
-out_isolate_failed:
-                unlock_page(page);
-                put_page(page);
-                goto xa_unlocked;
 out_unlock:
                 unlock_page(page);
                 put_page(page);
-                break;
+                goto xa_unlocked;
         }
-        xas_unlock_irq(&xas);
 
+        __inc_node_page_state(new_page, NR_SHMEM_THPS);
+        if (nr_none) {
+                struct zone *zone = page_zone(new_page);
+
+                __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none);
+                __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none);
+        }
+
+xa_locked:
+        xas_unlock_irq(&xas);
 xa_unlocked:
+
         if (result == SCAN_SUCCEED) {
                 struct page *page, *tmp;
-                struct zone *zone = page_zone(new_page);
 
                 /*
                  * Replacing old pages with new one has succeeded, now we
                  * need to copy the content and free the old pages.
                  */
+                index = start;
                 list_for_each_entry_safe(page, tmp, &pagelist, lru) {
+                        while (index < page->index) {
+                                clear_highpage(new_page + (index % HPAGE_PMD_NR));
+                                index++;
+                        }
                         copy_highpage(new_page + (page->index % HPAGE_PMD_NR),
                                         page);
                         list_del(&page->lru);
-                        unlock_page(page);
-                        page_ref_unfreeze(page, 1);
                         page->mapping = NULL;
+                        page_ref_unfreeze(page, 1);
                         ClearPageActive(page);
                         ClearPageUnevictable(page);
+                        unlock_page(page);
                         put_page(page);
+                        index++;
                 }
-
-                local_irq_disable();
-                __inc_node_page_state(new_page, NR_SHMEM_THPS);
-                if (nr_none) {
-                        __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none);
-                        __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none);
+                while (index < end) {
+                        clear_highpage(new_page + (index % HPAGE_PMD_NR));
+                        index++;
                 }
-                local_irq_enable();
 
-                /*
-                 * Remove pte page tables, so we can re-fault
-                 * the page as huge.
-                 */
-                retract_page_tables(mapping, start);
-
-                /* Everything is ready, let's unfreeze the new_page */
-                set_page_dirty(new_page);
                 SetPageUptodate(new_page);
-                page_ref_unfreeze(new_page, HPAGE_PMD_NR);
+                page_ref_add(new_page, HPAGE_PMD_NR - 1);
+                set_page_dirty(new_page);
                 mem_cgroup_commit_charge(new_page, memcg, false, true);
                 lru_cache_add_anon(new_page);
-                unlock_page(new_page);
 
+                /*
+                 * Remove pte page tables, so we can re-fault the page as huge.
+                 */
+                retract_page_tables(mapping, start);
                 *hpage = NULL;
 
                 khugepaged_pages_collapsed++;
         } else {
                 struct page *page;
+
                 /* Something went wrong: roll back page cache changes */
-                shmem_uncharge(mapping->host, nr_none);
                 xas_lock_irq(&xas);
+                mapping->nrpages -= nr_none;
+                shmem_uncharge(mapping->host, nr_none);
+
                 xas_set(&xas, start);
                 xas_for_each(&xas, page, end - 1) {
                         page = list_first_entry_or_null(&pagelist,
@@ -1519,19 +1542,18 @@ xa_unlocked:
                         xas_store(&xas, page);
                         xas_pause(&xas);
                         xas_unlock_irq(&xas);
-                        putback_lru_page(page);
                         unlock_page(page);
+                        putback_lru_page(page);
                         xas_lock_irq(&xas);
                 }
                 VM_BUG_ON(nr_none);
                 xas_unlock_irq(&xas);
 
-                /* Unfreeze new_page, caller would take care about freeing it */
-                page_ref_unfreeze(new_page, 1);
                 mem_cgroup_cancel_charge(new_page, memcg, true);
-                unlock_page(new_page);
                 new_page->mapping = NULL;
         }
+
+        unlock_page(new_page);
 out:
         VM_BUG_ON(!list_empty(&pagelist));
         /* TODO: tracepoints */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6847177dc4a1..2ec9cc407216 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5813,8 +5813,10 @@ void __meminit init_currently_empty_zone(struct zone *zone,
                                         unsigned long size)
 {
         struct pglist_data *pgdat = zone->zone_pgdat;
+        int zone_idx = zone_idx(zone) + 1;
 
-        pgdat->nr_zones = zone_idx(zone) + 1;
+        if (zone_idx > pgdat->nr_zones)
+                pgdat->nr_zones = zone_idx;
 
         zone->zone_start_pfn = zone_start_pfn;
 
diff --git a/mm/rmap.c b/mm/rmap.c
index 1e79fac3186b..85b7f9423352 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1627,16 +1627,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                                                       address + PAGE_SIZE);
                 } else {
                         /*
-                         * We should not need to notify here as we reach this
-                         * case only from freeze_page() itself only call from
-                         * split_huge_page_to_list() so everything below must
-                         * be true:
-                         *   - page is not anonymous
-                         *   - page is locked
-                         *
-                         * So as it is a locked file back page thus it can not
-                         * be remove from the page cache and replace by a new
-                         * page before mmu_notifier_invalidate_range_end so no
+                         * This is a locked file-backed page, thus it cannot
+                         * be removed from the page cache and replaced by a new
+                         * page before mmu_notifier_invalidate_range_end, so no
                          * concurrent thread might update its page table to
                          * point at new page while a device still is using this
                          * page.
diff --git a/mm/shmem.c b/mm/shmem.c
index d44991ea5ed4..cddc72ac44d8 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -297,12 +297,14 @@ bool shmem_charge(struct inode *inode, long pages)
         if (!shmem_inode_acct_block(inode, pages))
                 return false;
 
+        /* nrpages adjustment first, then shmem_recalc_inode() when balanced */
+        inode->i_mapping->nrpages += pages;
+
         spin_lock_irqsave(&info->lock, flags);
         info->alloced += pages;
         inode->i_blocks += pages * BLOCKS_PER_PAGE;
         shmem_recalc_inode(inode);
         spin_unlock_irqrestore(&info->lock, flags);
-        inode->i_mapping->nrpages += pages;
 
         return true;
 }
@@ -312,6 +314,8 @@ void shmem_uncharge(struct inode *inode, long pages)
         struct shmem_inode_info *info = SHMEM_I(inode);
         unsigned long flags;
 
+        /* nrpages adjustment done by __delete_from_page_cache() or caller */
+
         spin_lock_irqsave(&info->lock, flags);
         info->alloced -= pages;
         inode->i_blocks -= pages * BLOCKS_PER_PAGE;
@@ -1509,11 +1513,13 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
 {
         struct page *oldpage, *newpage;
         struct address_space *swap_mapping;
+        swp_entry_t entry;
         pgoff_t swap_index;
         int error;
 
         oldpage = *pagep;
-        swap_index = page_private(oldpage);
+        entry.val = page_private(oldpage);
+        swap_index = swp_offset(entry);
         swap_mapping = page_mapping(oldpage);
 
         /*
@@ -1532,7 +1538,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         __SetPageLocked(newpage);
         __SetPageSwapBacked(newpage);
         SetPageUptodate(newpage);
-        set_page_private(newpage, swap_index);
+        set_page_private(newpage, entry.val);
         SetPageSwapCache(newpage);
 
         /*
@@ -2214,6 +2220,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
         struct page *page;
         pte_t _dst_pte, *dst_pte;
         int ret;
+        pgoff_t offset, max_off;
 
         ret = -ENOMEM;
         if (!shmem_inode_acct_block(inode, 1))
@@ -2236,7 +2243,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
                                 *pagep = page;
                                 shmem_inode_unacct_blocks(inode, 1);
                                 /* don't free the page */
-                                return -EFAULT;
+                                return -ENOENT;
                         }
                 } else {                /* mfill_zeropage_atomic */
                         clear_highpage(page);
@@ -2251,6 +2258,12 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
         __SetPageSwapBacked(page);
         __SetPageUptodate(page);
 
+        ret = -EFAULT;
+        offset = linear_page_index(dst_vma, dst_addr);
+        max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+        if (unlikely(offset >= max_off))
+                goto out_release;
+
         ret = mem_cgroup_try_charge_delay(page, dst_mm, gfp, &memcg, false);
         if (ret)
                 goto out_release;
@@ -2265,9 +2278,25 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
         _dst_pte = mk_pte(page, dst_vma->vm_page_prot);
         if (dst_vma->vm_flags & VM_WRITE)
                 _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte));
+        else {
+                /*
+                 * We don't set the pte dirty if the vma has no
+                 * VM_WRITE permission, so mark the page dirty or it
+                 * could be freed from under us. We could do it
+                 * unconditionally before unlock_page(), but doing it
+                 * only if VM_WRITE is not set is faster.
+                 */
+                set_page_dirty(page);
+        }
 
-        ret = -EEXIST;
         dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
+
+        ret = -EFAULT;
+        max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+        if (unlikely(offset >= max_off))
+                goto out_release_uncharge_unlock;
+
+        ret = -EEXIST;
         if (!pte_none(*dst_pte))
                 goto out_release_uncharge_unlock;
 
@@ -2285,13 +2314,15 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
 
         /* No need to invalidate - it was non-present before */
         update_mmu_cache(dst_vma, dst_addr, dst_pte);
-        unlock_page(page);
         pte_unmap_unlock(dst_pte, ptl);
+        unlock_page(page);
         ret = 0;
 out:
         return ret;
 out_release_uncharge_unlock:
         pte_unmap_unlock(dst_pte, ptl);
+        ClearPageDirty(page);
+        delete_from_page_cache(page);
 out_release_uncharge:
         mem_cgroup_cancel_charge(page, memcg, false);
 out_release:
diff --git a/mm/truncate.c b/mm/truncate.c
index 45d68e90b703..798e7ccfb030 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -517,9 +517,13 @@ void truncate_inode_pages_final(struct address_space *mapping)
                  */
                 xa_lock_irq(&mapping->i_pages);
                 xa_unlock_irq(&mapping->i_pages);
-
-                truncate_inode_pages(mapping, 0);
         }
+
+        /*
+         * Cleancache needs notification even if there are no pages or shadow
+         * entries.
+         */
+        truncate_inode_pages(mapping, 0);
 }
 EXPORT_SYMBOL(truncate_inode_pages_final);
 
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 5029f241908f..458acda96f20 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -33,6 +33,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
         void *page_kaddr;
         int ret;
         struct page *page;
+        pgoff_t offset, max_off;
+        struct inode *inode;
 
         if (!*pagep) {
                 ret = -ENOMEM;
@@ -48,7 +50,7 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
 
                 /* fallback to copy_from_user outside mmap_sem */
                 if (unlikely(ret)) {
-                        ret = -EFAULT;
+                        ret = -ENOENT;
                         *pagep = page;
                         /* don't free the page */
                         goto out;
@@ -73,8 +75,17 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
         if (dst_vma->vm_flags & VM_WRITE)
                 _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte));
 
-        ret = -EEXIST;
         dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
+        if (dst_vma->vm_file) {
+                /* the shmem MAP_PRIVATE case requires checking the i_size */
+                inode = dst_vma->vm_file->f_inode;
+                offset = linear_page_index(dst_vma, dst_addr);
+                max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+                ret = -EFAULT;
+                if (unlikely(offset >= max_off))
+                        goto out_release_uncharge_unlock;
+        }
+        ret = -EEXIST;
         if (!pte_none(*dst_pte))
                 goto out_release_uncharge_unlock;
 
@@ -108,11 +119,22 @@ static int mfill_zeropage_pte(struct mm_struct *dst_mm,
         pte_t _dst_pte, *dst_pte;
         spinlock_t *ptl;
         int ret;
+        pgoff_t offset, max_off;
+        struct inode *inode;
 
         _dst_pte = pte_mkspecial(pfn_pte(my_zero_pfn(dst_addr),
                                          dst_vma->vm_page_prot));
-        ret = -EEXIST;
         dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
+        if (dst_vma->vm_file) {
+                /* the shmem MAP_PRIVATE case requires checking the i_size */
+                inode = dst_vma->vm_file->f_inode;
+                offset = linear_page_index(dst_vma, dst_addr);
+                max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+                ret = -EFAULT;
+                if (unlikely(offset >= max_off))
+                        goto out_unlock;
+        }
+        ret = -EEXIST;
         if (!pte_none(*dst_pte))
                 goto out_unlock;
         set_pte_at(dst_mm, dst_addr, dst_pte, _dst_pte);
@@ -205,8 +227,9 @@ retry:
                 if (!dst_vma || !is_vm_hugetlb_page(dst_vma))
                         goto out_unlock;
                 /*
-                 * Only allow __mcopy_atomic_hugetlb on userfaultfd
-                 * registered ranges.
+                 * Check the vma is registered in uffd, this is
+                 * required to enforce the VM_MAYWRITE check done at
+                 * uffd registration time.
                  */
                 if (!dst_vma->vm_userfaultfd_ctx.ctx)
                         goto out_unlock;
@@ -274,7 +297,7 @@ retry:
 
                 cond_resched();
 
-                if (unlikely(err == -EFAULT)) {
+                if (unlikely(err == -ENOENT)) {
                         up_read(&dst_mm->mmap_sem);
                         BUG_ON(!page);
 
@@ -380,7 +403,17 @@ static __always_inline ssize_t mfill_atomic_pte(struct mm_struct *dst_mm,
 {
         ssize_t err;
 
-        if (vma_is_anonymous(dst_vma)) {
+        /*
+         * The normal page fault path for a shmem will invoke the
+         * fault, fill the hole in the file and COW it right away. The
+         * result generates plain anonymous memory. So when we are
+         * asked to fill an hole in a MAP_PRIVATE shmem mapping, we'll
+         * generate anonymous memory directly without actually filling
+         * the hole. For the MAP_PRIVATE case the robustness check
+         * only happens in the pagetable (to verify it's still none)
+         * and not in the radix tree.
+         */
+        if (!(dst_vma->vm_flags & VM_SHARED)) {
                 if (!zeropage)
                         err = mcopy_atomic_pte(dst_mm, dst_pmd, dst_vma,
                                                dst_addr, src_addr, page);
@@ -449,13 +482,9 @@ retry:
         if (!dst_vma)
                 goto out_unlock;
         /*
-         * Be strict and only allow __mcopy_atomic on userfaultfd
-         * registered ranges to prevent userland errors going
-         * unnoticed. As far as the VM consistency is concerned, it
-         * would be perfectly safe to remove this check, but there's
-         * no useful usage for __mcopy_atomic ouside of userfaultfd
-         * registered ranges. This is after all why these are ioctls
-         * belonging to the userfaultfd and not syscalls.
+         * Check the vma is registered in uffd, this is required to
+         * enforce the VM_MAYWRITE check done at uffd registration
+         * time.
          */
         if (!dst_vma->vm_userfaultfd_ctx.ctx)
                 goto out_unlock;
@@ -489,7 +518,8 @@ retry:
          * dst_vma.
          */
         err = -ENOMEM;
-        if (vma_is_anonymous(dst_vma) && unlikely(anon_vma_prepare(dst_vma)))
+        if (!(dst_vma->vm_flags & VM_SHARED) &&
+            unlikely(anon_vma_prepare(dst_vma)))
                 goto out_unlock;
 
         while (src_addr < src_start + len) {
@@ -530,7 +560,7 @@ retry:
                                        src_addr, &page, zeropage);
                 cond_resched();
 
-                if (unlikely(err == -EFAULT)) {
+                if (unlikely(err == -ENOENT)) {
                         void *page_kaddr;
 
                         up_read(&dst_mm->mmap_sem);
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 9f481cfdf77d..e8090f099eb8 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -352,19 +352,21 @@ out:
  */
 int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
 {
+        static const size_t tvlv_padding = sizeof(__be32);
         struct batadv_elp_packet *elp_packet;
         unsigned char *elp_buff;
         u32 random_seqno;
         size_t size;
         int res = -ENOMEM;
 
-        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN;
+        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN + tvlv_padding;
         hard_iface->bat_v.elp_skb = dev_alloc_skb(size);
         if (!hard_iface->bat_v.elp_skb)
                 goto out;
 
         skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
-        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
+        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb,
+                                BATADV_ELP_HLEN + tvlv_padding);
         elp_packet = (struct batadv_elp_packet *)elp_buff;
 
         elp_packet->packet_type = BATADV_ELP;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 0fddc17106bd..5b71a289d04f 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -275,7 +275,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
         kfree(entry);
 
         packet = (struct batadv_frag_packet *)skb_out->data;
-        size = ntohs(packet->total_size);
+        size = ntohs(packet->total_size) + hdr_size;
 
         /* Make room for the rest of the fragments. */
         if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2920e06a5403..04c19a37e500 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -102,12 +102,18 @@ struct br_tunnel_info {
         struct metadata_dst     *tunnel_dst;
 };
 
+/* private vlan flags */
+enum {
+        BR_VLFLAG_PER_PORT_STATS = BIT(0),
+};
+
 /**
  * struct net_bridge_vlan - per-vlan entry
  *
  * @vnode: rhashtable member
  * @vid: VLAN id
  * @flags: bridge vlan flags
+ * @priv_flags: private (in-kernel) bridge vlan flags
  * @stats: per-cpu VLAN statistics
  * @br: if MASTER flag set, this points to a bridge struct
  * @port: if MASTER flag unset, this points to a port struct
@@ -127,6 +133,7 @@ struct net_bridge_vlan {
         struct rhash_head               tnode;
         u16                             vid;
         u16                             flags;
+        u16                             priv_flags;
         struct br_vlan_stats __percpu   *stats;
         union {
                 struct net_bridge       *br;
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 8c9297a01947..e84be08b8285 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -197,7 +197,7 @@ static void nbp_vlan_rcu_free(struct rcu_head *rcu)
         v = container_of(rcu, struct net_bridge_vlan, rcu);
         WARN_ON(br_vlan_is_master(v));
         /* if we had per-port stats configured then free them here */
-        if (v->brvlan->stats != v->stats)
+        if (v->priv_flags & BR_VLFLAG_PER_PORT_STATS)
                 free_percpu(v->stats);
         v->stats = NULL;
         kfree(v);
@@ -264,6 +264,7 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
                                 err = -ENOMEM;
                                 goto out_filt;
                         }
+                        v->priv_flags |= BR_VLFLAG_PER_PORT_STATS;
                 } else {
                         v->stats = masterv->stats;
                 }
diff --git a/net/can/raw.c b/net/can/raw.c
index 1051eee82581..3aab7664933f 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
         } else
                 ifindex = ro->ifindex;
 
-        if (ro->fd_frames) {
+        dev = dev_get_by_index(sock_net(sk), ifindex);
+        if (!dev)
+                return -ENXIO;
+
+        err = -EINVAL;
+        if (ro->fd_frames && dev->mtu == CANFD_MTU) {
                 if (unlikely(size != CANFD_MTU && size != CAN_MTU))
-                        return -EINVAL;
+                        goto put_dev;
         } else {
                 if (unlikely(size != CAN_MTU))
-                        return -EINVAL;
+                        goto put_dev;
         }
 
-        dev = dev_get_by_index(sock_net(sk), ifindex);
-        if (!dev)
-                return -ENXIO;
-
         skb = sock_alloc_send_skb(sk, size + sizeof(struct can_skb_priv),
                                   msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 57fcc6b4bf6e..2f126eff275d 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
         struct bio_vec bvec;
         int ret;
 
-        /* sendpage cannot properly handle pages with page_count == 0,
-         * we need to fallback to sendmsg if that's the case */
-        if (page_count(page) >= 1)
+        /*
+         * sendpage cannot properly handle pages with page_count == 0,
+         * we need to fall back to sendmsg if that's the case.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
+         */
+        if (page_count(page) >= 1 && !PageSlab(page))
                 return __ceph_tcp_sendpage(sock, page, offset, size, more);
 
         bvec.bv_page = page;
diff --git a/net/core/dev.c b/net/core/dev.c
index 0ffcbdd55fa9..ddc551f24ba2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5655,6 +5655,10 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
+
+        /* eth_type_trans() assumes pkt_type is PACKET_HOST */
+        skb->pkt_type = PACKET_HOST;
+
         skb->encapsulation = 0;
         skb_shinfo(skb)->gso_type = 0;
         skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
@@ -5966,11 +5970,14 @@ bool napi_complete_done(struct napi_struct *n, int work_done)
                 if (work_done)
                         timeout = n->dev->gro_flush_timeout;
 
+                /* When the NAPI instance uses a timeout and keeps postponing
+                 * it, we need to bound somehow the time packets are kept in
+                 * the GRO layer
+                 */
+                napi_gro_flush(n, !!timeout);
                 if (timeout)
                         hrtimer_start(&n->timer, ns_to_ktime(timeout),
                                       HRTIMER_MODE_REL_PINNED);
-                else
-                        napi_gro_flush(n, false);
         }
         if (unlikely(!list_empty(&n->poll_list))) {
                 /* If n->poll_list is not empty, we need to mask irqs */
diff --git a/net/core/filter.c b/net/core/filter.c
index e521c5ebc7d1..9a1327eb25fa 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4852,18 +4852,17 @@ static struct sock *sk_lookup(struct net *net, struct bpf_sock_tuple *tuple,
         } else {
                 struct in6_addr *src6 = (struct in6_addr *)&tuple->ipv6.saddr;
                 struct in6_addr *dst6 = (struct in6_addr *)&tuple->ipv6.daddr;
-                u16 hnum = ntohs(tuple->ipv6.dport);
                 int sdif = inet6_sdif(skb);
 
                 if (proto == IPPROTO_TCP)
                         sk = __inet6_lookup(net, &tcp_hashinfo, skb, 0,
                                             src6, tuple->ipv6.sport,
-                                            dst6, hnum,
+                                            dst6, ntohs(tuple->ipv6.dport),
                                             dif, sdif, &refcounted);
                 else if (likely(ipv6_bpf_stub))
                         sk = ipv6_bpf_stub->udp6_lib_lookup(net,
                                                             src6, tuple->ipv6.sport,
-                                                            dst6, hnum,
+                                                            dst6, tuple->ipv6.dport,
                                                             dif, sdif,
                                                             &udp_table, skb);
 #endif
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index b4ee5c8b928f..a8217e221e19 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4854,6 +4854,11 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         nf_reset(skb);
         nf_reset_trace(skb);
 
+#ifdef CONFIG_NET_SWITCHDEV
+        skb->offload_fwd_mark = 0;
+        skb->offload_mr_fwd_mark = 0;
+#endif
+
         if (!xnet)
                 return;
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c09219e7f230..5dbec21856f4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -939,7 +939,7 @@ static int __ip_append_data(struct sock *sk,
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        unsigned int pagedlen = 0;
+                        unsigned int pagedlen;
                         struct sk_buff *skb_prev;
 alloc_new_skb:
                         skb_prev = skb;
@@ -956,6 +956,7 @@ alloc_new_skb:
                         if (datalen > mtu - fragheaderlen)
                                 datalen = maxfraglen - fragheaderlen;
                         fraglen = datalen + fragheaderlen;
+                        pagedlen = 0;
 
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index dde671e97829..c248e0dccbe1 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -80,7 +80,7 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
 
         iph->version    =       4;
         iph->ihl        =       sizeof(struct iphdr) >> 2;
-        iph->frag_off   =       df;
+        iph->frag_off   =       ip_mtu_locked(&rt->dst) ? 0 : df;
         iph->protocol   =       proto;
         iph->tos        =       tos;
         iph->daddr      =       dst;
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index ce1512b02cb2..fd3f9e8a74da 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -81,9 +81,12 @@ static int __init masquerade_tg_init(void)
         int ret;
 
         ret = xt_register_target(&masquerade_tg_reg);
+        if (ret)
+                return ret;
 
-        if (ret == 0)
-                nf_nat_masquerade_ipv4_register_notifier();
+        ret = nf_nat_masquerade_ipv4_register_notifier();
+        if (ret)
+                xt_unregister_target(&masquerade_tg_reg);
 
         return ret;
 }
diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
index a9d5e013e555..41327bb99093 100644
--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
@@ -147,28 +147,50 @@ static struct notifier_block masq_inet_notifier = {
         .notifier_call  = masq_inet_event,
 };
 
-static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
+static int masq_refcnt;
+static DEFINE_MUTEX(masq_mutex);
 
-void nf_nat_masquerade_ipv4_register_notifier(void)
+int nf_nat_masquerade_ipv4_register_notifier(void)
 {
+        int ret = 0;
+
+        mutex_lock(&masq_mutex);
         /* check if the notifier was already set */
-        if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
-                return;
+        if (++masq_refcnt > 1)
+                goto out_unlock;
 
         /* Register for device down reports */
-        register_netdevice_notifier(&masq_dev_notifier);
+        ret = register_netdevice_notifier(&masq_dev_notifier);
+        if (ret)
+                goto err_dec;
         /* Register IP address change reports */
-        register_inetaddr_notifier(&masq_inet_notifier);
+        ret = register_inetaddr_notifier(&masq_inet_notifier);
+        if (ret)
+                goto err_unregister;
+
+        mutex_unlock(&masq_mutex);
+        return ret;
+
+err_unregister:
+        unregister_netdevice_notifier(&masq_dev_notifier);
+err_dec:
+        masq_refcnt--;
+out_unlock:
+        mutex_unlock(&masq_mutex);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);
 
 void nf_nat_masquerade_ipv4_unregister_notifier(void)
 {
+        mutex_lock(&masq_mutex);
         /* check if the notifier still has clients */
-        if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
-                return;
+        if (--masq_refcnt > 0)
+                goto out_unlock;
 
         unregister_netdevice_notifier(&masq_dev_notifier);
         unregister_inetaddr_notifier(&masq_inet_notifier);
+out_unlock:
+        mutex_unlock(&masq_mutex);
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index f1193e1e928a..6847de1d1db8 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -69,7 +69,9 @@ static int __init nft_masq_ipv4_module_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_nat_masquerade_ipv4_register_notifier();
+        ret = nf_nat_masquerade_ipv4_register_notifier();
+        if (ret)
+                nft_unregister_expr(&nft_masq_ipv4_type);
 
         return ret;
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2868ef28ce52..a9d9555a973f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -579,10 +579,12 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
                 u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
                 u32 delta_us;
 
-                if (!delta)
-                        delta = 1;
-                delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
-                tcp_rcv_rtt_update(tp, delta_us, 0);
+                if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
+                        if (!delta)
+                                delta = 1;
+                        delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+                        tcp_rcv_rtt_update(tp, delta_us, 0);
+                }
         }
 }
 
@@ -2910,9 +2912,11 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag,
         if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
             flag & FLAG_ACKED) {
                 u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
-                u32 delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
 
-                seq_rtt_us = ca_rtt_us = delta_us;
+                if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
+                        seq_rtt_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+                        ca_rtt_us = seq_rtt_us;
+                }
         }
         rs->rtt_us = ca_rtt_us; /* RTT of last (S)ACKed packet (or -1) */
         if (seq_rtt_us < 0)
@@ -4268,7 +4272,7 @@ static void tcp_sack_new_ofo_skb(struct sock *sk, u32 seq, u32 end_seq)
          * If the sack array is full, forget about the last one.
          */
         if (this_sack >= TCP_NUM_SACKS) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
                 this_sack--;
                 tp->rx_opt.num_sacks--;
@@ -4363,6 +4367,7 @@ static bool tcp_try_coalesce(struct sock *sk,
         if (TCP_SKB_CB(from)->has_rxtstamp) {
                 TCP_SKB_CB(to)->has_rxtstamp = true;
                 to->tstamp = from->tstamp;
+                skb_hwtstamps(to)->hwtstamp = skb_hwtstamps(from)->hwtstamp;
         }
 
         return true;
@@ -5188,7 +5193,17 @@ send_now:
         if (!tcp_is_sack(tp) ||
             tp->compressed_ack >= sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr)
                 goto send_now;
-        tp->compressed_ack++;
+
+        if (tp->compressed_ack_rcv_nxt != tp->rcv_nxt) {
+                tp->compressed_ack_rcv_nxt = tp->rcv_nxt;
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
+                        NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
+                                      tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = 0;
+        }
+
+        if (++tp->compressed_ack <= TCP_FASTRETRANS_THRESH)
+                goto send_now;
 
         if (hrtimer_is_queued(&tp->compressed_ack_timer))
                 return;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 9c34b97d365d..3f510cad0b3e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -180,10 +180,10 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (unlikely(tp->compressed_ack)) {
+        if (unlikely(tp->compressed_ack > TCP_FASTRETRANS_THRESH)) {
                 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
-                              tp->compressed_ack);
-                tp->compressed_ack = 0;
+                              tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = TCP_FASTRETRANS_THRESH;
                 if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
                         __sock_put(sk);
         }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 676020663ce8..091c53925e4d 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -40,15 +40,17 @@ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         u32 elapsed, start_ts;
+        s32 remaining;
 
         start_ts = tcp_retransmit_stamp(sk);
         if (!icsk->icsk_user_timeout || !start_ts)
                 return icsk->icsk_rto;
         elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts;
-        if (elapsed >= icsk->icsk_user_timeout)
+        remaining = icsk->icsk_user_timeout - elapsed;
+        if (remaining <= 0)
                 return 1; /* user timeout has passed; fire ASAP */
-        else
-                return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(icsk->icsk_user_timeout - elapsed));
+
+        return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining));
 }
 
 /**
@@ -209,7 +211,7 @@ static bool retransmits_timed_out(struct sock *sk,
                                 (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
                 timeout = jiffies_to_msecs(timeout);
         }
-        return (tcp_time_stamp(tcp_sk(sk)) - start_ts) >= timeout;
+        return (s32)(tcp_time_stamp(tcp_sk(sk)) - start_ts - timeout) >= 0;
 }
 
 /* A write timeout has occurred. Process the after effects. */
@@ -740,7 +742,7 @@ static enum hrtimer_restart tcp_compressed_ack_kick(struct hrtimer *timer)
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
         } else {
                 if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 63a808d5af15..045597b9a7c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                                    bool send_na);
-static void addrconf_dad_run(struct inet6_dev *idev);
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
 static void addrconf_rs_timer(struct timer_list *t);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -3439,6 +3439,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
         struct netdev_notifier_changeupper_info *info;
         struct inet6_dev *idev = __in6_dev_get(dev);
         struct net *net = dev_net(dev);
@@ -3513,7 +3514,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 break;
                         }
 
-                        if (idev) {
+                        if (!IS_ERR_OR_NULL(idev)) {
                                 if (idev->if_flags & IF_READY) {
                                         /* device is already configured -
                                          * but resend MLD reports, we might
@@ -3521,6 +3522,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                          * multicast snooping switches
                                          */
                                         ipv6_mc_up(idev);
+                                        change_info = ptr;
+                                        if (change_info->flags_changed & IFF_NOARP)
+                                                addrconf_dad_run(idev, true);
                                         rt6_sync_up(dev, RTNH_F_LINKDOWN);
                                         break;
                                 }
@@ -3555,7 +3559,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 
                 if (!IS_ERR_OR_NULL(idev)) {
                         if (run_pending)
-                                addrconf_dad_run(idev);
+                                addrconf_dad_run(idev, false);
 
                         /* Device has an address by now */
                         rt6_sync_up(dev, RTNH_F_DEAD);
@@ -4173,16 +4177,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                 addrconf_verify_rtnl();
 }
 
-static void addrconf_dad_run(struct inet6_dev *idev)
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
 {
         struct inet6_ifaddr *ifp;
 
         read_lock_bh(&idev->lock);
         list_for_each_entry(ifp, &idev->addr_list, if_list) {
                 spin_lock(&ifp->lock);
-                if (ifp->flags & IFA_F_TENTATIVE &&
-                    ifp->state == INET6_IFADDR_STATE_DAD)
+                if ((ifp->flags & IFA_F_TENTATIVE &&
+                     ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
+                        if (restart)
+                                ifp->state = INET6_IFADDR_STATE_PREDAD;
                         addrconf_dad_kick(ifp);
+                }
                 spin_unlock(&ifp->lock);
         }
         read_unlock_bh(&idev->lock);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 89e0d5118afe..827a3f5ff3bb 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1354,7 +1354,7 @@ emsgsize:
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        unsigned int pagedlen = 0;
+                        unsigned int pagedlen;
 alloc_new_skb:
                         /* There's no room in the current skb */
                         if (skb)
@@ -1378,6 +1378,7 @@ alloc_new_skb:
                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
                                 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
                         fraglen = datalen + fragheaderlen;
+                        pagedlen = 0;
 
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 5ae8e1c51079..8b075f0bc351 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -24,7 +24,8 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
         unsigned int hh_len;
         struct dst_entry *dst;
         struct flowi6 fl6 = {
-                .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
+                .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
+                        rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
                 .flowi6_mark = skb->mark,
                 .flowi6_uid = sock_net_uid(net, sk),
                 .daddr = iph->daddr,
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 491f808e356a..29c7f1915a96 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -58,8 +58,12 @@ static int __init masquerade_tg6_init(void)
         int err;
 
         err = xt_register_target(&masquerade_tg6_reg);
-        if (err == 0)
-                nf_nat_masquerade_ipv6_register_notifier();
+        if (err)
+                return err;
+
+        err = nf_nat_masquerade_ipv6_register_notifier();
+        if (err)
+                xt_unregister_target(&masquerade_tg6_reg);
 
         return err;
 }
diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
index 3e4bf2286abe..0ad0da5a2600 100644
--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
@@ -132,8 +132,8 @@ static void iterate_cleanup_work(struct work_struct *work)
  * of ipv6 addresses being deleted), we also need to add an upper
  * limit to the number of queued work items.
  */
-static int masq_inet_event(struct notifier_block *this,
-                           unsigned long event, void *ptr)
+static int masq_inet6_event(struct notifier_block *this,
+                            unsigned long event, void *ptr)
 {
         struct inet6_ifaddr *ifa = ptr;
         const struct net_device *dev;
@@ -171,30 +171,53 @@ static int masq_inet_event(struct notifier_block *this,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block masq_inet_notifier = {
-        .notifier_call  = masq_inet_event,
+static struct notifier_block masq_inet6_notifier = {
+        .notifier_call  = masq_inet6_event,
 };
 
-static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
+static int masq_refcnt;
+static DEFINE_MUTEX(masq_mutex);
 
-void nf_nat_masquerade_ipv6_register_notifier(void)
+int nf_nat_masquerade_ipv6_register_notifier(void)
 {
+        int ret = 0;
+
+        mutex_lock(&masq_mutex);
         /* check if the notifier is already set */
-        if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
-                return;
+        if (++masq_refcnt > 1)
+                goto out_unlock;
+
+        ret = register_netdevice_notifier(&masq_dev_notifier);
+        if (ret)
+                goto err_dec;
+
+        ret = register_inet6addr_notifier(&masq_inet6_notifier);
+        if (ret)
+                goto err_unregister;
 
-        register_netdevice_notifier(&masq_dev_notifier);
-        register_inet6addr_notifier(&masq_inet_notifier);
+        mutex_unlock(&masq_mutex);
+        return ret;
+
+err_unregister:
+        unregister_netdevice_notifier(&masq_dev_notifier);
+err_dec:
+        masq_refcnt--;
+out_unlock:
+        mutex_unlock(&masq_mutex);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6_register_notifier);
 
 void nf_nat_masquerade_ipv6_unregister_notifier(void)
 {
+        mutex_lock(&masq_mutex);
         /* check if the notifier still has clients */
-        if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
-                return;
+        if (--masq_refcnt > 0)
+                goto out_unlock;
 
-        unregister_inet6addr_notifier(&masq_inet_notifier);
+        unregister_inet6addr_notifier(&masq_inet6_notifier);
         unregister_netdevice_notifier(&masq_dev_notifier);
+out_unlock:
+        mutex_unlock(&masq_mutex);
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6_unregister_notifier);
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index dd0122f3cffe..e06c82e9dfcd 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -70,7 +70,9 @@ static int __init nft_masq_ipv6_module_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_nat_masquerade_ipv6_register_notifier();
+        ret = nf_nat_masquerade_ipv6_register_notifier();
+        if (ret)
+                nft_unregister_expr(&nft_masq_ipv6_type);
 
         return ret;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 2a7423c39456..059f0531f7c1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2232,8 +2232,7 @@ static void ip6_link_failure(struct sk_buff *skb)
         if (rt) {
                 rcu_read_lock();
                 if (rt->rt6i_flags & RTF_CACHE) {
-                        if (dst_hold_safe(&rt->dst))
-                                rt6_remove_exception_rt(rt);
+                        rt6_remove_exception_rt(rt);
                 } else {
                         struct fib6_info *from;
                         struct fib6_node *fn;
@@ -2360,10 +2359,13 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
 
 void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
 {
+        int oif = sk->sk_bound_dev_if;
         struct dst_entry *dst;
 
-        ip6_update_pmtu(skb, sock_net(sk), mtu,
-                        sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
+        if (!oif && skb->dev)
+                oif = l3mdev_master_ifindex(skb->dev);
+
+        ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid);
 
         dst = __sk_dst_get(sk);
         if (!dst || !dst->obsolete ||
@@ -3214,8 +3216,8 @@ static int ip6_del_cached_rt(struct rt6_info *rt, struct fib6_config *cfg)
         if (cfg->fc_flags & RTF_GATEWAY &&
             !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
                 goto out;
-        if (dst_hold_safe(&rt->dst))
-                rc = rt6_remove_exception_rt(rt);
+
+        rc = rt6_remove_exception_rt(rt);
 out:
         return rc;
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 82cdf9020b53..26f1d435696a 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1490,12 +1490,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
                         goto err_sock;
         }
 
-        sk = sock->sk;
-
-        sock_hold(sk);
-        tunnel->sock = sk;
         tunnel->l2tp_net = net;
-
         pn = l2tp_pernet(net);
 
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1510,6 +1505,10 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
 
+        sk = sock->sk;
+        sock_hold(sk);
+        tunnel->sock = sk;
+
         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
                 struct udp_tunnel_sock_cfg udp_cfg = {
                         .sk_user_data = tunnel,
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 83395bf6dc35..432141f04af3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3980,6 +3980,9 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs)
 
 static struct notifier_block ip_vs_dst_notifier = {
         .notifier_call = ip_vs_dst_event,
+#ifdef CONFIG_IP_VS_IPV6
+        .priority = ADDRCONF_NOTIFY_PRIORITY + 5,
+#endif
 };
 
 int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 02ca7df793f5..b6d0f6deea86 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -49,6 +49,7 @@ struct nf_conncount_tuple {
         struct nf_conntrack_zone        zone;
         int                             cpu;
         u32                             jiffies32;
+        bool                            dead;
         struct rcu_head                 rcu_head;
 };
 
@@ -106,15 +107,16 @@ nf_conncount_add(struct nf_conncount_list *list,
         conn->zone = *zone;
         conn->cpu = raw_smp_processor_id();
         conn->jiffies32 = (u32)jiffies;
-        spin_lock(&list->list_lock);
+        conn->dead = false;
+        spin_lock_bh(&list->list_lock);
         if (list->dead == true) {
                 kmem_cache_free(conncount_conn_cachep, conn);
-                spin_unlock(&list->list_lock);
+                spin_unlock_bh(&list->list_lock);
                 return NF_CONNCOUNT_SKIP;
         }
         list_add_tail(&conn->node, &list->head);
         list->count++;
-        spin_unlock(&list->list_lock);
+        spin_unlock_bh(&list->list_lock);
         return NF_CONNCOUNT_ADDED;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_add);
@@ -132,19 +134,22 @@ static bool conn_free(struct nf_conncount_list *list,
 {
         bool free_entry = false;
 
-        spin_lock(&list->list_lock);
+        spin_lock_bh(&list->list_lock);
 
-        if (list->count == 0) {
-                spin_unlock(&list->list_lock);
-                return free_entry;
+        if (conn->dead) {
+                spin_unlock_bh(&list->list_lock);
+                return free_entry;
         }
 
         list->count--;
+        conn->dead = true;
         list_del_rcu(&conn->node);
-        if (list->count == 0)
+        if (list->count == 0) {
+                list->dead = true;
                 free_entry = true;
+        }
 
-        spin_unlock(&list->list_lock);
+        spin_unlock_bh(&list->list_lock);
         call_rcu(&conn->rcu_head, __conn_free);
         return free_entry;
 }
@@ -245,7 +250,7 @@ void nf_conncount_list_init(struct nf_conncount_list *list)
 {
         spin_lock_init(&list->list_lock);
         INIT_LIST_HEAD(&list->head);
-        list->count = 1;
+        list->count = 0;
         list->dead = false;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_list_init);
@@ -259,6 +264,7 @@ bool nf_conncount_gc_list(struct net *net,
         struct nf_conn *found_ct;
         unsigned int collected = 0;
         bool free_entry = false;
+        bool ret = false;
 
         list_for_each_entry_safe(conn, conn_n, &list->head, node) {
                 found = find_or_evict(net, list, conn, &free_entry);
@@ -288,7 +294,15 @@ bool nf_conncount_gc_list(struct net *net,
                 if (collected > CONNCOUNT_GC_MAX_NODES)
                         return false;
         }
-        return false;
+
+        spin_lock_bh(&list->list_lock);
+        if (!list->count) {
+                list->dead = true;
+                ret = true;
+        }
+        spin_unlock_bh(&list->list_lock);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_gc_list);
 
@@ -309,11 +323,8 @@ static void tree_nodes_free(struct rb_root *root,
         while (gc_count) {
                 rbconn = gc_nodes[--gc_count];
                 spin_lock(&rbconn->list.list_lock);
-                if (rbconn->list.count == 0 && rbconn->list.dead == false) {
-                        rbconn->list.dead = true;
-                        rb_erase(&rbconn->node, root);
-                        call_rcu(&rbconn->rcu_head, __tree_nodes_free);
-                }
+                rb_erase(&rbconn->node, root);
+                call_rcu(&rbconn->rcu_head, __tree_nodes_free);
                 spin_unlock(&rbconn->list.list_lock);
         }
 }
@@ -414,6 +425,7 @@ insert_tree(struct net *net,
         nf_conncount_list_init(&rbconn->list);
         list_add(&conn->node, &rbconn->list.head);
         count = 1;
+        rbconn->list.count = count;
 
         rb_link_node(&rbconn->node, parent, rbnode);
         rb_insert_color(&rbconn->node, root);
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 9b48dc8b4b88..2a5e56c6d8d9 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -43,24 +43,12 @@
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
-enum grep_conntrack {
-        GRE_CT_UNREPLIED,
-        GRE_CT_REPLIED,
-        GRE_CT_MAX
-};
-
 static const unsigned int gre_timeouts[GRE_CT_MAX] = {
         [GRE_CT_UNREPLIED]      = 30*HZ,
         [GRE_CT_REPLIED]        = 180*HZ,
 };
 
 static unsigned int proto_gre_net_id __read_mostly;
-struct netns_proto_gre {
-        struct nf_proto_net     nf;
-        rwlock_t                keymap_lock;
-        struct list_head        keymap_list;
-        unsigned int            gre_timeouts[GRE_CT_MAX];
-};
 
 static inline struct netns_proto_gre *gre_pernet(struct net *net)
 {
@@ -402,6 +390,8 @@ static int __init nf_ct_proto_gre_init(void)
 {
         int ret;
 
+        BUILD_BUG_ON(offsetof(struct netns_proto_gre, nf) != 0);
+
         ret = register_pernet_subsys(&proto_gre_net_ops);
         if (ret < 0)
                 goto out_pernet;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 42487d01a3ed..2e61aab6ed73 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2457,7 +2457,7 @@ err:
 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
                                    struct nft_rule *rule)
 {
-        struct nft_expr *expr;
+        struct nft_expr *expr, *next;
 
         /*
          * Careful: some expressions might not be initialized in case this
@@ -2465,8 +2465,9 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
          */
         expr = nft_expr_first(rule);
         while (expr != nft_expr_last(rule) && expr->ops) {
+                next = nft_expr_next(expr);
                 nf_tables_expr_destroy(ctx, expr);
-                expr = nft_expr_next(expr);
+                expr = next;
         }
         kfree(rule);
 }
@@ -2589,17 +2590,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
 
                 if (chain->use == UINT_MAX)
                         return -EOVERFLOW;
-        }
-
-        if (nla[NFTA_RULE_POSITION]) {
-                if (!(nlh->nlmsg_flags & NLM_F_CREATE))
-                        return -EOPNOTSUPP;
 
-                pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
-                old_rule = __nft_rule_lookup(chain, pos_handle);
-                if (IS_ERR(old_rule)) {
-                        NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
-                        return PTR_ERR(old_rule);
+                if (nla[NFTA_RULE_POSITION]) {
+                        pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
+                        old_rule = __nft_rule_lookup(chain, pos_handle);
+                        if (IS_ERR(old_rule)) {
+                                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
+                                return PTR_ERR(old_rule);
+                        }
                 }
         }
 
@@ -2669,21 +2667,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
         }
 
         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
-                if (!nft_is_active_next(net, old_rule)) {
-                        err = -ENOENT;
-                        goto err2;
-                }
-                trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
-                                           old_rule);
+                trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
                 if (trans == NULL) {
                         err = -ENOMEM;
                         goto err2;
                 }
-                nft_deactivate_next(net, old_rule);
-                chain->use--;
-
-                if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
-                        err = -ENOMEM;
+                err = nft_delrule(&ctx, old_rule);
+                if (err < 0) {
+                        nft_trans_destroy(trans);
                         goto err2;
                 }
 
@@ -6324,7 +6315,7 @@ static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
         call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
 }
 
-static void nf_tables_commit_chain_active(struct net *net, struct nft_chain *chain)
+static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
 {
         struct nft_rule **g0, **g1;
         bool next_genbit;
@@ -6441,11 +6432,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
 
         /* step 2.  Make rules_gen_X visible to packet path */
         list_for_each_entry(table, &net->nft.tables, list) {
-                list_for_each_entry(chain, &table->chains, list) {
-                        if (!nft_is_active_next(net, chain))
-                                continue;
-                        nf_tables_commit_chain_active(net, chain);
-                }
+                list_for_each_entry(chain, &table->chains, list)
+                        nf_tables_commit_chain(net, chain);
         }
 
         /*
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index a518eb162344..109b0d27345a 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -455,7 +455,8 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
         case IPPROTO_TCP:
                 timeouts = nf_tcp_pernet(net)->timeouts;
                 break;
-        case IPPROTO_UDP:
+        case IPPROTO_UDP: /* fallthrough */
+        case IPPROTO_UDPLITE:
                 timeouts = nf_udp_pernet(net)->timeouts;
                 break;
         case IPPROTO_DCCP:
@@ -471,11 +472,21 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
                 timeouts = nf_sctp_pernet(net)->timeouts;
 #endif
                 break;
+        case IPPROTO_GRE:
+#ifdef CONFIG_NF_CT_PROTO_GRE
+                if (l4proto->net_id) {
+                        struct netns_proto_gre *net_gre;
+
+                        net_gre = net_generic(net, *l4proto->net_id);
+                        timeouts = net_gre->gre_timeouts;
+                }
+#endif
+                break;
         case 255:
                 timeouts = &nf_generic_pernet(net)->timeout;
                 break;
         default:
-                WARN_ON_ONCE(1);
+                WARN_ONCE(1, "Missing timeouts for proto %d", l4proto->l4proto);
                 break;
         }
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 9d0ede474224..7334e0b80a5e 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -520,6 +520,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
                     void *info)
 {
         struct xt_match *match = expr->ops->data;
+        struct module *me = match->me;
         struct xt_mtdtor_param par;
 
         par.net = ctx->net;
@@ -530,7 +531,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 par.match->destroy(&par);
 
         if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
-                module_put(match->me);
+                module_put(me);
 }
 
 static void
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index e82d9a966c45..974525eb92df 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -214,7 +214,9 @@ static int __init nft_flow_offload_module_init(void)
 {
         int err;
 
-        register_netdevice_notifier(&flow_offload_netdev_notifier);
+        err = register_netdevice_notifier(&flow_offload_netdev_notifier);
+        if (err)
+                goto err;
 
         err = nft_register_expr(&nft_flow_offload_type);
         if (err < 0)
@@ -224,6 +226,7 @@ static int __init nft_flow_offload_module_init(void)
 
 register_expr:
         unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+err:
         return err;
 }
 
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index dec843cadf46..9e05c86ba5c4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -201,18 +201,8 @@ static __net_init int xt_rateest_net_init(struct net *net)
         return 0;
 }
 
-static void __net_exit xt_rateest_net_exit(struct net *net)
-{
-        struct xt_rateest_net *xn = net_generic(net, xt_rateest_id);
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(xn->hash); i++)
-                WARN_ON_ONCE(!hlist_empty(&xn->hash[i]));
-}
-
 static struct pernet_operations xt_rateest_net_ops = {
         .init = xt_rateest_net_init,
-        .exit = xt_rateest_net_exit,
         .id   = &xt_rateest_id,
         .size = sizeof(struct xt_rateest_net),
 };
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 3e7d259e5d8d..1ad4017f9b73 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -295,9 +295,10 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,
 
         /* copy match config into hashtable config */
         ret = cfg_copy(&hinfo->cfg, (void *)cfg, 3);
-
-        if (ret)
+        if (ret) {
+                vfree(hinfo);
                 return ret;
+        }
 
         hinfo->cfg.size = size;
         if (hinfo->cfg.max == 0)
@@ -814,7 +815,6 @@ hashlimit_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
         int ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
-
         if (ret)
                 return ret;
 
@@ -830,7 +830,6 @@ hashlimit_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
         int ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
-
         if (ret)
                 return ret;
 
@@ -921,7 +920,6 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
                 return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
-
         if (ret)
                 return ret;
 
@@ -940,7 +938,6 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
                 return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
-
         if (ret)
                 return ret;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ec3095f13aae..a74650e98f42 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2394,7 +2394,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
                 void *ph;
                 __u32 ts;
 
-                ph = skb_shinfo(skb)->destructor_arg;
+                ph = skb_zcopy_get_nouarg(skb);
                 packet_dec_pending(&po->tx_ring);
 
                 ts = __packet_set_timestamp(po, ph, skb);
@@ -2461,7 +2461,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->mark = po->sk.sk_mark;
         skb->tstamp = sockc->transmit_time;
         sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
-        skb_shinfo(skb)->destructor_arg = ph.raw;
+        skb_zcopy_set_nouarg(skb, ph.raw);
 
         skb_reserve(skb, hlen);
         skb_reset_network_header(skb);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 64362d078da8..a2522f9d71e2 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -375,17 +375,36 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
  * getting ACKs from the server.  Returns a number representing the life state
  * which can be compared to that returned by a previous call.
  *
- * If this is a client call, ping ACKs will be sent to the server to find out
- * whether it's still responsive and whether the call is still alive on the
- * server.
+ * If the life state stalls, rxrpc_kernel_probe_life() should be called and
+ * then 2RTT waited.
  */
-u32 rxrpc_kernel_check_life(struct socket *sock, struct rxrpc_call *call)
+u32 rxrpc_kernel_check_life(const struct socket *sock,
+                            const struct rxrpc_call *call)
 {
         return call->acks_latest;
 }
 EXPORT_SYMBOL(rxrpc_kernel_check_life);
 
 /**
+ * rxrpc_kernel_probe_life - Poke the peer to see if it's still alive
+ * @sock: The socket the call is on
+ * @call: The call to check
+ *
+ * In conjunction with rxrpc_kernel_check_life(), allow a kernel service to
+ * find out whether a call is still alive by pinging it.  This should cause the
+ * life state to be bumped in about 2*RTT.
+ *
+ * The must be called in TASK_RUNNING state on pain of might_sleep() objecting.
+ */
+void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
+{
+        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                          rxrpc_propose_ack_ping_for_check_life);
+        rxrpc_send_ack_packet(call, true, NULL);
+}
+EXPORT_SYMBOL(rxrpc_kernel_probe_life);
+
+/**
  * rxrpc_kernel_get_epoch - Retrieve the epoch value from a call.
  * @sock: The socket the call is on
  * @call: The call to query
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index da3dd0f68cc2..2b372a06b432 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -201,7 +201,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                         goto out_release;
                 }
         } else {
-                return err;
+                ret = err;
+                goto out_free;
         }
 
         p = to_pedit(*a);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 052855d47354..37c9b8f0e10f 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -27,10 +27,7 @@ struct tcf_police_params {
         u32                     tcfp_ewma_rate;
         s64                     tcfp_burst;
         u32                     tcfp_mtu;
-        s64                     tcfp_toks;
-        s64                     tcfp_ptoks;
         s64                     tcfp_mtu_ptoks;
-        s64                     tcfp_t_c;
         struct psched_ratecfg   rate;
         bool                    rate_present;
         struct psched_ratecfg   peak;
@@ -41,6 +38,11 @@ struct tcf_police_params {
 struct tcf_police {
         struct tc_action        common;
         struct tcf_police_params __rcu *params;
+
+        spinlock_t              tcfp_lock ____cacheline_aligned_in_smp;
+        s64                     tcfp_toks;
+        s64                     tcfp_ptoks;
+        s64                     tcfp_t_c;
 };
 
 #define to_police(pc) ((struct tcf_police *)pc)
@@ -122,6 +124,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                         return ret;
                 }
                 ret = ACT_P_CREATED;
+                spin_lock_init(&(to_police(*a)->tcfp_lock));
         } else if (!ovr) {
                 tcf_idr_release(*a, bind);
                 return -EEXIST;
@@ -186,12 +189,9 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
-        new->tcfp_toks = new->tcfp_burst;
-        if (new->peak_present) {
+        if (new->peak_present)
                 new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
                                                          new->tcfp_mtu);
-                new->tcfp_ptoks = new->tcfp_mtu_ptoks;
-        }
 
         if (tb[TCA_POLICE_AVRATE])
                 new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
@@ -207,7 +207,12 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         spin_lock_bh(&police->tcf_lock);
-        new->tcfp_t_c = ktime_get_ns();
+        spin_lock_bh(&police->tcfp_lock);
+        police->tcfp_t_c = ktime_get_ns();
+        police->tcfp_toks = new->tcfp_burst;
+        if (new->peak_present)
+                police->tcfp_ptoks = new->tcfp_mtu_ptoks;
+        spin_unlock_bh(&police->tcfp_lock);
         police->tcf_action = parm->action;
         rcu_swap_protected(police->params,
                            new,
@@ -257,25 +262,28 @@ static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
                 }
 
                 now = ktime_get_ns();
-                toks = min_t(s64, now - p->tcfp_t_c, p->tcfp_burst);
+                spin_lock_bh(&police->tcfp_lock);
+                toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
                 if (p->peak_present) {
-                        ptoks = toks + p->tcfp_ptoks;
+                        ptoks = toks + police->tcfp_ptoks;
                         if (ptoks > p->tcfp_mtu_ptoks)
                                 ptoks = p->tcfp_mtu_ptoks;
                         ptoks -= (s64)psched_l2t_ns(&p->peak,
                                                     qdisc_pkt_len(skb));
                 }
-                toks += p->tcfp_toks;
+                toks += police->tcfp_toks;
                 if (toks > p->tcfp_burst)
                         toks = p->tcfp_burst;
                 toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
                 if ((toks|ptoks) >= 0) {
-                        p->tcfp_t_c = now;
-                        p->tcfp_toks = toks;
-                        p->tcfp_ptoks = ptoks;
+                        police->tcfp_t_c = now;
+                        police->tcfp_toks = toks;
+                        police->tcfp_ptoks = ptoks;
+                        spin_unlock_bh(&police->tcfp_lock);
                         ret = p->tcfp_result;
                         goto inc_drops;
                 }
+                spin_unlock_bh(&police->tcfp_lock);
         }
 
 inc_overlimits:
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 4b1af706896c..25a7cf6d380f 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -469,22 +469,29 @@ begin:
                 goto begin;
         }
         prefetch(&skb->end);
-        f->credit -= qdisc_pkt_len(skb);
+        plen = qdisc_pkt_len(skb);
+        f->credit -= plen;
 
-        if (ktime_to_ns(skb->tstamp) || !q->rate_enable)
+        if (!q->rate_enable)
                 goto out;
 
         rate = q->flow_max_rate;
-        if (skb->sk)
-                rate = min(skb->sk->sk_pacing_rate, rate);
-
-        if (rate <= q->low_rate_threshold) {
-                f->credit = 0;
-                plen = qdisc_pkt_len(skb);
-        } else {
-                plen = max(qdisc_pkt_len(skb), q->quantum);
-                if (f->credit > 0)
-                        goto out;
+
+        /* If EDT time was provided for this skb, we need to
+         * update f->time_next_packet only if this qdisc enforces
+         * a flow max rate.
+         */
+        if (!skb->tstamp) {
+                if (skb->sk)
+                        rate = min(skb->sk->sk_pacing_rate, rate);
+
+                if (rate <= q->low_rate_threshold) {
+                        f->credit = 0;
+                } else {
+                        plen = max(plen, q->quantum);
+                        if (f->credit > 0)
+                                goto out;
+                }
         }
         if (rate != ~0UL) {
                 u64 len = (u64)plen * NSEC_PER_SEC;
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 67939ad99c01..025f48e14a91 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -118,6 +118,9 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
                 sctp_transport_route(tp, NULL, sp);
                 if (asoc->param_flags & SPP_PMTUD_ENABLE)
                         sctp_assoc_sync_pmtu(asoc);
+        } else if (!sctp_transport_pmtu_check(tp)) {
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
         }
 
         if (asoc->pmtu_pending) {
@@ -396,25 +399,6 @@ finish:
         return retval;
 }
 
-static void sctp_packet_release_owner(struct sk_buff *skb)
-{
-        sk_free(skb->sk);
-}
-
-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
-{
-        skb_orphan(skb);
-        skb->sk = sk;
-        skb->destructor = sctp_packet_release_owner;
-
-        /*
-         * The data chunks have already been accounted for in sctp_sendmsg(),
-         * therefore only reserve a single byte to keep socket around until
-         * the packet has been transmitted.
-         */
-        refcount_inc(&sk->sk_wmem_alloc);
-}
-
 static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
 {
         if (SCTP_OUTPUT_CB(head)->last == head)
@@ -426,6 +410,7 @@ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
         head->truesize += skb->truesize;
         head->data_len += skb->len;
         head->len += skb->len;
+        refcount_add(skb->truesize, &head->sk->sk_wmem_alloc);
 
         __skb_header_release(skb);
 }
@@ -601,7 +586,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         if (!head)
                 goto out;
         skb_reserve(head, packet->overhead + MAX_HEADER);
-        sctp_packet_set_owner_w(head, sk);
+        skb_set_owner_w(head, sk);
 
         /* set sctp header */
         sh = skb_push(head, sizeof(struct sctphdr));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 739f3e50120d..bf618d1b41fd 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3940,32 +3940,16 @@ static int sctp_setsockopt_pr_supported(struct sock *sk,
                                         unsigned int optlen)
 {
         struct sctp_assoc_value params;
-        struct sctp_association *asoc;
-        int retval = -EINVAL;
 
         if (optlen != sizeof(params))
-                goto out;
-
-        if (copy_from_user(&params, optval, optlen)) {
-                retval = -EFAULT;
-                goto out;
-        }
-
-        asoc = sctp_id2assoc(sk, params.assoc_id);
-        if (asoc) {
-                asoc->prsctp_enable = !!params.assoc_value;
-        } else if (!params.assoc_id) {
-                struct sctp_sock *sp = sctp_sk(sk);
+                return -EINVAL;
 
-                sp->ep->prsctp_enable = !!params.assoc_value;
-        } else {
-                goto out;
-        }
+        if (copy_from_user(&params, optval, optlen))
+                return -EFAULT;
 
-        retval = 0;
+        sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value;
 
-out:
-        return retval;
+        return 0;
 }
 
 static int sctp_setsockopt_default_prinfo(struct sock *sk,
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index ffb940d3b57c..3892e7630f3a 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -535,7 +535,6 @@ int sctp_send_add_streams(struct sctp_association *asoc,
                 goto out;
         }
 
-        stream->incnt = incnt;
         stream->outcnt = outcnt;
 
         asoc->strreset_outstanding = !!out + !!in;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 80e2119f1c70..5fbaf1901571 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -127,6 +127,8 @@ static int smc_release(struct socket *sock)
         smc = smc_sk(sk);
 
         /* cleanup for a dangling non-blocking connect */
+        if (smc->connect_info && sk->sk_state == SMC_INIT)
+                tcp_abort(smc->clcsock->sk, ECONNABORTED);
         flush_work(&smc->connect_work);
         kfree(smc->connect_info);
         smc->connect_info = NULL;
@@ -547,7 +549,8 @@ static int smc_connect_rdma(struct smc_sock *smc,
 
         mutex_lock(&smc_create_lgr_pending);
         local_contact = smc_conn_create(smc, false, aclc->hdr.flag, ibdev,
-                                        ibport, &aclc->lcl, NULL, 0);
+                                        ibport, ntoh24(aclc->qpn), &aclc->lcl,
+                                        NULL, 0);
         if (local_contact < 0) {
                 if (local_contact == -ENOMEM)
                         reason_code = SMC_CLC_DECL_MEM;/* insufficient memory*/
@@ -618,7 +621,7 @@ static int smc_connect_ism(struct smc_sock *smc,
         int rc = 0;
 
         mutex_lock(&smc_create_lgr_pending);
-        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0,
+        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0, 0,
                                         NULL, ismdev, aclc->gid);
         if (local_contact < 0)
                 return smc_connect_abort(smc, SMC_CLC_DECL_MEM, 0);
@@ -1083,7 +1086,7 @@ static int smc_listen_rdma_init(struct smc_sock *new_smc,
                                 int *local_contact)
 {
         /* allocate connection / link group */
-        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport,
+        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport, 0,
                                          &pclc->lcl, NULL, 0);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
@@ -1107,7 +1110,7 @@ static int smc_listen_ism_init(struct smc_sock *new_smc,
         struct smc_clc_msg_smcd *pclc_smcd;
 
         pclc_smcd = smc_get_clc_msg_smcd(pclc);
-        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, NULL,
+        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, 0, NULL,
                                          ismdev, pclc_smcd->gid);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index ed5dcf03fe0b..db83332ac1c8 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -81,7 +81,7 @@ static inline void smc_cdc_add_pending_send(struct smc_connection *conn,
                 sizeof(struct smc_cdc_msg) > SMC_WR_BUF_SIZE,
                 "must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg)");
         BUILD_BUG_ON_MSG(
-                sizeof(struct smc_cdc_msg) != SMC_WR_TX_SIZE,
+                offsetofend(struct smc_cdc_msg, reserved) > SMC_WR_TX_SIZE,
                 "must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send()");
         BUILD_BUG_ON_MSG(
                 sizeof(struct smc_cdc_tx_pend) > SMC_WR_TX_PEND_PRIV_SIZE,
@@ -177,23 +177,24 @@ void smc_cdc_tx_dismiss_slots(struct smc_connection *conn)
 int smcd_cdc_msg_send(struct smc_connection *conn)
 {
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
+        union smc_host_cursor curs;
         struct smcd_cdc_msg cdc;
         int rc, diff;
 
         memset(&cdc, 0, sizeof(cdc));
         cdc.common.type = SMC_CDC_MSG_TYPE;
-        cdc.prod_wrap = conn->local_tx_ctrl.prod.wrap;
-        cdc.prod_count = conn->local_tx_ctrl.prod.count;
-
-        cdc.cons_wrap = conn->local_tx_ctrl.cons.wrap;
-        cdc.cons_count = conn->local_tx_ctrl.cons.count;
-        cdc.prod_flags = conn->local_tx_ctrl.prod_flags;
-        cdc.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.prod.acurs);
+        cdc.prod.wrap = curs.wrap;
+        cdc.prod.count = curs.count;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.cons.acurs);
+        cdc.cons.wrap = curs.wrap;
+        cdc.cons.count = curs.count;
+        cdc.cons.prod_flags = conn->local_tx_ctrl.prod_flags;
+        cdc.cons.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
         rc = smcd_tx_ism_write(conn, &cdc, sizeof(cdc), 0, 1);
         if (rc)
                 return rc;
-        smc_curs_copy(&conn->rx_curs_confirmed, &conn->local_tx_ctrl.cons,
-                      conn);
+        smc_curs_copy(&conn->rx_curs_confirmed, &curs, conn);
         /* Calculate transmitted data and increment free send buffer space */
         diff = smc_curs_diff(conn->sndbuf_desc->len, &conn->tx_curs_fin,
                              &conn->tx_curs_sent);
@@ -331,13 +332,16 @@ static void smc_cdc_msg_recv(struct smc_sock *smc, struct smc_cdc_msg *cdc)
 static void smcd_cdc_rx_tsklet(unsigned long data)
 {
         struct smc_connection *conn = (struct smc_connection *)data;
+        struct smcd_cdc_msg *data_cdc;
         struct smcd_cdc_msg cdc;
         struct smc_sock *smc;
 
         if (!conn)
                 return;
 
-        memcpy(&cdc, conn->rmb_desc->cpu_addr, sizeof(cdc));
+        data_cdc = (struct smcd_cdc_msg *)conn->rmb_desc->cpu_addr;
+        smcd_curs_copy(&cdc.prod, &data_cdc->prod, conn);
+        smcd_curs_copy(&cdc.cons, &data_cdc->cons, conn);
         smc = container_of(conn, struct smc_sock, conn);
         smc_cdc_msg_recv(smc, (struct smc_cdc_msg *)&cdc);
 }
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index 934df4473a7c..b5bfe38c7f9b 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -48,21 +48,31 @@ struct smc_cdc_msg {
         struct smc_cdc_producer_flags   prod_flags;
         struct smc_cdc_conn_state_flags conn_state_flags;
         u8                              reserved[18];
-} __packed;                                     /* format defined in RFC7609 */
+};
+
+/* SMC-D cursor format */
+union smcd_cdc_cursor {
+        struct {
+                u16     wrap;
+                u32     count;
+                struct smc_cdc_producer_flags   prod_flags;
+                struct smc_cdc_conn_state_flags conn_state_flags;
+        } __packed;
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_t              acurs;          /* for atomic processing */
+#else
+        u64                     acurs;          /* for atomic processing */
+#endif
+} __aligned(8);
 
 /* CDC message for SMC-D */
 struct smcd_cdc_msg {
         struct smc_wr_rx_hdr common;    /* Type = 0xFE */
         u8 res1[7];
-        u16 prod_wrap;
-        u32 prod_count;
-        u8 res2[2];
-        u16 cons_wrap;
-        u32 cons_count;
-        struct smc_cdc_producer_flags   prod_flags;
-        struct smc_cdc_conn_state_flags conn_state_flags;
+        union smcd_cdc_cursor   prod;
+        union smcd_cdc_cursor   cons;
         u8 res3[8];
-} __packed;
+} __aligned(8);
 
 static inline bool smc_cdc_rxed_any_close(struct smc_connection *conn)
 {
@@ -135,6 +145,21 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
 #endif
 }
 
+static inline void smcd_curs_copy(union smcd_cdc_cursor *tgt,
+                                  union smcd_cdc_cursor *src,
+                                  struct smc_connection *conn)
+{
+#ifndef KERNEL_HAS_ATOMIC64
+        unsigned long flags;
+
+        spin_lock_irqsave(&conn->acurs_lock, flags);
+        tgt->acurs = src->acurs;
+        spin_unlock_irqrestore(&conn->acurs_lock, flags);
+#else
+        atomic64_set(&tgt->acurs, atomic64_read(&src->acurs));
+#endif
+}
+
 /* calculate cursor difference between old and new, where old <= new */
 static inline int smc_curs_diff(unsigned int size,
                                 union smc_host_cursor *old,
@@ -222,12 +247,17 @@ static inline void smcr_cdc_msg_to_host(struct smc_host_cdc_msg *local,
 static inline void smcd_cdc_msg_to_host(struct smc_host_cdc_msg *local,
                                         struct smcd_cdc_msg *peer)
 {
-        local->prod.wrap = peer->prod_wrap;
-        local->prod.count = peer->prod_count;
-        local->cons.wrap = peer->cons_wrap;
-        local->cons.count = peer->cons_count;
-        local->prod_flags = peer->prod_flags;
-        local->conn_state_flags = peer->conn_state_flags;
+        union smc_host_cursor temp;
+
+        temp.wrap = peer->prod.wrap;
+        temp.count = peer->prod.count;
+        atomic64_set(&local->prod.acurs, atomic64_read(&temp.acurs));
+
+        temp.wrap = peer->cons.wrap;
+        temp.count = peer->cons.count;
+        atomic64_set(&local->cons.acurs, atomic64_read(&temp.acurs));
+        local->prod_flags = peer->cons.prod_flags;
+        local->conn_state_flags = peer->cons.conn_state_flags;
 }
 
 static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 18daebcef181..1c9fa7f0261a 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -184,6 +184,8 @@ free:
 
                 if (!lgr->is_smcd && lnk->state != SMC_LNK_INACTIVE)
                         smc_llc_link_inactive(lnk);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -485,7 +487,7 @@ void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport)
 }
 
 /* Called when SMC-D device is terminated or peer is lost */
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid, unsigned short vlan)
 {
         struct smc_link_group *lgr, *l;
         LIST_HEAD(lgr_free_list);
@@ -495,7 +497,7 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &smc_lgr_list.list, list) {
                 if (lgr->is_smcd && lgr->smcd == dev &&
                     (!peer_gid || lgr->peer_gid == peer_gid) &&
-                    !list_empty(&lgr->list)) {
+                    (vlan == VLAN_VID_MASK || lgr->vlan_id == vlan)) {
                         __smc_lgr_terminate(lgr);
                         list_move(&lgr->list, &lgr_free_list);
                 }
@@ -506,6 +508,8 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &lgr_free_list, list) {
                 list_del_init(&lgr->list);
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (!peer_gid && vlan == VLAN_VID_MASK) /* dev terminated? */
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -559,7 +563,7 @@ out:
 
 static bool smcr_lgr_match(struct smc_link_group *lgr,
                            struct smc_clc_msg_local *lcl,
-                           enum smc_lgr_role role)
+                           enum smc_lgr_role role, u32 clcqpn)
 {
         return !memcmp(lgr->peer_systemid, lcl->id_for_peer,
                        SMC_SYSTEMID_LEN) &&
@@ -567,7 +571,9 @@ static bool smcr_lgr_match(struct smc_link_group *lgr,
                         SMC_GID_SIZE) &&
                 !memcmp(lgr->lnk[SMC_SINGLE_LINK].peer_mac, lcl->mac,
                         sizeof(lcl->mac)) &&
-                lgr->role == role;
+                lgr->role == role &&
+                (lgr->role == SMC_SERV ||
+                 lgr->lnk[SMC_SINGLE_LINK].peer_qpn == clcqpn);
 }
 
 static bool smcd_lgr_match(struct smc_link_group *lgr,
@@ -578,7 +584,7 @@ static bool smcd_lgr_match(struct smc_link_group *lgr,
 
 /* create a new SMC connection (and a new link group if necessary) */
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid)
 {
@@ -603,7 +609,7 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
         list_for_each_entry(lgr, &smc_lgr_list.list, list) {
                 write_lock_bh(&lgr->conns_lock);
                 if ((is_smcd ? smcd_lgr_match(lgr, smcd, peer_gid) :
-                     smcr_lgr_match(lgr, lcl, role)) &&
+                     smcr_lgr_match(lgr, lcl, role, clcqpn)) &&
                     !lgr->sync_err &&
                     lgr->vlan_id == vlan_id &&
                     (role == SMC_CLNT ||
@@ -1024,6 +1030,8 @@ void smc_core_exit(void)
                         smc_llc_link_inactive(lnk);
                 }
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr); /* free link group */
         }
 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index c156674733c9..cf98f4d6093e 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -247,7 +247,8 @@ void smc_lgr_free(struct smc_link_group *lgr);
 void smc_lgr_forget(struct smc_link_group *lgr);
 void smc_lgr_terminate(struct smc_link_group *lgr);
 void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport);
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid);
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid,
+                        unsigned short vlan);
 int smc_buf_create(struct smc_sock *smc, bool is_smcd);
 int smc_uncompress_bufsize(u8 compressed);
 int smc_rmb_rtoken_handling(struct smc_connection *conn,
@@ -262,7 +263,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, unsigned short *vlan_id);
 
 void smc_conn_free(struct smc_connection *conn);
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid);
 void smcd_conn_free(struct smc_connection *conn);
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index e36f21ce7252..2fff79db1a59 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -187,22 +187,28 @@ struct smc_ism_event_work {
 #define ISM_EVENT_REQUEST               0x0001
 #define ISM_EVENT_RESPONSE              0x0002
 #define ISM_EVENT_REQUEST_IR            0x00000001
+#define ISM_EVENT_CODE_SHUTDOWN         0x80
 #define ISM_EVENT_CODE_TESTLINK         0x83
 
+union smcd_sw_event_info {
+        u64     info;
+        struct {
+                u8              uid[SMC_LGR_ID_SIZE];
+                unsigned short  vlan_id;
+                u16             code;
+        };
+};
+
 static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
 {
-        union {
-                u64     info;
-                struct {
-                        u32             uid;
-                        unsigned short  vlanid;
-                        u16             code;
-                };
-        } ev_info;
+        union smcd_sw_event_info ev_info;
 
+        ev_info.info = wrk->event.info;
         switch (wrk->event.code) {
+        case ISM_EVENT_CODE_SHUTDOWN:   /* Peer shut down DMBs */
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, ev_info.vlan_id);
+                break;
         case ISM_EVENT_CODE_TESTLINK:   /* Activity timer */
-                ev_info.info = wrk->event.info;
                 if (ev_info.code == ISM_EVENT_REQUEST) {
                         ev_info.code = ISM_EVENT_RESPONSE;
                         wrk->smcd->ops->signal_event(wrk->smcd,
@@ -215,6 +221,21 @@ static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
         }
 }
 
+int smc_ism_signal_shutdown(struct smc_link_group *lgr)
+{
+        int rc;
+        union smcd_sw_event_info ev_info;
+
+        memcpy(ev_info.uid, lgr->id, SMC_LGR_ID_SIZE);
+        ev_info.vlan_id = lgr->vlan_id;
+        ev_info.code = ISM_EVENT_REQUEST;
+        rc = lgr->smcd->ops->signal_event(lgr->smcd, lgr->peer_gid,
+                                          ISM_EVENT_REQUEST_IR,
+                                          ISM_EVENT_CODE_SHUTDOWN,
+                                          ev_info.info);
+        return rc;
+}
+
 /* worker for SMC-D events */
 static void smc_ism_event_work(struct work_struct *work)
 {
@@ -223,7 +244,7 @@ static void smc_ism_event_work(struct work_struct *work)
 
         switch (wrk->event.type) {
         case ISM_EVENT_GID:     /* GID event, token is peer GID */
-                smc_smcd_terminate(wrk->smcd, wrk->event.tok);
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, VLAN_VID_MASK);
                 break;
         case ISM_EVENT_DMB:
                 break;
@@ -289,7 +310,7 @@ void smcd_unregister_dev(struct smcd_dev *smcd)
         spin_unlock(&smcd_dev_list.lock);
         flush_workqueue(smcd->event_wq);
         destroy_workqueue(smcd->event_wq);
-        smc_smcd_terminate(smcd, 0);
+        smc_smcd_terminate(smcd, 0, VLAN_VID_MASK);
 
         device_del(&smcd->dev);
 }
diff --git a/net/smc/smc_ism.h b/net/smc/smc_ism.h
index aee45b860b79..4da946cbfa29 100644
--- a/net/smc/smc_ism.h
+++ b/net/smc/smc_ism.h
@@ -45,4 +45,5 @@ int smc_ism_register_dmb(struct smc_link_group *lgr, int buf_size,
 int smc_ism_unregister_dmb(struct smcd_dev *dev, struct smc_buf_desc *dmb_desc);
 int smc_ism_write(struct smcd_dev *dev, const struct smc_ism_position *pos,
                   void *data, size_t len);
+int smc_ism_signal_shutdown(struct smc_link_group *lgr);
 #endif
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 3c458d279855..c2694750a6a8 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
 
         pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
         if (pend->idx < link->wr_tx_cnt) {
+                u32 idx = pend->idx;
+
                 /* clear the full struct smc_wr_tx_pend including .priv */
                 memset(&link->wr_tx_pends[pend->idx], 0,
                        sizeof(link->wr_tx_pends[pend->idx]));
                 memset(&link->wr_tx_bufs[pend->idx], 0,
                        sizeof(link->wr_tx_bufs[pend->idx]));
-                test_and_clear_bit(pend->idx, link->wr_tx_mask);
+                test_and_clear_bit(idx, link->wr_tx_mask);
                 return 1;
         }
 
diff --git a/net/socket.c b/net/socket.c
index 593826e11a53..334fcc617ef2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -853,7 +853,7 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
         struct socket *sock = file->private_data;
 
         if (unlikely(!sock->ops->splice_read))
-                return -EINVAL;
+                return generic_file_splice_read(file, ppos, pipe, len, flags);
 
         return sock->ops->splice_read(sock, ppos, pipe, len, flags);
 }
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 2830709957bd..c138d68e8a69 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -166,7 +166,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
 
         /* Apply trial address if we just left trial period */
         if (!trial && !self) {
-                tipc_net_finalize(net, tn->trial_addr);
+                tipc_sched_net_finalize(net, tn->trial_addr);
+                msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
                 msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
         }
 
@@ -300,14 +301,12 @@ static void tipc_disc_timeout(struct timer_list *t)
                 goto exit;
         }
 
-        /* Trial period over ? */
-        if (!time_before(jiffies, tn->addr_trial_end)) {
-                /* Did we just leave it ? */
-                if (!tipc_own_addr(net))
-                        tipc_net_finalize(net, tn->trial_addr);
-
-                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
-                msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
+        /* Did we just leave trial period ? */
+        if (!time_before(jiffies, tn->addr_trial_end) && !tipc_own_addr(net)) {
+                mod_timer(&d->timer, jiffies + TIPC_DISC_INIT);
+                spin_unlock_bh(&d->lock);
+                tipc_sched_net_finalize(net, tn->trial_addr);
+                return;
         }
 
         /* Adjust timeout interval according to discovery phase */
@@ -319,6 +318,8 @@ static void tipc_disc_timeout(struct timer_list *t)
                         d->timer_intv = TIPC_DISC_SLOW;
                 else if (!d->num_nodes && d->timer_intv > TIPC_DISC_FAST)
                         d->timer_intv = TIPC_DISC_FAST;
+                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+                msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
         }
 
         mod_timer(&d->timer, jiffies + d->timer_intv);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 62199cf5a56c..f076edb74338 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -104,6 +104,14 @@
  *     - A local spin_lock protecting the queue of subscriber events.
 */
 
+struct tipc_net_work {
+        struct work_struct work;
+        struct net *net;
+        u32 addr;
+};
+
+static void tipc_net_finalize(struct net *net, u32 addr);
+
 int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
 {
         if (tipc_own_id(net)) {
@@ -119,17 +127,38 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
         return 0;
 }
 
-void tipc_net_finalize(struct net *net, u32 addr)
+static void tipc_net_finalize(struct net *net, u32 addr)
 {
         struct tipc_net *tn = tipc_net(net);
 
-        if (!cmpxchg(&tn->node_addr, 0, addr)) {
-                tipc_set_node_addr(net, addr);
-                tipc_named_reinit(net);
-                tipc_sk_reinit(net);
-                tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
-                                     TIPC_CLUSTER_SCOPE, 0, addr);
-        }
+        if (cmpxchg(&tn->node_addr, 0, addr))
+                return;
+        tipc_set_node_addr(net, addr);
+        tipc_named_reinit(net);
+        tipc_sk_reinit(net);
+        tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+                             TIPC_CLUSTER_SCOPE, 0, addr);
+}
+
+static void tipc_net_finalize_work(struct work_struct *work)
+{
+        struct tipc_net_work *fwork;
+
+        fwork = container_of(work, struct tipc_net_work, work);
+        tipc_net_finalize(fwork->net, fwork->addr);
+        kfree(fwork);
+}
+
+void tipc_sched_net_finalize(struct net *net, u32 addr)
+{
+        struct tipc_net_work *fwork = kzalloc(sizeof(*fwork), GFP_ATOMIC);
+
+        if (!fwork)
+                return;
+        INIT_WORK(&fwork->work, tipc_net_finalize_work);
+        fwork->net = net;
+        fwork->addr = addr;
+        schedule_work(&fwork->work);
 }
 
 void tipc_net_stop(struct net *net)
diff --git a/net/tipc/net.h b/net/tipc/net.h
index 09ad02b50bb1..b7f2e364eb99 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -42,7 +42,7 @@
 extern const struct nla_policy tipc_nl_net_policy[];
 
 int tipc_net_init(struct net *net, u8 *node_id, u32 addr);
-void tipc_net_finalize(struct net *net, u32 addr);
+void tipc_sched_net_finalize(struct net *net, u32 addr);
 void tipc_net_stop(struct net *net);
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 2afc4f8c37a7..488019766433 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -584,12 +584,15 @@ static void  tipc_node_clear_links(struct tipc_node *node)
 /* tipc_node_cleanup - delete nodes that does not
  * have active links for NODE_CLEANUP_AFTER time
  */
-static int tipc_node_cleanup(struct tipc_node *peer)
+static bool tipc_node_cleanup(struct tipc_node *peer)
 {
         struct tipc_net *tn = tipc_net(peer->net);
         bool deleted = false;
 
-        spin_lock_bh(&tn->node_list_lock);
+        /* If lock held by tipc_node_stop() the node will be deleted anyway */
+        if (!spin_trylock_bh(&tn->node_list_lock))
+                return false;
+
         tipc_node_write_lock(peer);
 
         if (!node_is_up(peer) && time_after(jiffies, peer->delete_at)) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 636e6131769d..b57b1be7252b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1555,16 +1555,17 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
 /**
  * tipc_sk_anc_data_recv - optionally capture ancillary data for received message
  * @m: descriptor for message info
- * @msg: received message header
+ * @skb: received message buffer
  * @tsk: TIPC port associated with message
  *
  * Note: Ancillary data is not captured if not requested by receiver.
  *
  * Returns 0 if successful, otherwise errno
  */
-static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
+static int tipc_sk_anc_data_recv(struct msghdr *m, struct sk_buff *skb,
                                  struct tipc_sock *tsk)
 {
+        struct tipc_msg *msg;
         u32 anc_data[3];
         u32 err;
         u32 dest_type;
@@ -1573,6 +1574,7 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
 
         if (likely(m->msg_controllen == 0))
                 return 0;
+        msg = buf_msg(skb);
 
         /* Optionally capture errored message object(s) */
         err = msg ? msg_errcode(msg) : 0;
@@ -1583,6 +1585,9 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
                 if (res)
                         return res;
                 if (anc_data[1]) {
+                        if (skb_linearize(skb))
+                                return -ENOMEM;
+                        msg = buf_msg(skb);
                         res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1],
                                        msg_data(msg));
                         if (res)
@@ -1744,9 +1749,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 
         /* Collect msg meta data, including error code and rejected data */
         tipc_sk_set_orig_addr(m, skb);
-        rc = tipc_sk_anc_data_recv(m, hdr, tsk);
+        rc = tipc_sk_anc_data_recv(m, skb, tsk);
         if (unlikely(rc))
                 goto exit;
+        hdr = buf_msg(skb);
 
         /* Capture data if non-error msg, otherwise just set return value */
         if (likely(!err)) {
@@ -1856,9 +1862,10 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,
                 /* Collect msg meta data, incl. error code and rejected data */
                 if (!copied) {
                         tipc_sk_set_orig_addr(m, skb);
-                        rc = tipc_sk_anc_data_recv(m, hdr, tsk);
+                        rc = tipc_sk_anc_data_recv(m, skb, tsk);
                         if (rc)
                                 break;
+                        hdr = buf_msg(skb);
                 }
 
                 /* Copy data if msg ok, otherwise return error/partial data */
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index a8e7ba9f73e8..6a6be9f440cf 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -236,10 +236,8 @@ ifdef CONFIG_GCOV_KERNEL
 objtool_args += --no-unreachable
 endif
 ifdef CONFIG_RETPOLINE
-ifneq ($(RETPOLINE_CFLAGS),)
   objtool_args += --retpoline
 endif
-endif
 
 
 ifdef CONFIG_MODVERSIONS
diff --git a/scripts/unifdef.c b/scripts/unifdef.c
index 7493c0ee51cc..db00e3e30a59 100644
--- a/scripts/unifdef.c
+++ b/scripts/unifdef.c
@@ -395,7 +395,7 @@ usage(void)
  * When we have processed a group that starts off with a known-false
  * #if/#elif sequence (which has therefore been deleted) followed by a
  * #elif that we don't understand and therefore must keep, we edit the
- * latter into a #if to keep the nesting correct. We use strncpy() to
+ * latter into a #if to keep the nesting correct. We use memcpy() to
  * overwrite the 4 byte token "elif" with "if  " without a '\0' byte.
  *
  * When we find a true #elif in a group, the following block will
@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop();  ignoreon(); }
 static void Itrue (void) { Ftrue();  ignoreon(); }
 static void Ifalse(void) { Ffalse(); ignoreon(); }
 /* modify this line */
-static void Mpass (void) { strncpy(keyword, "if  ", 4); Pelif(); }
+static void Mpass (void) { memcpy(keyword, "if  ", 4); Pelif(); }
 static void Mtrue (void) { keywordedit("else");  state(IS_TRUE_MIDDLE); }
 static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); }
 static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); }
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 74b951f55608..9cec81209617 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
         { RTM_NEWSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ },
         { RTM_GETSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
         { RTM_NEWCACHEREPORT,   NETLINK_ROUTE_SOCKET__NLMSG_READ },
+        { RTM_NEWCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_DELCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_GETCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 };
 
 static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
@@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
 
         switch (sclass) {
         case SECCLASS_NETLINK_ROUTE_SOCKET:
-                /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
+                /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
+                 * If the BUILD_BUG_ON() below fails you must update the
+                 * structures at the top of this file with the new mappings
+                 * before updating the BUILD_BUG_ON() macro!
+                 */
                 BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
                                  sizeof(nlmsg_route_perms));
@@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
                 break;
 
         case SECCLASS_NETLINK_XFRM_SOCKET:
+                /* If the BUILD_BUG_ON() below fails you must update the
+                 * structures at the top of this file with the new mappings
+                 * before updating the BUILD_BUG_ON() macro!
+                 */
                 BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
                                  sizeof(nlmsg_xfrm_perms));
diff --git a/sound/core/control.c b/sound/core/control.c
index 9aa15bfc7936..649d3217590e 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -348,6 +348,40 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
         return 0;
 }
 
+/* add a new kcontrol object; call with card->controls_rwsem locked */
+static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+{
+        struct snd_ctl_elem_id id;
+        unsigned int idx;
+        unsigned int count;
+
+        id = kcontrol->id;
+        if (id.index > UINT_MAX - kcontrol->count)
+                return -EINVAL;
+
+        if (snd_ctl_find_id(card, &id)) {
+                dev_err(card->dev,
+                        "control %i:%i:%i:%s:%i is already present\n",
+                        id.iface, id.device, id.subdevice, id.name, id.index);
+                return -EBUSY;
+        }
+
+        if (snd_ctl_find_hole(card, kcontrol->count) < 0)
+                return -ENOMEM;
+
+        list_add_tail(&kcontrol->list, &card->controls);
+        card->controls_count += kcontrol->count;
+        kcontrol->id.numid = card->last_numid + 1;
+        card->last_numid += kcontrol->count;
+
+        id = kcontrol->id;
+        count = kcontrol->count;
+        for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+                snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+
+        return 0;
+}
+
 /**
  * snd_ctl_add - add the control instance to the card
  * @card: the card instance
@@ -364,45 +398,18 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
  */
 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
 {
-        struct snd_ctl_elem_id id;
-        unsigned int idx;
-        unsigned int count;
         int err = -EINVAL;
 
         if (! kcontrol)
                 return err;
         if (snd_BUG_ON(!card || !kcontrol->info))
                 goto error;
-        id = kcontrol->id;
-        if (id.index > UINT_MAX - kcontrol->count)
-                goto error;
 
         down_write(&card->controls_rwsem);
-        if (snd_ctl_find_id(card, &id)) {
-                up_write(&card->controls_rwsem);
-                dev_err(card->dev, "control %i:%i:%i:%s:%i is already present\n",
-                                        id.iface,
-                                        id.device,
-                                        id.subdevice,
-                                        id.name,
-                                        id.index);
-                err = -EBUSY;
-                goto error;
-        }
-        if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
-                up_write(&card->controls_rwsem);
-                err = -ENOMEM;
-                goto error;
-        }
-        list_add_tail(&kcontrol->list, &card->controls);
-        card->controls_count += kcontrol->count;
-        kcontrol->id.numid = card->last_numid + 1;
-        card->last_numid += kcontrol->count;
-        id = kcontrol->id;
-        count = kcontrol->count;
+        err = __snd_ctl_add(card, kcontrol);
         up_write(&card->controls_rwsem);
-        for (idx = 0; idx < count; idx++, id.index++, id.numid++)
-                snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+        if (err < 0)
+                goto error;
         return 0;
 
  error:
@@ -1361,9 +1368,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
                 kctl->tlv.c = snd_ctl_elem_user_tlv;
 
         /* This function manage to free the instance on failure. */
-        err = snd_ctl_add(card, kctl);
-        if (err < 0)
-                return err;
+        down_write(&card->controls_rwsem);
+        err = __snd_ctl_add(card, kctl);
+        if (err < 0) {
+                snd_ctl_free_one(kctl);
+                goto unlock;
+        }
         offset = snd_ctl_get_ioff(kctl, &info->id);
         snd_ctl_build_ioff(&info->id, kctl, offset);
         /*
@@ -1374,10 +1384,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
          * which locks the element.
          */
 
-        down_write(&card->controls_rwsem);
         card->user_ctl_count++;
-        up_write(&card->controls_rwsem);
 
+ unlock:
+        up_write(&card->controls_rwsem);
         return 0;
 }
 
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f8d4a419f3af..467039b342b5 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         runtime->oss.channels = params_channels(params);
         runtime->oss.rate = params_rate(params);
 
-        vfree(runtime->oss.buffer);
-        runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
+        kvfree(runtime->oss.buffer);
+        runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
         if (!runtime->oss.buffer) {
                 err = -ENOMEM;
                 goto failure;
@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime;
         runtime = substream->runtime;
-        vfree(runtime->oss.buffer);
+        kvfree(runtime->oss.buffer);
         runtime->oss.buffer = NULL;
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
         snd_pcm_oss_plugin_clear(substream);
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index 141c5f3a9575..31cb2acf8afc 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
                 return -ENXIO;
         size /= 8;
         if (plugin->buf_frames < frames) {
-                vfree(plugin->buf);
-                plugin->buf = vmalloc(size);
+                kvfree(plugin->buf);
+                plugin->buf = kvzalloc(size, GFP_KERNEL);
                 plugin->buf_frames = frames;
         }
         if (!plugin->buf) {
@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
         if (plugin->private_free)
                 plugin->private_free(plugin);
         kfree(plugin->buf_channels);
-        vfree(plugin->buf);
+        kvfree(plugin->buf);
         kfree(plugin);
         return 0;
 }
diff --git a/sound/isa/wss/wss_lib.c b/sound/isa/wss/wss_lib.c
index 32453f81b95a..3a5008837576 100644
--- a/sound/isa/wss/wss_lib.c
+++ b/sound/isa/wss/wss_lib.c
@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct snd_pcm_substream *substream)
         if (err < 0) {
                 if (chip->release_dma)
                         chip->release_dma(chip, chip->dma_private_data, chip->dma1);
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
                 return err;
         }
         chip->playback_substream = substream;
@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct snd_pcm_substream *substream)
         if (err < 0) {
                 if (chip->release_dma)
                         chip->release_dma(chip, chip->dma_private_data, chip->dma2);
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
                 return err;
         }
         chip->capture_substream = substream;
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index f4459d1a9d67..27b468f057dd 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -824,7 +824,7 @@ static int snd_ac97_put_spsa(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
 {
         struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
         int reg = kcontrol->private_value & 0xff;
-        int shift = (kcontrol->private_value >> 8) & 0xff;
+        int shift = (kcontrol->private_value >> 8) & 0x0f;
         int mask = (kcontrol->private_value >> 16) & 0xff;
         // int invert = (kcontrol->private_value >> 24) & 0xff;
         unsigned short value, old, new;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d8eb2b5f51ae..0bbdf1a01e76 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2169,6 +2169,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
         SND_PCI_QUIRK(0x1849, 0xc892, "Asrock B85M-ITX", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+        SND_PCI_QUIRK(0x1849, 0x0397, "Asrock N68C-S UCC", 0),
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
         SND_PCI_QUIRK(0x1849, 0x7662, "Asrock H81M-HDS", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
         SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0),
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 0a24037184c3..0a567634e5fa 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1177,6 +1177,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
         SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
         SND_PCI_QUIRK(0x1102, 0x0010, "Sound Blaster Z", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1102, 0x0023, "Sound Blaster Z", QUIRK_SBZ),
+        SND_PCI_QUIRK(0x1102, 0x0033, "Sound Blaster ZxR", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
@@ -8413,7 +8414,7 @@ static void ca0132_free(struct hda_codec *codec)
 
         snd_hda_power_down(codec);
         if (spec->mem_base)
-                iounmap(spec->mem_base);
+                pci_iounmap(codec->bus->pci, spec->mem_base);
         kfree(spec->spec_init_verbs);
         kfree(codec->spec);
 }
@@ -8488,7 +8489,7 @@ static void ca0132_config(struct hda_codec *codec)
                 break;
         case QUIRK_AE5:
                 codec_dbg(codec, "%s: QUIRK_AE5 applied.\n", __func__);
-                snd_hda_apply_pincfgs(codec, r3di_pincfgs);
+                snd_hda_apply_pincfgs(codec, ae5_pincfgs);
                 break;
         }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fa61674a5605..06f93032d0cc 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -388,6 +388,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
         case 0x10ec0285:
         case 0x10ec0298:
         case 0x10ec0289:
+        case 0x10ec0300:
                 alc_update_coef_idx(codec, 0x10, 1<<9, 0);
                 break;
         case 0x10ec0275:
@@ -2830,6 +2831,7 @@ enum {
         ALC269_TYPE_ALC215,
         ALC269_TYPE_ALC225,
         ALC269_TYPE_ALC294,
+        ALC269_TYPE_ALC300,
         ALC269_TYPE_ALC700,
 };
 
@@ -2864,6 +2866,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
         case ALC269_TYPE_ALC215:
         case ALC269_TYPE_ALC225:
         case ALC269_TYPE_ALC294:
+        case ALC269_TYPE_ALC300:
         case ALC269_TYPE_ALC700:
                 ssids = alc269_ssids;
                 break;
@@ -5358,6 +5361,16 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
         spec->gen.preferred_dacs = preferred_pairs;
 }
 
+/* The DAC of NID 0x3 will introduce click/pop noise on headphones, so invalidate it */
+static void alc285_fixup_invalidate_dacs(struct hda_codec *codec,
+                              const struct hda_fixup *fix, int action)
+{
+        if (action != HDA_FIXUP_ACT_PRE_PROBE)
+                return;
+
+        snd_hda_override_wcaps(codec, 0x03, 0);
+}
+
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
@@ -5495,6 +5508,8 @@ enum {
         ALC255_FIXUP_DELL_HEADSET_MIC,
         ALC295_FIXUP_HP_X360,
         ALC221_FIXUP_HP_HEADSET_MIC,
+        ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+        ALC295_FIXUP_HP_AUTO_MUTE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5659,6 +5674,8 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC269_FIXUP_HP_MUTE_LED_MIC3] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_hp_mute_led_mic3,
+                .chained = true,
+                .chain_id = ALC295_FIXUP_HP_AUTO_MUTE
         },
         [ALC269_FIXUP_HP_GPIO_LED] = {
                 .type = HDA_FIXUP_FUNC,
@@ -6362,6 +6379,14 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MIC
         },
+        [ALC285_FIXUP_LENOVO_HEADPHONE_NOISE] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc285_fixup_invalidate_dacs,
+        },
+        [ALC295_FIXUP_HP_AUTO_MUTE] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_auto_mute_via_amp,
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6481,6 +6506,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
         SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
         SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
@@ -6531,6 +6557,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
         SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
@@ -7033,6 +7060,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60130},
                 {0x19, 0x03a11020},
                 {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x19, 0x04a11040},
+                {0x21, 0x04211020}),
         SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
@@ -7294,6 +7326,10 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
                 break;
+        case 0x10ec0300:
+                spec->codec_variant = ALC269_TYPE_ALC300;
+                spec->gen.mixer_nid = 0; /* no loopback on ALC300 */
+                break;
         case 0x10ec0700:
         case 0x10ec0701:
         case 0x10ec0703:
@@ -8404,6 +8440,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
         HDA_CODEC_ENTRY(0x10ec0295, "ALC295", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269),
         HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861),
         HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd),
         HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861),
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 4e9854889a95..e63d6e33df48 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -2187,11 +2187,6 @@ static int hdac_hdmi_runtime_suspend(struct device *dev)
          */
         snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
                                                         AC_PWRST_D3);
-        err = snd_hdac_display_power(bus, false);
-        if (err < 0) {
-                dev_err(dev, "Cannot turn on display power on i915\n");
-                return err;
-        }
 
         hlink = snd_hdac_ext_bus_get_link(bus, dev_name(dev));
         if (!hlink) {
@@ -2201,7 +2196,11 @@ static int hdac_hdmi_runtime_suspend(struct device *dev)
 
         snd_hdac_ext_bus_link_put(bus, hlink);
 
-        return 0;
+        err = snd_hdac_display_power(bus, false);
+        if (err < 0)
+                dev_err(dev, "Cannot turn off display power on i915\n");
+
+        return err;
 }
 
 static int hdac_hdmi_runtime_resume(struct device *dev)
diff --git a/sound/soc/codecs/pcm186x.h b/sound/soc/codecs/pcm186x.h
index 2c6ba55bf394..bb3f0c42a1cd 100644
--- a/sound/soc/codecs/pcm186x.h
+++ b/sound/soc/codecs/pcm186x.h
@@ -139,7 +139,7 @@ enum pcm186x_type {
 #define PCM186X_MAX_REGISTER            PCM186X_CURR_TRIM_CTRL
 
 /* PCM186X_PAGE */
-#define PCM186X_RESET                   0xff
+#define PCM186X_RESET                   0xfe
 
 /* PCM186X_ADCX_INPUT_SEL_X */
 #define PCM186X_ADC_INPUT_SEL_POL       BIT(7)
diff --git a/sound/soc/codecs/pcm3060.c b/sound/soc/codecs/pcm3060.c
index 494d9d662be8..771b46e1974b 100644
--- a/sound/soc/codecs/pcm3060.c
+++ b/sound/soc/codecs/pcm3060.c
@@ -198,20 +198,16 @@ static const struct snd_kcontrol_new pcm3060_dapm_controls[] = {
 };
 
 static const struct snd_soc_dapm_widget pcm3060_dapm_widgets[] = {
-        SND_SOC_DAPM_OUTPUT("OUTL+"),
-        SND_SOC_DAPM_OUTPUT("OUTR+"),
-        SND_SOC_DAPM_OUTPUT("OUTL-"),
-        SND_SOC_DAPM_OUTPUT("OUTR-"),
+        SND_SOC_DAPM_OUTPUT("OUTL"),
+        SND_SOC_DAPM_OUTPUT("OUTR"),
 
         SND_SOC_DAPM_INPUT("INL"),
         SND_SOC_DAPM_INPUT("INR"),
 };
 
 static const struct snd_soc_dapm_route pcm3060_dapm_map[] = {
-        { "OUTL+", NULL, "Playback" },
-        { "OUTR+", NULL, "Playback" },
-        { "OUTL-", NULL, "Playback" },
-        { "OUTR-", NULL, "Playback" },
+        { "OUTL", NULL, "Playback" },
+        { "OUTR", NULL, "Playback" },
 
         { "Capture", NULL, "INL" },
         { "Capture", NULL, "INR" },
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index a53dc174bbf0..66501b8dc46f 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -765,38 +765,41 @@ static unsigned int wm_adsp_region_to_reg(struct wm_adsp_region const *mem,
 
 static void wm_adsp2_show_fw_status(struct wm_adsp *dsp)
 {
-        u16 scratch[4];
+        unsigned int scratch[4];
+        unsigned int addr = dsp->base + ADSP2_SCRATCH0;
+        unsigned int i;
         int ret;
 
-        ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2_SCRATCH0,
-                                scratch, sizeof(scratch));
-        if (ret) {
-                adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
-                return;
+        for (i = 0; i < ARRAY_SIZE(scratch); ++i) {
+                ret = regmap_read(dsp->regmap, addr + i, &scratch[i]);
+                if (ret) {
+                        adsp_err(dsp, "Failed to read SCRATCH%u: %d\n", i, ret);
+                        return;
+                }
         }
 
         adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
-                 be16_to_cpu(scratch[0]),
-                 be16_to_cpu(scratch[1]),
-                 be16_to_cpu(scratch[2]),
-                 be16_to_cpu(scratch[3]));
+                 scratch[0], scratch[1], scratch[2], scratch[3]);
 }
 
 static void wm_adsp2v2_show_fw_status(struct wm_adsp *dsp)
 {
-        u32 scratch[2];
+        unsigned int scratch[2];
         int ret;
 
-        ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
-                              scratch, sizeof(scratch));
-
+        ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
+                          &scratch[0]);
         if (ret) {
-                adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
+                adsp_err(dsp, "Failed to read SCRATCH0_1: %d\n", ret);
                 return;
         }
 
-        scratch[0] = be32_to_cpu(scratch[0]);
-        scratch[1] = be32_to_cpu(scratch[1]);
+        ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH2_3,
+                          &scratch[1]);
+        if (ret) {
+                adsp_err(dsp, "Failed to read SCRATCH2_3: %d\n", ret);
+                return;
+        }
 
         adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
                  scratch[0] & 0xFFFF,
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 0caa1f4eb94d..18e717703685 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -101,22 +101,42 @@ config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
           codec, then enable this option by saying Y or m. This is a
           recommended option
 
-config SND_SOC_INTEL_SKYLAKE_SSP_CLK
-        tristate
-
 config SND_SOC_INTEL_SKYLAKE
         tristate "SKL/BXT/KBL/GLK/CNL... Platforms"
         depends on PCI && ACPI
+        select SND_SOC_INTEL_SKYLAKE_COMMON
+        help
+          If you have a Intel Skylake/Broxton/ApolloLake/KabyLake/
+          GeminiLake or CannonLake platform with the DSP enabled in the BIOS
+          then enable this option by saying Y or m.
+
+if  SND_SOC_INTEL_SKYLAKE
+
+config SND_SOC_INTEL_SKYLAKE_SSP_CLK
+        tristate
+
+config SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
+        bool "HDAudio codec support"
+        help
+          If you have a Intel Skylake/Broxton/ApolloLake/KabyLake/
+          GeminiLake or CannonLake platform with an HDaudio codec
+          then enable this option by saying Y
+
+config SND_SOC_INTEL_SKYLAKE_COMMON
+        tristate
         select SND_HDA_EXT_CORE
         select SND_HDA_DSP_LOADER
         select SND_SOC_TOPOLOGY
         select SND_SOC_INTEL_SST
+        select SND_SOC_HDAC_HDA if SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
         select SND_SOC_ACPI_INTEL_MATCH
         help
           If you have a Intel Skylake/Broxton/ApolloLake/KabyLake/
           GeminiLake or CannonLake platform with the DSP enabled in the BIOS
           then enable this option by saying Y or m.
 
+endif ## SND_SOC_INTEL_SKYLAKE
+
 config SND_SOC_ACPI_INTEL_MATCH
         tristate
         select SND_SOC_ACPI if ACPI
diff --git a/sound/soc/intel/boards/Kconfig b/sound/soc/intel/boards/Kconfig
index 73ca1350aa31..b177db2a0dbb 100644
--- a/sound/soc/intel/boards/Kconfig
+++ b/sound/soc/intel/boards/Kconfig
@@ -293,16 +293,6 @@ config SND_SOC_INTEL_KBL_DA7219_MAX98927_MACH
           Say Y if you have such a device.
           If unsure select "N".
 
-config SND_SOC_INTEL_SKL_HDA_DSP_GENERIC_MACH
-        tristate "SKL/KBL/BXT/APL with HDA Codecs"
-        select SND_SOC_HDAC_HDMI
-        select SND_SOC_HDAC_HDA
-        help
-          This adds support for ASoC machine driver for Intel platforms
-          SKL/KBL/BXT/APL with iDisp, HDA audio codecs.
-          Say Y or m if you have such a device. This is a recommended option.
-          If unsure select "N".
-
 config SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH
         tristate "GLK with RT5682 and MAX98357A in I2S Mode"
         depends on MFD_INTEL_LPSS && I2C && ACPI
@@ -319,4 +309,18 @@ config SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH
 
 endif ## SND_SOC_INTEL_SKYLAKE
 
+if SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
+
+config SND_SOC_INTEL_SKL_HDA_DSP_GENERIC_MACH
+        tristate "SKL/KBL/BXT/APL with HDA Codecs"
+        select SND_SOC_HDAC_HDMI
+        # SND_SOC_HDAC_HDA is already selected
+        help
+          This adds support for ASoC machine driver for Intel platforms
+          SKL/KBL/BXT/APL with iDisp, HDA audio codecs.
+          Say Y or m if you have such a device. This is a recommended option.
+          If unsure select "N".
+
+endif ## SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC
+
 endif ## SND_SOC_INTEL_MACH
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index db6976f4ddaa..9d9f6e41d81c 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -19,6 +19,7 @@
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  */
 
+#include <linux/dmi.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
@@ -35,6 +36,8 @@
 #define CHT_PLAT_CLK_3_HZ       19200000
 #define CHT_CODEC_DAI   "HiFi"
 
+#define QUIRK_PMC_PLT_CLK_0                             0x01
+
 struct cht_mc_private {
         struct clk *mclk;
         struct snd_soc_jack jack;
@@ -385,11 +388,29 @@ static struct snd_soc_card snd_soc_card_cht = {
         .num_controls = ARRAY_SIZE(cht_mc_controls),
 };
 
+static const struct dmi_system_id cht_max98090_quirk_table[] = {
+        {
+                /* Swanky model Chromebook (Toshiba Chromebook 2) */
+                .matches = {
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Swanky"),
+                },
+                .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
+        },
+        {}
+};
+
 static int snd_cht_mc_probe(struct platform_device *pdev)
 {
+        const struct dmi_system_id *dmi_id;
         struct device *dev = &pdev->dev;
         int ret_val = 0;
         struct cht_mc_private *drv;
+        const char *mclk_name;
+        int quirks = 0;
+
+        dmi_id = dmi_first_match(cht_max98090_quirk_table);
+        if (dmi_id)
+                quirks = (unsigned long)dmi_id->driver_data;
 
         drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
         if (!drv)
@@ -411,11 +432,16 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         snd_soc_card_cht.dev = &pdev->dev;
         snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
 
-        drv->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+        if (quirks & QUIRK_PMC_PLT_CLK_0)
+                mclk_name = "pmc_plt_clk_0";
+        else
+                mclk_name = "pmc_plt_clk_3";
+
+        drv->mclk = devm_clk_get(&pdev->dev, mclk_name);
         if (IS_ERR(drv->mclk)) {
                 dev_err(&pdev->dev,
-                        "Failed to get MCLK from pmc_plt_clk_3: %ld\n",
-                        PTR_ERR(drv->mclk));
+                        "Failed to get MCLK from %s: %ld\n",
+                        mclk_name, PTR_ERR(drv->mclk));
                 return PTR_ERR(drv->mclk);
         }
 
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 29225623b4b4..7487f388e65d 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -37,7 +37,9 @@
 #include "skl.h"
 #include "skl-sst-dsp.h"
 #include "skl-sst-ipc.h"
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
 #include "../../../soc/codecs/hdac_hda.h"
+#endif
 
 /*
  * initialize the PCI registers
@@ -658,6 +660,8 @@ static void skl_clock_device_unregister(struct skl *skl)
                 platform_device_unregister(skl->clk_dev);
 }
 
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
+
 #define IDISP_INTEL_VENDOR_ID   0x80860000
 
 /*
@@ -676,6 +680,8 @@ static void load_codec_module(struct hda_codec *codec)
 #endif
 }
 
+#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */
+
 /*
  * Probe the given codec address
  */
@@ -685,9 +691,11 @@ static int probe_codec(struct hdac_bus *bus, int addr)
                 (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID;
         unsigned int res = -1;
         struct skl *skl = bus_to_skl(bus);
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
         struct hdac_hda_priv *hda_codec;
-        struct hdac_device *hdev;
         int err;
+#endif
+        struct hdac_device *hdev;
 
         mutex_lock(&bus->cmd_mutex);
         snd_hdac_bus_send_cmd(bus, cmd);
@@ -697,6 +705,7 @@ static int probe_codec(struct hdac_bus *bus, int addr)
                 return -EIO;
         dev_dbg(bus->dev, "codec #%d probed OK: %x\n", addr, res);
 
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
         hda_codec = devm_kzalloc(&skl->pci->dev, sizeof(*hda_codec),
                                  GFP_KERNEL);
         if (!hda_codec)
@@ -715,6 +724,13 @@ static int probe_codec(struct hdac_bus *bus, int addr)
                 load_codec_module(&hda_codec->codec);
         }
         return 0;
+#else
+        hdev = devm_kzalloc(&skl->pci->dev, sizeof(*hdev), GFP_KERNEL);
+        if (!hdev)
+                return -ENOMEM;
+
+        return snd_hdac_ext_bus_device_init(bus, addr, hdev);
+#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */
 }
 
 /* Codec initialization */
@@ -815,6 +831,12 @@ static void skl_probe_work(struct work_struct *work)
                 }
         }
 
+        /*
+         * we are done probing so decrement link counts
+         */
+        list_for_each_entry(hlink, &bus->hlink_list, list)
+                snd_hdac_ext_bus_link_put(bus, hlink);
+
         if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
                 err = snd_hdac_display_power(bus, false);
                 if (err < 0) {
@@ -824,12 +846,6 @@ static void skl_probe_work(struct work_struct *work)
                 }
         }
 
-        /*
-         * we are done probing so decrement link counts
-         */
-        list_for_each_entry(hlink, &bus->hlink_list, list)
-                snd_hdac_ext_bus_link_put(bus, hlink);
-
         /* configure PM */
         pm_runtime_put_noidle(bus->dev);
         pm_runtime_allow(bus->dev);
@@ -870,7 +886,7 @@ static int skl_create(struct pci_dev *pci,
         hbus = skl_to_hbus(skl);
         bus = skl_to_bus(skl);
 
-#if IS_ENABLED(CONFIG_SND_SOC_HDAC_HDA)
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC)
         ext_ops = snd_soc_hdac_hda_get_ops();
 #endif
         snd_hdac_ext_bus_init(bus, &pci->dev, &bus_core_ops, io_ops, ext_ops);
diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
index d5ae9eb8c756..fed45b41f9d3 100644
--- a/sound/soc/omap/omap-abe-twl6040.c
+++ b/sound/soc/omap/omap-abe-twl6040.c
@@ -36,6 +36,8 @@
 #include "../codecs/twl6040.h"
 
 struct abe_twl6040 {
+        struct snd_soc_card card;
+        struct snd_soc_dai_link dai_links[2];
         int     jack_detection; /* board can detect jack events */
         int     mclk_freq;      /* MCLK frequency speed for twl6040 */
 };
@@ -208,40 +210,10 @@ static int omap_abe_dmic_init(struct snd_soc_pcm_runtime *rtd)
                                 ARRAY_SIZE(dmic_audio_map));
 }
 
-/* Digital audio interface glue - connects codec <--> CPU */
-static struct snd_soc_dai_link abe_twl6040_dai_links[] = {
-        {
-                .name = "TWL6040",
-                .stream_name = "TWL6040",
-                .codec_dai_name = "twl6040-legacy",
-                .codec_name = "twl6040-codec",
-                .init = omap_abe_twl6040_init,
-                .ops = &omap_abe_ops,
-        },
-        {
-                .name = "DMIC",
-                .stream_name = "DMIC Capture",
-                .codec_dai_name = "dmic-hifi",
-                .codec_name = "dmic-codec",
-                .init = omap_abe_dmic_init,
-                .ops = &omap_abe_dmic_ops,
-        },
-};
-
-/* Audio machine driver */
-static struct snd_soc_card omap_abe_card = {
-        .owner = THIS_MODULE,
-
-        .dapm_widgets = twl6040_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets),
-        .dapm_routes = audio_map,
-        .num_dapm_routes = ARRAY_SIZE(audio_map),
-};
-
 static int omap_abe_probe(struct platform_device *pdev)
 {
         struct device_node *node = pdev->dev.of_node;
-        struct snd_soc_card *card = &omap_abe_card;
+        struct snd_soc_card *card;
         struct device_node *dai_node;
         struct abe_twl6040 *priv;
         int num_links = 0;
@@ -252,12 +224,18 @@ static int omap_abe_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        card->dev = &pdev->dev;
-
         priv = devm_kzalloc(&pdev->dev, sizeof(struct abe_twl6040), GFP_KERNEL);
         if (priv == NULL)
                 return -ENOMEM;
 
+        card = &priv->card;
+        card->dev = &pdev->dev;
+        card->owner = THIS_MODULE;
+        card->dapm_widgets = twl6040_dapm_widgets;
+        card->num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets);
+        card->dapm_routes = audio_map;
+        card->num_dapm_routes = ARRAY_SIZE(audio_map);
+
         if (snd_soc_of_parse_card_name(card, "ti,model")) {
                 dev_err(&pdev->dev, "Card name is not provided\n");
                 return -ENODEV;
@@ -274,14 +252,27 @@ static int omap_abe_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "McPDM node is not provided\n");
                 return -EINVAL;
         }
-        abe_twl6040_dai_links[0].cpu_of_node = dai_node;
-        abe_twl6040_dai_links[0].platform_of_node = dai_node;
+
+        priv->dai_links[0].name = "DMIC";
+        priv->dai_links[0].stream_name = "TWL6040";
+        priv->dai_links[0].cpu_of_node = dai_node;
+        priv->dai_links[0].platform_of_node = dai_node;
+        priv->dai_links[0].codec_dai_name = "twl6040-legacy";
+        priv->dai_links[0].codec_name = "twl6040-codec";
+        priv->dai_links[0].init = omap_abe_twl6040_init;
+        priv->dai_links[0].ops = &omap_abe_ops;
 
         dai_node = of_parse_phandle(node, "ti,dmic", 0);
         if (dai_node) {
                 num_links = 2;
-                abe_twl6040_dai_links[1].cpu_of_node = dai_node;
-                abe_twl6040_dai_links[1].platform_of_node = dai_node;
+                priv->dai_links[1].name = "TWL6040";
+                priv->dai_links[1].stream_name = "DMIC Capture";
+                priv->dai_links[1].cpu_of_node = dai_node;
+                priv->dai_links[1].platform_of_node = dai_node;
+                priv->dai_links[1].codec_dai_name = "dmic-hifi";
+                priv->dai_links[1].codec_name = "dmic-codec";
+                priv->dai_links[1].init = omap_abe_dmic_init;
+                priv->dai_links[1].ops = &omap_abe_dmic_ops;
         } else {
                 num_links = 1;
         }
@@ -300,7 +291,7 @@ static int omap_abe_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        card->dai_link = abe_twl6040_dai_links;
+        card->dai_link = priv->dai_links;
         card->num_links = num_links;
 
         snd_soc_card_set_drvdata(card, priv);
diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
index fe966272bd0c..cba9645b6487 100644
--- a/sound/soc/omap/omap-dmic.c
+++ b/sound/soc/omap/omap-dmic.c
@@ -48,6 +48,8 @@ struct omap_dmic {
         struct device *dev;
         void __iomem *io_base;
         struct clk *fclk;
+        struct pm_qos_request pm_qos_req;
+        int latency;
         int fclk_freq;
         int out_freq;
         int clk_div;
@@ -124,6 +126,8 @@ static void omap_dmic_dai_shutdown(struct snd_pcm_substream *substream,
 
         mutex_lock(&dmic->mutex);
 
+        pm_qos_remove_request(&dmic->pm_qos_req);
+
         if (!dai->active)
                 dmic->active = 0;
 
@@ -228,6 +232,8 @@ static int omap_dmic_dai_hw_params(struct snd_pcm_substream *substream,
         /* packet size is threshold * channels */
         dma_data = snd_soc_dai_get_dma_data(dai, substream);
         dma_data->maxburst = dmic->threshold * channels;
+        dmic->latency = (OMAP_DMIC_THRES_MAX - dmic->threshold) * USEC_PER_SEC /
+                        params_rate(params);
 
         return 0;
 }
@@ -238,6 +244,9 @@ static int omap_dmic_dai_prepare(struct snd_pcm_substream *substream,
         struct omap_dmic *dmic = snd_soc_dai_get_drvdata(dai);
         u32 ctrl;
 
+        if (pm_qos_request_active(&dmic->pm_qos_req))
+                pm_qos_update_request(&dmic->pm_qos_req, dmic->latency);
+
         /* Configure uplink threshold */
         omap_dmic_write(dmic, OMAP_DMIC_FIFO_CTRL_REG, dmic->threshold);
 
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index d0ebb6b9bfac..2d6decbfc99e 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -308,9 +308,9 @@ static int omap_mcbsp_dai_hw_params(struct snd_pcm_substream *substream,
                         pkt_size = channels;
                 }
 
-                latency = ((((buffer_size - pkt_size) / channels) * 1000)
-                                 / (params->rate_num / params->rate_den));
-
+                latency = (buffer_size - pkt_size) / channels;
+                latency = latency * USEC_PER_SEC /
+                          (params->rate_num / params->rate_den);
                 mcbsp->latency[substream->stream] = latency;
 
                 omap_mcbsp_set_threshold(substream, pkt_size);
diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
index 4c1be36c2207..7d5bdc5a2890 100644
--- a/sound/soc/omap/omap-mcpdm.c
+++ b/sound/soc/omap/omap-mcpdm.c
@@ -54,6 +54,8 @@ struct omap_mcpdm {
         unsigned long phys_base;
         void __iomem *io_base;
         int irq;
+        struct pm_qos_request pm_qos_req;
+        int latency[2];
 
         struct mutex mutex;
 
@@ -277,6 +279,9 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
                                   struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
+        int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
+        int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
+        int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
 
         mutex_lock(&mcpdm->mutex);
 
@@ -289,6 +294,14 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
                 }
         }
 
+        if (mcpdm->latency[stream2])
+                pm_qos_update_request(&mcpdm->pm_qos_req,
+                                      mcpdm->latency[stream2]);
+        else if (mcpdm->latency[stream1])
+                pm_qos_remove_request(&mcpdm->pm_qos_req);
+
+        mcpdm->latency[stream1] = 0;
+
         mutex_unlock(&mcpdm->mutex);
 }
 
@@ -300,7 +313,7 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
         int stream = substream->stream;
         struct snd_dmaengine_dai_dma_data *dma_data;
         u32 threshold;
-        int channels;
+        int channels, latency;
         int link_mask = 0;
 
         channels = params_channels(params);
@@ -344,14 +357,25 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
 
                 dma_data->maxburst =
                                 (MCPDM_DN_THRES_MAX - threshold) * channels;
+                latency = threshold;
         } else {
                 /* If playback is not running assume a stereo stream to come */
                 if (!mcpdm->config[!stream].link_mask)
                         mcpdm->config[!stream].link_mask = (0x3 << 3);
 
                 dma_data->maxburst = threshold * channels;
+                latency = (MCPDM_DN_THRES_MAX - threshold);
         }
 
+        /*
+         * The DMA must act to a DMA request within latency time (usec) to avoid
+         * under/overflow
+         */
+        mcpdm->latency[stream] = latency * USEC_PER_SEC / params_rate(params);
+
+        if (!mcpdm->latency[stream])
+                mcpdm->latency[stream] = 10;
+
         /* Check if we need to restart McPDM with this stream */
         if (mcpdm->config[stream].link_mask &&
             mcpdm->config[stream].link_mask != link_mask)
@@ -366,6 +390,20 @@ static int omap_mcpdm_prepare(struct snd_pcm_substream *substream,
                                   struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
+        struct pm_qos_request *pm_qos_req = &mcpdm->pm_qos_req;
+        int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
+        int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
+        int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+        int latency = mcpdm->latency[stream2];
+
+        /* Prevent omap hardware from hitting off between FIFO fills */
+        if (!latency || mcpdm->latency[stream1] < latency)
+                latency = mcpdm->latency[stream1];
+
+        if (pm_qos_request_active(pm_qos_req))
+                pm_qos_update_request(pm_qos_req, latency);
+        else if (latency)
+                pm_qos_add_request(pm_qos_req, PM_QOS_CPU_DMA_LATENCY, latency);
 
         if (!omap_mcpdm_active(mcpdm)) {
                 omap_mcpdm_start(mcpdm);
@@ -427,6 +465,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
         free_irq(mcpdm->irq, (void *)mcpdm);
         pm_runtime_disable(mcpdm->dev);
 
+        if (pm_qos_request_active(&mcpdm->pm_qos_req))
+                pm_qos_remove_request(&mcpdm->pm_qos_req);
+
         return 0;
 }
 
diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c
index eb1b9da05dd4..4715527054e5 100644
--- a/sound/soc/qcom/common.c
+++ b/sound/soc/qcom/common.c
@@ -13,6 +13,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
         struct device_node *cpu = NULL;
         struct device *dev = card->dev;
         struct snd_soc_dai_link *link;
+        struct of_phandle_args args;
         int ret, num_links;
 
         ret = snd_soc_of_parse_card_name(card, "model");
@@ -47,12 +48,14 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
                         goto err;
                 }
 
-                link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
-                if (!link->cpu_of_node) {
+                ret = of_parse_phandle_with_args(cpu, "sound-dai",
+                                        "#sound-dai-cells", 0, &args);
+                if (ret) {
                         dev_err(card->dev, "error getting cpu phandle\n");
-                        ret = -EINVAL;
                         goto err;
                 }
+                link->cpu_of_node = args.np;
+                link->id = args.args[0];
 
                 ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
                 if (ret) {
diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c
index 60ff4a2d3577..8f6c8fc073a9 100644
--- a/sound/soc/qcom/qdsp6/q6afe-dai.c
+++ b/sound/soc/qcom/qdsp6/q6afe-dai.c
@@ -1112,204 +1112,204 @@ static int q6afe_of_xlate_dai_name(struct snd_soc_component *component,
 }
 
 static const struct snd_soc_dapm_widget q6afe_dai_widgets[] = {
-        SND_SOC_DAPM_AIF_OUT("HDMI_RX", "HDMI Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_RX", "Slimbus Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_RX", "Slimbus1 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_RX", "Slimbus2 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_RX", "Slimbus3 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_RX", "Slimbus4 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_RX", "Slimbus5 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_RX", "Slimbus6 Playback", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_0_TX", "Slimbus Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_1_TX", "Slimbus1 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_2_TX", "Slimbus2 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_3_TX", "Slimbus3 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_4_TX", "Slimbus4 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_5_TX", "Slimbus5 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SLIMBUS_6_TX", "Slimbus6 Capture", 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_RX", "Quaternary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, 0, 0, 0),
+        SND_SOC_DAPM_AIF_IN("QUAT_MI2S_RX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_MI2S_TX", "Quaternary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_MI2S_RX", "Tertiary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_MI2S_RX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_MI2S_TX", "Tertiary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_RX", "Secondary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_MI2S_TX", "Secondary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_RX_SD1",
+        SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX_SD1",
                         "Secondary MI2S Playback SD1",
                         0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRI_MI2S_RX", "Primary MI2S Playback",
+        SND_SOC_DAPM_AIF_IN("PRI_MI2S_RX", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRI_MI2S_TX", "Primary MI2S Capture",
+        SND_SOC_DAPM_AIF_OUT("PRI_MI2S_TX", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_0", "Primary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_1", "Primary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_2", "Primary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_3", "Primary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_4", "Primary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_5", "Primary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_6", "Primary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_7", "Primary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_0", "Primary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_1", "Primary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_2", "Primary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_3", "Primary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_4", "Primary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_5", "Primary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_6", "Primary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_7", "Primary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_0", "Secondary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_1", "Secondary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_2", "Secondary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_3", "Secondary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_4", "Secondary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_5", "Secondary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_6", "Secondary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_7", "Secondary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_0", "Secondary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_1", "Secondary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_2", "Secondary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_3", "Secondary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_4", "Secondary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_5", "Secondary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_6", "Secondary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_7", "Secondary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_0", "Tertiary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_1", "Tertiary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_2", "Tertiary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_3", "Tertiary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_4", "Tertiary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_5", "Tertiary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_6", "Tertiary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_7", "Tertiary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_0", "Tertiary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_1", "Tertiary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_2", "Tertiary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_3", "Tertiary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_4", "Tertiary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_5", "Tertiary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_6", "Tertiary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_7", "Tertiary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_0", "Quaternary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_1", "Quaternary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_2", "Quaternary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_3", "Quaternary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_4", "Quaternary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_5", "Quaternary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_6", "Quaternary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_7", "Quaternary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_0", "Quaternary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_1", "Quaternary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_2", "Quaternary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_3", "Quaternary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_4", "Quaternary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_5", "Quaternary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_6", "Quaternary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_7", "Quaternary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_0", "Quinary TDM0 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_0", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_1", "Quinary TDM1 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_1", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_2", "Quinary TDM2 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_2", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_3", "Quinary TDM3 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_3", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_4", "Quinary TDM4 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_4", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_5", "Quinary TDM5 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_5", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_6", "Quinary TDM6 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_6", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_7", "Quinary TDM7 Playback",
+        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_7", NULL,
                              0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_0", "Quinary TDM0 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_0", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_1", "Quinary TDM1 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_1", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_2", "Quinary TDM2 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_2", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_3", "Quinary TDM3 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_3", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_4", "Quinary TDM4 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_4", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_5", "Quinary TDM5 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_5", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_6", "Quinary TDM6 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_6", NULL,
                                                 0, 0, 0, 0),
-        SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_7", "Quinary TDM7 Capture",
+        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_7", NULL,
                                                 0, 0, 0, 0),
 };
 
diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c
index 000775b4bba8..829b5e987b2a 100644
--- a/sound/soc/qcom/qdsp6/q6afe.c
+++ b/sound/soc/qcom/qdsp6/q6afe.c
@@ -49,14 +49,14 @@
 #define AFE_PORT_I2S_SD1                0x2
 #define AFE_PORT_I2S_SD2                0x3
 #define AFE_PORT_I2S_SD3                0x4
-#define AFE_PORT_I2S_SD0_MASK           BIT(0x1)
-#define AFE_PORT_I2S_SD1_MASK           BIT(0x2)
-#define AFE_PORT_I2S_SD2_MASK           BIT(0x3)
-#define AFE_PORT_I2S_SD3_MASK           BIT(0x4)
-#define AFE_PORT_I2S_SD0_1_MASK         GENMASK(2, 1)
-#define AFE_PORT_I2S_SD2_3_MASK         GENMASK(4, 3)
-#define AFE_PORT_I2S_SD0_1_2_MASK       GENMASK(3, 1)
-#define AFE_PORT_I2S_SD0_1_2_3_MASK     GENMASK(4, 1)
+#define AFE_PORT_I2S_SD0_MASK           BIT(0x0)
+#define AFE_PORT_I2S_SD1_MASK           BIT(0x1)
+#define AFE_PORT_I2S_SD2_MASK           BIT(0x2)
+#define AFE_PORT_I2S_SD3_MASK           BIT(0x3)
+#define AFE_PORT_I2S_SD0_1_MASK         GENMASK(1, 0)
+#define AFE_PORT_I2S_SD2_3_MASK         GENMASK(3, 2)
+#define AFE_PORT_I2S_SD0_1_2_MASK       GENMASK(2, 0)
+#define AFE_PORT_I2S_SD0_1_2_3_MASK     GENMASK(3, 0)
 #define AFE_PORT_I2S_QUAD01             0x5
 #define AFE_PORT_I2S_QUAD23             0x6
 #define AFE_PORT_I2S_6CHS               0x7
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index a16c71c03058..86115de5c1b2 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -122,7 +122,6 @@ static struct snd_pcm_hardware q6asm_dai_hardware_playback = {
                         .rate_max =     48000,                          \
                 },                                                      \
                 .name = "MultiMedia"#num,                               \
-                .probe = fe_dai_probe,                                  \
                 .id = MSM_FRONTEND_DAI_MULTIMEDIA##num,                 \
         }
 
@@ -511,38 +510,6 @@ static void q6asm_dai_pcm_free(struct snd_pcm *pcm)
         }
 }
 
-static const struct snd_soc_dapm_route afe_pcm_routes[] = {
-        {"MM_DL1",  NULL, "MultiMedia1 Playback" },
-        {"MM_DL2",  NULL, "MultiMedia2 Playback" },
-        {"MM_DL3",  NULL, "MultiMedia3 Playback" },
-        {"MM_DL4",  NULL, "MultiMedia4 Playback" },
-        {"MM_DL5",  NULL, "MultiMedia5 Playback" },
-        {"MM_DL6",  NULL, "MultiMedia6 Playback" },
-        {"MM_DL7",  NULL, "MultiMedia7 Playback" },
-        {"MM_DL7",  NULL, "MultiMedia8 Playback" },
-        {"MultiMedia1 Capture", NULL, "MM_UL1"},
-        {"MultiMedia2 Capture", NULL, "MM_UL2"},
-        {"MultiMedia3 Capture", NULL, "MM_UL3"},
-        {"MultiMedia4 Capture", NULL, "MM_UL4"},
-        {"MultiMedia5 Capture", NULL, "MM_UL5"},
-        {"MultiMedia6 Capture", NULL, "MM_UL6"},
-        {"MultiMedia7 Capture", NULL, "MM_UL7"},
-        {"MultiMedia8 Capture", NULL, "MM_UL8"},
-
-};
-
-static int fe_dai_probe(struct snd_soc_dai *dai)
-{
-        struct snd_soc_dapm_context *dapm;
-
-        dapm = snd_soc_component_get_dapm(dai->component);
-        snd_soc_dapm_add_routes(dapm, afe_pcm_routes,
-                                ARRAY_SIZE(afe_pcm_routes));
-
-        return 0;
-}
-
-
 static const struct snd_soc_component_driver q6asm_fe_dai_component = {
         .name           = DRV_NAME,
         .ops            = &q6asm_dai_ops,
diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index c6b51571be94..d61b8404f7da 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -909,6 +909,25 @@ static const struct snd_soc_dapm_route intercon[] = {
         {"MM_UL6", NULL, "MultiMedia6 Mixer"},
         {"MM_UL7", NULL, "MultiMedia7 Mixer"},
         {"MM_UL8", NULL, "MultiMedia8 Mixer"},
+
+        {"MM_DL1",  NULL, "MultiMedia1 Playback" },
+        {"MM_DL2",  NULL, "MultiMedia2 Playback" },
+        {"MM_DL3",  NULL, "MultiMedia3 Playback" },
+        {"MM_DL4",  NULL, "MultiMedia4 Playback" },
+        {"MM_DL5",  NULL, "MultiMedia5 Playback" },
+        {"MM_DL6",  NULL, "MultiMedia6 Playback" },
+        {"MM_DL7",  NULL, "MultiMedia7 Playback" },
+        {"MM_DL8",  NULL, "MultiMedia8 Playback" },
+
+        {"MultiMedia1 Capture", NULL, "MM_UL1"},
+        {"MultiMedia2 Capture", NULL, "MM_UL2"},
+        {"MultiMedia3 Capture", NULL, "MM_UL3"},
+        {"MultiMedia4 Capture", NULL, "MM_UL4"},
+        {"MultiMedia5 Capture", NULL, "MM_UL5"},
+        {"MultiMedia6 Capture", NULL, "MM_UL6"},
+        {"MultiMedia7 Capture", NULL, "MM_UL7"},
+        {"MultiMedia8 Capture", NULL, "MM_UL8"},
+
 };
 
 static int routing_hw_params(struct snd_pcm_substream *substream,
diff --git a/sound/soc/rockchip/rockchip_pcm.c b/sound/soc/rockchip/rockchip_pcm.c
index 9e7b5fa4cf59..4ac78d7a4b2d 100644
--- a/sound/soc/rockchip/rockchip_pcm.c
+++ b/sound/soc/rockchip/rockchip_pcm.c
@@ -33,6 +33,7 @@ static const struct snd_pcm_hardware snd_rockchip_hardware = {
 
 static const struct snd_dmaengine_pcm_config rk_dmaengine_pcm_config = {
         .pcm_hardware = &snd_rockchip_hardware,
+        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
         .prealloc_buffer_size = 32 * 1024,
 };
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index fcb4df23248c..6ec78f3096dd 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -306,7 +306,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         if (rsnd_ssi_is_multi_slave(mod, io))
                 return 0;
 
-        if (ssi->rate) {
+        if (ssi->usrcnt > 1) {
                 if (ssi->rate != rate) {
                         dev_err(dev, "SSI parent/child should use same rate\n");
                         return -EINVAL;
diff --git a/sound/soc/soc-acpi.c b/sound/soc/soc-acpi.c
index b8e72b52db30..4fb29f0e561e 100644
--- a/sound/soc/soc-acpi.c
+++ b/sound/soc/soc-acpi.c
@@ -10,11 +10,17 @@ struct snd_soc_acpi_mach *
 snd_soc_acpi_find_machine(struct snd_soc_acpi_mach *machines)
 {
         struct snd_soc_acpi_mach *mach;
+        struct snd_soc_acpi_mach *mach_alt;
 
         for (mach = machines; mach->id[0]; mach++) {
                 if (acpi_dev_present(mach->id, NULL, -1)) {
-                        if (mach->machine_quirk)
-                                mach = mach->machine_quirk(mach);
+                        if (mach->machine_quirk) {
+                                mach_alt = mach->machine_quirk(mach);
+                                if (!mach_alt)
+                                        continue; /* not full match, ignore */
+                                mach = mach_alt;
+                        }
+
                         return mach;
                 }
         }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 6ddcf12bc030..b29d0f65611e 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2131,6 +2131,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
         }
 
         card->instantiated = 1;
+        dapm_mark_endpoints_dirty(card);
         snd_soc_dapm_sync(&card->dapm);
         mutex_unlock(&card->mutex);
         mutex_unlock(&client_mutex);
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index ea05cc91aa05..211589b0b2ef 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -390,7 +390,7 @@ static int stm32_sai_add_mclk_provider(struct stm32_sai_sub_data *sai)
         char *mclk_name, *p, *s = (char *)pname;
         int ret, i = 0;
 
-        mclk = devm_kzalloc(dev, sizeof(mclk), GFP_KERNEL);
+        mclk = devm_kzalloc(dev, sizeof(*mclk), GFP_KERNEL);
         if (!mclk)
                 return -ENOMEM;
 
diff --git a/sound/soc/sunxi/Kconfig b/sound/soc/sunxi/Kconfig
index 66aad0d3f9c7..8134c3c94229 100644
--- a/sound/soc/sunxi/Kconfig
+++ b/sound/soc/sunxi/Kconfig
@@ -31,7 +31,7 @@ config SND_SUN8I_CODEC_ANALOG
 config SND_SUN50I_CODEC_ANALOG
         tristate "Allwinner sun50i Codec Analog Controls Support"
         depends on (ARM64 && ARCH_SUNXI) || COMPILE_TEST
-        select SND_SUNXI_ADDA_PR_REGMAP
+        select SND_SUN8I_ADDA_PR_REGMAP
         help
           Say Y or M if you want to add support for the analog controls for
           the codec embedded in Allwinner A64 SoC.
diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
index 522a72fde78d..92c5de026c43 100644
--- a/sound/soc/sunxi/sun8i-codec.c
+++ b/sound/soc/sunxi/sun8i-codec.c
@@ -481,7 +481,11 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
         { "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
           "AIF1 Slot 0 Right"},
 
-        /* ADC routes */
+        /* ADC Routes */
+        { "AIF1 Slot 0 Right ADC", NULL, "ADC" },
+        { "AIF1 Slot 0 Left ADC", NULL, "ADC" },
+
+        /* ADC Mixer Routes */
         { "Left Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
           "AIF1 Slot 0 Left ADC" },
         { "Right Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
@@ -605,16 +609,10 @@ err_pm_disable:
 
 static int sun8i_codec_remove(struct platform_device *pdev)
 {
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
-        struct sun8i_codec *scodec = snd_soc_card_get_drvdata(card);
-
         pm_runtime_disable(&pdev->dev);
         if (!pm_runtime_status_suspended(&pdev->dev))
                 sun8i_codec_runtime_suspend(&pdev->dev);
 
-        clk_disable_unprepare(scodec->clk_module);
-        clk_disable_unprepare(scodec->clk_bus);
-
         return 0;
 }
 
diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c
index e73c962590eb..079063d8038d 100644
--- a/sound/sparc/cs4231.c
+++ b/sound/sparc/cs4231.c
@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(struct snd_pcm_substream *substream)
         runtime->hw = snd_cs4231_playback;
 
         err = snd_cs4231_open(chip, CS4231_MODE_PLAY);
-        if (err < 0) {
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+        if (err < 0)
                 return err;
-        }
         chip->playback_substream = substream;
         chip->p_periods_sent = 0;
         snd_pcm_set_sync(substream);
@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struct snd_pcm_substream *substream)
         runtime->hw = snd_cs4231_capture;
 
         err = snd_cs4231_open(chip, CS4231_MODE_RECORD);
-        if (err < 0) {
-                snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+        if (err < 0)
                 return err;
-        }
         chip->capture_substream = substream;
         chip->c_periods_sent = 0;
         snd_pcm_set_sync(substream);
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 849953e5775c..37fc0447c071 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3382,5 +3382,15 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
                 .ifnum = QUIRK_NO_INTERFACE
         }
 },
+/* Dell WD19 Dock */
+{
+        USB_DEVICE(0x0bda, 0x402e),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .vendor_name = "Dell",
+                .product_name = "WD19 Dock",
+                .profile_name = "Dell-WD15-Dock",
+                .ifnum = QUIRK_NO_INTERFACE
+        }
+},
 
 #undef USB_DEVICE_VENDOR_SPEC
diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
index edbe81534c6d..d07ccf8a23f7 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
@@ -137,4 +137,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-map**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index f55a2daed59b..7bb787cfa971 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -171,4 +171,10 @@ The following three commands are equivalent:
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-cgroup**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-net.rst b/tools/bpf/bpftool/Documentation/bpftool-net.rst
index 408ec30d8872..ed87c9b619ad 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-net.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-net.rst
@@ -136,4 +136,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-map**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-perf.rst b/tools/bpf/bpftool/Documentation/bpftool-perf.rst
index e3eb0eab7641..f4c5e5538bb8 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-perf.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-perf.rst
@@ -78,4 +78,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-map**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
index ac4e904b10fb..ecf618807125 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
@@ -124,7 +124,8 @@ OPTIONS
                   Generate human-readable JSON output. Implies **-j**.
 
         -f, --bpffs
-                  Show file names of pinned programs.
+                  When showing BPF programs, show file names of pinned
+                  programs.
 
 EXAMPLES
 ========
@@ -206,4 +207,10 @@ EXAMPLES
 
 SEE ALSO
 ========
-        **bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/Documentation/bpftool.rst b/tools/bpf/bpftool/Documentation/bpftool.rst
index 04cd4f92ab89..129b7a9c0f9b 100644
--- a/tools/bpf/bpftool/Documentation/bpftool.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool.rst
@@ -63,5 +63,10 @@ OPTIONS
 
 SEE ALSO
 ========
-        **bpftool-map**\ (8), **bpftool-prog**\ (8), **bpftool-cgroup**\ (8)
-        **bpftool-perf**\ (8), **bpftool-net**\ (8)
+        **bpf**\ (2),
+        **bpf-helpers**\ (7),
+        **bpftool-prog**\ (8),
+        **bpftool-map**\ (8),
+        **bpftool-cgroup**\ (8),
+        **bpftool-net**\ (8),
+        **bpftool-perf**\ (8)
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 25af85304ebe..70fd48d79f61 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -130,16 +130,17 @@ static int mnt_bpffs(const char *target, char *buff, size_t bufflen)
         return 0;
 }
 
-int open_obj_pinned(char *path)
+int open_obj_pinned(char *path, bool quiet)
 {
         int fd;
 
         fd = bpf_obj_get(path);
         if (fd < 0) {
-                p_err("bpf obj get (%s): %s", path,
-                      errno == EACCES && !is_bpffs(dirname(path)) ?
-                    "directory not in bpf file system (bpffs)" :
-                    strerror(errno));
+                if (!quiet)
+                        p_err("bpf obj get (%s): %s", path,
+                              errno == EACCES && !is_bpffs(dirname(path)) ?
+                            "directory not in bpf file system (bpffs)" :
+                            strerror(errno));
                 return -1;
         }
 
@@ -151,7 +152,7 @@ int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type)
         enum bpf_obj_type type;
         int fd;
 
-        fd = open_obj_pinned(path);
+        fd = open_obj_pinned(path, false);
         if (fd < 0)
                 return -1;
 
@@ -304,7 +305,7 @@ char *get_fdinfo(int fd, const char *key)
                 return NULL;
         }
 
-        while ((n = getline(&line, &line_n, fdi))) {
+        while ((n = getline(&line, &line_n, fdi)) > 0) {
                 char *value;
                 int len;
 
@@ -384,7 +385,7 @@ int build_pinned_obj_table(struct pinned_obj_table *tab,
                 while ((ftse = fts_read(fts))) {
                         if (!(ftse->fts_info & FTS_F))
                                 continue;
-                        fd = open_obj_pinned(ftse->fts_path);
+                        fd = open_obj_pinned(ftse->fts_path, true);
                         if (fd < 0)
                                 continue;
 
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 28322ace2856..a8bf1e2d9818 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -127,7 +127,7 @@ int cmd_select(const struct cmd *cmds, int argc, char **argv,
 int get_fd_type(int fd);
 const char *get_fd_type_name(enum bpf_obj_type type);
 char *get_fdinfo(int fd, const char *key);
-int open_obj_pinned(char *path);
+int open_obj_pinned(char *path, bool quiet);
 int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type);
 int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32));
 int do_pin_fd(int fd, const char *name);
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 5302ee282409..ccee180dfb76 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -357,10 +357,9 @@ static void print_prog_plain(struct bpf_prog_info *info, int fd)
         if (!hash_empty(prog_table.table)) {
                 struct pinned_obj *obj;
 
-                printf("\n");
                 hash_for_each_possible(prog_table.table, obj, hash, info->id) {
                         if (obj->id == info->id)
-                                printf("\tpinned %s\n", obj->path);
+                                printf("\n\tpinned %s", obj->path);
                 }
         }
 
@@ -845,6 +844,7 @@ static int do_load(int argc, char **argv)
                         }
                         NEXT_ARG();
                 } else if (is_prefix(*argv, "map")) {
+                        void *new_map_replace;
                         char *endptr, *name;
                         int fd;
 
@@ -878,12 +878,15 @@ static int do_load(int argc, char **argv)
                         if (fd < 0)
                                 goto err_free_reuse_maps;
 
-                        map_replace = reallocarray(map_replace, old_map_fds + 1,
-                                                   sizeof(*map_replace));
-                        if (!map_replace) {
+                        new_map_replace = reallocarray(map_replace,
+                                                       old_map_fds + 1,
+                                                       sizeof(*map_replace));
+                        if (!new_map_replace) {
                                 p_err("mem alloc failed");
                                 goto err_free_reuse_maps;
                         }
+                        map_replace = new_map_replace;
+
                         map_replace[old_map_fds].idx = idx;
                         map_replace[old_map_fds].name = name;
                         map_replace[old_map_fds].fd = fd;
diff --git a/tools/include/uapi/linux/pkt_cls.h b/tools/include/uapi/linux/pkt_cls.h
new file mode 100644
index 000000000000..401d0c1e612d
--- /dev/null
+++ b/tools/include/uapi/linux/pkt_cls.h
@@ -0,0 +1,612 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __LINUX_PKT_CLS_H
+#define __LINUX_PKT_CLS_H
+
+#include <linux/types.h>
+#include <linux/pkt_sched.h>
+
+#define TC_COOKIE_MAX_SIZE 16
+
+/* Action attributes */
+enum {
+        TCA_ACT_UNSPEC,
+        TCA_ACT_KIND,
+        TCA_ACT_OPTIONS,
+        TCA_ACT_INDEX,
+        TCA_ACT_STATS,
+        TCA_ACT_PAD,
+        TCA_ACT_COOKIE,
+        __TCA_ACT_MAX
+};
+
+#define TCA_ACT_MAX __TCA_ACT_MAX
+#define TCA_OLD_COMPAT (TCA_ACT_MAX+1)
+#define TCA_ACT_MAX_PRIO 32
+#define TCA_ACT_BIND    1
+#define TCA_ACT_NOBIND  0
+#define TCA_ACT_UNBIND  1
+#define TCA_ACT_NOUNBIND        0
+#define TCA_ACT_REPLACE         1
+#define TCA_ACT_NOREPLACE       0
+
+#define TC_ACT_UNSPEC   (-1)
+#define TC_ACT_OK               0
+#define TC_ACT_RECLASSIFY       1
+#define TC_ACT_SHOT             2
+#define TC_ACT_PIPE             3
+#define TC_ACT_STOLEN           4
+#define TC_ACT_QUEUED           5
+#define TC_ACT_REPEAT           6
+#define TC_ACT_REDIRECT         7
+#define TC_ACT_TRAP             8 /* For hw path, this means "trap to cpu"
+                                   * and don't further process the frame
+                                   * in hardware. For sw path, this is
+                                   * equivalent of TC_ACT_STOLEN - drop
+                                   * the skb and act like everything
+                                   * is alright.
+                                   */
+#define TC_ACT_VALUE_MAX        TC_ACT_TRAP
+
+/* There is a special kind of actions called "extended actions",
+ * which need a value parameter. These have a local opcode located in
+ * the highest nibble, starting from 1. The rest of the bits
+ * are used to carry the value. These two parts together make
+ * a combined opcode.
+ */
+#define __TC_ACT_EXT_SHIFT 28
+#define __TC_ACT_EXT(local) ((local) << __TC_ACT_EXT_SHIFT)
+#define TC_ACT_EXT_VAL_MASK ((1 << __TC_ACT_EXT_SHIFT) - 1)
+#define TC_ACT_EXT_OPCODE(combined) ((combined) & (~TC_ACT_EXT_VAL_MASK))
+#define TC_ACT_EXT_CMP(combined, opcode) (TC_ACT_EXT_OPCODE(combined) == opcode)
+
+#define TC_ACT_JUMP __TC_ACT_EXT(1)
+#define TC_ACT_GOTO_CHAIN __TC_ACT_EXT(2)
+#define TC_ACT_EXT_OPCODE_MAX   TC_ACT_GOTO_CHAIN
+
+/* Action type identifiers*/
+enum {
+        TCA_ID_UNSPEC=0,
+        TCA_ID_POLICE=1,
+        /* other actions go here */
+        __TCA_ID_MAX=255
+};
+
+#define TCA_ID_MAX __TCA_ID_MAX
+
+struct tc_police {
+        __u32                   index;
+        int                     action;
+#define TC_POLICE_UNSPEC        TC_ACT_UNSPEC
+#define TC_POLICE_OK            TC_ACT_OK
+#define TC_POLICE_RECLASSIFY    TC_ACT_RECLASSIFY
+#define TC_POLICE_SHOT          TC_ACT_SHOT
+#define TC_POLICE_PIPE          TC_ACT_PIPE
+
+        __u32                   limit;
+        __u32                   burst;
+        __u32                   mtu;
+        struct tc_ratespec      rate;
+        struct tc_ratespec      peakrate;
+        int                     refcnt;
+        int                     bindcnt;
+        __u32                   capab;
+};
+
+struct tcf_t {
+        __u64   install;
+        __u64   lastuse;
+        __u64   expires;
+        __u64   firstuse;
+};
+
+struct tc_cnt {
+        int                   refcnt;
+        int                   bindcnt;
+};
+
+#define tc_gen \
+        __u32                 index; \
+        __u32                 capab; \
+        int                   action; \
+        int                   refcnt; \
+        int                   bindcnt
+
+enum {
+        TCA_POLICE_UNSPEC,
+        TCA_POLICE_TBF,
+        TCA_POLICE_RATE,
+        TCA_POLICE_PEAKRATE,
+        TCA_POLICE_AVRATE,
+        TCA_POLICE_RESULT,
+        TCA_POLICE_TM,
+        TCA_POLICE_PAD,
+        __TCA_POLICE_MAX
+#define TCA_POLICE_RESULT TCA_POLICE_RESULT
+};
+
+#define TCA_POLICE_MAX (__TCA_POLICE_MAX - 1)
+
+/* tca flags definitions */
+#define TCA_CLS_FLAGS_SKIP_HW   (1 << 0) /* don't offload filter to HW */
+#define TCA_CLS_FLAGS_SKIP_SW   (1 << 1) /* don't use filter in SW */
+#define TCA_CLS_FLAGS_IN_HW     (1 << 2) /* filter is offloaded to HW */
+#define TCA_CLS_FLAGS_NOT_IN_HW (1 << 3) /* filter isn't offloaded to HW */
+#define TCA_CLS_FLAGS_VERBOSE   (1 << 4) /* verbose logging */
+
+/* U32 filters */
+
+#define TC_U32_HTID(h) ((h)&0xFFF00000)
+#define TC_U32_USERHTID(h) (TC_U32_HTID(h)>>20)
+#define TC_U32_HASH(h) (((h)>>12)&0xFF)
+#define TC_U32_NODE(h) ((h)&0xFFF)
+#define TC_U32_KEY(h) ((h)&0xFFFFF)
+#define TC_U32_UNSPEC   0
+#define TC_U32_ROOT     (0xFFF00000)
+
+enum {
+        TCA_U32_UNSPEC,
+        TCA_U32_CLASSID,
+        TCA_U32_HASH,
+        TCA_U32_LINK,
+        TCA_U32_DIVISOR,
+        TCA_U32_SEL,
+        TCA_U32_POLICE,
+        TCA_U32_ACT,
+        TCA_U32_INDEV,
+        TCA_U32_PCNT,
+        TCA_U32_MARK,
+        TCA_U32_FLAGS,
+        TCA_U32_PAD,
+        __TCA_U32_MAX
+};
+
+#define TCA_U32_MAX (__TCA_U32_MAX - 1)
+
+struct tc_u32_key {
+        __be32          mask;
+        __be32          val;
+        int             off;
+        int             offmask;
+};
+
+struct tc_u32_sel {
+        unsigned char           flags;
+        unsigned char           offshift;
+        unsigned char           nkeys;
+
+        __be16                  offmask;
+        __u16                   off;
+        short                   offoff;
+
+        short                   hoff;
+        __be32                  hmask;
+        struct tc_u32_key       keys[0];
+};
+
+struct tc_u32_mark {
+        __u32           val;
+        __u32           mask;
+        __u32           success;
+};
+
+struct tc_u32_pcnt {
+        __u64 rcnt;
+        __u64 rhit;
+        __u64 kcnts[0];
+};
+
+/* Flags */
+
+#define TC_U32_TERMINAL         1
+#define TC_U32_OFFSET           2
+#define TC_U32_VAROFFSET        4
+#define TC_U32_EAT              8
+
+#define TC_U32_MAXDEPTH 8
+
+
+/* RSVP filter */
+
+enum {
+        TCA_RSVP_UNSPEC,
+        TCA_RSVP_CLASSID,
+        TCA_RSVP_DST,
+        TCA_RSVP_SRC,
+        TCA_RSVP_PINFO,
+        TCA_RSVP_POLICE,
+        TCA_RSVP_ACT,
+        __TCA_RSVP_MAX
+};
+
+#define TCA_RSVP_MAX (__TCA_RSVP_MAX - 1 )
+
+struct tc_rsvp_gpi {
+        __u32   key;
+        __u32   mask;
+        int     offset;
+};
+
+struct tc_rsvp_pinfo {
+        struct tc_rsvp_gpi dpi;
+        struct tc_rsvp_gpi spi;
+        __u8    protocol;
+        __u8    tunnelid;
+        __u8    tunnelhdr;
+        __u8    pad;
+};
+
+/* ROUTE filter */
+
+enum {
+        TCA_ROUTE4_UNSPEC,
+        TCA_ROUTE4_CLASSID,
+        TCA_ROUTE4_TO,
+        TCA_ROUTE4_FROM,
+        TCA_ROUTE4_IIF,
+        TCA_ROUTE4_POLICE,
+        TCA_ROUTE4_ACT,
+        __TCA_ROUTE4_MAX
+};
+
+#define TCA_ROUTE4_MAX (__TCA_ROUTE4_MAX - 1)
+
+
+/* FW filter */
+
+enum {
+        TCA_FW_UNSPEC,
+        TCA_FW_CLASSID,
+        TCA_FW_POLICE,
+        TCA_FW_INDEV, /*  used by CONFIG_NET_CLS_IND */
+        TCA_FW_ACT, /* used by CONFIG_NET_CLS_ACT */
+        TCA_FW_MASK,
+        __TCA_FW_MAX
+};
+
+#define TCA_FW_MAX (__TCA_FW_MAX - 1)
+
+/* TC index filter */
+
+enum {
+        TCA_TCINDEX_UNSPEC,
+        TCA_TCINDEX_HASH,
+        TCA_TCINDEX_MASK,
+        TCA_TCINDEX_SHIFT,
+        TCA_TCINDEX_FALL_THROUGH,
+        TCA_TCINDEX_CLASSID,
+        TCA_TCINDEX_POLICE,
+        TCA_TCINDEX_ACT,
+        __TCA_TCINDEX_MAX
+};
+
+#define TCA_TCINDEX_MAX     (__TCA_TCINDEX_MAX - 1)
+
+/* Flow filter */
+
+enum {
+        FLOW_KEY_SRC,
+        FLOW_KEY_DST,
+        FLOW_KEY_PROTO,
+        FLOW_KEY_PROTO_SRC,
+        FLOW_KEY_PROTO_DST,
+        FLOW_KEY_IIF,
+        FLOW_KEY_PRIORITY,
+        FLOW_KEY_MARK,
+        FLOW_KEY_NFCT,
+        FLOW_KEY_NFCT_SRC,
+        FLOW_KEY_NFCT_DST,
+        FLOW_KEY_NFCT_PROTO_SRC,
+        FLOW_KEY_NFCT_PROTO_DST,
+        FLOW_KEY_RTCLASSID,
+        FLOW_KEY_SKUID,
+        FLOW_KEY_SKGID,
+        FLOW_KEY_VLAN_TAG,
+        FLOW_KEY_RXHASH,
+        __FLOW_KEY_MAX,
+};
+
+#define FLOW_KEY_MAX    (__FLOW_KEY_MAX - 1)
+
+enum {
+        FLOW_MODE_MAP,
+        FLOW_MODE_HASH,
+};
+
+enum {
+        TCA_FLOW_UNSPEC,
+        TCA_FLOW_KEYS,
+        TCA_FLOW_MODE,
+        TCA_FLOW_BASECLASS,
+        TCA_FLOW_RSHIFT,
+        TCA_FLOW_ADDEND,
+        TCA_FLOW_MASK,
+        TCA_FLOW_XOR,
+        TCA_FLOW_DIVISOR,
+        TCA_FLOW_ACT,
+        TCA_FLOW_POLICE,
+        TCA_FLOW_EMATCHES,
+        TCA_FLOW_PERTURB,
+        __TCA_FLOW_MAX
+};
+
+#define TCA_FLOW_MAX    (__TCA_FLOW_MAX - 1)
+
+/* Basic filter */
+
+enum {
+        TCA_BASIC_UNSPEC,
+        TCA_BASIC_CLASSID,
+        TCA_BASIC_EMATCHES,
+        TCA_BASIC_ACT,
+        TCA_BASIC_POLICE,
+        __TCA_BASIC_MAX
+};
+
+#define TCA_BASIC_MAX (__TCA_BASIC_MAX - 1)
+
+
+/* Cgroup classifier */
+
+enum {
+        TCA_CGROUP_UNSPEC,
+        TCA_CGROUP_ACT,
+        TCA_CGROUP_POLICE,
+        TCA_CGROUP_EMATCHES,
+        __TCA_CGROUP_MAX,
+};
+
+#define TCA_CGROUP_MAX (__TCA_CGROUP_MAX - 1)
+
+/* BPF classifier */
+
+#define TCA_BPF_FLAG_ACT_DIRECT         (1 << 0)
+
+enum {
+        TCA_BPF_UNSPEC,
+        TCA_BPF_ACT,
+        TCA_BPF_POLICE,
+        TCA_BPF_CLASSID,
+        TCA_BPF_OPS_LEN,
+        TCA_BPF_OPS,
+        TCA_BPF_FD,
+        TCA_BPF_NAME,
+        TCA_BPF_FLAGS,
+        TCA_BPF_FLAGS_GEN,
+        TCA_BPF_TAG,
+        TCA_BPF_ID,
+        __TCA_BPF_MAX,
+};
+
+#define TCA_BPF_MAX (__TCA_BPF_MAX - 1)
+
+/* Flower classifier */
+
+enum {
+        TCA_FLOWER_UNSPEC,
+        TCA_FLOWER_CLASSID,
+        TCA_FLOWER_INDEV,
+        TCA_FLOWER_ACT,
+        TCA_FLOWER_KEY_ETH_DST,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_DST_MASK,    /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_SRC,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_SRC_MASK,    /* ETH_ALEN */
+        TCA_FLOWER_KEY_ETH_TYPE,        /* be16 */
+        TCA_FLOWER_KEY_IP_PROTO,        /* u8 */
+        TCA_FLOWER_KEY_IPV4_SRC,        /* be32 */
+        TCA_FLOWER_KEY_IPV4_SRC_MASK,   /* be32 */
+        TCA_FLOWER_KEY_IPV4_DST,        /* be32 */
+        TCA_FLOWER_KEY_IPV4_DST_MASK,   /* be32 */
+        TCA_FLOWER_KEY_IPV6_SRC,        /* struct in6_addr */
+        TCA_FLOWER_KEY_IPV6_SRC_MASK,   /* struct in6_addr */
+        TCA_FLOWER_KEY_IPV6_DST,        /* struct in6_addr */
+        TCA_FLOWER_KEY_IPV6_DST_MASK,   /* struct in6_addr */
+        TCA_FLOWER_KEY_TCP_SRC,         /* be16 */
+        TCA_FLOWER_KEY_TCP_DST,         /* be16 */
+        TCA_FLOWER_KEY_UDP_SRC,         /* be16 */
+        TCA_FLOWER_KEY_UDP_DST,         /* be16 */
+
+        TCA_FLOWER_FLAGS,
+        TCA_FLOWER_KEY_VLAN_ID,         /* be16 */
+        TCA_FLOWER_KEY_VLAN_PRIO,       /* u8   */
+        TCA_FLOWER_KEY_VLAN_ETH_TYPE,   /* be16 */
+
+        TCA_FLOWER_KEY_ENC_KEY_ID,      /* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_SRC,    /* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_SRC_MASK,/* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_DST,    /* be32 */
+        TCA_FLOWER_KEY_ENC_IPV4_DST_MASK,/* be32 */
+        TCA_FLOWER_KEY_ENC_IPV6_SRC,    /* struct in6_addr */
+        TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK,/* struct in6_addr */
+        TCA_FLOWER_KEY_ENC_IPV6_DST,    /* struct in6_addr */
+        TCA_FLOWER_KEY_ENC_IPV6_DST_MASK,/* struct in6_addr */
+
+        TCA_FLOWER_KEY_TCP_SRC_MASK,    /* be16 */
+        TCA_FLOWER_KEY_TCP_DST_MASK,    /* be16 */
+        TCA_FLOWER_KEY_UDP_SRC_MASK,    /* be16 */
+        TCA_FLOWER_KEY_UDP_DST_MASK,    /* be16 */
+        TCA_FLOWER_KEY_SCTP_SRC_MASK,   /* be16 */
+        TCA_FLOWER_KEY_SCTP_DST_MASK,   /* be16 */
+
+        TCA_FLOWER_KEY_SCTP_SRC,        /* be16 */
+        TCA_FLOWER_KEY_SCTP_DST,        /* be16 */
+
+        TCA_FLOWER_KEY_ENC_UDP_SRC_PORT,        /* be16 */
+        TCA_FLOWER_KEY_ENC_UDP_SRC_PORT_MASK,   /* be16 */
+        TCA_FLOWER_KEY_ENC_UDP_DST_PORT,        /* be16 */
+        TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK,   /* be16 */
+
+        TCA_FLOWER_KEY_FLAGS,           /* be32 */
+        TCA_FLOWER_KEY_FLAGS_MASK,      /* be32 */
+
+        TCA_FLOWER_KEY_ICMPV4_CODE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV4_CODE_MASK,/* u8 */
+        TCA_FLOWER_KEY_ICMPV4_TYPE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,/* u8 */
+        TCA_FLOWER_KEY_ICMPV6_CODE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV6_CODE_MASK,/* u8 */
+        TCA_FLOWER_KEY_ICMPV6_TYPE,     /* u8 */
+        TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,/* u8 */
+
+        TCA_FLOWER_KEY_ARP_SIP,         /* be32 */
+        TCA_FLOWER_KEY_ARP_SIP_MASK,    /* be32 */
+        TCA_FLOWER_KEY_ARP_TIP,         /* be32 */
+        TCA_FLOWER_KEY_ARP_TIP_MASK,    /* be32 */
+        TCA_FLOWER_KEY_ARP_OP,          /* u8 */
+        TCA_FLOWER_KEY_ARP_OP_MASK,     /* u8 */
+        TCA_FLOWER_KEY_ARP_SHA,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ARP_SHA_MASK,    /* ETH_ALEN */
+        TCA_FLOWER_KEY_ARP_THA,         /* ETH_ALEN */
+        TCA_FLOWER_KEY_ARP_THA_MASK,    /* ETH_ALEN */
+
+        TCA_FLOWER_KEY_MPLS_TTL,        /* u8 - 8 bits */
+        TCA_FLOWER_KEY_MPLS_BOS,        /* u8 - 1 bit */
+        TCA_FLOWER_KEY_MPLS_TC,         /* u8 - 3 bits */
+        TCA_FLOWER_KEY_MPLS_LABEL,      /* be32 - 20 bits */
+
+        TCA_FLOWER_KEY_TCP_FLAGS,       /* be16 */
+        TCA_FLOWER_KEY_TCP_FLAGS_MASK,  /* be16 */
+
+        TCA_FLOWER_KEY_IP_TOS,          /* u8 */
+        TCA_FLOWER_KEY_IP_TOS_MASK,     /* u8 */
+        TCA_FLOWER_KEY_IP_TTL,          /* u8 */
+        TCA_FLOWER_KEY_IP_TTL_MASK,     /* u8 */
+
+        TCA_FLOWER_KEY_CVLAN_ID,        /* be16 */
+        TCA_FLOWER_KEY_CVLAN_PRIO,      /* u8   */
+        TCA_FLOWER_KEY_CVLAN_ETH_TYPE,  /* be16 */
+
+        TCA_FLOWER_KEY_ENC_IP_TOS,      /* u8 */
+        TCA_FLOWER_KEY_ENC_IP_TOS_MASK, /* u8 */
+        TCA_FLOWER_KEY_ENC_IP_TTL,      /* u8 */
+        TCA_FLOWER_KEY_ENC_IP_TTL_MASK, /* u8 */
+
+        TCA_FLOWER_KEY_ENC_OPTS,
+        TCA_FLOWER_KEY_ENC_OPTS_MASK,
+
+        TCA_FLOWER_IN_HW_COUNT,
+
+        __TCA_FLOWER_MAX,
+};
+
+#define TCA_FLOWER_MAX (__TCA_FLOWER_MAX - 1)
+
+enum {
+        TCA_FLOWER_KEY_ENC_OPTS_UNSPEC,
+        TCA_FLOWER_KEY_ENC_OPTS_GENEVE, /* Nested
+                                         * TCA_FLOWER_KEY_ENC_OPT_GENEVE_
+                                         * attributes
+                                         */
+        __TCA_FLOWER_KEY_ENC_OPTS_MAX,
+};
+
+#define TCA_FLOWER_KEY_ENC_OPTS_MAX (__TCA_FLOWER_KEY_ENC_OPTS_MAX - 1)
+
+enum {
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_UNSPEC,
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS,            /* u16 */
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE,             /* u8 */
+        TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA,             /* 4 to 128 bytes */
+
+        __TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX,
+};
+
+#define TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX \
+                (__TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX - 1)
+
+enum {
+        TCA_FLOWER_KEY_FLAGS_IS_FRAGMENT = (1 << 0),
+        TCA_FLOWER_KEY_FLAGS_FRAG_IS_FIRST = (1 << 1),
+};
+
+/* Match-all classifier */
+
+enum {
+        TCA_MATCHALL_UNSPEC,
+        TCA_MATCHALL_CLASSID,
+        TCA_MATCHALL_ACT,
+        TCA_MATCHALL_FLAGS,
+        __TCA_MATCHALL_MAX,
+};
+
+#define TCA_MATCHALL_MAX (__TCA_MATCHALL_MAX - 1)
+
+/* Extended Matches */
+
+struct tcf_ematch_tree_hdr {
+        __u16           nmatches;
+        __u16           progid;
+};
+
+enum {
+        TCA_EMATCH_TREE_UNSPEC,
+        TCA_EMATCH_TREE_HDR,
+        TCA_EMATCH_TREE_LIST,
+        __TCA_EMATCH_TREE_MAX
+};
+#define TCA_EMATCH_TREE_MAX (__TCA_EMATCH_TREE_MAX - 1)
+
+struct tcf_ematch_hdr {
+        __u16           matchid;
+        __u16           kind;
+        __u16           flags;
+        __u16           pad; /* currently unused */
+};
+
+/*  0                   1
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 
+ * +-----------------------+-+-+---+
+ * |         Unused        |S|I| R |
+ * +-----------------------+-+-+---+
+ *
+ * R(2) ::= relation to next ematch
+ *          where: 0 0 END (last ematch)
+ *                 0 1 AND
+ *                 1 0 OR
+ *                 1 1 Unused (invalid)
+ * I(1) ::= invert result
+ * S(1) ::= simple payload
+ */
+#define TCF_EM_REL_END  0
+#define TCF_EM_REL_AND  (1<<0)
+#define TCF_EM_REL_OR   (1<<1)
+#define TCF_EM_INVERT   (1<<2)
+#define TCF_EM_SIMPLE   (1<<3)
+
+#define TCF_EM_REL_MASK 3
+#define TCF_EM_REL_VALID(v) (((v) & TCF_EM_REL_MASK) != TCF_EM_REL_MASK)
+
+enum {
+        TCF_LAYER_LINK,
+        TCF_LAYER_NETWORK,
+        TCF_LAYER_TRANSPORT,
+        __TCF_LAYER_MAX
+};
+#define TCF_LAYER_MAX (__TCF_LAYER_MAX - 1)
+
+/* Ematch type assignments
+ *   1..32767           Reserved for ematches inside kernel tree
+ *   32768..65535       Free to use, not reliable
+ */
+#define TCF_EM_CONTAINER        0
+#define TCF_EM_CMP              1
+#define TCF_EM_NBYTE            2
+#define TCF_EM_U32              3
+#define TCF_EM_META             4
+#define TCF_EM_TEXT             5
+#define TCF_EM_VLAN             6
+#define TCF_EM_CANID            7
+#define TCF_EM_IPSET            8
+#define TCF_EM_IPT              9
+#define TCF_EM_MAX              9
+
+enum {
+        TCF_EM_PROG_TC
+};
+
+enum {
+        TCF_EM_OPND_EQ,
+        TCF_EM_OPND_GT,
+        TCF_EM_OPND_LT
+};
+
+#endif
diff --git a/tools/include/uapi/linux/prctl.h b/tools/include/uapi/linux/prctl.h
index c0d7ea0bf5b6..b17201edfa09 100644
--- a/tools/include/uapi/linux/prctl.h
+++ b/tools/include/uapi/linux/prctl.h
@@ -212,6 +212,7 @@ struct prctl_mm_map {
 #define PR_SET_SPECULATION_CTRL         53
 /* Speculation control variants */
 # define PR_SPEC_STORE_BYPASS           0
+# define PR_SPEC_INDIRECT_BRANCH        1
 /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
 # define PR_SPEC_NOT_AFFECTED           0
 # define PR_SPEC_PRCTL                  (1UL << 0)
diff --git a/tools/include/uapi/linux/tc_act/tc_bpf.h b/tools/include/uapi/linux/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..6e89a5df49a4
--- /dev/null
+++ b/tools/include/uapi/linux/tc_act/tc_bpf.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __LINUX_TC_BPF_H
+#define __LINUX_TC_BPF_H
+
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_BPF 13
+
+struct tc_act_bpf {
+        tc_gen;
+};
+
+enum {
+        TCA_ACT_BPF_UNSPEC,
+        TCA_ACT_BPF_TM,
+        TCA_ACT_BPF_PARMS,
+        TCA_ACT_BPF_OPS_LEN,
+        TCA_ACT_BPF_OPS,
+        TCA_ACT_BPF_FD,
+        TCA_ACT_BPF_NAME,
+        TCA_ACT_BPF_PAD,
+        TCA_ACT_BPF_TAG,
+        TCA_ACT_BPF_ID,
+        __TCA_ACT_BPF_MAX,
+};
+#define TCA_ACT_BPF_MAX (__TCA_ACT_BPF_MAX - 1)
+
+#endif
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 6dbb9fae0f9d..b8f3cca8e58b 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -31,6 +31,8 @@
 #include "elf.h"
 #include "warn.h"
 
+#define MAX_NAME_LEN 128
+
 struct section *find_section_by_name(struct elf *elf, const char *name)
 {
         struct section *sec;
@@ -298,6 +300,8 @@ static int read_symbols(struct elf *elf)
         /* Create parent/child links for any cold subfunctions */
         list_for_each_entry(sec, &elf->sections, list) {
                 list_for_each_entry(sym, &sec->symbol_list, list) {
+                        char pname[MAX_NAME_LEN + 1];
+                        size_t pnamelen;
                         if (sym->type != STT_FUNC)
                                 continue;
                         sym->pfunc = sym->cfunc = sym;
@@ -305,14 +309,21 @@ static int read_symbols(struct elf *elf)
                         if (!coldstr)
                                 continue;
 
-                        coldstr[0] = '\0';
-                        pfunc = find_symbol_by_name(elf, sym->name);
-                        coldstr[0] = '.';
+                        pnamelen = coldstr - sym->name;
+                        if (pnamelen > MAX_NAME_LEN) {
+                                WARN("%s(): parent function name exceeds maximum length of %d characters",
+                                     sym->name, MAX_NAME_LEN);
+                                return -1;
+                        }
+
+                        strncpy(pname, sym->name, pnamelen);
+                        pname[pnamelen] = '\0';
+                        pfunc = find_symbol_by_name(elf, pname);
 
                         if (!pfunc) {
                                 WARN("%s(): can't find parent function",
                                      sym->name);
-                                goto err;
+                                return -1;
                         }
 
                         sym->pfunc = pfunc;
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 1dd5f4fcffd5..db66a952c173 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -129,7 +129,7 @@ WARNINGS += $(call cc-supports,-Wno-pointer-sign)
 WARNINGS += $(call cc-supports,-Wdeclaration-after-statement)
 WARNINGS += -Wshadow
 
-CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
+override CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
                 -DPACKAGE_BUGREPORT=\"$(PACKAGE_BUGREPORT)\" -D_GNU_SOURCE
 
 UTIL_OBJS =  utils/helpers/amd.o utils/helpers/msr.o \
@@ -156,12 +156,12 @@ LIB_SRC = 	lib/cpufreq.c lib/cpupower.c lib/cpuidle.c
 LIB_OBJS =      lib/cpufreq.o lib/cpupower.o lib/cpuidle.o
 LIB_OBJS :=     $(addprefix $(OUTPUT),$(LIB_OBJS))
 
-CFLAGS +=       -pipe
+override CFLAGS +=      -pipe
 
 ifeq ($(strip $(NLS)),true)
         INSTALL_NLS += install-gmo
         COMPILE_NLS += create-gmo
-        CFLAGS += -DNLS
+        override CFLAGS += -DNLS
 endif
 
 ifeq ($(strip $(CPUFREQ_BENCH)),true)
@@ -175,7 +175,7 @@ ifeq ($(strip $(STATIC)),true)
         UTIL_SRC += $(LIB_SRC)
 endif
 
-CFLAGS += $(WARNINGS)
+override CFLAGS += $(WARNINGS)
 
 ifeq ($(strip $(V)),false)
         QUIET=@
@@ -188,10 +188,10 @@ export QUIET ECHO
 
 # if DEBUG is enabled, then we do not strip or optimize
 ifeq ($(strip $(DEBUG)),true)
-        CFLAGS += -O1 -g -DDEBUG
+        override CFLAGS += -O1 -g -DDEBUG
         STRIPCMD = /bin/true -Since_we_are_debugging
 else
-        CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
+        override CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
         STRIPCMD = $(STRIP) -s --remove-section=.note --remove-section=.comment
 endif
 
diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
index d79ab161cc75..f68b4bc55273 100644
--- a/tools/power/cpupower/bench/Makefile
+++ b/tools/power/cpupower/bench/Makefile
@@ -9,7 +9,7 @@ endif
 ifeq ($(strip $(STATIC)),true)
 LIBS = -L../ -L$(OUTPUT) -lm
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \
-       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o
+       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o
 else
 LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index 59af84b8ef45..b1b6c43644e7 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -13,10 +13,10 @@ INSTALL = /usr/bin/install
 default: all
 
 $(OUTPUT)centrino-decode: ../i386/centrino-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 $(OUTPUT)powernow-k8-decode: ../i386/powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 all: $(OUTPUT)centrino-decode $(OUTPUT)powernow-k8-decode
 
diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c
index 1b993fe1ce23..0c0f3e3f0d80 100644
--- a/tools/power/cpupower/lib/cpufreq.c
+++ b/tools/power/cpupower/lib/cpufreq.c
@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s",
                          cpu, fname);
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 /* helper function to write a new value to a /sys file */
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index 9bd4c7655fdb..852d25462388 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname);
 
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 
diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
index 9c395ec924de..9711d628b0f4 100644
--- a/tools/power/cpupower/lib/cpupower.c
+++ b/tools/power/cpupower/lib/cpupower.c
@@ -15,7 +15,7 @@
 #include "cpupower.h"
 #include "cpupower_intern.h"
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen)
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen)
 {
         int fd;
         ssize_t numread;
@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s",
                          cpu, fname);
-        if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0)
+        if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
                 return -1;
         *result = strtol(linebuf, &endp, 0);
         if (endp == linebuf || errno == ERANGE)
diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h
index 92affdfbe417..4887c76d23f8 100644
--- a/tools/power/cpupower/lib/cpupower_intern.h
+++ b/tools/power/cpupower/lib/cpupower_intern.h
@@ -3,4 +3,4 @@
 #define MAX_LINE_LEN 4096
 #define SYSFS_PATH_MAX 255
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen);
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index f1fe492c8e17..f0017c831e57 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -24,6 +24,7 @@ TARGETS += memory-hotplug
 TARGETS += mount
 TARGETS += mqueue
 TARGETS += net
+TARGETS += netfilter
 TARGETS += nsfs
 TARGETS += powerpc
 TARGETS += proc
diff --git a/tools/testing/selftests/bpf/test_netcnt.c b/tools/testing/selftests/bpf/test_netcnt.c
index 7887df693399..44ed7f29f8ab 100644
--- a/tools/testing/selftests/bpf/test_netcnt.c
+++ b/tools/testing/selftests/bpf/test_netcnt.c
@@ -81,7 +81,10 @@ int main(int argc, char **argv)
                 goto err;
         }
 
-        assert(system("ping localhost -6 -c 10000 -f -q > /dev/null") == 0);
+        if (system("which ping6 &>/dev/null") == 0)
+                assert(!system("ping6 localhost -c 10000 -f -q > /dev/null"));
+        else
+                assert(!system("ping -6 localhost -c 10000 -f -q > /dev/null"));
 
         if (bpf_prog_query(cgroup_fd, BPF_CGROUP_INET_EGRESS, 0, NULL, NULL,
                            &prog_cnt)) {
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 6f61df62f690..550b7e46bf4a 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -13896,6 +13896,25 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
                 .result = ACCEPT,
         },
+        {
+                "calls: ctx read at start of subprog",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
+                        BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
+                .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
new file mode 100644
index 000000000000..47ed6cef93fb
--- /dev/null
+++ b/tools/testing/selftests/netfilter/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+# Makefile for netfilter selftests
+
+TEST_PROGS := nft_trans_stress.sh
+
+include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
new file mode 100644
index 000000000000..1017313e41a8
--- /dev/null
+++ b/tools/testing/selftests/netfilter/config
@@ -0,0 +1,2 @@
+CONFIG_NET_NS=y
+NF_TABLES_INET=y
diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
new file mode 100755
index 000000000000..f1affd12c4b1
--- /dev/null
+++ b/tools/testing/selftests/netfilter/nft_trans_stress.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+#
+# This test is for stress-testing the nf_tables config plane path vs.
+# packet path processing: Make sure we never release rules that are
+# still visible to other cpus.
+#
+# set -e
+
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+testns=testns1
+tables="foo bar baz quux"
+
+nft --version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without nft tool"
+        exit $ksft_skip
+fi
+
+ip -Version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without ip tool"
+        exit $ksft_skip
+fi
+
+tmp=$(mktemp)
+
+for table in $tables; do
+        echo add table inet "$table" >> "$tmp"
+        echo flush table inet "$table" >> "$tmp"
+
+        echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
+        echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
+        for c in $(seq 1 400); do
+                chain=$(printf "chain%03u" "$c")
+                echo "add chain inet $table $chain" >> "$tmp"
+        done
+
+        for c in $(seq 1 400); do
+                chain=$(printf "chain%03u" "$c")
+                for BASE in INPUT OUTPUT; do
+                        echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
+                done
+                echo "add rule inet $table $chain counter return" >> "$tmp"
+        done
+done
+
+ip netns add "$testns"
+ip -netns "$testns" link set lo up
+
+lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
+cpunum=$((cpunum-1))
+for i in $(seq 0 $cpunum);do
+        mask=$(printf 0x%x $((1<<$i)))
+        ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
+        ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
+done)
+
+sleep 1
+
+for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
+
+for table in $tables;do
+        randsleep=$((RANDOM%10))
+        sleep $randsleep
+        ip netns exec "$testns" nft delete table inet $table 2>/dev/null
+done
+
+randsleep=$((RANDOM%10))
+sleep $randsleep
+
+pkill -9 ping
+
+wait
+
+rm -f "$tmp"
+ip netns del "$testns"
diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c
index 6f1f4a6e1ecb..85744425b08d 100644
--- a/tools/testing/selftests/proc/proc-self-map-files-002.c
+++ b/tools/testing/selftests/proc/proc-self-map-files-002.c
@@ -13,7 +13,7 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
-/* Test readlink /proc/self/map_files/... with address 0. */
+/* Test readlink /proc/self/map_files/... with minimum address. */
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -47,6 +47,11 @@ static void fail(const char *fmt, unsigned long a, unsigned long b)
 int main(void)
 {
         const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
+#ifdef __arm__
+        unsigned long va = 2 * PAGE_SIZE;
+#else
+        unsigned long va = 0;
+#endif
         void *p;
         int fd;
         unsigned long a, b;
@@ -55,7 +60,7 @@ int main(void)
         if (fd == -1)
                 return 1;
 
-        p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
+        p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
         if (p == MAP_FAILED) {
                 if (errno == EPERM)
                         return 2;
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index 87a04a8a5945..7607ba3e3cbe 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -134,9 +134,9 @@ def exec_cmd(args, pm, stage, command):
     (rawout, serr) = proc.communicate()
 
     if proc.returncode != 0 and len(serr) > 0:
-        foutput = serr.decode("utf-8")
+        foutput = serr.decode("utf-8", errors="ignore")
     else:
-        foutput = rawout.decode("utf-8")
+        foutput = rawout.decode("utf-8", errors="ignore")
 
     proc.stdout.close()
     proc.stderr.close()
@@ -169,6 +169,8 @@ def prepare_env(args, pm, stage, prefix, cmdlist, output = None):
                   file=sys.stderr)
             print("\n{} *** Error message: \"{}\"".format(prefix, foutput),
                   file=sys.stderr)
+            print("returncode {}; expected {}".format(proc.returncode,
+                                                      exit_codes))
             print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr)
             print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr)
             print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr)
@@ -195,12 +197,18 @@ def run_one_test(pm, args, index, tidx):
         print('-----> execute stage')
     pm.call_pre_execute()
     (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"])
-    exit_code = p.returncode
+    if p:
+        exit_code = p.returncode
+    else:
+        exit_code = None
+
     pm.call_post_execute()
 
-    if (exit_code != int(tidx["expExitCode"])):
+    if (exit_code is None or exit_code != int(tidx["expExitCode"])):
         result = False
-        print("exit:", exit_code, int(tidx["expExitCode"]))
+        print("exit: {!r}".format(exit_code))
+        print("exit: {}".format(int(tidx["expExitCode"])))
+        #print("exit: {!r} {}".format(exit_code, int(tidx["expExitCode"])))
         print(procout)
     else:
         if args.verbose > 0: